Edit tour

Windows Analysis Report
SaasAntTransactions-Setup (1).exe

Overview

General Information

Sample name:	SaasAntTransactions-Setup (1).exe
Analysis ID:	1367779
MD5:	b11f2737286c7d5def40591018967a9e
SHA1:	0ae122f676125dec27ca1b2e2ce353e825439686
SHA256:	c4f68fa1668adb315ab6e7d88a3644273d811dd2cc786c8206aef159753c9b7c
Infos:

Detection

RedLine

Score:	46
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	34
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

May use the Tor software to hide its network traffic

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Yara detected Generic Downloader

Checks for available system drives (often done to infect USB drives)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

DLL planting / hijacking vulnerabilities found

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64_ra

SaasAntTransactions-Setup (1).exe (PID: 5364 cmdline: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe MD5: B11F2737286C7D5DEF40591018967A9E)

SaasAntTransactions-Setup.exe (PID: 4220 cmdline: .\SaasAntTransactions-Setup.exe /m="C:\Users\user\Desktop\SAASAN~1.EXE" /k="" MD5: 41C67C2E7C85536894C9E348DA79EC9F)

SaasAntTransactions.exe (PID: 2452 cmdline: "C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe" MD5: 0F6452633C2790B06B482D15C47B5D0A)

msiexec.exe (PID: 1080 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6652 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 65C17165B9D6E452AFEA89C327EA4A92 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 23 88 44 24 2B 88 44 24 2F B0 03 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 23 88 44 24 2B 88 44 24 2F B0 03 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
C:\ProgramData\miaB83E.tmp\data\OFFLINE\1B03632E\F3574DDF\Telerik.Windows.Controls.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.1798730636.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.SaasAntTransactions-Setup (1).exe.76fb132.15.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.SaasAntTransactions-Setup (1).exe.76fb132.15.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a8ec:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x225e0c:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x232cb8:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x6e8:$s3: 83 EC 38 53 B0 23 88 44 24 2B 88 44 24 2F B0 03 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1c5c6:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1c20c:$s5: delete[] 0x1b6c4:$s6: constructor or from DllMain.
11.2.SaasAntTransactions.exe.1ef20000.10.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.SaasAntTransactions-Setup.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: 44212c.rbf (copy)

Virustotal: Detection: 11%

Perma Link

Multi AV Scanner detection for submitted file

Source: SaasAntTransactions-Setup (1).exe

Virustotal: Detection: 13%

Perma Link

Privilege Escalation

DLL planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	DLL: profapi.dll	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	DLL: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	DLL: Wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	DLL: TextShaping.dll	Jump to behavior

Compliance

DLL planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	DLL: profapi.dll	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	DLL: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	DLL: Wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	DLL: TextShaping.dll	Jump to behavior

Uses 32bit PE files

Source: SaasAntTransactions-Setup (1).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Found installer window with terms and condition text

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Window detected: I &accept the license agreementEND USER LICENSE AGREEMENTTHIS END USER LICENSE AGREEMENT (LICENSE AGREEMENT) is a legal document that binds registered users ("User" or "Users") to certain obligations contained herein. You should read this Agreement carefully before accepting its terms. You understand and agree that the software application services described below are provided to Users exclusive under this Agreement by SaasAnt Infotech Pvt Ltd (referred to hereunder as "SaasAnt" "we" or "us"). By clicking the "Agree" check-box you are acknowledging and agreeing that you are eighteen (18) years or older that you have read and understand this Agreement that you agree to be bound by the terms of this Agreement currently in effect and as updated by SaasAnt from time to time.THE AGREEMENTBy downloading installing using or copying the Software you accept and agree to be bound by the terms of this EULA. If you do not agree to all of the terms of this EULA you may not download install use or copy the Software.THE LICENSEThis EULA entitles you to install as many copies of the Software as you want and use the Software for any lawful purpose consistent with this EULA. Your license to use the Software is expressly conditioned upon your agreement to all of the terms of this EULA. This software is licensed not sold. SaasAnt reserves all other rights not granted by this EULA.SOFTWARE UPDATESFrom time to time SaasAnt may provide updates upgrades patches bug fixes and other modifications to improve the Software and related services (Patches). You acknowledge that you may be required to install Patches to continue to access and use the Product and the Product Software. You agree and consent to critical Patches being automatically installed without receiving any additional notice or providing any additional consent.INSTALLATION REPORT You agree and consent to send anonymous installation report automatically after the successful installation. - No personal information is collected.- The data are not sold nor used/given/shared with 3rd parties.- The platform of Google Analytics is used for the data collection and reporting. The privacy and personal data policies of Google's Measurement Protocol are also respected.The data collected are completely anonymous and consist of parameters like the operating system the version of the software the screen resolution the country any errors occurred during the running of the program etc. The same type of data are commonly collected every time you visit anonymously a website.The data are collected for the sole purpose of monitoring the good running of the program and identifying areas for improvement discover incompatibilities with specific operating systems estimate the size of the user base plan and respond to increases in demand estimate the usefulness of the various features of the program etc. Data are transferred directly from the program to the secure platform of Google Analytics. Google Analytics is used as the rep

Creates license or readme file

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

File created: C:\Users\user\AppData\Local\Temp\mia1\license.rtf

Jump to behavior

PE / OLE file has a valid certificate

Source: SaasAntTransactions-Setup (1).exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 45.76.164.236:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.76.164.236:443 -> 192.168.2.16:49728 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: msiexec.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\Input\obj\Release.NoXaml\Telerik.Windows.Controls.Input.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3088836623.000000001EDC2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: regsip.pdbU source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\GridView\GridView\obj\Release.NoXaml\Telerik.Windows.Controls.GridView.pdb source: SaasAntTransactions.exe, 0000000B.00000002.3111007097.000000001F642000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: MsiInst.pdbU source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: GameuxInstallHelper.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: gacutil.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: +;!msiregmv.pdbV source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\ConversationalUI\ConversationalUI\obj\Release.NoXaml\Telerik.Windows.Controls.ConversationalUI.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3081929725.000000001EB82000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\Users\Josh\Projects\CsvHelper\src\CsvHelper\bin\release\net40\CsvHelper.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\exceldatareader\src\ExcelDataReader\obj\Release\net20\ExcelDataReader.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\_oss\common-logging\src\Common.Logging\obj\Release\Common.Logging.pdbt source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\_oss\common-logging\src\Common.Logging.Core\obj\Release\Common.Logging.Core.pdbl< source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\exceldatareader\src\ExcelDataReader.DataSet\obj\Release\net20\ExcelDataReader.DataSet.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msiregmv.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\excelnumberformat\src\ExcelNumberFormat\obj\Release\net20\ExcelNumberFormat.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007F9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\GridView\GridView\obj\Release.NoXaml\Telerik.Windows.Controls.GridView.pdbL2 source: SaasAntTransactions.exe, 0000000B.00000002.3111007097.000000001F642000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: c:\_oss\common-logging\src\Common.Logging.Core\obj\Release\Common.Logging.Core.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\GalaSoft\mydotnet\MVVMLight\source\GalaSoft.MvvmLight\GalaSoft.MvvmLight (NET4)\obj\Release\GalaSoft.MvvmLight.pdbh source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\projects\exceldatareader\src\ExcelDataReader\obj\Release\net20\ExcelDataReader.pdbr; source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\Data\obj\Release.NoXaml\Telerik.Windows.Controls.Data.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3082925578.000000001EBC2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\VirtualGrid\VirtualGrid\obj\Release.NoXaml\Telerik.Windows.Controls.VirtualGrid.pdbl source: SaasAntTransactions.exe, 0000000B.00000002.3090943671.000000001EE62000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: msiregmv.pdbV source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Core\Controls\obj\Release.NoXaml\Telerik.Windows.Controls.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Core\Controls\obj\Release.NoXaml\Telerik.Windows.Controls.pdb` source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\ConversationalUI\ConversationalUI\obj\Release.NoXaml\Telerik.Windows.Controls.ConversationalUI.pdbT source: SaasAntTransactions.exe, 0000000B.00000002.3081929725.000000001EB82000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\GalaSoft\mydotnet\MVVMLight\source\GalaSoft.MvvmLight\GalaSoft.MvvmLight.Extras (NET4)\obj\Release\GalaSoft.MvvmLight.Extras.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: gacutil.pdb(0 source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\VirtualGrid\VirtualGrid\obj\Release.NoXaml\Telerik.Windows.Controls.VirtualGrid.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3090943671.000000001EE62000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Core\Data\obj\Release.NoXaml\Telerik.Windows.Data.pdb@5 source: SaasAntTransactions.exe, 0000000B.00000002.3086206375.000000001ECA2000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Git\LiteDB\LiteDB\obj\Release\net40\LiteDB.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3302804112.0000000029C02000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\Input\obj\Release.NoXaml\Telerik.Windows.Controls.Input.pdbtg source: SaasAntTransactions.exe, 0000000B.00000002.3088836623.000000001EDC2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Core\Data\obj\Release.NoXaml\Telerik.Windows.Data.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3086206375.000000001ECA2000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\Josh\Projects\CsvHelper\src\CsvHelper\bin\release\net40\CsvHelper.pdb\I source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: regsip.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\Navigation\obj\Release.NoXaml\Telerik.Windows.Controls.Navigation.pdb source: SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: c:\b\4741\2098\src\intermediate\System.Net.Http.2.0.csproj_f5d23ea6\Release\System.Net.Http.pdb source: SaasAntTransactions.exe, 0000000B.00000002.3305370011.0000000029E02000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\GalaSoft\mydotnet\MVVMLight\source\GalaSoft.MvvmLight\GalaSoft.MvvmLight (NET4)\obj\Release\GalaSoft.MvvmLight.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: msi_l.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\_oss\common-logging\src\Common.Logging\obj\Release\Common.Logging.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Projects\CommonServiceLocator\main\Microsoft.Practices.ServiceLocation.PortableClassLibrary\obj\Release\Microsoft.Practices.ServiceLocation.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007B0A000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087769472.000000001ED32000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: imagehlp.pdbMZ source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi.pdbh source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007F9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Windows.Shell.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007B0A000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3127083082.0000000020482000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: SaasAntTransactions.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: MsiInst.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\GalaSoft\mydotnet\MVVMLight\source\GalaSoft.MvvmLight\GalaSoft.MvvmLight.Extras (NET4)\obj\Release\GalaSoft.MvvmLight.Extras.pdbpj source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: gacutlrc.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D282A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,		2_2_6D282A30
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D272470 FindClose,FindFirstFileW,FindFirstFileW,		2_2_6D272470

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 11.2.SaasAntTransactions.exe.1ef20000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1B03632E\F3574DDF\Telerik.Windows.Controls.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.dll, type: DROPPED

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /dt-service/installation/installed HTTP/1.1Accept: application/jsonContent-Type: application/json; charset=utf-8Host: saasant.comContent-Length: 366Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dt-service/installation/updateInfo?app=1&version=3.1.3.0&out=JSON HTTP/1.1Accept: application/jsonHost: desktop.saasant.comConnection: Keep-Alive

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /dt-service/installation/updateInfo?app=1&version=3.1.3.0&out=JSON HTTP/1.1Accept: application/jsonHost: desktop.saasant.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: saasant.com

Source: unknown

HTTP traffic detected: POST /dt-service/installation/installed HTTP/1.1Accept: application/jsonContent-Type: application/json; charset=utf-8Host: saasant.comContent-Length: 366Expect: 100-continueConnection: Keep-Alive

Source: SaasAntTransactions-Setup.exe, 00000002.00000003.2157723436.000000000338B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.MYWEBSITE.COM/DEFAULT.7ZIPA$;
Source: SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.00000000028A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTPS://SAASANT.COM/DT-SERVICE/INSTALLATION/UPDATEINFO?APP=1&DESC=$TITLE$&VERSION=$VERSION$&OUT=MIA
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/SaasAntTransactions;component/controls/onboardingcontrol.xamll
Source: SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/onboardingcontrol.baml
Source: SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/onboardingcontrol.bamll
Source: SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/controls/onboardingcontrol.xaml
Source: SaasAntTransactions.exe	String found in binary or memory: http://logging.apache.org/log4ne
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netcommon.sourceforge.net/
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netcommon.sourceforge.net/B
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://saasant.com/
Source: SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.0000000002982000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://saasant.com/az
Source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003060000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3073876070.000000001E7E2000.00000002.00000001.01000000.00000015.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3103729702.000000001F2E2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://schemas.telerik.com/2008/xaml/compile
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3103729702.000000001F2E2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://schemas.telerik.com/2008/xaml/presentation
Source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://schemas.telerik.com/2008/xaml/presentation#Telerik.Windows.Controls.Primitives
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://schemas.telerik.com/2008/xaml/presentation#Telerik.Windows.Controls.PrimitivesV
Source: SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://schemas.telerik.com/2008/xaml/presentation#Telerik.Windows.Controls.RadialMenu
Source: SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://schemas.telerik.com/2008/xaml/presentation#Telerik.Windows.Controls.RadialMenuV
Source: SaasAntTransactions.exe, 0000000B.00000002.3111007097.000000001F642000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: http://schemas.telerik.com/2008/xaml/presentation%Telerik.Windows.Controls.TreeListView
Source: SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://schemas.telerik.com/2008/xaml/presentation&Telerik.Windows.Controls.LayoutControl
Source: SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: SaasAntTransactions.exe, 0000000B.00000002.3046273465.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: SaasAntTransactions.exe, 0000000B.00000002.3037588109.000000000AE79000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3037588109.000000000AD6E000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3018293075.00000000074D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sha256timestamp.ws.symantec.com/sha256/timestamp
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006E97000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.0000000000418000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2008/schema.xsd
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.0000000002982000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.saasant.com/
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.00000000028A9000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://timestamp.globalsign.com/tsa/r6advanced1
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.apache.or
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://www.apache.org/).
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.apache.org/l
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.apache.org/licen
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.apache.org/licenses/LICEN
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htm
Source: SaasAntTransactions.exe, 0000000B.00000002.3124251402.000000001FBA2000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlhttp://www.apache.org/licenses/LICENSE-2.0.htmlVersio
Source: SaasAntTransactions.exe, 0000000B.00000002.3067183260.000000001C84F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.011k
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Robo
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Robot
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0RobotoLight
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0RobotoMedium
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3088007794.000000001ED48000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.galasoft.ch
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003046000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.galasoft.ch/mvvmlight
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.galasoft.ch/s/dialogmessage.
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.galasoft.ch4
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087703824.000000001ED2A000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.galasoft.chN
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006E97000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.000000000078C000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.0000000000418000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/
Source: SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/InstallAware
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.000000000078C000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/buydirect.aspopen
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.000000000078C000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/x2/
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000000.1722063412.0000000000445000.00000002.00000001.01000000.00000003.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.installaware.comz
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.00000000028EE000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2155131713.00000000035DB000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/Default.7zip
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/Microsoft
Source: SaasAntTransactions.exe	String found in binary or memory: http://www.telerik.co
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.telerik.com
Source: SaasAntTransactions.exe, 0000000B.00000002.3124251402.000000001FBA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.telerik.com-TelerikWebUI
Source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.telerik.com/purchase.aspx?utm_source=trial&utm_medium=dsk&utm_campaign=WPF
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.telerik.comhttp://www.telerik.comApache
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.telerik.comhttp://www.telerik.comTelerikWebUI
Source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://demos.telerik.com/xaml-sdkbrowser/SDKSamplesBrowser.application
Source: SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://demos.telerik.com/xaml-sdkbrowser/SDKSamplesBrowser.application5
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://desktop.apps.com/apps/232752#
Source: SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://desktop.saasant.com
Source: SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://desktop.saasant.com/dt-service/conversion/conversion&File
Source: SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://desktop.saasant.com/dt-service/installation/crashReport
Source: SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://desktop.saasant.com/dt-service/installation/releaseNotes?app=APP_ID&version=VERSION&out=JSON
Source: SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://desktop.saasant.com/dt-service/installation/updateInfo?app=1&version=3.1.3.0&out=JSON
Source: SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://desktop.saasant.com/dt-service/installation/updateInfo?app=APP_ID&version=VERSION&out=JSON
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://desktop.saasant.com/quickbooks-desktop-login/login.html
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://dle.telerik.com/metrics/v1/events/callhome
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://go.mikogo.com/
Source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://identity.telerik.com/v2/oauth/telerik/token
Source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://identity.telerik.com/v2/oauth/telerik/token&uri:client.licenser
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://portal.saasant.com
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://portal.saasant.com/blog/privacy-policy/
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://portal.saasant.com/blog/security-policy/
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://portal.saasant.com/blog/terms-and-conditions/
Source: SaasAntTransactions.exe, 0000000B.00000002.3037588109.000000000ACD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://saasant.com
Source: SaasAntTransactions.exe, 0000000B.00000002.3046273465.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://saasant.com/dt-service/installation/installed
Source: SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://saasant.com/dt-service/installation/updateInfo?app=1&desc=$TITLE$&version=$VERSION$&out=MIA
Source: SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://saasant.com/dt-service/license/register
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://support.saasant.com/support/solutions/14000073957
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://support.saasant.com/support/solutions/articles/14000096467-how-to-use-lookup-in-saasant-tran
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.saasant.com
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.saasant.com/app-saasant-transactions-quickbooks-desktop.html#planList
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.saasant.com/chat.html
Source: SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3046273465.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.saasant.com/chat.html?ServicePack=No
Source: SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.saasant.com/report-issue.html?File=
Source: SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.saasant.com/request-demo.html

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 45.76.164.236:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.76.164.236:443 -> 192.168.2.16:49728 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe

File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msi.cat

Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.SaasAntTransactions-Setup (1).exe.76fb132.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\442129.msi

Jump to behavior

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI2233.tmp

Jump to behavior

Detected potential crypto function

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10001000	2_2_10001000
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10009028	2_2_10009028
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10017330	2_2_10017330
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_100153E0	2_2_100153E0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1000D450	2_2_1000D450
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1001E5C3	2_2_1001E5C3
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10017710	2_2_10017710
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1001E751	2_2_1001E751
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1000E770	2_2_1000E770
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_100127E0	2_2_100127E0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1001E82B	2_2_1001E82B
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_100178D0	2_2_100178D0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1000C8E0	2_2_1000C8E0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10014A40	2_2_10014A40
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1000EB10	2_2_1000EB10
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1000CCA0	2_2_1000CCA0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1001AD1A	2_2_1001AD1A
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10016D80	2_2_10016D80
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10017DC0	2_2_10017DC0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10012F00	2_2_10012F00
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10016F80	2_2_10016F80
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D274C00	2_2_6D274C00
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D26AE70	2_2_6D26AE70
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D268AB0	2_2_6D268AB0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D2735F0	2_2_6D2735F0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D266460	2_2_6D266460
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D288E1B	2_2_6D288E1B
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D27FEE0	2_2_6D27FEE0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D27E950	2_2_6D27E950
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D27B9C0	2_2_6D27B9C0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D26B447	2_2_6D26B447
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D28E78B	2_2_6D28E78B
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D26E670	2_2_6D26E670
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D28E6B0	2_2_6D28E6B0
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D26D1B0	2_2_6D26D1B0
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1E7E4D7D	11_2_1E7E4D7D
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EB8AAC2	11_2_1EB8AAC2
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EBC4F58	11_2_1EBC4F58
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECA598C	11_2_1ECA598C
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECA5D94	11_2_1ECA5D94
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECAF0A0	11_2_1ECAF0A0
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECA5369	11_2_1ECA5369
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECB0924	11_2_1ECB0924
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECAD137	11_2_1ECAD137
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ED25845	11_2_1ED25845
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ED439DF	11_2_1ED439DF
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EDC43AF	11_2_1EDC43AF
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EDC43A4	11_2_1EDC43A4
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EE64A7C	11_2_1EE64A7C
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EE6589D	11_2_1EE6589D
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EF28B14	11_2_1EF28B14
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EDC90BE	11_2_1EDC90BE
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EBC4D54	11_2_1EBC4D54
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECA46C6	11_2_1ECA46C6
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECA24FC	11_2_1ECA24FC
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ECA843F	11_2_1ECA843F

Found potential string decryption / allocating functions

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: String function: 6D287AA4 appears 37 times
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: String function: 6D264C80 appears 39 times
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: String function: 10018EB0 appears 95 times

Sample file is different than original file name gathered from version info

Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSaasAntTransactions.exeH vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSaasAntTransactionsConsole.exeV vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecabinet.dll~/ vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCommon.Logging.Core.dllT vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCommon.Logging.dllT vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCsvHelper.dll4 vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZip.dll@ vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExcelDataReader.DataSet.dllP vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExcelDataReader.dll@ vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExcelNumberFormat.dllD vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGalaSoft.MvvmLight.dllF vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGalaSoft.MvvmLight.Extras.dllT vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dll8 vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiexec.exeX vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiexec.exeD vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiinst.exej% vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiinst.exeD vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiregmv.exeX vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameregsip.dllD vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameregsip.dllX vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameimagehlp.dllz- vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInterop.QBXMLRP2Lib.dll vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLiteDB.dll. vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelog4net.dll0 vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameahadmin_wrapper.dll4 vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameahadmin_.dll4 vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGameuxInstallHelper.DLLb! vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameManagedVCL.Utils.dll8 vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutlrc.dllT vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamez vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007B0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Practices.ServiceLocation.dllh$ vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007B0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Windows.Shell.dllT vs SaasAntTransactions-Setup (1).exe
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007EFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs SaasAntTransactions-Setup (1).exe

Tries to load missing DLLs

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior

Uses 32bit PE files

Source: SaasAntTransactions-Setup (1).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Yara signature match

Source: 0.3.SaasAntTransactions-Setup (1).exe.76fb132.15.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3302804112.0000000029C02000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: .sln
Source: SaasAntTransactions.exe, 0000000B.00000002.3305370011.0000000029E02000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: c:\b\4741\2098\src\intermediate\System.Net.Http.2.0.csproj_f5d23ea6\Release\System.Net.Http.pdb
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3302804112.0000000029C02000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: .csproj.css
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3302804112.0000000029C02000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: .vbproj.vbs

Source: classification engine

Classification label: mal46.troj.evad.winEXE@7/1366@2/1

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Code function: 2_2_6D282980 LoadResource,SizeofResource,LockResource,CreateFileW,WriteFile,FindCloseChangeNotification,DeleteFileW,

2_2_6D282980

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

File created: C:\Program Files (x86)\SaasAnt Transactions\setup.location

Jump to behavior

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

File created: C:\Users\user\AppData\Local\IIIQF

Jump to behavior

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Mutant created: \Sessions\1\BaseNamedObjects\SaasAnt Transactions
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_SaasAntTransactions_saasant.log

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

File created: C:\Users\user\AppData\Local\Temp\mia1

Jump to behavior

Source: Yara match	File source: 2.0.SaasAntTransactions-Setup.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1798730636.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.exe, type: DROPPED

Source: SaasAntTransactions-Setup (1).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\faf93f57aa8c4c5dddd9cd0de441d5a1\mscorlib.ni.dll

Jump to behavior

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: SaasAntTransactions-Setup.exe, 00000002.00000003.1981553875.0000000006257000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO `Property` ( `Property` , `Value` ) VALUES ( 'P2639F99_1' , 'C:\Program Files (x86)\SaasAnt Transactions' )\|;2
Source: SaasAntTransactions-Setup.exe, 00000002.00000003.1983623125.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1985756838.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1987328635.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1981753352.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO `Property` ( `Property` , `Value` ) VALUES ( 'PF89064B2_1' , 'C:\Program Files (x86)\SaasAnt Transactions\Images' );

Source: SaasAntTransactions-Setup (1).exe

Virustotal: Detection: 13%

Source: SaasAntTransactions.exe

String found in binary or memory: {0}<html> <body>

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe

File read: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Process created: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe .\SaasAntTransactions-Setup.exe /m="C:\Users\user\Desktop\SAASAN~1.EXE" /k=""
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 65C17165B9D6E452AFEA89C327EA4A92
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process created: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe "C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe"
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Process created: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe .\SaasAntTransactions-Setup.exe /m="C:\Users\user\Desktop\SAASAN~1.EXE" /k=""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 65C17165B9D6E452AFEA89C327EA4A92	Jump to behavior

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Reads the Windows registered owner settings

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Window found: window name: TButton

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Uses Microsoft Silverlight

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: SaasAntTransactions-Setup (1).exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: SaasAntTransactions-Setup (1).exe

Static file information: File size 15152616 > 1048576

Binary contains paths to debug symbols

Source:	Binary string: msiexec.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\Input\obj\Release.NoXaml\Telerik.Windows.Controls.Input.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3088836623.000000001EDC2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: regsip.pdbU source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\GridView\GridView\obj\Release.NoXaml\Telerik.Windows.Controls.GridView.pdb source: SaasAntTransactions.exe, 0000000B.00000002.3111007097.000000001F642000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: MsiInst.pdbU source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: GameuxInstallHelper.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: gacutil.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: +;!msiregmv.pdbV source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\ConversationalUI\ConversationalUI\obj\Release.NoXaml\Telerik.Windows.Controls.ConversationalUI.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3081929725.000000001EB82000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\Users\Josh\Projects\CsvHelper\src\CsvHelper\bin\release\net40\CsvHelper.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\exceldatareader\src\ExcelDataReader\obj\Release\net20\ExcelDataReader.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\_oss\common-logging\src\Common.Logging\obj\Release\Common.Logging.pdbt source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\_oss\common-logging\src\Common.Logging.Core\obj\Release\Common.Logging.Core.pdbl< source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\exceldatareader\src\ExcelDataReader.DataSet\obj\Release\net20\ExcelDataReader.DataSet.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msiregmv.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\excelnumberformat\src\ExcelNumberFormat\obj\Release\net20\ExcelNumberFormat.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007F9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\GridView\GridView\obj\Release.NoXaml\Telerik.Windows.Controls.GridView.pdbL2 source: SaasAntTransactions.exe, 0000000B.00000002.3111007097.000000001F642000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: c:\_oss\common-logging\src\Common.Logging.Core\obj\Release\Common.Logging.Core.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\GalaSoft\mydotnet\MVVMLight\source\GalaSoft.MvvmLight\GalaSoft.MvvmLight (NET4)\obj\Release\GalaSoft.MvvmLight.pdbh source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\projects\exceldatareader\src\ExcelDataReader\obj\Release\net20\ExcelDataReader.pdbr; source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\Data\obj\Release.NoXaml\Telerik.Windows.Controls.Data.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3082925578.000000001EBC2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\VirtualGrid\VirtualGrid\obj\Release.NoXaml\Telerik.Windows.Controls.VirtualGrid.pdbl source: SaasAntTransactions.exe, 0000000B.00000002.3090943671.000000001EE62000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: msiregmv.pdbV source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Core\Controls\obj\Release.NoXaml\Telerik.Windows.Controls.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Core\Controls\obj\Release.NoXaml\Telerik.Windows.Controls.pdb` source: SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\ConversationalUI\ConversationalUI\obj\Release.NoXaml\Telerik.Windows.Controls.ConversationalUI.pdbT source: SaasAntTransactions.exe, 0000000B.00000002.3081929725.000000001EB82000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\GalaSoft\mydotnet\MVVMLight\source\GalaSoft.MvvmLight\GalaSoft.MvvmLight.Extras (NET4)\obj\Release\GalaSoft.MvvmLight.Extras.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: gacutil.pdb(0 source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\VirtualGrid\VirtualGrid\obj\Release.NoXaml\Telerik.Windows.Controls.VirtualGrid.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3090943671.000000001EE62000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Core\Data\obj\Release.NoXaml\Telerik.Windows.Data.pdb@5 source: SaasAntTransactions.exe, 0000000B.00000002.3086206375.000000001ECA2000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Git\LiteDB\LiteDB\obj\Release\net40\LiteDB.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3302804112.0000000029C02000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\Input\obj\Release.NoXaml\Telerik.Windows.Controls.Input.pdbtg source: SaasAntTransactions.exe, 0000000B.00000002.3088836623.000000001EDC2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Core\Data\obj\Release.NoXaml\Telerik.Windows.Data.pdb source: SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3086206375.000000001ECA2000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\Josh\Projects\CsvHelper\src\CsvHelper\bin\release\net40\CsvHelper.pdb\I source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: regsip.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006723000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DeveloperTooling_Agent8\_work\89\s\Controls\Navigation\obj\Release.NoXaml\Telerik.Windows.Controls.Navigation.pdb source: SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: c:\b\4741\2098\src\intermediate\System.Net.Http.2.0.csproj_f5d23ea6\Release\System.Net.Http.pdb source: SaasAntTransactions.exe, 0000000B.00000002.3305370011.0000000029E02000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\GalaSoft\mydotnet\MVVMLight\source\GalaSoft.MvvmLight\GalaSoft.MvvmLight (NET4)\obj\Release\GalaSoft.MvvmLight.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: msi_l.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\_oss\common-logging\src\Common.Logging\obj\Release\Common.Logging.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Projects\CommonServiceLocator\main\Microsoft.Practices.ServiceLocation.PortableClassLibrary\obj\Release\Microsoft.Practices.ServiceLocation.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007B0A000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087769472.000000001ED32000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: imagehlp.pdbMZ source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi.pdbh source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007F9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Windows.Shell.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007B0A000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3127083082.0000000020482000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: SaasAntTransactions.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: MsiInst.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006B10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\GalaSoft\mydotnet\MVVMLight\source\GalaSoft.MvvmLight\GalaSoft.MvvmLight.Extras (NET4)\obj\Release\GalaSoft.MvvmLight.Extras.pdbpj source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: gacutlrc.pdb source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Code function: 2_2_1001D844 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_1001D844

Uses code obfuscation techniques (call, push, ret)

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10013130 push ecx; mov dword ptr [esp], ecx	2_2_10013131
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1001D2C0 push eax; ret	2_2_1001D2EE
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_10018EB0 push eax; ret	2_2_10018ECE
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D287AE9 push ecx; ret	2_2_6D287AFC
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1E7E20C4 push ebp; iretd	11_2_1E7E20C5
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EB83BE0 push es; retn 0000h	11_2_1EB83BEB
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1ED46933 push ebx; retf	11_2_1ED46936
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EF290F9 push es; iretd	11_2_1EF2946B
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EF2946C push es; iretd	11_2_1EF2946B
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EF2946C push es; retf 0002h	11_2_1EF294A5
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Code function: 11_2_1EF294A8 push es; retf 0002h	11_2_1EF294A5

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.Extras.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A38D2E8\F3574DDF\Telerik.Windows.Documents.Spreadsheet.FormatProviders.Pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C8694C4A\F3574DDF\Telerik.Windows.Zip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\NPOI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\riched20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D0DC5192\F3574DDF\Microsoft.Windows.Shell.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AA301B57\F3574DDF\Telerik.Windows.Controls.VirtualGrid.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\79EF4496\F3574DDF\GalaSoft.MvvmLight.Extras.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\661E908A\F3574DDF\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\80CC9BA\88DA6A7B\SaasAntTransactions.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\ExcelNumberFormat.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Themes.Windows7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\CC802F8F\F3574DDF\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\riched20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Renci.SshNet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\2639F99\F3574DDF\Telerik.Windows.Controls.Charting.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Interop.QBXMLRP2Lib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C9CFA174\F3574DDF\System.Net.Http.Primitives.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\901C7C89\F3574DDF\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\imagehlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\usp10.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\4625E0D0\F3574DDF\SgmlReaderDll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\sdbapi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Chart.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\4AD6D99\F3574DDF\Telerik.Windows.Controls.Chart.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\cabinet.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.WebRequest.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\905D63D6\F3574DDF\Telerik.Windows.Documents.Spreadsheet.FormatProviders.OpenXml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msimsg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\905D6215\F3574DDF\Telerik.Windows.Controls.Navigation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\System.Runtime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Charting.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\cabinet.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Quartz.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\shfolder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.ConversationalUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\sdbapiU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\usp10.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\imagehlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D3571AAB\F3574DDF\Telerik.Windows.Themes.Windows7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\FCC6B9D7\F3574DDF\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msimsg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\A04D6C1D\F3574DDF\log4net.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\52098B21\F3574DDF\CsvHelper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\System.IO.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1A97511A\F3574DDF\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.DataServices.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msiexec.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.VirtualGrid.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\CB29EF87\F3574DDF\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msisip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\log4net.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\59E0FAE8\F3574DDF\ExcelDataReader.DataSet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D5A26372\F3574DDF\Telerik.Windows.Controls.GridView.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A99F5AE\F3574DDF\NLog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\7703EBBF\F3574DDF\Common.Logging.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\SgmlReaderDll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\41283706\F3574DDF\Telerik.Windows.Documents.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Extensions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\32755537\F3574DDF\Telerik.Windows.Controls.DataServices.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Input.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\92A72B5F\F3574DDF\Telerik.Windows.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\F6E1FDBA\F3574DDF\Microsoft.Practices.ServiceLocation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.FormatProviders.Pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1A3ADFB4\F3574DDF\NPOI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\3D4D0848\F3574DDF\Telerik.Windows.Documents.Spreadsheet.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI22D0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\BE04B6CA\F3574DDF\System.Net.Http.Extensions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EB13BCBE\F3574DDF\System.IO.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msls31.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AAB28644\F3574DDF\Telerik.Windows.Controls.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\E832CDA\A31F71D2\Interop.QBXMLRP2Lib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\85CA11D2\F3574DDF\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\7AA45FEF\F3574DDF\Common.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\B788C7C3\F3574DDF\ExcelDataReader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\LiteDB.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\B35D72DF\F3574DDF\Telerik.Windows.Controls.Input.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msihnd.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mDown.dll\mDownExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.GridView.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msls31.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\NLog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msihnd.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\mia.lib	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 44212c.rbf (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1B03632E\F3574DDF\Telerik.Windows.Controls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI237E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\DA156853\F3574DDF\OFXSharp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\shfolder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.FormatProviders.OpenXml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\DotNetZip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI234E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A02C8CD\F3574DDF\Telerik.Windows.Controls.GridView.Export.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2233.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msisip.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\OFXSharp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C86575FB\F3574DDF\Renci.SshNet.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Navigation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EDD15B9F\F3574DDF\Telerik.Windows.Controls.ConversationalUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EEE19DB2\F3574DDF\LiteDB.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\F8ED8800\F3574DDF\Quartz.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\5A32B2FE\F3574DDF\ExcelNumberFormat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AA35C740\F3574DDF\System.Net.Http.WebRequest.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\63ADD426\F3574DDF\GalaSoft.MvvmLight.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.GridView.Export.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Windows.Shell.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\CsvHelper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Practices.ServiceLocation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.DataSet.dll	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\32755537\F3574DDF\Telerik.Windows.Controls.DataServices.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\92A72B5F\F3574DDF\Telerik.Windows.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A38D2E8\F3574DDF\Telerik.Windows.Documents.Spreadsheet.FormatProviders.Pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C8694C4A\F3574DDF\Telerik.Windows.Zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\F6E1FDBA\F3574DDF\Microsoft.Practices.ServiceLocation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\riched20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1A3ADFB4\F3574DDF\NPOI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D0DC5192\F3574DDF\Microsoft.Windows.Shell.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\3D4D0848\F3574DDF\Telerik.Windows.Documents.Spreadsheet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AA301B57\F3574DDF\Telerik.Windows.Controls.VirtualGrid.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\79EF4496\F3574DDF\GalaSoft.MvvmLight.Extras.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EB13BCBE\F3574DDF\System.IO.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\BE04B6CA\F3574DDF\System.Net.Http.Extensions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\661E908A\F3574DDF\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msls31.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\80CC9BA\88DA6A7B\SaasAntTransactions.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AAB28644\F3574DDF\Telerik.Windows.Controls.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\E832CDA\A31F71D2\Interop.QBXMLRP2Lib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\CC802F8F\F3574DDF\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\riched20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\7AA45FEF\F3574DDF\Common.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\85CA11D2\F3574DDF\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\2639F99\F3574DDF\Telerik.Windows.Controls.Charting.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\B788C7C3\F3574DDF\ExcelDataReader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C9CFA174\F3574DDF\System.Net.Http.Primitives.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\901C7C89\F3574DDF\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\imagehlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mDown.dll\mDownExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msihnd.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\B35D72DF\F3574DDF\Telerik.Windows.Controls.Input.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\usp10.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msls31.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\4625E0D0\F3574DDF\SgmlReaderDll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\sdbapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msihnd.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\4AD6D99\F3574DDF\Telerik.Windows.Controls.Chart.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1B03632E\F3574DDF\Telerik.Windows.Controls.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\cabinet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\DA156853\F3574DDF\OFXSharp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\905D63D6\F3574DDF\Telerik.Windows.Documents.Spreadsheet.FormatProviders.OpenXml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\shfolder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msimsg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\905D6215\F3574DDF\Telerik.Windows.Controls.Navigation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A02C8CD\F3574DDF\Telerik.Windows.Controls.GridView.Export.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\cabinet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msisip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\shfolder.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\sdbapiU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\usp10.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\imagehlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C86575FB\F3574DDF\Renci.SshNet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D3571AAB\F3574DDF\Telerik.Windows.Themes.Windows7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\FCC6B9D7\F3574DDF\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msimsg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EDD15B9F\F3574DDF\Telerik.Windows.Controls.ConversationalUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EEE19DB2\F3574DDF\LiteDB.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\A04D6C1D\F3574DDF\log4net.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\52098B21\F3574DDF\CsvHelper.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1A97511A\F3574DDF\System.Net.Http.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\CB29EF87\F3574DDF\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msisip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\F8ED8800\F3574DDF\Quartz.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\5A32B2FE\F3574DDF\ExcelNumberFormat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\59E0FAE8\F3574DDF\ExcelDataReader.DataSet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D5A26372\F3574DDF\Telerik.Windows.Controls.GridView.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A99F5AE\F3574DDF\NLog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AA35C740\F3574DDF\System.Net.Http.WebRequest.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\63ADD426\F3574DDF\GalaSoft.MvvmLight.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\7703EBBF\F3574DDF\Common.Logging.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\data\OFFLINE\41283706\F3574DDF\Telerik.Windows.Documents.Core.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2233.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI22D0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI237E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI234E.tmp	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	File created: C:\ProgramData\miaB83E.tmp\mia.lib			Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File created: C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\mia.lib			Jump to dropped file

Creates license or readme file

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

File created: C:\Users\user\AppData\Local\Temp\mia1\license.rtf

Jump to behavior

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Window found: window name: Progman

Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaasAnt Transactions

Jump to behavior

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007B0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: torConnect

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Code function: 11_2_1ED2489D rdtsc

11_2_1ED2489D

Contains long sleeps (>= 3 min)

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Window / User API: threadDelayed 1131	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Window / User API: threadDelayed 7815	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Window / User API: windowPlacementGot 471	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.Extras.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A38D2E8\F3574DDF\Telerik.Windows.Documents.Spreadsheet.FormatProviders.Pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C8694C4A\F3574DDF\Telerik.Windows.Zip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\NPOI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D0DC5192\F3574DDF\Microsoft.Windows.Shell.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AA301B57\F3574DDF\Telerik.Windows.Controls.VirtualGrid.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\79EF4496\F3574DDF\GalaSoft.MvvmLight.Extras.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\661E908A\F3574DDF\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\ExcelNumberFormat.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Themes.Windows7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Renci.SshNet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\CC802F8F\F3574DDF\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\2639F99\F3574DDF\Telerik.Windows.Controls.Charting.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Interop.QBXMLRP2Lib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C9CFA174\F3574DDF\System.Net.Http.Primitives.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\901C7C89\F3574DDF\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Data.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\imagehlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\4625E0D0\F3574DDF\SgmlReaderDll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\sdbapi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Chart.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\4AD6D99\F3574DDF\Telerik.Windows.Controls.Chart.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\cabinet.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.WebRequest.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\905D63D6\F3574DDF\Telerik.Windows.Documents.Spreadsheet.FormatProviders.OpenXml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\905D6215\F3574DDF\Telerik.Windows.Controls.Navigation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msimsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\System.Runtime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Charting.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Quartz.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\cabinet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\shfolder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.ConversationalUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\sdbapiU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\imagehlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D3571AAB\F3574DDF\Telerik.Windows.Themes.Windows7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\FCC6B9D7\F3574DDF\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msimsg.dll	Jump to dropped file
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\A04D6C1D\F3574DDF\log4net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\System.IO.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\52098B21\F3574DDF\CsvHelper.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1A97511A\F3574DDF\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.DataServices.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msiexec.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.VirtualGrid.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\CB29EF87\F3574DDF\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msisip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\log4net.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\59E0FAE8\F3574DDF\ExcelDataReader.DataSet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\D5A26372\F3574DDF\Telerik.Windows.Controls.GridView.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A99F5AE\F3574DDF\NLog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\SgmlReaderDll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\7703EBBF\F3574DDF\Common.Logging.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\41283706\F3574DDF\Telerik.Windows.Documents.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Extensions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\32755537\F3574DDF\Telerik.Windows.Controls.DataServices.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Input.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\92A72B5F\F3574DDF\Telerik.Windows.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\F6E1FDBA\F3574DDF\Microsoft.Practices.ServiceLocation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.FormatProviders.Pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1A3ADFB4\F3574DDF\NPOI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\3D4D0848\F3574DDF\Telerik.Windows.Documents.Spreadsheet.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\BE04B6CA\F3574DDF\System.Net.Http.Extensions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EB13BCBE\F3574DDF\System.IO.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AAB28644\F3574DDF\Telerik.Windows.Controls.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\E832CDA\A31F71D2\Interop.QBXMLRP2Lib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\85CA11D2\F3574DDF\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\7AA45FEF\F3574DDF\Common.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\B788C7C3\F3574DDF\ExcelDataReader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\LiteDB.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mDown.dll\mDownExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\B35D72DF\F3574DDF\Telerik.Windows.Controls.Input.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msihnd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.GridView.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\NLog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msihnd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 44212c.rbf (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1B03632E\F3574DDF\Telerik.Windows.Controls.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msiinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI237E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\DA156853\F3574DDF\OFXSharp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\shfolder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.FormatProviders.OpenXml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A02C8CD\F3574DDF\Telerik.Windows.Controls.GridView.Export.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msisip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\OFXSharp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\C86575FB\F3574DDF\Renci.SshNet.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Navigation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EDD15B9F\F3574DDF\Telerik.Windows.Controls.ConversationalUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\EEE19DB2\F3574DDF\LiteDB.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\F8ED8800\F3574DDF\Quartz.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\5A32B2FE\F3574DDF\ExcelNumberFormat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\AA35C740\F3574DDF\System.Net.Http.WebRequest.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe	Dropped PE file which has not been started: C:\ProgramData\miaB83E.tmp\data\OFFLINE\63ADD426\F3574DDF\GalaSoft.MvvmLight.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.GridView.Export.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Windows.Shell.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\CsvHelper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Practices.ServiceLocation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.DataSet.dll	Jump to dropped file

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_2-37285

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -59847s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -59724s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -59601s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -59486s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -59362s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -59235s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -59124s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -59012s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -58898s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -58788s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -58674s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -58549s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -58422s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -58312s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -58202s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -58100s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe TID: 3480	Thread sleep time: -57978s >= -30000s	Jump to behavior

Queries keyboard layouts

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809			Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809			Jump to behavior

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D282A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,		2_2_6D282A30
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D272470 FindClose,FindFirstFileW,FindFirstFileW,		2_2_6D272470

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Code function: 2_2_10001B41 GetSystemInfo,

2_2_10001B41

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 59847	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 59724	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 59601	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 59486	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 59362	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 59235	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 59124	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 59012	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 58898	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 58788	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 58674	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 58549	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 58422	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 58312	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 58202	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 58100	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Thread delayed: delay time: 57978	Jump to behavior

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: SaasAntTransactions.exe, 0000000B.00000002.3308387851.0000000029F11000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

API call chain: ExitProcess graph end node

graph_2-37070

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Code function: 11_2_1ED2489D rdtsc

11_2_1ED2489D

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Code function: 2_2_6D285A8A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_6D285A8A

Contains functionality to dynamically determine API calls

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Code function: 2_2_1001D844 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_1001D844

Enables debug privileges

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1001B723 SetUnhandledExceptionFilter,	2_2_1001B723
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_1001B735 SetUnhandledExceptionFilter,	2_2_1001B735
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D286CD8 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6D286CD8
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D285A8A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6D285A8A
Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe	Code function: 2_2_6D2851C7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6D2851C7

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: SaasAntTransactions-Setup.exe, 00000002.00000003.2154651438.0000000005E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager WindowaIconWindowClass.0C:\Program Files (x86)\SaasAnt Transactions\Data
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006E97000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.0000000000418000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progmanadvapi32.dllCreateProcessWithTokenW
Source: SaasAntTransactions-Setup.exe, 00000002.00000003.2154651438.0000000005E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progman UIClassionAreaIconWindowClass.0
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006E97000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.0000000000418000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ProgmanU
Source: SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006E97000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.0000000000418000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndU

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Code function: GetLocaleInfoA,

2_2_6D28DEDB

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\log4net.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Themes.Windows7.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Chart.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Input.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.ConversationalUI.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.GridView.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Navigation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.VirtualGrid.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Practices.ServiceLocation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.Extras.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\LiteDB.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Windows.Shell.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Program Files (x86)\SaasAnt Transactions\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemData.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXmlLinq.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Code function: 2_2_6D27B9C0 GetLastError,__CxxThrowException@8,GetSystemTime,SystemTimeToFileTime,GetLastError,GetLastError,LoadLibraryW,GetProcAddress,GetLastError,FreeLibrary,GetLastError,SetCurrentDirectoryW,FreeLibrary,GetLastError,FreeLibrary,

2_2_6D27B9C0

Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Code function: 2_2_10019EFC GetVersion,GetCommandLineA,

2_2_10019EFC

Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 0.3.SaasAntTransactions-Setup (1).exe.76fb132.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 0.3.SaasAntTransactions-Setup (1).exe.76fb132.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Replication Through Removable Media	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	2 Native API	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	2 Process Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Multi-hop Proxy			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	57 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Search Order Hijacking	LSA Secrets	1 Query Registry	SSH	Keylogging	Scheduled Transfer	4 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	441 Security Software Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	1 Proxy			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	32 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	2 System Owner/User Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SaasAntTransactions-Setup (1).exe	14%	Virustotal		Browse
SaasAntTransactions-Setup (1).exe	9%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
44212c.rbf (copy)	9%	ReversingLabs
44212c.rbf (copy)	11%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.Core.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.Core.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\CsvHelper.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\CsvHelper.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\DotNetZip.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\DotNetZip.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.DataSet.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.DataSet.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\ExcelNumberFormat.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\ExcelNumberFormat.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.Extras.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.Extras.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\ICSharpCode.SharpZipLib.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\ICSharpCode.SharpZipLib.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\Interop.QBXMLRP2Lib.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Interop.QBXMLRP2Lib.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\LiteDB.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\LiteDB.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Practices.ServiceLocation.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Practices.ServiceLocation.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Windows.Shell.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Windows.Shell.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\NLog.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\NLog.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\NPOI.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\NPOI.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Newtonsoft.Json.dll	0%	Virustotal	Browse
C:\Program Files (x86)\SaasAnt Transactions\OFXSharp.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Quartz.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Renci.SshNet.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe	9%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\SgmlReaderDll.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\System.IO.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Extensions.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Primitives.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.WebRequest.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\System.Runtime.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\System.Threading.Tasks.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\System.Windows.Interactivity.dll	0%	ReversingLabs
C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Chart.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://foo/bar/controls/onboardingcontrol.bamll	0%	Avira URL Cloud	safe
http://defaultcontainer/SaasAntTransactions;component/controls/onboardingcontrol.xamll	0%	Avira URL Cloud	safe
http://www.telerik.com-TelerikWebUI	0%	Avira URL Cloud	safe
http://www.telerik.co	0%	Avira URL Cloud	safe
http://www.installaware.comz	0%	Avira URL Cloud	safe
http://www.installaware.com/InstallAware	0%	Avira URL Cloud	safe
HTTP://WWW.MYWEBSITE.COM/DEFAULT.7ZIPA$;	0%	Avira URL Cloud	safe
http://www.galasoft.ch/s/dialogmessage.	0%	Avira URL Cloud	safe
http://www.telerik.co	0%	Virustotal		Browse
http://www.galasoft.ch/mvvmlight	0%	Avira URL Cloud	safe
http://www.mywebsite.com/Microsoft	0%	Avira URL Cloud	safe
http://www.installaware.com/	0%	Avira URL Cloud	safe
http://www.installaware.com/InstallAware	1%	Virustotal		Browse
http://www.telerik.comhttp://www.telerik.comTelerikWebUI	0%	Avira URL Cloud	safe
http://foo/controls/onboardingcontrol.xaml	0%	Avira URL Cloud	safe
http://www.galasoft.ch/mvvmlight	0%	Virustotal		Browse
http://www.mywebsite.com/Default.7zip	0%	Avira URL Cloud	safe
http://www.galasoft.ch4	0%	Avira URL Cloud	safe
http://www.installaware.com/buydirect.aspopen	0%	Avira URL Cloud	safe
http://www.telerik.comhttp://www.telerik.comApache	0%	Avira URL Cloud	safe
http://www.apache.or	0%	Avira URL Cloud	safe
http://www.mywebsite.com/Default.7zip	0%	Virustotal		Browse
http://www.galasoft.ch	0%	Avira URL Cloud	safe
http://www.galasoft.chN	0%	Avira URL Cloud	safe
http://www.galasoft.ch/s/dialogmessage.	0%	Virustotal		Browse
http://www.installaware.com/	0%	Virustotal		Browse
http://www.installaware.com/buydirect.aspopen	1%	Virustotal		Browse
http://www.installaware.com/x2/	0%	Avira URL Cloud	safe
http://foo/bar/controls/onboardingcontrol.baml	0%	Avira URL Cloud	safe
http://www.mywebsite.com/Microsoft	0%	Virustotal		Browse
http://www.galasoft.ch	0%	Virustotal		Browse
http://www.installaware.com/x2/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
saasant.com	45.76.164.236	true	false		high
desktop.saasant.com	45.76.164.236	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://desktop.saasant.com/dt-service/installation/updateInfo?app=1&version=3.1.3.0&out=JSON	false		high
https://saasant.com/dt-service/installation/installed	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://saasant.com/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp	false		high
https://www.saasant.com/request-demo.html	SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.	SaasAntTransactions.exe	false		high
https://portal.saasant.com/blog/privacy-policy/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://www.apache.org/licenses/LICEN	SaasAntTransactions.exe	false		high
http://www.apache.org/licenses/LICENSE-2.0.htm	SaasAntTransactions.exe	false		high
http://defaultcontainer/SaasAntTransactions;component/controls/onboardingcontrol.xamll	SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003B47000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://desktop.saasant.com/quickbooks-desktop-login/login.html	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
https://www.saasant.com/chat.html	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://www.installaware.comz	SaasAntTransactions-Setup (1).exe, 00000000.00000000.1722063412.0000000000445000.00000002.00000001.01000000.00000003.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1801971771.000000000080F000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp	false		high
http://schemas.telerik.com/2008/xaml/presentation#Telerik.Windows.Controls.RadialMenu	SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp	false		high
https://www.saasant.com	SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.telerik.com/2008/xaml/presentation&Telerik.Windows.Controls.LayoutControl	SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp	false		high
https://go.mikogo.com/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://schemas.telerik.com/2008/xaml/presentation#Telerik.Windows.Controls.RadialMenuV	SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp	false		high
http://schemas.telerik.com/2008/xaml/compile	SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003060000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3120537686.000000001F962000.00000002.00000001.01000000.0000001D.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3073876070.000000001E7E2000.00000002.00000001.01000000.00000015.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3103729702.000000001F2E2000.00000002.00000001.01000000.00000017.sdmp	false		high
http://schemas.telerik.com/2008/xaml/presentation	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3103729702.000000001F2E2000.00000002.00000001.01000000.00000017.sdmp	false		high
https://demos.telerik.com/xaml-sdkbrowser/SDKSamplesBrowser.application5	SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/).	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp	false		high
http://netcommon.sourceforge.net/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://saasant.com/dt-service/installation/updateInfo?app=1&desc=$TITLE$&version=$VERSION$&out=MIA	SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.saasant.com/support/solutions/articles/14000096467-how-to-use-lookup-in-saasant-tran	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://foo/bar/controls/onboardingcontrol.bamll	SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003B47000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.telerik.com-TelerikWebUI	SaasAntTransactions.exe, 0000000B.00000002.3124251402.000000001FBA2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://netcommon.sourceforge.net/B	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.telerik.co	SaasAntTransactions.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.installaware.com/InstallAware	SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licen	SaasAntTransactions.exe	false		high
http://www.apache.org/licenses/LICENSE-2.0.htmlhttp://www.apache.org/licenses/LICENSE-2.0.htmlVersio	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
https://demos.telerik.com/xaml-sdkbrowser/SDKSamplesBrowser.application	SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
https://portal.saasant.com/blog/terms-and-conditions/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SaasAntTransactions.exe, 0000000B.00000002.3046273465.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://logging.apache.org/log4ne	SaasAntTransactions.exe	false		high
https://desktop.saasant.com/dt-service/installation/crashReport	SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://support.saasant.com/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.0000000002982000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0RobotoLight	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
https://identity.telerik.com/v2/oauth/telerik/token&uri:client.licenser	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
http://schemas.telerik.com/2008/xaml/presentation%Telerik.Windows.Controls.TreeListView	SaasAntTransactions.exe, 0000000B.00000002.3111007097.000000001F642000.00000002.00000001.01000000.0000001C.sdmp	false		high
http://saasant.com/az	SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.0000000002982000.00000004.00001000.00020000.00000000.sdmp	false		high
HTTP://WWW.MYWEBSITE.COM/DEFAULT.7ZIPA$;	SaasAntTransactions-Setup.exe, 00000002.00000003.2157723436.000000000338B000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
http://www.galasoft.ch/s/dialogmessage.	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.telerik.com/2008/xaml/presentation#Telerik.Windows.Controls.Primitives	SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
http://www.galasoft.ch/mvvmlight	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003046000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000007A27000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3057520372.000000001BEF2000.00000002.00000001.01000000.00000013.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	SaasAntTransactions.exe, 0000000B.00000002.3124251402.000000001FBA2000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
http://www.mywebsite.com/Microsoft	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://saasant.com/dt-service/license/register	SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://portal.saasant.com/blog/security-policy/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://www.apache.org/l	SaasAntTransactions.exe	false		high
http://standards.iso.org/iso/19770/-2/2008/schema.xsd	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006E97000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.0000000000418000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://desktop.apps.com/apps/232752#	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://www.telerik.com/purchase.aspx?utm_source=trial&utm_medium=dsk&utm_campaign=WPF	SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
https://support.saasant.com/support/solutions/14000073957	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.011k	SaasAntTransactions.exe, 0000000B.00000002.3067183260.000000001C84F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://desktop.saasant.com	SaasAntTransactions.exe, 0000000B.00000002.3018293075.0000000006D7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://desktop.saasant.com/dt-service/installation/updateInfo?app=APP_ID&version=VERSION&out=JSON	SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.installaware.com/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.0000000006E97000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.000000000078C000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.0000000000418000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.saasant.com/app-saasant-transactions-quickbooks-desktop.html#planList	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://schemas.telerik.com/2008/xaml/presentation#Telerik.Windows.Controls.PrimitivesV	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
http://www.telerik.comhttp://www.telerik.comTelerikWebUI	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false	Avira URL Cloud: safe	unknown
https://www.saasant.com/chat.html?ServicePack=No	SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3046273465.000000000ECD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0RobotoMedium	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
http://foo/controls/onboardingcontrol.xaml	SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003B47000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.telerik.com	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
http://www.mywebsite.com/Default.7zip	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.00000000028EE000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2075522871.000000000665E000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.2155131713.00000000035DB000.00000004.00001000.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FF8E0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galasoft.ch4	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp	false	Avira URL Cloud: safe	unknown
https://saasant.com	SaasAntTransactions.exe, 0000000B.00000002.3037588109.000000000ACD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.installaware.com/buydirect.aspopen	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.000000000078C000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0Robo	SaasAntTransactions.exe	false		high
https://dle.telerik.com/metrics/v1/events/callhome	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
http://www.codeplex.com/DotNetZip	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://identity.telerik.com/v2/oauth/telerik/token	SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false		high
https://www.saasant.com/report-issue.html?File=	SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://portal.saasant.com	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000000.2145737898.00000000008E6000.00000002.00000001.01000000.00000011.sdmp	false		high
http://www.telerik.comhttp://www.telerik.comApache	SaasAntTransactions.exe, 0000000B.00000002.3092093524.000000001EF22000.00000002.00000001.01000000.00000016.sdmp	false	Avira URL Cloud: safe	unknown
HTTPS://SAASANT.COM/DT-SERVICE/INSTALLATION/UPDATEINFO?APP=1&DESC=$TITLE$&VERSION=$VERSION$&OUT=MIA	SaasAntTransactions-Setup.exe, 00000002.00000003.2159937356.00000000028A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.or	SaasAntTransactions.exe	false	Avira URL Cloud: safe	unknown
http://www.galasoft.ch	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, SaasAntTransactions.exe, 0000000B.00000002.3087908547.000000001ED42000.00000002.00000001.01000000.00000021.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3088007794.000000001ED48000.00000002.00000001.01000000.00000021.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://desktop.saasant.com/dt-service/installation/releaseNotes?app=APP_ID&version=VERSION&out=JSON	SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galasoft.chN	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions.exe, 0000000B.00000002.3087703824.000000001ED2A000.00000002.00000001.01000000.0000001F.sdmp	false	Avira URL Cloud: safe	unknown
https://desktop.saasant.com/dt-service/conversion/conversion&File	SaasAntTransactions.exe, 0000000B.00000002.3049581161.0000000014CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0Robot	SaasAntTransactions.exe	false		high
http://www.installaware.com/x2/	SaasAntTransactions-Setup (1).exe, 00000000.00000003.1784923265.00000000071A5000.00000004.00000020.00020000.00000000.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000000.1798730636.000000000078C000.00000020.00000001.01000000.00000005.sdmp, SaasAntTransactions-Setup.exe, 00000002.00000003.1805485220.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://foo/bar/controls/onboardingcontrol.baml	SaasAntTransactions.exe, 0000000B.00000002.2973722160.0000000003B47000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.76.164.236	saasant.com	United States		20473	AS-CHOOPAUS	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1367779
Start date and time:	2023-12-28 19:53:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SaasAntTransactions-Setup (1).exe
Detection:	MAL
Classification:	mal46.troj.evad.winEXE@7/1366@2/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 69 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SaasAntTransactions-Setup (1).exe, PID 5364 because there are no executed function
Execution Graph export aborted for target SaasAntTransactions.exe, PID 2452 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:55:01	API Interceptor	10x Sleep call for process: SaasAntTransactions-Setup.exe modified
19:55:05	API Interceptor	1234277x Sleep call for process: SaasAntTransactions.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	887OOdJ3rV.elf	Get hash	malicious	Mirai	Browse	45.77.227.106
	$RVQLQNQ.crdownload	Get hash	malicious	Unknown	Browse	45.63.109.237
	gdbhUbyHV7.elf	Get hash	malicious	Mirai	Browse	8.6.8.220
	y6RDe2Qj7S.exe	Get hash	malicious	Unknown	Browse	66.42.108.166
	java.exe	Get hash	malicious	Tinba	Browse	45.77.249.79
	https://jspen.co/#JTNDJTczJTYzJTcyJTY5JTcwJTc0JTIwJTczJTcyJTYzJTNEJTIyJTY4JTc0JTc0JTcwJTczJTNBJTJGJTJGJTYxJTcwJTcwJTczJTY1JTZFJTY0JTY3JTcyJTY5JTY0JTM5JTMzJTM4JTM3JTJFJTYxJTdBJTc1JTcyJTY1JTY2JTY0JTJFJTZFJTY1JTc0JTJGJTc1JTcwJTY0JTYxJTc0JTY1JTczJTJFJTZBJTczJTIyJTNFJTIwJTNDJTJGJTczJTYzJTcyJTY5JTcwJTc0JTNF	Get hash	malicious	Unknown	Browse	66.42.84.244
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	155.138.149.238
	cum.z.dll	Get hash	malicious	PikaBot	Browse	107.191.56.230
	TransferiXX103XXDMT231151342.docx.doc	Get hash	malicious	Unknown	Browse	149.28.109.84
	TransferiXX103XXDMT231151342.docx.doc	Get hash	malicious	Unknown	Browse	149.28.109.84
	Y3b5c7qTOT.exe	Get hash	malicious	Gurcu Stealer	Browse	104.238.189.120
	https://storage.googleapis.com/fedexfr/hreflj.html#?Z289MSZzMT0xNzYyOTM4JnMyPTM3NjI4MTYzOSZzMz1HTEI=	Get hash	malicious	Phisher	Browse	66.42.117.113
	XEXPJu3n0v.exe	Get hash	malicious	BazaLoader	Browse	216.128.135.246
	XEXPJu3n0v.exe	Get hash	malicious	BazaLoader	Browse	216.128.135.246
	Qzb.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	Qzb.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	https://freelancerden.com/zinv3z/?74937581	Get hash	malicious	Unknown	Browse	45.77.85.150
	Notevu.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	Notevu.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	Oom.js	Get hash	malicious	Unknown	Browse	45.77.85.150

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	45.76.164.236
	AlteryxDownload_Test.exe	Get hash	malicious	Unknown	Browse	45.76.164.236
	AlteryxDownload_Test.exe	Get hash	malicious	Unknown	Browse	45.76.164.236
	prenuptial agreement cheating clause 88020.js	Get hash	malicious	Unknown	Browse	45.76.164.236
	SecuriteInfo.com.Win32.RansomX-gen.29384.16358.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.76.164.236
	C7e8AncaYu.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	45.76.164.236
	IMG-662466100.vbs	Get hash	malicious	XWorm	Browse	45.76.164.236
	confirmation.vbs	Get hash	malicious	Redline Clipper	Browse	45.76.164.236
	IMG5527735001.vbs	Get hash	malicious	XWorm	Browse	45.76.164.236
	Gbm1OTFacv.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	45.76.164.236
	wl4ESZQ0ZH.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	45.76.164.236
	https://ppt.cc/fNWanx	Get hash	malicious	Phisher	Browse	45.76.164.236
	algo.hta	Get hash	malicious	Remcos	Browse	45.76.164.236
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	45.76.164.236
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	45.76.164.236
	uVQLD8YVk6.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, RHADAMANTHYS, RedLine, SmokeLoader	Browse	45.76.164.236
	W73PCbSH71.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, RHADAMANTHYS, RedLine, SmokeLoader	Browse	45.76.164.236
	b7ThScyoHi.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	45.76.164.236
	PEeR32pvuF.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	45.76.164.236
	support.client.exe	Get hash	malicious	ScreenConnect Tool	Browse	45.76.164.236

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\SaasAnt Transactions\DotNetZip.dll	T5Kc39s36e.bin	Get hash	malicious	Unknown	Browse
	SyncroInstaller.msi	Get hash	malicious	Unknown	Browse
	SyncroSetup-next_gi-42605.exe	Get hash	malicious	Unknown	Browse
	http://www.edi-texteditor.com/EdiSetup.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.dll	ShareGate.18.0.2.msi	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.Core.dll	ShareGate.18.0.2.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

44212c.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2212856
Entropy (8bit):	7.984882716563244
Encrypted:	false
SSDEEP:	49152:xkQTAfvy2l5gF8yChTk90rxraCvj2yzo96yvDii8wma/tMrUzXlpeAPjsm3rG:xafvpjgFQTZxjgiilKrmHeQso
MD5:	D4D3CC4AE87C1D4CC794AD864B211E3B
SHA1:	0FDD5672DBF1533C537F76844B2756DAA1BA9FAE
SHA-256:	A02B86F93D6CF2277723C1B78FDA5F119D40D156CA672CB272A1E9C3F6B573AF
SHA-512:	C3D064B98CE3F375755A3B54ED2062CD445B0E6DB37E6A22F99ECA86B1AF7FA5270A4230616F8863149DC0813CCC4BE1676D138E9DBDECE8B2E8F215983D0DA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9% Antivirus: Virustotal, Detection: 11%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~..................ue....PE..L...t..P..........#................./.............@...........................!.......!.........................................P....`...q............!..1..............................................@............................................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@....rsrc....q...`...r... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Config.Msi\44212b.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	432142
Entropy (8bit):	4.958112857590568
Encrypted:	false
SSDEEP:	1536:w55r2Ps8aGsI8Duf5H2ItyG0dUr3xy9fEf3ksXfsEL381No5x/7:w55CgxItidUrBEfEf0sXfCo5J7
MD5:	6A8CC4BCB6D7C2CCDC9A06AB98F37A6B
SHA1:	CDB8258B44294B16FED42B8AF694322C0671585E
SHA-256:	A3887ECBF5B89B1158C34508A8B7FA7D4158CD235C4EE8BE4406EB8B948335FA
SHA-512:	29249E3095F2E7BDE38877D378F147B0C9A77DCA812AED6510CE52BA18A3671DBD8F6CD3E438D1DD5C3B8D452EA902600E01507F92D70846149C69C01636AC64
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@..W.@.....@.....@.....@.....@.....@......&.{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}..SaasAnt Transactions..SaasAntTransactions-Setup.msi.@.....@.....@.....@........\PROGRA~3\&.{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}.....@.....@.....@.....@.......@.....@.....@.......@......SaasAnt Transactions......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{1A1C48FA-A4B1-45F0-9919-0D545F0A41E3}&.{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}.@......&.{47B9CE9A-2F54-408C-9F06-CF19966B5A6F}&.{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}.@......&.{E744BCB4-7928-41A6-9F0A-9186AF757EE3}&.{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}.@......&.{5B6E1CA1-E811-42EE-89B4-951552C0A984}&.{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}.@......&.{A1C55C0C-1A0E-4FAB-82DD-7E10B0F7891B}&.{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}.@......&.{61185043-AD9E-45C6-AF50-ACAA123D02A0}&.{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}.@......&.{2197D740-E0B8-

C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.Core.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.515668005518576
Encrypted:	false
SSDEEP:	192:Iw2SGGh3mQQQQQbzsESNa0G+xEMMPoLXrYshSkvW:fXXh3JJSNH2PUJSkvW
MD5:	1830CD72D0EA37BAB9AF9FDF81FC96DE
SHA1:	3480C6662A0E1C0F579DDC0B30D3FF79278FC915
SHA-256:	43D21A6EF97B8B9E02994BE1EAEE2D73EAAD10F2DC1FA100FD57636FFAFF446C
SHA-512:	1A5D96B92876C796EE6FA1A77F46E202913FFD89939347784F783F664CC11DE880D4627A9D0A4D14AB335ACF29EE8C691EBF06D59B78E7E386F799C53BDEAF1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: ShareGate.18.0.2.msi, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~GV...........!.................<... ...@....... ............................... ....@.................................D<..W....@.......................`.......;............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H........ ......................P .........................................S.....d........ei'...!..P.tpO#.g.Z).._wnST..N.Q.......h...[8./B.~Z9...$sv.H...t..d.P.f%.W.U..O0K0...2.3Q....a...P..:.(......(......{...."..}....BSJB............v4.0.30319......l.......#~..P.......#Strings............#US.........#GUID...........#Blob...........W.........%3........!...........]...............D.........................................................w.........................

C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	5.5636356942236285
Encrypted:	false
SSDEEP:	768:47Fuak/yRoDPqJjW8SDSsR7TuPXj0Hiz4mZ2b8eqrxa:47poD1Gz+pmZ2b9qr4
MD5:	7C4C80A7A8B46A7100937018DFF0540E
SHA1:	37B979C2A79031AEDF8729ECF46AE1AB9E2B513A
SHA-256:	7D4435779924F739DD0ABD0117B380FA4CF63BBA552BC6EB9E0D29E24B85E6D1
SHA-512:	28850810683AE532FE7448D43D64B7FCF319374DF889565FD8920B090CD4FDDA4478C7E5D7BE29426DBBCC0B66E49544BDEDB719E144F549CA3274D1B19B6B5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: ShareGate.18.0.2.msi, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~GV...........!..................... ........... ....................... ............@.................................L...O.......x............................................................................ ............... ..H............text........ ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B........................H........M...t..................P ......................................_.P....\|.x.v..4t....Z.C.W.:q...+.xj.....1...r..........K...h...........2....DK]r..l.=.f.....h..&b.%...n.....g,.PJC).5..9....%>..( .....("..."..(#...&...($...&...(%.......0..........s&...........'...s(...(...+...)...s...(...+...+...s,...(...+...-...s....(...+.../...s0...(...+...1...s2...(...+...3...s4...(...+Z~.........(5....o6...&...(....*..0..J........,C.o7...o8....+...(9.......(:...-...o).....

C:\Program Files (x86)\SaasAnt Transactions\CsvHelper.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	5.801641850177608
Encrypted:	false
SSDEEP:	1536:N1ZVFPFqL84arP8B7jXHs2APWgYLcSnqm5jsX:NdQ8nrPMrAP80L
MD5:	01E481345E306F0A3E1682066E9D63A2
SHA1:	D319F6DC778401EC9D97B466E7D296F07E024593
SHA-256:	3D1A08960B8D55C74B088A64D47966FCF77A54A65BC2171F0275EE27BB330F6D
SHA-512:	52185CF7F435AF479B9058A7D515FF962774CD323523D17013FD26FE5D775F5B9B85E1A65A560C330C086B176A850FF773B3FF788919C7B1F15BD1279D79D909
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W.........." ..0.............I... ...`....... ....................................@.................................4I..O....`...............................G............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................hI......H.......4...H...................\|G........................................{$.....{%...V.(&.....}$.....}%......0..;........u......,/('....{$....{$...o(...,.()....{%....{%...o..... .ab~ )UU.Z('....{$...o+...X )UU.Z()....{%...o,...X.0...........r...p......%..{$....................-.q.............-.&.+.......o-....%..{%....................-.q.............-.&.+.......o-....(......s....2.{....o/...2.{....o0...2.{....o1...2.{....o2...2.{....o3...:.(&.....}....*J.{.....

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Credit Memo.properties

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:3MRMG3LMeMRA:3QMqJQA
MD5:	0772ADC7DF3E26FDA7D6052D5E24B66C
SHA1:	4C006ADB76247D5A6AC1C4BAD93ADFD16E3BD975
SHA-256:	0ED4A743021E2B89B988F5744B30BFE077FF40CA28562906D05C9A86C18CF08C
SHA-512:	E8690A00EA50DD16E7EE59DA9D1B391959AE271102219C13868B13164A945833DA09949C37793C8C1C42173DBF6C957E56E218413ADA966031807968A1210949
Malicious:	false
Reputation:	low
Preview:	.InventorySiteLocation=InventorySite

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Estimate.properties

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:3MRMG3LMeMRA:3QMqJQA
MD5:	0772ADC7DF3E26FDA7D6052D5E24B66C
SHA1:	4C006ADB76247D5A6AC1C4BAD93ADFD16E3BD975
SHA-256:	0ED4A743021E2B89B988F5744B30BFE077FF40CA28562906D05C9A86C18CF08C
SHA-512:	E8690A00EA50DD16E7EE59DA9D1B391959AE271102219C13868B13164A945833DA09949C37793C8C1C42173DBF6C957E56E218413ADA966031807968A1210949
Malicious:	false
Preview:	.InventorySiteLocation=InventorySite

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Invoice.properties

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.146168704467279
Encrypted:	false
SSDEEP:	3:6C/ocR9swLyMRMG3LMeMRA:qcvZLyQMqJQA
MD5:	9CDF75F130E226586143B565CC1C5AF0
SHA1:	BD1E05B7DEDE2B6B81A70289C3A5D29B15999F50
SHA-256:	C0D4B45AAF93A5FEEC89EFE3984C4563AD3B3BF54FB7D20DA0DB9F6B08CB55B8
SHA-512:	C59E1EA3C615E135E3EA731975083FA8892C8333FEE1D2D6D0CE2187A8D2F6F599E1F7009C4AA1BD7926150D774B7A205A00DF88F018B0D833379F09121CBA6B
Malicious:	false
Preview:	.Quantity=Item..Rate=Item..InventorySiteLocation=InventorySite

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Sales Order.properties

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:3MRMG3LMeMRA:3QMqJQA
MD5:	0772ADC7DF3E26FDA7D6052D5E24B66C
SHA1:	4C006ADB76247D5A6AC1C4BAD93ADFD16E3BD975
SHA-256:	0ED4A743021E2B89B988F5744B30BFE077FF40CA28562906D05C9A86C18CF08C
SHA-512:	E8690A00EA50DD16E7EE59DA9D1B391959AE271102219C13868B13164A945833DA09949C37793C8C1C42173DBF6C957E56E218413ADA966031807968A1210949
Malicious:	false
Preview:	.InventorySiteLocation=InventorySite

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Sales Receipt.properties

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:3MRMG3LMeMRA:3QMqJQA
MD5:	0772ADC7DF3E26FDA7D6052D5E24B66C
SHA1:	4C006ADB76247D5A6AC1C4BAD93ADFD16E3BD975
SHA-256:	0ED4A743021E2B89B988F5744B30BFE077FF40CA28562906D05C9A86C18CF08C
SHA-512:	E8690A00EA50DD16E7EE59DA9D1B391959AE271102219C13868B13164A945833DA09949C37793C8C1C42173DBF6C957E56E218413ADA966031807968A1210949
Malicious:	false
Preview:	.InventorySiteLocation=InventorySite

C:\Program Files (x86)\SaasAnt Transactions\Data\importantfields.properties

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2340
Entropy (8bit):	4.7748908634690315
Encrypted:	false
SSDEEP:	24:xkQypVEwVUVEmVNq8wKb4P4qlTyIgZLiu9/suQtQFt83ex32dwSZy5TfuERYY8+Z:QAjb4V9zgFx90FQFt8OxmdbZ8RYErt
MD5:	8C1FC93C9C1893EFFD51D5B89F19578C
SHA1:	47C865380A35D7CDCFF0D8A242703D585490E5F2
SHA-256:	67835258D2F8EAE248BD99AB10DC58E5D6B6614ED69FBAC8BC7AD7811609BDDD
SHA-512:	FE420AC796BBF5E4AB0DF6F06BF5BD833FF0DCD358AA650982E46E0D57D513F3CB8F7FA3053E6F8779C98B86F0D53D150DC3C1251A8D468C39044200AF7CBAA7
Malicious:	false
Preview:	.Invoice=,Customer,Item,InvoiceDate,CustomerMsg,Number,BillingAddressLine1,SalesTaxCode,Amount,ItemSalesTax,..Estimate=,Customer,Item,TxnDate,CustomerMsg,Number,BillAddressLine1,SalesTaxCode,Amount,ItemSalesTax,..CreditMemo=,Customer,Item,TxnDate,CustomerMsg,Number,BillAddressLine1,SalesTaxCode,Amount,ItemSalesTax,..SalesReceipt=,Customer,Item,TxnDate,CustomerMsg,Number,BillAddressLine1,SalesTaxCode,Amount,ItemSalesTax,..Customer=,Name,Parent,CompanyName,FirstName,MiddleName,LastName,BillAddressLine1,ShipAddressLine1,Phone,Email,OpenBalance,Notes,Currency,..Vendor=,Name,CompanyName,FirstName,MiddleName,LastName,VendorAddressLine1,ShipAddressLine1,Phone,Email,BillingRate,VendorTaxIdent,AccountNumber,OpenBalance,Notes,Currency,..Item=,Name,ItemType,Price,SalesDescription,IncomeAccount,ExpenseAccount,AssetAccount,..Charge=,Customer,Item,Amount,ARAccount,..Account=,Name,AccountType,AccountNumber,Description,..ItemFixedAsset=,Name,AssetAccount,PurchaseDesc,PurchaseDate,PurchaseCost,AssetD

C:\Program Files (x86)\SaasAnt Transactions\Data\mandatoryfields.properties

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	4.754766181385497
Encrypted:	false
SSDEEP:	24:xOG/hqM9GZLXGm/P1QtFaw/N/vwSZyJI1sIS:Bd9GFXGtFaw/NHbZmI1zS
MD5:	B9E415F072A324B08483AC1AD5BC7F28
SHA1:	96CF8AE26ED41A8AFE14EF959F2D8F6B2F4BBCB8
SHA-256:	859221197FD34B69E30EBA0B8BACB30BA346A1BDCDC182943D4DE4B12B6059BC
SHA-512:	D630DC4B7796C0406A29540047B95D61A026B32AD9A1823CDAC4410DD8BD925F0C70D67E91D5B3EB23903C31BBDDD44689FF271D6189F90D5CF92A28B66C78DE
Malicious:	false
Preview:	.Invoice=,Customer,Item,..Estimate=,Customer,Item,..Credit Memo=,Customer,Item,..Sales Receipt=,Customer,Item,..Statement Charge=,Customer,Item,..Payment=,Customer,Amount,..Customer=,Name,..Vendor=,Name,..Employee=,Name,..Item=,Name,..Account=,Name,..Fixed Assets=,Name,..Price Level=,Name,..Class=,Name,..Other Name=,Name,..Group Items=,Name,..Item Payment=,Name,..Item Discount=,Name,..Bank Statement=,TxnDate,Payee,BankAccount,Account,..Credit Card Statement=,TxnDate,Payee,CardAccount,Account,..Inventory Adjustment=,Account,Item,..Bill=,Vendor,..Bill Payment=,Payee,Amount,BillNumber,..Check=,BankAccount,..Credit Card Charge=,CreditCardAccount,..Credit Card Credit=,CreditCardAccount,..Inventory Transfer=,FromInventorySite,ToInventorySite,Item,QuantityTransferred,..Journal Entry=,Account,..Transfer=,TransferFromAccount,TransferToAccount,Amount,..Vendor Credit=,Vendor,APAccount,..Sales Order=,Customer,Item,..Trial Balance=,AccountName,Debit,Credit,..Build Assembly=,ItemInventoryAssembly,

C:\Program Files (x86)\SaasAnt Transactions\Data\wiki.properties

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	67106
Entropy (8bit):	4.97126068658023
Encrypted:	false
SSDEEP:	1536:K4peyzqO3uf3AYLCrs2wAq5+fgbtHb1K7SSbKPAC1ddFd6I35LhtrOTr0t+O/wkN:BpeyzqO3uf3AYLCrs2wAq5+fgbtHb1Kk
MD5:	68765B68B2077BD6CC2EB8B87B9EA3D5
SHA1:	85699D0DF1EBF9861933404A6D639F070928DCD8
SHA-256:	D4A914CE356DB7518F595ACA8A154C4E3FA388E07869AB582C0A8593C03AFAFB
SHA-512:	AD72138A0969BCD85C40E0239D118654A3F37A18EB1441076688621C06A4E0539C71EBB034A9607E17A7BB1823096FE825087EF6F5C98DE33233B24829E59D70
Malicious:	false
Preview:	.Select_Enum=Select..Invoice_Enum=Invoice..Sales Receipt_Enum=SalesReceipt..Estimate_Enum=Estimate..Sales Order_Enum=SalesOrder..Statement Charge_Enum=Charge..Payment_Enum=ReceivePayment..Credit Memo_Enum=CreditMemo..Bill_Enum=Bill..Deposit_Enum=Deposit..Journal Entry_Enum=JournalEntry..Check_Enum=Check..Credit Card Charge_Enum=CreditCardCharge..Credit Card Credit_Enum=CreditCardCredit..Purchase Order_Enum=PurchaseOrder..Vendor Credit_Enum=VendorCredit..Time Tracking_Enum=TimeTracking..Inventory Adjustment_Enum=InventoryAdjustment..Inventory Transfer_Enum=TransferInventory..Item Receipt_Enum=ItemReceipt..Transfer_Enum=Transfer..Vehicle Mileage_Enum=VehicleMileage..Customer_Enum=Customer..Item_Enum=Item..Class_Enum=Class..Employee_Enum=Employee..Vendor_Enum=Vendor..Item Payment_Enum=ItemPayment..Sales Rep_Enum=SalesRep..Inventory Site_Enum=InventorySite..Vehicle_Enum=Vehicle..Item Sites_Enum=ItemSites..Assembly Items_Enum=ItemInventoryAssembly..Fixed Assets_Enum=ItemFixedAsset..Group

C:\Program Files (x86)\SaasAnt Transactions\DotNetZip.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	456704
Entropy (8bit):	6.8144585735393015
Encrypted:	false
SSDEEP:	6144:gsYYIOQaKp/NFN0if3Rd99UW0zW+Lc3P9QPQyHjGtSV41OJDsTDD50Yhe6dwxLVX:geYa2Xz3mPKS4msB0ie6CfP
MD5:	2AC40DA17C4AC9DF4A8701FAF3913A52
SHA1:	F5518FD34D920546BAFA8D648AA8FEECA3179B93
SHA-256:	46BF5F182875F53994B6BEE810570F85B2B39643C27EBBEE77CE554B1E3B6ED4
SHA-512:	80025E7F79839138B7365071265BCC6D791A3FAC48CECD7D170BE79A46016C3FCEF928676E666F6798A18C534310E5E27BF7F2896214DC615F0913F5F2798F3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: T5Kc39s36e.bin, Detection: malicious, Browse Filename: SyncroInstaller.msi, Detection: malicious, Browse Filename: SyncroSetup-next_gi-42605.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....kW.........." ..0.................. ... ....... .......................`......v.....@.................................x...O.... .......................@......@................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........H.............../............................................{...."..}.......(......0..F.......s....%r...po.....{.........(<...o....r...po.....\|....( ...o....&o!......0...........s"......o#...(.....0.............{......E............,.......8...D...+Q..{..........+M..{.......+A..{..........+2..{.......+&..{.......+...{..........+.r...ps$...z.6..od...(......(....*....0..a.......s....%.\|..........o!...o....r...po.....{.........(<...o....r...po.....\|....r#..p

C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.DataSet.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.028217051385981
Encrypted:	false
SSDEEP:	192:4e2kfGIqU83vUUUUUKE4eW8lJffpaoOSjmdgBHvTc:P24GIV8UUUUUKr+lJQoOs
MD5:	E7F246A70BF35522323150C4699D323C
SHA1:	0B86129118B7E5584E5FFC4EDDAEE1631E34ACF9
SHA-256:	6D25FA352045B5A8B9C119CAA42C04D923F140C28D27A0F70676E7612BEB90FE
SHA-512:	8A04E6DB085B4C85F6FD914C529C585D502E80C0C4052BA5E5FE4A786DFD9041F3F578CC34BF94CDBE16C7EB07584FB6E459DCA65E9C79FAFA4163D0519DC462
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............9... ...@....... ..............................Z:....@..................................9..O....@..t....................`.......8..8............................................ ............... ..H............text........ ...................... ..`.rsrc...t....@......................@..@.reloc.......`......."..............@..B.................9......H.......L%..$...................p8........................................(.....0..o........-.s.......o....s......o....-..+..o.....o......-.s.......(......o.....o.....o....-..o.....o....,..(.....o.......0..,...........+.r...p... ...(.......X..o.....o....-...0..v.......s....%.o....o......o....r...p.o....o........82....9.....o....,..o....,..o.....o.......+k.o....-..+....o....( .......(!...,..o....... ...("........(.........(#...s$...%..o%......o......o&......X.....o'...2..o(

C:\Program Files (x86)\SaasAnt Transactions\ExcelDataReader.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141312
Entropy (8bit):	6.0071023665423615
Encrypted:	false
SSDEEP:	3072:876KBUlsTcVxZz1cvk056vRy+8CkZukXiLin78Shl2l:aBHgcvZ6vF8CkIkXiWn7ni
MD5:	EB58E362D86798A547D05CFF1501B112
SHA1:	F34944D80168FA40F2B6D9F536CFE28DC1F8B433
SHA-256:	319CB6C476BD3E3DFE19089B9B0A66450AB2BA2365A975E08D9EE7463DB74011
SHA-512:	A1EE7826540D16CC12CF733FAAC658AFEA9F1D47D60A8594D094B8F25001D785E4172EDAA8F51584169FCC107EC698233D997C3ECB7428A2B48463940C88D41E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5............." ..0..............;... ...@....... ...............................)....@.................................J;..O....@..<....................`.......:..8............................................ ............... ..H............text........ ...................... ..`.rsrc...<....@....... ..............@..@.reloc.......`.......&..............@..B................~;......H.......h...._..................$:.........................................(#......($...o?....($...o=...sb...(%....(&.....('....((...oc...%-.&+.().....(%.....(....-.sA......sA...%.o=...o>...%.o?...o@...}+.....0............(,......(.........................0..C........{-...%-.&.o.....................-.q.............-.&.......o......0..C........{-...%-.&.o.....................-.q.............-.&.......o......0..C........{-...%-.&.o.....................-.q...........

C:\Program Files (x86)\SaasAnt Transactions\ExcelNumberFormat.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.542801291507589
Encrypted:	false
SSDEEP:	768:8OrXGzMW83eu4768a7Af+yQ48MAeXez6:lrWzMF3eA8a7lha1Xd
MD5:	0C461A4B0190B2E66999DFBB7C94C780
SHA1:	8A52572E1C3ABA10787AA3E18A73A9053C51F8F2
SHA-256:	3E03911DCAD68D01AC11879B1E50C04C231B14858BBBF19C1851C1D3FA5F54C4
SHA-512:	3BA5974DDD196095647D2334829119F945D026FADCE69D6ECBEF53D47EBA171A532A4FA163554FE355334BE26BBED9D51BA844E94AA292F78EE889D472FB90F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0............." ..0..`...........~... ........... ....................................@..................................~..O....................................}..8............................................ ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@..@.reloc...............h..............@..B.................~......H........I...3..................d}........................................{...."..}......(......{...."..}......{...."..}......0...........(......r...p(....-C.r...p(....-@.r...p(....-@.r...p(....-=.r...p(....-=.r...p(....-=+E..(........(...........(........(...........(...........(.........(......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....*.0..a...............(Y....o....3G...(.......(.......s....%.o....%.o.

C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.Extras.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.460171271073151
Encrypted:	false
SSDEEP:	384:x1ovgfOI8VYPh6+A8V34kAS8e9UnXQUkz+rybx0gWgRJTKkZAlphPyWA1isrH:x1o0pPg+KFS8e9UX5O+raVWgRJTKOShS
MD5:	43312122AF66A3E99CF2F9C597012C22
SHA1:	634D4C39A874EDDD4A733C4548C37FFB0D2F467B
SHA-256:	8E248E95E6DC65317AF9CAAF6A43091D5CB75FD1302BAE0A49DEA821FA21DC8E
SHA-512:	2A73B9DF94F219A2B8DDF54A7D1B176BB79FBAE346AC8B30E3DF82CB8C604C681960FD8208D68D30CA66CE4DE9F9963B789D3105402D899FD930A4831BEE2EE3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W.........." ..0..L...........j... ........... ...............................S....@.................................Hj..O....................................i............................................... ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................\|j......H.......l4..$4...................h........................................{......{....V.(......}......}.......0..;........u......,/(.....{.....{....o....,.(.....{.....{....o...... ..O' )UU.Z(.....{....o....X )UU.Z(.....{....o....X.0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(....F.~....( ...t....6.~.....(!...2.~....( ...6.~.....(!...F.{....%-.&.(....:..}.....( ...*F.~.

C:\Program Files (x86)\SaasAnt Transactions\GalaSoft.MvvmLight.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	5.6173719329363045
Encrypted:	false
SSDEEP:	768:cO12uMd438J2Bd+5onSYEBHyOR+DmHKPrzX7uFL3xLA1n1s6j:b0uM63jv+2nCBFs8FFLA1r
MD5:	B349A5C9165CBB8663F82C31F9402D35
SHA1:	E8B38649C05408DA796E2DC21E699CA8352A059F
SHA-256:	60FFBD8A891ACBE1ADBE79D320806A32AE826575F5218A51379FFC83F03F62A7
SHA-512:	377C0C88F0FEBF3DBB4786CE823AA2CF2B85F55A654D9F3D10A44480A9F9B726A08BB2C03B190473F4F461824ECDCF0FEB9AF098D4840952A2ACCBC197E89E6E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W.........." ..0..f............... ........... ...............................1....@.................................@...O.................................................................................... ............... ..H............text....e... ...f.................. ..`.rsrc................h..............@..@.reloc...............n..............@..B................t.......H.......d:..$I...........................................................0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...{........0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...{........0..p.......s.......}....(......{...(....-N..{...o.....(....,:.u......,..o....(...+.......s....(...+,.r...p.{...s....z.0...........{......,....s ...o!...*.0......

C:\Program Files (x86)\SaasAnt Transactions\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	5.683688089372797
Encrypted:	false
SSDEEP:	3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
MD5:	C8164876B6F66616D68387443621510C
SHA1:	7A9DF9C25D49690B6A3C451607D311A866B131F4
SHA-256:	40B3D590F95191F3E33E5D00E534FA40F823D9B1BB2A9AFE05F139C4E0A3AF8D
SHA-512:	44A6ACCC70C312A16D0E533D3287E380997C5E5D610DBEAA14B2DBB5567F2C41253B895C9817ECD96C85D286795BBE6AB35FD2352FDDD9D191669A2FB0774BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.K...........!......... ......^.... ........@.. .......................@............@.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SaasAnt Transactions\Images\App Logo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 200 x 75, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15245
Entropy (8bit):	7.9727562410449435
Encrypted:	false
SSDEEP:	384:uTgI02clnvAIrTA8SMqaOJ5GlIner1T1MsatCqlBe5+FrO//d7:uTc7RvPYaOJ+IsfHeS//x
MD5:	EE0E75D4810DAFBA921E23D2B17ED95B
SHA1:	BCE7CDD5E667612EB4316D58BA9DF7E382EC2954
SHA-256:	97EA6703D93CD25FCE0BC26FA222B2494C9F7064A829DF536DB9574AFCF3735A
SHA-512:	D0D08ADAE2B39E9B8E79ACA7C04E979ADC382323F99F5F0693867FA75C1E683C15924B6874DB02ED068F20AE9D7A75339C108BFF9A3F1191E003A029D5AB0672
Malicious:	false
Preview:	.PNG........IHDR.......K.....5\|......sRGB.........pHYs...#...#.x.?v...YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y..9.IDATx..}...U..{U.=}M. \".r..pI.......TV. ...~...L.s=wW@W.W!.._.....".9....r..K.%H...}...U.T..\d..w^.SU.......WZ.....w..n{@..3u..].;.q..i..J.....{.(..Q.a.8wm<3....]f...WZ......02..G..8.z...[.C./e..f..pW.(S.J^..N.(.S./2..Z+.`.../%..E...o.....k....}V8~U.`...d.....P... .i...`.Q>..P.q...CD).p...J.}.IF.$..Kd...H4~U~.;&}..=...j.~.)....S.....q.wE..9....qP. ^...6.....#.{CF@.`.......;........j@.`...i.o[...LO..w. ..p..#...L.jf.......]..^U{-_..GD..4....m+..I..:..F..N.BC)..K..`..6B.....W..U....L.BQ.b....>F......m..W..>2.A^.....l.a...\|...

C:\Program Files (x86)\SaasAnt Transactions\Images\Banner.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, PhotometricIntepretation=RGB, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 492x63, components 3
Category:	dropped
Size (bytes):	19981
Entropy (8bit):	7.529123248543396
Encrypted:	false
SSDEEP:	384:JWXgil04jcQbK46uSgcP96YGAjdeytzYCTyOwzypLeiWtz/:Ju7QQuruSg+cnytdTyOwzypKFtL
MD5:	7EF965631C0E277ABBBD63CCCED7C304
SHA1:	5E85B366520472681104084D085B05F8730E9162
SHA-256:	82B4F18E62BBC3CFBE1026BACEAE92B06ACAEE80CFE5E2259DF5841BAB0FC03F
SHA-512:	CC75FF4688B479ABD961FAF88CC67E93FF69B857CDC18A8A8C178B4EB90E291E947CB0FFB723E8A23B9D0443819BF8A5312D6A475E9700E538A8AFD99A3C4507
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM.*.........................................V...........^.(...........i.........f.......H.......H........................................?.......!http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

C:\Program Files (x86)\SaasAnt Transactions\Images\Chat.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	7.852862736239081
Encrypted:	false
SSDEEP:	48:C/6B9gI/QC+BtnaBAuGLB/jZctT/c9Iu0wjnxkzozkHaC:CSBlrKQBoBZctT/cWuFxBaaC
MD5:	F685A3B8099A6FFABDFEB991E15513C2
SHA1:	4D815C6BD14390A4AFE99F642CFE2FDCC394F83C
SHA-256:	CD13B2A6F9FD4A405956CDFA7599D2762BE4DAA4B605FA48B30196177FC2C070
SHA-512:	FE46E41C3BFF38ACABCDED8BE0401B62F3AC407C68F12F96C16FA178E4A8087DC140FF30FA24EDFAA80F77DEBA9F1D310B361888F5E9E31A82843DD9247A832D
Malicious:	false
Preview:	.PNG........IHDR...`...`......w8....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<...!IDATx..]]L.U.>,..].......-..I...jS_0...&>.....o.....K....I#..\|.jb......h."T~#.......=..f!....;s../...=...9..;3...X....F...$... ..$..@ .H...@..H...@.......o~=.g......}..=W_.....~.#.(.hP...y.+. .L.^. .Q....\|.....-2y.....=``....^a..../....../P..C.H..1...PG}.;.J6..aG...`3.\|.`{$$.T.zT.w.....?.&eG;..]..iF>.js........V.as.:.}............m6X....?...D..bADw...6...f..k....c....e.<...o.pp.......5^.zZD..]....3.j".G.<)...f.#......3\ca...]..X...!......eP...b.../....b.rp...CF...[...`$.8.2...3.D.W&....J..!....~]q......G`..V........~..'+!.ij~....?...y....o...l........i.k.m..\|....E@.....S.,..h.....g8.....m.F..h.Z..f9.,@[..v...N.n.._6....r..4.q..1..m.1!7. ......d....2..).._.V....Y*..T.0/.......iMI...F=.RS......k..........hMKEr..FWC.y@n.....\.9......x....\|........3G...gNm...o....]R..=Z.o5....$.:eX..{..Zs...'.G.L..q..x..........i.TK.."....wyy.+f..!...`vq%...xx..V.x..

C:\Program Files (x86)\SaasAnt Transactions\Images\Company Logo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 200 x 75, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15245
Entropy (8bit):	7.9727562410449435
Encrypted:	false
SSDEEP:	384:uTgI02clnvAIrTA8SMqaOJ5GlIner1T1MsatCqlBe5+FrO//d7:uTc7RvPYaOJ+IsfHeS//x
MD5:	EE0E75D4810DAFBA921E23D2B17ED95B
SHA1:	BCE7CDD5E667612EB4316D58BA9DF7E382EC2954
SHA-256:	97EA6703D93CD25FCE0BC26FA222B2494C9F7064A829DF536DB9574AFCF3735A
SHA-512:	D0D08ADAE2B39E9B8E79ACA7C04E979ADC382323F99F5F0693867FA75C1E683C15924B6874DB02ED068F20AE9D7A75339C108BFF9A3F1191E003A029D5AB0672
Malicious:	false
Preview:	.PNG........IHDR.......K.....5\|......sRGB.........pHYs...#...#.x.?v...YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y..9.IDATx..}...U..{U.=}M. \".r..pI.......TV. ...~...L.s=wW@W.W!.._.....".9....r..K.%H...}...U.T..\d..w^.SU.......WZ.....w..n{@..3u..].;.q..i..J.....{.(..Q.a.8wm<3....]f...WZ......02..G..8.z...[.C./e..f..pW.(S.J^..N.(.S./2..Z+.`.../%..E...o.....k....}V8~U.`...d.....P... .i...`.Q>..P.q...CD).p...J.}.IF.$..Kd...H4~U~.;&}..=...j.~.)....S.....q.wE..9....qP. ^...6.....#.{CF@.`.......;........j@.`...i.o[...LO..w. ..p..#...L.jf.......]..^U{-_..GD..4....m+..I..:..F..N.BC)..K..`..6B.....W..U....L.BQ.b....>F......m..W..>2.A^.....l.a...\|...

C:\Program Files (x86)\SaasAnt Transactions\Images\Delete.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10597
Entropy (8bit):	7.912220615047378
Encrypted:	false
SSDEEP:	192:XbZToCRBzu9cfYvHKasUzFBOaujHRNr2x7cbGfz8ZX3LWAOmGVDiwpYCBp3PErxD:r2C6iasUJBzujmx7cSLWHLWAqtiYBl8B
MD5:	CAB3AFAA84A26E1A668A40B388505B81
SHA1:	1EB0B1BB63551CF8DC5DBF4EDEE629C1C30C8042
SHA-256:	64A3A4E33438ABD9AFD5B83276E76553784E99693E2F8E3D332184FF55252D26
SHA-512:	BCEA2498EAC10079F997AAC38C177C769EB8D833D65B4DB9B6913F0B682E7275B3AFBEED487C71A1CF2EFCE6405C5418EBF497B38B739A50900A1B39AF095A80
Malicious:	false
Preview:	.PNG........IHDR.............\r.f.. .IDATx..{t.U...y....$....../.s.9.D.....(.H..".R..=..gf.5.3.\.s..Td.Q.E ......qP@@..@^..........]U.......+U{..U....{.j. ....o...nDHd....n.0...n...\|...;w..hw].Dj<.544x.<..F3+C....,...=.d...c.pCCC~CCC%..H..5.f...n........T..iYm."..@.0..\|.....L .p..444..G./..<...!..E.E...`0..Mc...;...V...AJJ.<.CC....HOO.j4..,DW....\|....T.........!....u.,.'..Mu..T...0.DQ.(...p.. D./E.....{Gq.P$`.<.p#sC..EQDOOO.?. x......A.(.jF@&`2<q{....%............Ctuu......'j,)%%%...^Rw.Dx. ../._...."^..`d.@.On..Af2..0<r'.k@...'.@>........d.&`..$.k....a.].V......7g....u...............E2.....n.o..^...W.....O..\|.@...u.<..o.y^../...;...f.j.....H..;...}.}...@.~.....ZF.J........k...%........g....=#.x<....'^...@.@8...D.....]w...............@k.@.&..o...^.......@K..F....w..w{.>7'C.@8...?^#.x<....g^................{..k.9:.2.........Vd..x\|..,..}.N...p....K......v... . ..4..3..`..w...{.>_.@.@8....5...A..,Z..k.9;.2...h.=^#.J.......x.>o.!. ......"..2

C:\Program Files (x86)\SaasAnt Transactions\Images\Delete1.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	7.774540431612985
Encrypted:	false
SSDEEP:	24:/7/6Dy6IDArHWVGvtYRnNjFFxLpyKNLbi36K7df126VM0cN:/7/6ulDOk5LjnxMvBf12+LcN
MD5:	CB5FF13082B66DBC4580D487FB901501
SHA1:	44D3D54449271120801EAAEE70D676B30AA63E32
SHA-256:	907E011D925252DE71DED669BEAA90B5D34419C7B8360E6816A180C4BDEE8836
SHA-512:	17024B79EAC3B47220061321085D54F5DDD93DEA7C6FB9F110F0BE97C5E2BAAD85C67AE74552BD4F510EB60E8B26392E1A63DAE521EEBE86048BB1CD9AF7B462
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sBIT....\|.d.....pHYs.................IDATx...k]E..?ym......^]=.b+d....M.M-........Z.W..E........H..B.J.+..Q!.XBM.G.......sq^h.=..;sg.x.0.ys.....s....T....D..0.<.4..`W.........w..%...5.(p...:.e........`.8....i......%...C...'.:.,+..`..>....@..'./.........W.W..i...$..lG&.a.i...[...%.g.a......Z..1...}.>..0...a...@.^..K......g...x..6.dp.....q..Ot..{....;.!.SxW...r..!..O.{#.7.[)....c..!.?..^.E..}..)~."Yfp.H!.,..c1....l.~\.M6f..Z.4.N."..Nr.F}."..>.D...A0...X]..5.+.O....=.-r..?F.Ex..0.......y.h...[.0...?.k...U..'9...?._.5.Q.X...,.Z.k...1vY1.Fvn.K........c.6.....R./..o]..U.t..#/z%......v...H...\|....Y..e.#..\|w]..a........nn*u.....^.:.D?2....ot_.ZcK.-..rPQ...J.......z.#(S.e..I....\|....a#oCK...N..>(C.G......@k<....-BC.S.....U.&...5.%...-.6....P.B..$.j.FN9:..!E8..h#.%'L+.&].8 ..7...q.bh..G.EE.....}......("...s.}..!73......O...;...d....^..'b..p..C..GE..#Ya.."z...yEh"yJ...r.Y.....(.]......?... r''..r@..V.G_.x.A....E..W.^....A...U..."\|..\|

C:\Program Files (x86)\SaasAnt Transactions\Images\Export.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6968
Entropy (8bit):	7.772180551455239
Encrypted:	false
SSDEEP:	96:C13g1mnTT4xCeTx9Isgh0wHY2goia54ALv9YXe3pEcyDyflsWBRvLLZ6U5mb4jaI:CFB8pT3YqQ72A7lpZtsWbmMm8rf7Fdh
MD5:	63B02A4F13B2B48091C18D82889513AE
SHA1:	61158066B337737AD8B87D80102F681CC3BC2B99
SHA-256:	D311BC1359AAE8A767B508B224AA5D58287EAC2FC480346D20D54810564B2DAE
SHA-512:	6B3F7E199E61F59B4407F365CD21F26D5BE3FA93886C5D2D0B22AB857E92E963FC9D73376874DB0DC42FFE355FDC0B35A2AE981C7043BD4D91DDC7E99EC4E1EA
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..{pU.....I @..I(.B.(...3....k....j..p9"(R..........Zg:-.Z...L...VcA8=:.p....$.;.r.{..[..,.....{=..o.-...<...[;D......$...~x..Br..."---..\.F..S.........\|...s.Vl.......`.[... B....$@0...._c.U.?p.7.g..R.....`...y.L.c....u..r....L.... .....~I......\|~.x...>z.D...1s..5.J)...n...322h.....@.@.'......bI..[)uJ.2.Y...$....'..I.&.gb}......A..B.....<X{..A./........A.7t&.r ....[.&..!~...............{^..Kn.\|?Q{C....@...-..........@o.Z....`..f.j....\|..@d.F....L ..@...0B+r.4.<..H%.@..v.@$z.C.e.U.3.&.f..?.v&.')@5.I...y....[..]~.m.`a...<..0.7..j.`7....,...r9.......@..V.vS.r.l.s........[..M@o.V....p..7o.L...R5..M..e....?.>L...R..`.....r.X.`.L...R.......e.\.,\..&...n.._..(....IY '.E....`. Uz.f)@T.X....,^..&....`.v.....A6.'.\|.&...n-."1.;e..'...O..`....@.........$P^^.....7.."1.3.....,Y.....7..".;5......X.t)L....d.F..4..$....y.R....0....R..!.XU(......0.....0K.fb....U...TVV....pY.`d.f.

C:\Program Files (x86)\SaasAnt Transactions\Images\Import.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6800
Entropy (8bit):	7.7716733712347885
Encrypted:	false
SSDEEP:	192:J+Be/Q+/vVOL50+stWcd9hj8lw5bFG3OT67CtMJjp:J+A/Q+FaW+sbNRbFGerMJjp
MD5:	5509C7D4D493B3E1993B8DF54C1B295A
SHA1:	69064A29FA8F3DD771314EE1F949DC449F514350
SHA-256:	3856EF4B2C82EB7D8F86B4691387E3CA372AB735D0044467D19B23E5FDACCE3E
SHA-512:	F9D2E3082CF6398B900CBDA183163588EDAAD7B0D11D62973D79F34C7844C71424B97C54B9F10E861B79F928046577933D8397B8F1B4DFA08AEE8A3816A27184
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<..."IDATx...p....C..,.../.e..jMb..........B.SYH..lj.$[.,..,..MX...,w .0.8....`..%[6.,..K.i.......z}.h...\.F3.f.o..}............3{...... ..A.;'.......460. J..%K..a.....b:.'..=.X..\|.x..`.....H/..........@..RLC.........cz.$.0.D...0....s..$..`..R ..fe. ..v..._..8.P(D..{/.[.l.\.~}=f)G.h..0..^/...(.@....08...`...j1K...X`....7)......AR..RL.O...cyQ.)...$I...\{..A=.......k.xP........`f..x<....?..P8....a...../e.......P....X^~1e..[.\|......~hD.....5.."........_/.H ......0B..f.@.{.@...e?.#.^.....V7g..H .. g...$.x..U.. ..;...V.........."..n....F.`...V.f.o.,.x<.r`.y.......... z."....C..$.........J....Y...... ......j.`Y...n..vH..........N.....; ......w...l,.....w...@. .._.~^.`&..e.R..u.]....r..`V......E.w.}7$...\...a$......s.=.....u.....,..=...C......@..........%K ...ds. ...I@..... ...d........A.]..........I.FA.hU`R!(.X.ti-..@..@..VU...l.*T...-.....p....0.v....U.H`......Y..0.

C:\Program Files (x86)\SaasAnt Transactions\Images\Import_Export1.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	465
Entropy (8bit):	7.25564314625225
Encrypted:	false
SSDEEP:	12:6v/7Y7/6TR8RdYoXlWXn4pw2Xos7GYFsALzvgpj2f:/7/618RblWXnLnYnfn
MD5:	F0EC31A34818D0E5FDC17D7E4F42B0B2
SHA1:	DF21A95FC0BADF6E1012E6EC3EA424525FB2250A
SHA-256:	76F67C90403E692E4CB83CA26894D992CEA57603F70A8D060CD844FA4EDEF2C3
SHA-512:	C9168ADFCE79C76C0F1CE9773B7798B80DF63C1FF97599DDFBF40DDFC2CE0838E9268B8F2502F2C2C74D78E5EAB0A273C834494BEFBD51AE991F51918B0B272D
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sBIT....\|.d.....pHYs................sIDATx..MJ.P.F........".{p...A.?E...g.nB..Waq!:.$.4Ms.5y....4........q..q..r`...b.\|.Lr.&...3.&.)...H../?x.s...3.e4....'.......5...^...K.ix.....#.O..........p..7.q<Q....."l...q...j\.:....4}...../.-../........#.....\.:...........q...j...o)...it.....f.....-......u.5....]w..W.?...k...;z.jm....f.q..hCBo....+.M..kB........06.&.=u$d.p].w.mr..9...d$\>..py.q..ql.............IEND.B`.

C:\Program Files (x86)\SaasAnt Transactions\Images\Logo-Transactions.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 1131 x 572, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	81424
Entropy (8bit):	7.939508818618094
Encrypted:	false
SSDEEP:	1536:I2ZLqkAeokB+Qy5C9I0+ZOTqwWhlnbj/HXlNDGdl1ab18sNLoxxO9chm4/sU4g97:35Azy/IxZQWPbrXl/asJFytR7
MD5:	45001E25C02B845F9304953655210492
SHA1:	D24963C74C764630283E136122C84E223A3E5FF5
SHA-256:	3CEA526EAD7DEC1C5BE8B0FF6655AB09072160FE7AD02A9DBFB843ED5B6320BA
SHA-512:	B377379C04EF006890EB3C41F32163CB37C16B9D2749AB2F98057E5146E304EA988E6FAE58865A75BC08FF3356D897B7F08D1A873D3D7541A23AAE924B4C701B
Malicious:	false
Preview:	.PNG........IHDR...k...<.....Fr&.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:Compression>1</tiff:Compression>. <tiff:Orientation>1</tiff:Orientation>. <tiff:PhotometricInterpretation>2</tiff:PhotometricInterpretation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..E*...@.IDATx......e....y.........!.$.!.!..t...0..}........}.]w.............+!...r$.p.@.!.\}T=..W....d....o.df......tW..9.bC....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@

C:\Program Files (x86)\SaasAnt Transactions\Images\Logo.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	121104
Entropy (8bit):	4.123155981048824
Encrypted:	false
SSDEEP:	768:mxarF3HDyeMMY4t8zAnyhODi5VVZDxVbcOiNMH0jJi+UWo7ORCteUla0jyG1if:mxAFZnt8CyhOKVVZcx7tiaCQUlakVE
MD5:	195A448C748728F9A61A7F455018E5BC
SHA1:	3D5CB16EC91CEC66A30348685465394ED1584C4F
SHA-256:	868229E3CAA7DBC05D3CFF67781C3D2E8385620593A8DBA8674FD0357A5B1AE4
SHA-512:	9128A161DC437792E53BD526D5E605BDA4980157A07ABF668ADC0D635B06F83DBFAE31F190701165662E677684E836F67AE49A4FEE838420ACCB7F233642E105
Malicious:	false
Preview:	............ ..S..f......... .(....T..@@.... .(B..0\..00.... ..%..X... .... ............... .h........PNG........IHDR.............\r.f..SiIDATx..y\|.Wy..}...m..8.Y..$.xK."S.-;2e).....B[Z..R(oK..%J......Z.RZ.H...."%.C....o!.JC6g..;w........zKl..W...D...=3s..<.9."..,%Tex.gr....^^...eD....g....JT..n}r.^..G....\|.....wU...'.<..U.3q;.uq99=..b.."...n..8x../..B.KL..m5.....#...D\.[.Z..`...{..7fJiD....TR.A..r.?cc.##3.t.....^...T.b....m..8....S6.@.E....l=8.r...p..gvm9..."..et~.A..r./.jX.d...7./.....y.....s.v.........gF.....{R,#....P..#.....u..`L.Ff..n.+....:.._y...t.+*...+O@..j..Q....)...b.D\.b.[o.....g../..j...5.+....0......g...+n...6....}g..{..X.1..H.....X.aG.?.5T.1....0W.9..d.o..K...2w....o3._LVT.@.`.z....bE@.#..[.n....l..8.8.O{K.+..E...;.eK....OQ....T7k.b..XD..........ol....Q)..M..C..... ....Pwr.D....^..^S... ..3../...q])..Am.P...C.]....S..oJN...f...R1.d... "1.{..?iT.E0./.t}.1....._...r.......M._..O.{...?S(.:(.n...b..E...].....y...9)..w.r....n.....3..i

C:\Program Files (x86)\SaasAnt Transactions\Images\Logo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26140
Entropy (8bit):	7.968446606897966
Encrypted:	false
SSDEEP:	768:HuHBhSqowaS1LH79Uf+sgXuT1Q5LlKM0g8:OHyqEeH7N9uekM0g8
MD5:	201AE20E32F9EE1E760B4D19DF29047A
SHA1:	DC1E80A621565CF6AA3E8FFC2E26488222985620
SHA-256:	0662B36E0C40DA1938D1328DA0A59612CE7C35D81C75C241E04D17DD9932E8FE
SHA-512:	4D59FCBE1118689444FA138F11E489B1324076B003B3E9DBE89DC39C0622290482B561ADF9AFB97BCC1C5C75AE04108F0C49A6F912351AAE362E821757F38BDD
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....sRGB........ cHRM..z&..............u0...`..:....p..Q<....pHYs.................iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:Compression>1</tiff:Compression>. <tiff:Orientation>1</tiff:Orientation>. <tiff:PhotometricInterpretation>2</tiff:PhotometricInterpretation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..E...@.IDATx.....U.?^..{..I......$(...L.DE.P...?.cU@E]..u.]..^..{...u.]V$^.......fD..Lb...+@...>.....VUOO2G.3.3...z...{..............Z..n...2.C)...._..k..6_...x6..Z.9~.$..RZ.jK.m..HT.......6.H..C...W..Zu..m...!P..h.Z..zC...h,.....%..W..RCYs.V...".]@..T^\.V.&."Q.I.2x.....C...3..'J....V.......!..%4.....o...@.o.?w.9....k..X./0.q.d.......t.

C:\Program Files (x86)\SaasAnt Transactions\Images\Logo_su_4a.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 1489 x 556, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	27896
Entropy (8bit):	7.866837910731793
Encrypted:	false
SSDEEP:	384:DfG4TysniBbGLTPXuxBLO0rkIBap1waxyYsFAYtbWydmoKZMNiOG0vdNS3c+F8mu:D0snGKTv9FlxyNrtbXQFMT5mABb
MD5:	E0048821CA3F154EB5B180E2D2740A11
SHA1:	7103074CC6E23FAF253789663C36753B2F588B61
SHA-256:	2257C7E1E8D2A0E6FA84BDBCB68B7333E602C7E1EFD6B8D71D55EC61DD1D7311
SHA-512:	7F21EF89FFDB01ED882DFC1631E81FEADF1DD53E4F5A5AA55556D1E75ED35D582F95772F0EDD288636D61A9EB2068E493E8F99B7652B93140207AF03D0884E7E
Malicious:	false
Preview:	.PNG........IHDR.......,........C....pHYs...#...#.x.?v.. .IDATx....n...6.;F..q .}...r$e.n.9...4...1...r.f..........D.7......8....k.h..=`)Q..?U.....d.M>U......./.......d...y.~....>I^<._......:.u...m..........3...l...\$9.<X?Mr:.u..%..!:.....U.y..Yg`~_.....$.i.s.(........X..d.<.^.......B...C.sG.........B\.....,..%.%9....M.....<Z..\..i...Y.P.!:....`..........'J.P.!:...po..l.d..j..".Qt..4.......U.d.a.....<.e.K..Y;.........7]...c.Ex.d(L.h.!:....7.....4.......S...Q...k..X3.......@..Y?..y.Z..w..).@=.........v../Uc...N{..R.......Z.;..&...-u.[..x...!:....Lw2..\|.....$.]... D.........D#.J...!:....@w2{..$...h..${.^.T).......@...^....h+........Nt...(Xw2.&y..E...Z.w.X!!:......-.:.<H.....X........v..F.^..$.j...V@.......Nf.$....L.I~.N:.j.........l.......Mw2.)..r.......UW.[.h..A:.r.X.......Q.T.......'..X,......`.tW..>W........@C.... .`.......@.tn H.X0!:...4...;.$.+..b......A...a...m.z....}....U......Nf.$oU..x7.u....x:.........^..<.A...........j.;..f....j.H?

C:\Program Files (x86)\SaasAnt Transactions\Images\Mail.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	7.788837850676476
Encrypted:	false
SSDEEP:	48:C/6BXKi6wZWMmuYWvZq+VEF8zZ5M+BvvvPPe+hOwqqgdA7WCcK3:CSBXKi6CmAvZrEo5Pe+YwLgd413
MD5:	A165D58FC112BA2F92AB98B1E2F356F3
SHA1:	04B732824F897D99012D7614D7375B960FC5044D
SHA-256:	DDC79360670A083AF8D098CA666D2E06E00730BF03A2900A83DC193621C84BB9
SHA-512:	544D25B8C3D795D2DF44A567156CE3513D78033D222F7523112D0A4B8A70EE46B9BDABAF42DDC9BC221B41E3AE16CD9A70248237DDFA1877F058E47CCCA44937
Malicious:	false
Preview:	.PNG........IHDR...`...`......w8....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..]IS.G.~ZG..%..$..'.J...rINv.9...L~@..#.\\eN9.b........[9.qp..0...b...!.H....C.#.[.3~.jJ..f.....i.....f.9..$..@C...4$..@C...4$..@C...4$..0.U:../...&G...X....V..C.............O3...&..".....>...UJ.9....R...}...$2&e..S.0.x.0...\|...E.%.bDTlO.......,...c.....1.4..H.>.>.>./....._...&..q.D....v.....X.....D..%.)......m..%f!I...3`/.ZD...6....4:O.....I...0O..:.l=B..)...n.RF@..?.T!.tC[UME..rA.....(p..3.>.\|{>.C.!..R-.O.^CuW.;..H.{....w.G...Z$......_......&*Q.>4..h.[..@..^Z.....e".......9.`q.1l.._'}.f....z.G+...oW........[4..Ba......u...l.G.%.....E!.P....."I..O..'._.._.>v...NF..)9.N'......]M.z)9....#.b.".0....p:..gO.B....>..'... .]...&.W)F-..B.R.G.w.H.='=.......y......H...T8.^.....B...Ur.......h...m.L.2.G...!...o....\$.>!4.....`.0.ru4M...aR.fa......v{......B......s!....P...9....o..$.Tr...v.Y......h....p{......c.C.....Rg..%[Qf.5....h.K/..@;p../.I..,.\|.N...

C:\Program Files (x86)\SaasAnt Transactions\Images\Phone.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.780650713229545
Encrypted:	false
SSDEEP:	48:C/6Be673Rn0xZ/PeUdruV0DnnV3/TfhPVXkbusO22oe0gUNg:CSBT3RmiODp/TfRVXGus12o0
MD5:	1F6405B0C620582B1B94036DD2B36E31
SHA1:	74F5044501961A0A19998D0C2451C1630A730F92
SHA-256:	E3D3B98135C4580591471F1AD939030A3C4996497F6392E47DC2B1BF167CADC9
SHA-512:	994CF76F4514AFEBA8DEDF39B08A994EFDBD029E75F1E77B3A743D418328AB371795833E4469E0B7DE1C2B0B15364D25F85F3C3C51C003BB766476D08F1B48CD
Malicious:	false
Preview:	.PNG........IHDR...`...`......w8....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..MLTW......t>p.. t.d.Hj.Q...B..6...UY.t...Y4...l....nhJ..:..R...B.D,....0........ax_....'7....;.{....E[[[@.'........ .$.@.H....... ...@"....f...=#..%.Zd...Y..z.>n.........4..oT.17d ..H..(.._.........k.D..!...MEOW..m"x.W.../..........d$.A,X.....!X<.`..ho..l\|.......k..z..n.{........Z,..&3>.\|...`B....F......./.....t...ay.....GzLQ5. 'YqA..j....CP.....'....Z.=...(/s....,.Zz(r......i.....H...K.;?.g.....!......c.p..........(q...i2.......4......?.NMN..#.6..aI /.'...=..A...".t.x.(...{....%...=?S.YpF..D-".hV....s.`..d......3..qbeO.A/.D>..{@..7:.K!....f..(.FvW1...==.wD........K.v.../.7.L....E......S....b..v}..._..b._$..m...B.{....3...../. esAYyP.8...@.d..5O.}j~..>X.w.R.@...4.............Pd..nza.........r.'G......z...3..X.\|(.&.Z..B..u.D.T7 .i..Z{.lb=g@....,.A....LL.p.M..d%......6.}....\O...q......uy..c...$Dc...O....z\|:k......#U....9..?.>.......

C:\Program Files (x86)\SaasAnt Transactions\Images\QBLogo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 292 x 288, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	12141
Entropy (8bit):	7.956002709913871
Encrypted:	false
SSDEEP:	192:tjp/wEY+cxOTyJ/3oJPc62WvHWdavqb+Q586IqcBXu7PugoAj:tjp/jY+TyJ/EqFyQz1IXu7PZok
MD5:	8C9CC418E4C8B0A179944DFA95D6EA89
SHA1:	4BD827C69F770D9D5B3C7FB22D1A6A67400A0B88
SHA-256:	1FA721ED8DA497449DB8CFF1150B8F15288232570DF1D548016E10F6B737C689
SHA-512:	01472411FFCE2954BEF39B3BDFA48F0BD4FF5A23926990A821A2A1E12523C3EFA7E623DB60539B9783EB570F496419A9C98B97C3AC737AB86F75F07E7207E36C
Malicious:	false
Preview:	.PNG........IHDR...$... .............sRGB........ cHRM..z&..............u0...`..:....p..Q<....iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:Compression>1</tiff:Compression>. <tiff:Orientation>1</tiff:Orientation>. <tiff:PhotometricInterpretation>2</tiff:PhotometricInterpretation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..E...,.IDATx..}.\|M...I$...$"!A....K.;....(.V...U..X...Z-.E..]...A"...X"$....o~....r.9s.9.>>...{..\|.\|..y.B.^.z.........V_.i ..... ..s@.h...M#.I.!@d.g.....".F@..B..F..!...D6..&5..-A.....?J.~....O..?I...n..{.O..5.i...^.z..Y..~..!..m![."........-l.T..........;.........K;.f..._k...-j....L\zL\Z.....7..'g]..(UUc..J.8..v..T..._y........... ...P......b......j..O.t.b>.

C:\Program Files (x86)\SaasAnt Transactions\Images\QuickBooks Logo_Horz.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 1100 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42028
Entropy (8bit):	6.381458504537123
Encrypted:	false
SSDEEP:	768:NtsnOhoVMeP0GdhW9bkM2DtdGbhmxEz6RuFMCPr/:NSn0ORMoU0LGt96RuFpT
MD5:	7DD06B14CF008DC8CC3C275777455440
SHA1:	8B8585FF7C43D50C9B98099A3C8435076AFBBC53
SHA-256:	0CF253F6035570D054921661F1306FE92C2635939052C5849DAAA07EDB0EE983
SHA-512:	8ACFA81E1286C6D4B264862EEF030071F971687F8B79DE6616A76B574B2FB4B2DB6196CDF4BC3153105A0602C1D0A7017888F592283B19D56005CEDE69233960
Malicious:	false
Preview:	.PNG........IHDR...L...,.......&G....pHYs.........g..R..;.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Macintosh)</xmp:CreatorTool>. <xmp:CreateDate>2016-02-19T11:28:13-08:00</xmp:CreateDate>. <xmp:ModifyDate>2016-07-20T09:47:56-07:00</xmp:ModifyDate>. <xmp

C:\Program Files (x86)\SaasAnt Transactions\Images\SplashScreenBackgroud.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 3001 x 3384, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	611849
Entropy (8bit):	7.933848107965016
Encrypted:	false
SSDEEP:	12288:YXh6SfMP/FdrL0a4Y/wcpg3I7YrPqZTrHExhfVwFOT9:YASQvYL2wLSYMTTEEOT9
MD5:	447AFE92EF2367498D5338F53278F51E
SHA1:	D820090B868B958736966991A31A048F471AB44C
SHA-256:	E643CFD3D6EAFC2A011273A1AED9C41425A4FD82AF435962B83E19CB79803C6C
SHA-512:	4B6E27EAF9C3AE79A2335B44D056C12CF51AB903D5A0B87FE674FAC48C1CFBEBD11526945D67E13DB9E8DFD150BF2B80C723A1222B696A78947B3CB546CEE700
Malicious:	false
Preview:	.PNG........IHDR.......8...........pHYs............... .IDATx...Ol.g././.E.A]n......N....3....3.]...t..f;......]pW....WJh..,\R`q%N..."..Y.q..{.v..r.ec.'..\....\|$........U......~.!.....Ok.1.d.G~..~.E~...b...,%.}.._...........(..%w.....}.)...]4...Z.~.n.{.r._..M.4.S..8......T..;....T@3..M..t.}l......kt.\.,....Ofz.......[E........S'..e...tq....Z..M.>........^.].............'<UZ...M...:.....I.....+......@.Pr......4......Sk..\|..X..v.*k.i...+......@!......(...7..>i........Q..Y...d..l......T..;....=...zY}l........S.g...~B.S......`.)......u.N`_/.+..U.SEx'........Rr......6....?...C@!.%Yx...........Sr.....m:..ye....H..%x'.......&J.......f.Sy..>.'..l..$KIf..}&..d.gm.......D......$I3.....8...J.O..M..?.v.~.......P.%w....>.v".X.,.O......v.}..?.'...............Lc..>.'..Nd.2n..fi...........[......'^....ewm...NZ?.~&.'./Lfz.......PUJ.....=...p......Si........J.?V,_Z.&.W...{w...........{y...y.G.....{.k{r.~._W...v.~!..w........uJ.........^h_..S.I.\|}k.......2.....Z)n/vT...3

C:\Program Files (x86)\SaasAnt Transactions\Images\favicon.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 1 icon, 76x75, 32 bits/pixel
Category:	dropped
Size (bytes):	23762
Entropy (8bit):	2.5647461231279522
Encrypted:	false
SSDEEP:	48:7cYW2bFQyKH6/hMDOURaSdV49wmzXgCfRJUXbOqGZaHkkwqiL4m69lUX8HK3qIIM:c2ZQyKHdOqaqQfILO5xkw3WK3mCz
MD5:	7F3952744F3463220D36416F713175C3
SHA1:	8FDB88694AA0E0E76FA66C46F29A04E979093683
SHA-256:	BBCC568BBC7720FCD0743AA617282F149E9F901639F8C534808BC39DB6B129FA
SHA-512:	695FA97B6063EFF04399B276A8CF83FBDACB1D0D8ED6A2E156B8E63D1B3035E727B13BBE1C6CBE1F7AA0DBA7E7052CC6E1C1703956A45978503F090573538DC2
Malicious:	false
Preview:	......LK.... ..\......(...L......... ......Y.......................................................................................................................................................................&/..'T..(...(...(...(...'...(Y..(3..$...........................................................................................................................................................................................................................................................3...(M..(...)...)...)...)...)...(...(...)...)...(...(...)...V.."......................................................................................................................................................................................................................................+...(l..)...)......)...(...(...(...(...(...(...(...(...(...)...*...)...)...(x.(...........................................................................................................................

C:\Program Files (x86)\SaasAnt Transactions\Images\favicon.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 76 x 75, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4412
Entropy (8bit):	7.953462093425719
Encrypted:	false
SSDEEP:	96:8g9+gflb3X7CKATktHkAlMp0lZ8+0AwDmRYlLDKd2MNClGfwEyY/9+:8gZtHOKATkNeB15m+l/TMCGa
MD5:	04882E62A343D362BE82B98145EAE556
SHA1:	0B5D6B2091E50091A4BD0FC1F3C3CC9D34571459
SHA-256:	159C1CB448EA2D8549C6E396C4A7C1877FF9807E8BC604754F33317C86BA5148
SHA-512:	2D5045A02A28FBAFB0688D32687CDFB3C2D718255650CF2050D928E0D2506973192C3DCB67D48E5CCEB4B10C07104BACEE8F6C4A4A941B4A479D22B4A1F4EBC6
Malicious:	false
Preview:	.PNG........IHDR...L...K......a.....sRGB.........IDATx..\....y.....$.1 #..N..F..;.+!Q.cHY..D....y.@..8..Db.U.M."..F..J9........%N...l.;.@.N...t.}..Lw...vwvv..q.GN]u.~.............9m..]..v..OI..s..J...\.d.....\|...x%.gJ.K~v2.<.y...v..2....m1e%.%...U.5...z..#.L9.;..k..n..~..\|..L%..D..B..}..`..O.1.......7N..W...4........P.s.u{.8.F.I+1....../z.d....Z_..S..\|G.6c..U$.........W6.)D...m...\.~...U.V...4...w.:.D..L......a....".H....2).o....j..fF#_.....p..[..(.......$g4`....d..Z...H1........`....L.-H.W..M.Y:.,_3...n:3..P+./.'g...:........p..1..........J,p......0.zj.'.g...p..K.W^....:..D...]`........=N].>......c.ry.=....Vr.L...k.M.....LSo...h..b....~...5.$.u...w....-9.rn....:.k...e2aK&..[..,.7v.%.k..\.m9Wq.A...j...#]-o{.N.sR7..1v'...T...X.Y.#.d,.#.M=.VE7....Z......wp.w....SJ".....0...L.m......g......1u..y`..f.k.{.w..........y .I:)....v.3\."....$K._.[.\._...)........G.V..D....V.2...W7./D"....G.4..9..s..+.'...$CT.%..?L.Z{F7s=. .....e'..g.&.c.\|.....

C:\Program Files (x86)\SaasAnt Transactions\Images\index.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.430378597201219
Encrypted:	false
SSDEEP:	6:qkxAGKQXMiIOYWJe5KVJJcUOzIYKZ3yueXMGb:5kyYjUVXlOzIYN8Gb
MD5:	BA9FF954F1E41B392A6B9918ABAB7BC0
SHA1:	8735A6F2CBC5EE528C2FA51AECBE701CA397BA88
SHA-256:	4FDA4B56D4DD2BF137C965D33A31D24EC16941919B06C32489E962CF3BE1ED76
SHA-512:	7A7998F463C7FAF48E0E894B447069FF276BAFC0B572503276437D5F016A408B10BA6C34F0CE237D30C904CB491D282F2A5A5D718514CEDCAA897665E4582220
Malicious:	false
Preview:	<html>.. <head></head>.. <body>.. .. <h1>.. .Excel Transactions for QuickBooks Desktop.. </h1>.. <br/>.. <p>Fast,Reliable & most trusted app for QuickBooks</p>.. </body>.. ..</html>

C:\Program Files (x86)\SaasAnt Transactions\Images\installaware.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2510
Entropy (8bit):	7.7918243528472955
Encrypted:	false
SSDEEP:	48:6S/6x4vOrKQ5N0SI2i6Qg32KvfcmiB225ORA7bjhxZc2xCYrXm1LSxv6hU9:nSDuOKb2i6F2Ec3pOa/jxBxCYr2Bsvd
MD5:	5A920C50F9C88A600A69A98B51CC1487
SHA1:	DA284E3F77C84532F96265C3AAC556F7C600FF59
SHA-256:	AC0E370D8EED1D7EB7F1CF8AB3C9F284E92EC24410ADBBE8163E89BCC037AE90
SHA-512:	56B698D81D388E579A179977E78B9182C5D69A68FF88C748B323178EB6E533F93202621A4F4667D501AE59ECE9962C248F90CED18460D3DF65EEE81EF4DBA6C0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y....IDATX..W[l.W.>.....NR.CD%......[.A....Q.&m.............}.......@..)u..D-..b .%$%....+M......{wgf.....7.m.._..s.....Y..I. 2,r.X....i5h......B.....o...#.F.6S....r..U)...M).F%Bfs.$J....?9.EE.#.f.0h...o./.../).4....$e...*..Pe!......3V/......0...i.=.>...B.C.a.82.....$@.<.>....b@..pX..3.nH.#...w.\|...#%..H....p..'.wg..g/....6#..!_......q.x...H(.6.9.. ....K.f.t.E2..xoD@..R7xM. U..q..!<....1./l..{...q..>.#...d.1..<G....=.\|.........Q..4.f....r...y1.$......8....j9......K.#..L....3B-../.f'.g..q.4.I...y....<.t3:..:<

C:\Program Files (x86)\SaasAnt Transactions\Images\logo.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 1489x556, components 3
Category:	dropped
Size (bytes):	77300
Entropy (8bit):	7.696977797483546
Encrypted:	false
SSDEEP:	1536:6nK/KT4lB8QQCLxID2xgxihfHNIBw0iRWytlwH7ME9wH9xV2:iKblKhC9ID6gxihfH2BtiYAUVGHZ2
MD5:	ED7B767134151892EEDBC7E56BBAFD89
SHA1:	02919D3DEBD2084E90064DD04CD737D55A3ABF8D
SHA-256:	F3B68B60AEBFC858239958288D3B1AAE054C03C7AC77C94FE90C108998CDC5A7
SHA-512:	4FA9A5AAF4C0B46C8E19F5CFE145D94EFF738D9D8979C5134D34A786549FEA1FDED1A4778B292F0FCACEB5AB8D78435AD8B53F95D7C3F4F42C6A231A7345AF54
Malicious:	false
Preview:	......JFIF.....`.`.....:Exif..MM.......Q...........Q..........#Q..........#.......C....................................................................C.......................................................................,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.../...\|3.;....."..V..~{..;F....A.H..><...F.U..I.\|1..;ew.

C:\Program Files (x86)\SaasAnt Transactions\Images\shortcut.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	99678
Entropy (8bit):	5.037372625199376
Encrypted:	false
SSDEEP:	1536:HjUKLWwDBy+4myMzq8SkfpIpCK4nbRJO+/V5rXkgE2VYTJWlZkUh1UtgBx1BtiQx:HA7wD/f+34nb+Ulwc
MD5:	47E5065A805B7C4B8F680BD6D1D226C7
SHA1:	D283B0C2B07478F2932E75440F9817414439603E
SHA-256:	989EBE671B60804D221C299746CC253C5E0A150FA6A0A6CB6DB15FAB8FC917BE
SHA-512:	C5192D01EBE9886C372A205A9A9001AF7C29FC05141056F8C92E2EDDDCA6A67A5FF684A459E1F2ED56DE81C9C71DD574CD773AA2788641A84F0ACB6AB77219CA
Malicious:	false
Preview:	............ .h...V... .... .........00.... ..%..f...@@.... .(B...;........ .(...6}..(....... ..... ...................................W...\...NL..F...F...H...G...D...F...PN..^...X...........[...P...R...I...U.`..................R.v...M...K...X...S...k...O...O...J.J.v.................................3.d...L...Y...W...O...H.T.~...............f...O...T................4.h...O...b...DI-.e...............^..............................W...UO..F.................m......B.........r.............V.....P...V..................m......E.........u..................R.1.e...................A..................................X.7.h..........{...d......u...W...G..........................Y.+.`......<.......h...................\|.......................T...P......Y.../......................d...d............l....O...HGV.{............................./...#...5.........$.d...TLP.q. .Q.............................&...&...,....V....Q.@.w.'.U.*.V.+.X..........................g...

C:\Program Files (x86)\SaasAnt Transactions\Images\success.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 395 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11001
Entropy (8bit):	7.809790157356541
Encrypted:	false
SSDEEP:	192:kSnTOm6+FxUVvuQCZ6JXDeP6ZIgUxCQiQggQ0RuhmbWtRRq:jnimFXQvuQCkJzBbUCyggnRuhmboHq
MD5:	7819D36917A33ACA79CE4D6D10CCF4D2
SHA1:	9AB0809601B7EB1A24DE0CE077176AE3E1989B19
SHA-256:	5BF36319603782F4048D47618DB90CBA3A4350F9922CB9B549326173AE433EBB
SHA-512:	F69CBAC70F45DE262AB64699F5CF76C96EF7EED5E97219FD35C88D804A72E8964A75C99FBF42C64EFED31EEEC642081FC7D194D7F34F9281E4E04D3D629A1077
Malicious:	false
Preview:	.PNG........IHDR.............s.@.....sBIT....\|.d.....pHYs............... .IDATx...y..U....9U...%A.8..Q...#.J.Hw.(&.N.....q...3..Q.^..w.Etd&IwT.I%!...F^2b.t.%......;]..?...,.tW..<O}..........M......................................................................................................................................................................................................................_.x....)a...M-G?..?.9M-.).^....H..c.PIax..i!.....C..C;V.....Z.X .....v..'.X...s.p..g.i..fE.Y...A~....Wy...4.._{.=...Na...-.=rq........kv............!.....S.......'.....9..#...y.J.Y..ny..K...B..3f....@.h...s....~.\...:....+..........;}.NI;..;....\.\|.O...c............tnt.\..s..c.w...7r..I7K...w..[...z....@KU..Or...s.t.\|x../Y.J^.\...nVt7.:.o..E...z....@SU..Ls.N.(......7.F..w..\u..x..}......s]..\p=u...0.{?.zS..i..q0:m...7.b...P,...Q..g...;i..N....._^.w!...W.i...G,0a......V...{.l..........s.oX..{.s.O......4..K.s.t...d..w....x....... ?....ree.;nz...r9U.....b

C:\Program Files (x86)\SaasAnt Transactions\Interop.QBXMLRP2Lib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	5.060583948751635
Encrypted:	false
SSDEEP:	192:+oH17/37VBd/iFtstktk9tktstkBtkVjPcF1hSQCG4x6Itkd8bW/Ou8hkaX0i1+:+ori0Ap2GR38W/Ou8hZu
MD5:	0E02345D512D2F12CC4E952C97738241
SHA1:	7F7A76CFFCB561EE7593F8C9B292FC934C5283A6
SHA-256:	49AC72D20755C8F68B8F98D10C3B4EE2C4DD909A60B1BA3B92E560C21BC7738C
SHA-512:	7B55F7F0EEECDB622D80F254E287BDB35B8A3F5836EF368A98935C76F24156DC294202B3C1695FB73D4BAF03820AC9AA78DCD866798E919D29FEAED42FBF5B75
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R..[...........!.....:..........~X... ...`....@.. ....................................@.................................(X..S....`............................................................................... ............... ..H............text....8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............@..............@..B................`X......H.......P ...7..........................................................BSJB............v4.0.30319......l....!..#~..<"..\|...#Strings.....3......#US..3......#GUID....3......#Blob...........W?........%3....................................................M...M...n.............k.........t.{.................{.......................{.....{.....$...4.$...D.....a.......................!...........-.!.....C.....?.!.....C.....R.!.....U.....e.!.....f.....x.!.....v.......!.%...........!.

C:\Program Files (x86)\SaasAnt Transactions\LiteDB.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	355328
Entropy (8bit):	5.97632681013557
Encrypted:	false
SSDEEP:	6144:mtY8gj5LlWwTjrG6VFNEjqpmzYyfQQG5HdE:t9LlTTjTu2pHyoW
MD5:	25B242D00C6C32E1F437EB2064EA2E29
SHA1:	3712BD78C80A237DD804EC77C64498DEFDE12E94
SHA-256:	E72ACDDF47586BC0999D598E3BD125A254BB6F4AE151C076993304F6E31FBBED
SHA-512:	F1CA54008290F67825F4AA0C8F78476D0E4EBB3B7F50C338F51C87A96B0D25457496FE6062AA57E401C444F5AA80DF8E6B97C2E681E699905F3DC39200D235D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....2..........." ..0..d............... ........... ..............................Q.....@.....................................O...................................,...8............................................ ............... ..H............text....c... ...d.................. ..`.rsrc................f..............@..@.reloc...............j..............@..B.......................H........z...............................................................0..a.........4j(,..........s?...}......{....sF...}......{....sC...}......{....s;...}......{....s9...}.....^.{.....o...+o/...o3...Z..s....%.}....%.}....Z..s....%.}....%.}....R.{....,..{....o@.....(4.....{...."..}......{...."..}......{...."..}......{...."..}......(4.....(......(......(......(.......YE....................+..s.....s6....s#....s(...s1...*....0..)........s......o.....o.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Account.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5696
Entropy (8bit):	3.36440461691417
Encrypted:	false
SSDEEP:	96:uDTmW8W9WgWpWTW3WPWYWn+WfWoWnWFRxyxmW3W8iW3iWxhofS:/REXT9
MD5:	7EBA5CF892154F4C8222C7873DD57995
SHA1:	99E430DD08CD422B9A975C7C52017C3254FC688C
SHA-256:	0EF03F6573B01186EBAF3884F1F2BB3C08CEA16FD22683269BAE4DEFA7F5305F
SHA-512:	AAFC9DE9E748AADEA93A9C1AB156F28845ECF2F16234917DA5C933B51F4B6E12738BA0C55B7C0E5E61F7070758381025F71396035E362D8F2398F94182D195B4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\BankStatement.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4202
Entropy (8bit):	3.362023315280313
Encrypted:	false
SSDEEP:	96:uDT+WXWxWEW0WJWQWpWdch1WYW4HWiWn2WT2VXWxhofb:gchvr
MD5:	F2809696DBE87E6EF86A224E1E0FB224
SHA1:	4404A5547D4EB9CE3D1A2B40781FCAA28C817433
SHA-256:	13B541A6C7A627B15E10E7EC1F1B5619B64893DB6169133D9940CE099D2A3F42
SHA-512:	40348944CFBD0A7F72BE8FE0703023D1A4E29C05BC63D4D93D0A2C1186A5E8B1F84B9D49B965D368330969BFE62748F882FE2E9960E2A29BB80F7AFB7F74AF7E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Bill.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16472
Entropy (8bit):	3.369506101034054
Encrypted:	false
SSDEEP:	96:uDTyWjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WGW526Ts:nkFwOlcJs2ZNEXTw
MD5:	22DD5C191418AE042D685CC551171670
SHA1:	519D05FE41A605BA9D0842E55CE19895D3979850
SHA-256:	E2DC130B0EB63C5DA641143164DFFC6F46646CA3C19150986C659111CECE27F2
SHA-512:	7EDB9106C2E2A186F6DC6CEF9309DE4E356E7E5554B49D312F55A645BADC9911BAC0661096F697CA176B9765BB1DBC78EFDEA9278D486D57796767EF471F214B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.x.p.e.n.s.e. .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\BillPayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXW3WDWxW+WBKgWoW0WbWuDWVWn2WT2VXWnWcG3W/WeoFWDEW8iW3iWxhk:df2Tw
MD5:	9822C955955BB940E0E48E5DF1DCEBA9
SHA1:	C39B2B3CB49F85FA90E22751A28AC98B4578FAB9
SHA-256:	5BA02DF7D3BF6D12899E58D9EBF9C20FF6AF11AF15A5CA5B465D8E157D2AD0CD
SHA-512:	9356CFE1B171E671364E91ECD1C6962760A031E1638D7F836E276E576C551FD55BC791BDFF4F478C2BB5F7F29F5343A7C9A4F7168653C55B9C5F6BDF07FBDB93
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.m.o.u.n.t.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\BillPaymentCheck.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3WeoFWDEW/W8iW3iWxhk:df+Tw
MD5:	119EEA3B83228CF4AF90DB3DA987393D
SHA1:	36E1EE9BFD06B5DB21E8057D6B0A94046805F927
SHA-256:	5BE92994641722A1CAD46DFC600645960E53C3928B2833CA296CDFE865B71118
SHA-512:	367416667D7660D6ADA00DA018FC90DCF6F1035E394B637E75AD26163D9B878902BCA03BBA5FEEC8E2C301A9B3CC60AA10A3F4FDF82593BC418AFFADAC967DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\BillPaymentCreditCard.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3W/WeoFWDEW8iW3iWxhk:dfuTw
MD5:	CCF424242AE506049732FBF1BFFDBC8E
SHA1:	82B5FD23AB9978D8FC24E887C69E126A8597F80E
SHA-256:	40D96F01472756C1C1D6429F629F097C0DE1BEB94AB80CAF1E8F4A4F787327CB
SHA-512:	23A2769384B4A921D921345BF1B02AC7FCDEC923AEBC4C57496C8F0D8674CA3788334DA726CB94D786295C9EE139D0A8D4743C13B39DE2C462858E02F78733CC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\BuildAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Charge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	3.341511882057727
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWxWoWDWWj6yWpWDW0WjW526TMWCwWPWdW5W8iW3iWxhofb:jVQD6y2lfTw
MD5:	4DE6FBB0E4913F56506A55D2F197CD89
SHA1:	0EEC53EDF169E613317FE7FDA43A9D48043D620E
SHA-256:	8DA6DAFE0EE49B9B773956B0A108C3C40BA81A4074470D9936887381D19A0F26
SHA-512:	C76CFD7CFB9E65C902DDD55B4EB6124974B79451AF86A0EB52AB47A2563CDA4413B25716242FE79AC9868DAC86174376C0863FB7712568C8E065350B932DA3CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.e.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.e.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Check.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13386
Entropy (8bit):	3.3689913335499573
Encrypted:	false
SSDEEP:	96:uDToDvW+WXWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWy:xDRkFwOlcJP2ZAE0Tw
MD5:	1C0664D5AA1BB10BC49A85A10CFACB16
SHA1:	A2A461CD1E9317E5A640ADB2DB6CD03EA8EC24A4
SHA-256:	BD547314AE670B52125F0ABA4B051DD2086C49D8B9B8F8DE51AE35FA8D861337
SHA-512:	3407CB83AB03B5D3AFEFDAAEC44C15C131DC42E45BCEC8D24AD6509A733797F6DA189D026D74553A3511873795C3EFD68DFCE7076DF125372AE90A772AECAC44
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Class.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	3.3737628801824364
Encrypted:	false
SSDEEP:	48:y+6DTfRU2VsPUW8FPUW3FPUWhnRnFRUfb:uDTG23W8iW3iWxhofb
MD5:	8394D50FB8C4B1B44E4BFC1E85D8E90E
SHA1:	6FF949F58308BB699CD5AB6C8843F968DB9A135E
SHA-256:	3780ABC3C231B58C09AE37893FEA3AFE44AEE41F07EB503BE4BF9BE90E2204A5
SHA-512:	2C4265418371BC6D88263DB8727982545CEC9214835D8BED5C30EB7D54B51064FFE5674D51D770782899DCAA9AA8A27B6929BA09A902DBDD9837F28C7D43B417
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\CreditCardCharge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13734
Entropy (8bit):	3.3746926532041783
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWH:UkFwOlcJP2ZkEJTw
MD5:	85A3C4FF059214D7032EB18B90D67FC6
SHA1:	BBB3D13CA4CAE06E636C72E07E8C27A08322D1F1
SHA-256:	B06ABF8C753CE58FF4167D569379B0BDBC92F9AA7172F8A1E2234FF1B7D3BEC6
SHA-512:	B96B47E6033823A0D6E7082E2F2E160BD962DF2C838A31DEADE1C070CFA2E52F8BAC19221B8CFB9E32B08A6F56956A23CD0A14BF4AE8B8CA7E8DC926B5EBA682
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\CreditCardCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11192
Entropy (8bit):	3.376232314447034
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWQ:UkFwOlcJP2ZaTw
MD5:	8799B566ECB2D1BA2FF14D17AA84C271
SHA1:	1170D91A3BEDCBE0B852DFEECED775039F1E77BA
SHA-256:	8327782D98DEB9EC910666CB54E1FDC31F9FA0CC34ADCF731A8D4AC48F3BB9C4
SHA-512:	9DA64E810B494E8B3DA65374136555CC09AB5A8D9BEC90DACDB9E9FC156A26F4DC600C10C20F0F33D2EE803FEDB790C9D45643DDC92E728729ACF5FC664DFE90
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\CreditCardStatement.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	4.696241236318063
Encrypted:	false
SSDEEP:	48:3YV1LJ1mc+J1+c7ZJ1ucuJ1QcwJ1Dcu8J13cRJ1uc0kEfJ1Q3cMuYJ1bchXJ10cN:O19/2v7bGx8yuYGv/mbuuvhhVn5SQIEX
MD5:	B5F0345E4EC6B43B8E374DDCE3DFAEBE
SHA1:	C35A35015F4A9012B076F90F0F20A1ABD2F11726
SHA-256:	955FF27F62B8845D34D0D1EF414BC4371870466CEA6B92D38E20583932313EC5
SHA-512:	F5036B28BB39C68A9377BB6BD0DA99E1799EFCC329FEE433BC92FB0720741FE935E0FC3E205EDFF4C385588C5F2D83BC42C1704FF9CEFA60DE96FF4EBB206046
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Statement No</FileHeader>.. <Display>Statement No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>CardAccount</Key>.. <FileHeader>Credit Card Account</FileHeader>.. <Display>Credit Card Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Payee</Key>.. <FileHeader>Payee</FileHeader>.. <Display>Payee</Display>.. </MappingLine>.. <MappingLine>.. <Key>Account</Key>.. <FileHeader>Account</FileHeader>.. <Display>Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Memo</Key>.. <FileHeader>Statement Memo</FileHeader>.. <Display>Statement Memo</Display>.. </MappingLine>.. <MappingLine>.. <Key>ExpAmount</Key>.. <FileHeader>Amount</FileHeader>.. <Display>Amount</Display>.. </MappingLine>..

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\CreditMemo.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23580
Entropy (8bit):	3.3710777732304122
Encrypted:	false
SSDEEP:	96:uDTQQqW2VQXWxWoWBWDWWjRWjW8WhWyObW0WjW526TMW3dUWZVgIW3GWlWcWfWiQ:jVQSu2Z8d/Q/9kQfqoQvZsATw
MD5:	C25945E64B97E72C57BCC9F7379C9EF9
SHA1:	F35B6EB3E6FD0F297232D98727478989941486A6
SHA-256:	0076BABE7A06C173B633073A7B2F653C67213D5A484FAB6CFF818B51EE304979
SHA-512:	C0018D7E32DC4AF7CCCEFA6060FEB147066EC4594D3E962425A99D10A35A67B59BEAFC14C8651BCD3A428111220ACFBAC891CCD5552DE7C424AEEC59ABAB10FA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Customer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18668
Entropy (8bit):	3.352815492415269
Encrypted:	false
SSDEEP:	96:uDTn/uW3WlW/qnWpTWgW9WlWcWfWimWZRoW9GWVWQP5WhawWGFzWLEP5WVDyDoWh:2/lqX0tgrpXmT2NfbDo8tTw
MD5:	75D963B4C35917C19F3A3D8AE3B95FD9
SHA1:	F900D7C232551EF384DA4F294AEA1D0C800F2139
SHA-256:	0D542F1557DFF61EC1EB5886EF3BBE3DF3F7C0F2AB75A9A319A8C013434C5893
SHA-512:	7F07D3204EFF25B8FC0E76DCF260A93BF13FDF3CE81FCD84B2644E0B17F06C938C5D4A84AB6C16607C1CFB8537C04A3F0C6D4F292CE6AF67331C6C3A7F2E4776
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Deposit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	3.3749994451487755
Encrypted:	false
SSDEEP:	96:uDTXNUW4e7WsclWyW8WOWdcDvWoWO8FWG2TW+gHkW+HArW+RC9WVWDWn2WT2VXWa:ucDITw
MD5:	D60B6517E5C856A330029224348ADB67
SHA1:	1112AD001BA5FBC2A23CA993ACE8F2AF4F85C60B
SHA-256:	319C59A778AE176BD9B2C5232F2703DB05F90604D0AA3398F8AB76B8E5117259
SHA-512:	DF59081A0C17AF14F2B4E01CBEE5E606A744A5F81619F1BA5AFE1D12EFF3C1A4E10BE239CF06596A31D6EF84A15AFA4EA249D94CF2F9DBC108FC43AF46488B25
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Employee.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13236
Entropy (8bit):	3.335089551147612
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgGMrWfWDWpWrW9W4AaWJW2WkWOEtWZZW5mWSWPWD2WjooWkUWt:jqsgAB7/LebT2iTw
MD5:	A8F8FD205854B92DF247460D1B68AE61
SHA1:	DF84C1592E4C80910E6D7F79ED70E6DE37343737
SHA-256:	97ECFF8FDB71FA0766E53CB1C600745A4D6FDF1FFE6E19D097BAB425B98BE14C
SHA-512:	1AED2CE7FF57A93429E0EEAAD54A40130B868A07A06FF4FE9B17058A6FE63AED7C45E880520C2086DC7FD88B901E3C86EB3C11F642432E26F7AE984D0805ED81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Estimate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19246
Entropy (8bit):	3.365048018472737
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQX2D+iWoWBWDWWjRWj2hGfW0WjW526TMO3GWlWcWfWimWVWZRoW9GW3:/LXVQM+AY2WMd/Q/ckQLZsATo
MD5:	A982E98D2D012B5DF3855011A16CAFE1
SHA1:	211D4093AC6185B43B2B33409CADC5A0F9999DAF
SHA-256:	85075E28695BC26C00140E277478CAAAA0F7A210B8846FF57C75849DD9871347
SHA-512:	102BA71331AF0ECC14AEB046F9670994F9F945BBC66CC94856C50080BF0B5CAF00BEC3E46F5420EC92E9E47E2CF65549C22FB58B3937919B05D1343B5FFDB61F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\InventoryAdjustment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6062
Entropy (8bit):	3.3963922355007456
Encrypted:	false
SSDEEP:	96:uDTaW2V4vWBWEWIWHEj5WdpIWDW7W3XKWvlnWvInWZVW+W0WjWVW5WmWRdeeWxhk:zV4mjT
MD5:	628902A4F6736D6D5F4B9982F5ADC705
SHA1:	25914A4FB3E0EDDA415A218C7EA6DAC5E92A58B5
SHA-256:	D7AF0A4FC2D52FA29CDF6C9C19FB230ECF3D1AA904A11A175DD90ECC0FACE374
SHA-512:	364712CC3DA576AC90E543989D9FB4B5077B2E6454DAA2ED7D971D7863BA779F74FA0AF48E5C69DF1E224663B171F843E3C145CE96BC908523646B952DAFEF81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r./.J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r./.J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\InventorySite.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8130
Entropy (8bit):	3.328234644697249
Encrypted:	false
SSDEEP:	96:uDTm2mWpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrLqW36WUCW3:5ZwvGcUDTjQpm/FTw
MD5:	0B0DC1FEB1B046A4A54166A0A1DBAA06
SHA1:	25BDA861ECE1DB4ED0B89B0665488BE12A895239
SHA-256:	D2006AC23D0AA1C25C30635019BF59B27077F1612D8E2C795425A1C38870823A
SHA-512:	5A210839D2635668F9F41C85CC1CF45D48F35783461AD42E50F3678811482305AED9CC052B89C3EBE2D154B2A7D6D93F349AD43B0F976784C983B8B8B8E607B1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.S.i.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.n.t.a.c.t.<./.K.e.y.>.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Invoice.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11461
Entropy (8bit):	4.727888657534949
Encrypted:	false
SSDEEP:	192:OmXblKXYCEHoH4VdpedUjulYYANFbHZGBJ1gN7J/NTx+JohknTZWDq8D8r4D8l+4:OmXblKXYCEHoH4VdpedUjulYYANFbHZg
MD5:	7DFAE276E0DA2EE55A36D8B9682B719D
SHA1:	C63A931DCAFDEF0C95A23B897771A9DAE8D2B1AB
SHA-256:	F97501D9CAC0BAE698CF98D089979EB20C52F4F4F32B8AF192D61576C54C5798
SHA-512:	BB5D1A95BF64004AAF0B7AA60C7710C16ABF5BCE669505B6773E8E76D50E017AE2583E97803D0A3211A672422B753B92866FC6081DF1FD93E5E4423408D54DC2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Invoice No</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>Product/Service</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>Product/Service Quantity</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeade

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Item.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7666
Entropy (8bit):	3.379894943545433
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWSWyHWcWYWoWCKWb82tWkWUW5W7WoWwMW0W1WtWxWxWxhofb:SQn
MD5:	8F2342D90B7556819FDB288CBE37D7AB
SHA1:	323CD5E41E27972764825D476D3ED22AE43142C8
SHA-256:	D6169A7729C2C14D7E2B0717C3B4E03B40871D468035DABD2E857BC447D89F09
SHA-512:	CAB6BD2621285177435DA693DED203069F3B644A5B88B5F25FF5BFAB50614736A4A4DC7A1130BF1568038772D58F0AAEFF23E37BF858D20DD7324437AE5B0D3A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemDiscount.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	3.369253287042973
Encrypted:	false
SSDEEP:	48:y+6DTnRUWYCORUW/RUW0RUWRRUWbpRUWGRUWsRUWhnRnFRUfb:uDT+WLWmWTWEWbsW5W7Wxhofb
MD5:	25CD8C4E6AF24CAA5FF6EE1B6F903C18
SHA1:	A639747DF534EA47858E4A8D4F36814DA597F533
SHA-256:	20109C74800E1A6DEDBB9D81A8F07D42A5FE12BD399870BD87C5979500188568
SHA-512:	BD4B0D2C92A3829B46021C3FF9D4CEC093D2F0436CF2C585F517C849F8541D5D7A83627A9C3D3328DE5E0AA7F6716C48F0DD5267EB91A95B9506E8810A1082A8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.i.s.c.o.u.n.t.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemFixedAsset.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8138
Entropy (8bit):	3.3590441395434176
Encrypted:	false
SSDEEP:	96:uDTmWOW5WUW5WyWWeWnWxWCLWDWQWPWRvWZaWbWX3KWeW6W6WgxMHxqW1lQQW3W/:92xMHxcbTw
MD5:	22858F010F6BBDEE70F95C304A46F36B
SHA1:	86F75CCF6C690E7FAB0C1CD08361C7D9D220E968
SHA-256:	CA8F453C6429247748AC2CB686A2798EEC84C62ED65E3F37B45F1D9BF7A778DF
SHA-512:	78C14BAA218D0BD2F9AB147E12A3D1661D7061BE18A5E4E825A2D22FD473D71275532561906EC161AE4F6EDE87DFD2F25853B17479707D1AC1AA2664C47CC2F7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.l.a.s.s.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.s.s.e.t.A.c.c.o.u.n.t.<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemGroup.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	3.362693101616319
Encrypted:	false
SSDEEP:	96:uDT2GOWpWeW4WdWDmWk/5WW3W8iW3iWxhofb:X/5xTw
MD5:	124F9AE4C966E010D53679722FFC508A
SHA1:	38C814162C4D3B7E2E6E21A48F52C1DB13B29368
SHA-256:	0D222B200446C0646679201A4CE6B458CEAC61E7365192530780254F98900FB8
SHA-512:	19068388DB1E412B5680AE2A976DEE3FFD54338FAA1A2F11EDA22540CE5A130EE96BA9BDB93624325DB8B010921357D032118519F5E036DEFB557CCE849AF1F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemInventoryAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8870
Entropy (8bit):	3.376494853568335
Encrypted:	false
SSDEEP:	96:uDTmWzW5QZW/W6WyHWcWCaWQWbsWtWUWNWwkW8WFN1IWGQFW+WDuWYW5WrBcuW1q:rQITw
MD5:	95FB5D545CD13670722D8386EA8E7BAA
SHA1:	CCBD082AB859220AB9DABACAD59E8BBF6E45478C
SHA-256:	927BC1A9BF87E7CC2D6126DDFFB7886F0234E218CEF10A431DE69DE0F3DE919B
SHA-512:	379A7C4FFE9AB0B8F65D1922740F7A145D0D14FEE56DEC612B2CD5AEE7D2856C0F2BF5D13CC3BE104D3831414729528FD1DF0125C1CE3EC2069E88D6141D1D7B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.u.r.c.h.a.s.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemNonInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemOtherCharge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	3.3808418806351264
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWyHWcWYWoWCKWbsWtWkWUW5W7WoWwMW0WxWxhofb:SQ4
MD5:	6E56495D5843EBF317452EDA48016548
SHA1:	551CD5D29B84C07CA8B5F78897EA6EC73BFC2FC8
SHA-256:	1835A35348765C761CD41B6B31A8C474EAA722CE3230065903C53C12162247C3
SHA-512:	7F51BECC13CBA14C6B6B2529D3BF538AF0DB90B3B967275F8E6D2D68B0EBFCEC1D08B12B3FB0915A9728EC528B0844C92E44D5D7E9AEA9B6FC3700E0C0492E66
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemPayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3194
Entropy (8bit):	3.363338038961555
Encrypted:	false
SSDEEP:	48:y+6DTnRUWXRUWYCORUWnFRUWscCRUWGRUWVsPUW8FPUW3FPUWhnRnFRUfb:uDT+WOWLWoWsclW5W3W8iW3iWxhofb
MD5:	A6DB6D2135E5EB9517615A4358820761
SHA1:	440BA9F51FA39CD6E402B74E17538AF699956586
SHA-256:	624D43B83672248F4B5137A6CB6671EFDCA38D5A3662D4FB4601CAB8F934355E
SHA-512:	D35FDC067F222BDC6A6E42F6E235373AFF0859199117B77DB7C681D6591DE57C333E1958934D18469F9BD84E767E72CDC95076B82E2C20BE7CF7C1D6870D24ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12122
Entropy (8bit):	3.3777404813750835
Encrypted:	false
SSDEEP:	96:uDTaWjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjW526TH:/kFwOlcJP2Z/Tw
MD5:	AD3343901A04AFAECDFF9116ED7E9E63
SHA1:	22BB309FD9019E36BD907048864A70EC4B3A4ED0
SHA-256:	F88A8A322970A8845900DE777CDA86632FEF892FC396EA7FBC46C9F7CDE7E649
SHA-512:	0AEA7E4D98940950E6C9E7118F1EBB13FADAEAAD3BCB89107A3D66E6748DBFAFF7C601D07CA397028A4716F47DBCA0630C187A572DCC0A99BA1A909A39FE665D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemSalesTax.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	3.3852199742396483
Encrypted:	false
SSDEEP:	48:y+6DTPRUWYCORUWXRUWZ02RUWhnRnFRUfb:uDTWWLWOWcWxhofb
MD5:	811428AC1C5C9D7F349A44FF0ADB98C1
SHA1:	E812DA7171B9BC5551FF11FEB994E15B6A0D5E91
SHA-256:	4FB868BD432D7966E1299570522A2BBE922633790C93606F1A5E7AEAD78FD4BF
SHA-512:	8AAF9052A27F596451C7F89A90C4C2A0E4CF002CB07091DFEE74AEF49AE7A50150EFCC9303FAFE8FE5734EAC37E491B0E7A566C31AC47B6264BFE8CCC3641786
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.a.x. .R.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.a.x. .R.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.V.e.n.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemSalesTaxGroup.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.401575726316516
Encrypted:	false
SSDEEP:	24:QlL+6DTTyEyDARUWXtdtQy2tMRUWMHoyiURUWkAnjyzAnFRUfb:y+6DTGZARUWXPCORUWMBRUWhnRnFRUfb
MD5:	48DC90036A616570B925520A1193A8DC
SHA1:	68387C07D8A2A19E6EF3AE7C90C8A13F811DC58B
SHA-256:	60314415E46AF3A6249F949619D1A4D65270FDDCC0626DA6206DDE168D91B1B2
SHA-512:	D1241237F9E427709FD644EF1AEE2E0D366E8646B17DC30A6FAB44A2FA61F66BE0024D293DDA7912B90EB04220936AC0C5F736C6AD702B49FF7387EFADF9A62A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.S.a.l.e.s.T.a.x.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemService.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ItemSites.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3912
Entropy (8bit):	3.3753876657679873
Encrypted:	false
SSDEEP:	96:uDTGWhmWXmWrWrDWW0W9WUW8iW3iWxhofS:vD7T9
MD5:	C1CE6ECDBAF9310623531CC12B58EDD2
SHA1:	900177D32024BB15598C1F87B39A6EFB118DB140
SHA-256:	88B57C327CFAC295C0C7CDBE31C814EB36BB1170A5DA1CC83A22D5262C1E0107
SHA-512:	D0B8F63D8FC6A1B876676E88783490F8DD88BEF7367FFC585CE48064073AA502ACE2D1C9FA4F36E835A23A0982AA9C5A9456629612CC44A3F302453BF943C2C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.A.s.s.e.m.b.l.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.D.i.s.p.l.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\JournalEntry.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5682
Entropy (8bit):	3.3641718817926574
Encrypted:	false
SSDEEP:	96:uDTgBgfg1WbWW1Bx7W4WAWzWWEWDWxWoW4WnWVW5Wn2WT2VXW8iW3iWxhofb:ZKWTw
MD5:	2BD5A49FAA022BC84D5235AEFF84ACA4
SHA1:	D99A02652572731F7AD54F9C5AAD6B427C5D751F
SHA-256:	DE32A8233EF7F37F50A5D87E8F583A4A44BE99CB017CEDCDE1B1D4C6F3CADA1A
SHA-512:	E7C9589DBDED56781ED3EFB27143B6B7F006752DA08F09F13808BF8C781E26F1E1C54F741E959AAA6CD4EB21FE637FDBC52687B87564568BB7B6E5EB4999141C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\OtherName.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	3.337946781523756
Encrypted:	false
SSDEEP:	96:uDTmW9W3WlW/qnWpTWgWUW9W52WxooWeOWcWaZrEWrWVbobvbbWQW1kSEWrW3W8E:JqRTw
MD5:	187288B192B130A10398FBC41051BA8B
SHA1:	7DEB39AD9AD23B32D2FE8658222D1343F9835227
SHA-256:	703DC4C12585B0C955E72F044F07CDE6243F6762C56E9C34BB555C6E700F8EF4
SHA-512:	1F31FEB3E4ED30C74EDF0D169ED8FA2A9D85AE0C27D5490A2DC926F864A99CD45CC0DAF10A02302DFCB25E7746195E4D935E38FCC950A645373706032712972E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Payment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	3.385598702293327
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWdcDvWoW/z8QWDWsclWdW0WbWuDWxhofb:DVQTcDCz8k
MD5:	3043D744FB3967BEFE237A672CFB2471
SHA1:	68BCB0189BA41DF8164EBF390C30265A8B6001A8
SHA-256:	CCAB1ADDC394CDBD187B236DEC59E8D4F3832A3C22FE3E24FD24DAF0F4EA0488
SHA-512:	3594AAE617198B350780295F41C5AB1D63EABF6D97EF130454D6DC5840458E81CE40192BA382EBCCA28A3A3DF70725692C14E1CD26D5CCA06E6E2E3FE88963E6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.h.e.c.k.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\PriceLevel.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4188
Entropy (8bit):	3.3716445400273334
Encrypted:	false
SSDEEP:	96:uDTnGXWn2WxyW4WRWiWikWTvsW3W8iW3iWxhofb:cG2bvXTw
MD5:	E614B301835CD2B26E6C71941FA38064
SHA1:	770636C8C0809AF429E4D91AB26D4771886922FC
SHA-256:	6F0A6C45B22CCAD3FB086FE2F20AA36C743C8A1DE84D441196D575655C2AC4B3
SHA-512:	D72A717563335F24C8AD3F5DFD359F352E8FC535293C3E89AF7220F43F1DEC40AAB04CBEA6F14565E778997EF6156C636BE8381DBA2FB87CDA447F1B28D29F62
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\PurchaseOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18326
Entropy (8bit):	3.362876895276993
Encrypted:	false
SSDEEP:	96:uDTyWjWxWoWhWDWWjBWNW6WsWgXVQXW/WRW0WjW526TMW3GWwW5W2WVmWwWMRoWK:7WVQl2OlNmZsHTw
MD5:	EE58050BDEAD0A0A40BF05786C1A3165
SHA1:	5961C959ED8E0E1C4CA65A84A27BDB96A8D7B8BD
SHA-256:	E4323B9241194F182515FF085AAFAB873F71EF9450E664B0FD23D4C42FD75A3D
SHA-512:	B02D9C0831AED76FD7C8BDDE2E26F4B3D89ED7997F5AE33D9729461FFB2610791CB3EA3A5EC4CBF860F32C10ECE3164EAB9EF8A94B14E2519DD4D749316AD959
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\ReceivePayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11204
Entropy (8bit):	3.387327919099585
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWoWdcDvW/z8QWxBKUW8WDWsclWDMuWBgvXWzWFW0L9WWWTW1WPio3:DVQhcD4z8bNqoQOrGoo3Tw
MD5:	A1696CBFE2413516C0624AA64CD46F90
SHA1:	AE6C8D6AE1E718106648D6AA80007EBF4A01AA24
SHA-256:	FA0AD6866FE892A9DF3027FE52EF7AACA27BC503794CD0E14DD09E8874876FBC
SHA-512:	1478A19296B2AEE18A179C9B1D9D3939BD38A164905F4B1F2DBB75450AEC7AD3930C080ACF3023C1552C2129852434C65DE6EFC599E97F1ACD8D4D564F733A8B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.m.e.n.t.M.e.t.h.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\SalesOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17966
Entropy (8bit):	3.3596296223763984
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWBWPWoWBWDWWjRWjWhWyObW0WjW526TMW3GWlWcWfWimWVWZRoW9GWZ:DVQ1Q2OVd/Q/akQSZsATw
MD5:	8DDAFEB175CD46E5266A3C7D6961A8FD
SHA1:	47D52E3E7BF2153F85D113F6B5AA1C657BEB5A73
SHA-256:	9A358650848A454410DEDFC96A5CD00C6FEC48014F84B8EB6BDD467182012A18
SHA-512:	3EE06E10AE3AB30058A16CC7964A3E516DA25B9767EF5866088F0201938AD0F1CD4C91BE26F2E4032AE2C695B66113FD5F4EE0FCB09B49AA15677367BC07B0ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\SalesReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23970
Entropy (8bit):	3.371707688246353
Encrypted:	false
SSDEEP:	96:uDTqW2VQX2hWoWoWBWDWWjRWjG8WhWfO0WjW526TMW3GWlWcWfWimWVWZRoW9GWx:DVQAe2OGd/Q/1kQ9qoQecDlZsuTw
MD5:	80CE7AA22B92382E8A92DC5497582AB1
SHA1:	9ED81F08DB5D171A4D2C8059ECB4B5796A7694B6
SHA-256:	0370942C2663D59356BAD9306A13BEB8B9E06A57070ED02754F41D0B8EAD0CF2
SHA-512:	096939544811108FCBA59E3D4BAE23CC8EA0F39B3DE17746BBA030AE550ADAFBD736B9AAD6E409C90FCCA76344043F1BC0B82FB9F53AA26FAAD0C3B8F6EA9686
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\SalesRep.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	3.3569081983689473
Encrypted:	false
SSDEEP:	48:y+6DTSS/RUWdGJGSRUWVsPUW8FPUW3FPU2hnRnFRUfS:uDTSSmWd0YW3W8iW3i2xhofS
MD5:	439F52DDFAEBE0B265BD919956ECEED5
SHA1:	8F994D34A6011651B014F0083FE4B1CCA6F1E3D4
SHA-256:	B47081FAE2FEE41F38FFF8DAF5F4DE58396132B445F113E9A488784E1F852D8A
SHA-512:	315D4FDA7304EF0A542C4F2C9939D1ACBB164D01C8987441FAA9013F8DF8252A7DE15819CCD1F89D15597566119736A6F2832AC60D16B7F7093E7E524515A5F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.p. .N.a.m.e. .<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.p. .N.a.m.e. .<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.n.i.t.i.a.l.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.p. .I.n.i.t.i.a.l.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.p. .I.n.i.t.i.a.l.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\TimeTracking.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3924
Entropy (8bit):	3.346158044789658
Encrypted:	false
SSDEEP:	96:uDTbWW2VVAWxW4WxW3WTWaW5W5W8iW3iWxhofb:zVV8Tw
MD5:	D6368DF55D96E8A243DE77C4DE5716FF
SHA1:	258C995AB1B1D637AC8A9738DC92710A12B463EF
SHA-256:	71B468801F6D0401C1D57F415E0E8CA05B5B25D535EEEF2DCE17D756F79CA76F
SHA-512:	E5B5899CE5F24559E25717675C822AC629255A3B88C13B49350F794150EEF26FA436C0F442C0C8AF301AAC90C3366446A955BA90CB6A94D8580E6B3FB59CFDC5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.a.b.l.e.S.t.a.t.u.s.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Transfer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	3.367053488969973
Encrypted:	false
SSDEEP:	48:y+6DTuRUWURUWZRUWVbqRUWSRUWGRUW8FPUW3FPUWhnRnFRUfb:uDTxWzW8WVbdWVW5W8iW3iWxhofb
MD5:	90DDFCD975DABF2BFC155FE574B62409
SHA1:	CC3B584BB4DAA913E22BE5961567E4AFD7274540
SHA-256:	5D3D38448434064F774E032558DEC06585DD61F826A1689AC73767C14D2E1512
SHA-512:	6909865128DFE719AD8106210AB55A1684E0FEA30636B1C93A067AA1300C538457B24B3F30C152C3B8B2FDA7F7C2FBF65E5F9300CD9D09EDC5EE2D7C1DB97D23
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\TransferInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4582
Entropy (8bit):	3.3680537578680694
Encrypted:	false
SSDEEP:	96:uDTaWhWQWmWtWdWGWKWZVW+W3XKWVW8iW3iWxhofb:8Tw
MD5:	E60071D0621D5A15FAD97C168E735A0A
SHA1:	26E62142851B7E8F2ACE2530F48A3997FF5D092D
SHA-256:	012A14B3230223FB17DA860E13E1CB932B2DB2D4B25C06DD463482BE4D49C9AF
SHA-512:	51296D9A2CADF0419C2C3C7C851AE23A4ABC0F74A365F3DE8D205C29A4A86C9975DFEAEE6E96EE903E14887BEBD0E2D79CCA245FFDDD6D8C418F35C587313EB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\TrialBalance.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2896
Entropy (8bit):	3.368697128468666
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRUGEyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWoGEyFWKWHWUWb1KxfS
MD5:	EFC5F768E3D06E52B694549ABCFD8B87
SHA1:	4622C4188EA88C0188FBB5EB16EC70A1C7359047
SHA-256:	9A4EF4F77EEA239DEC61155ACCD233D778A82A9DA99A07412160A0ED47FDEA70
SHA-512:	F1253652D4F19BBEAF86DD17150D5CAA6103EB75B13D7EBE5A0FEA5DD7DBC961312A86790062E08167965889FEADF715270F3CA216276F5E7AB31F8496DE4F9F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Vehicle.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2026
Entropy (8bit):	3.3590278843434818
Encrypted:	false
SSDEEP:	48:y+6DT/RUWyPCORUWVsPUW8FPUW3FPUGhnRnFRUfS:uDTmWpW3W8iW3iGxhofS
MD5:	69DA4404C8BD10DD3054119F5166C3EB
SHA1:	697AAD467353B3114F0C2B45CC869A3D914480C3
SHA-256:	DBE9632DBFE9E07BD0E63E3AD7C7938F18923CB186A4A3BDD8CB6BB7C37F2D06
SHA-512:	010F33D334C406939BDE99F5C447C705F5D24CFD2721D1CDE00550151494DFA6221C150F2377155EE8F2C9C891DA4845EC517ECA92BB240E154B451C27EC3FC0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\VehicleMileage.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4850
Entropy (8bit):	3.353849500727898
Encrypted:	false
SSDEEP:	96:uDTvWJgHHWwYjWBE7zWPWY4F4KW2VNoWIW4W5WaWyWoW8iW3iWxhofb:iYZVNHTw
MD5:	ADBB383E2E3B4626700B09388095DEF4
SHA1:	9FCA832E044CF69F39C15041D8D40D3731911A6F
SHA-256:	248DBA3F7B8AA576F43CBC8A6A709A034701BCDC121641043F9C517AA1FCFC23
SHA-512:	24E551E17871925A02AEC60DE918A8D860D4E7C9E5F7A61CDC9BAAA93962F5E6CDB14748043E216E267C17023070EADF830A5354B8D55562FFA1AE18D186BE7A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.h.i.c.l.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.S.t.a.r.t.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.E.n.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\Vendor.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14326
Entropy (8bit):	3.3493576325255554
Encrypted:	false
SSDEEP:	96:uDTGW3WlW/qnWpTWgW7IPaW9WwW5W2WVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDy4:8qjIPHgT2XrDTw
MD5:	6503E48C78ADFDFBEAECFCE42896D342
SHA1:	B2C96DE6B4BE2BA845A03D2E7712D0D7A6259491
SHA-256:	14ED4835BE5430D2D5F5B806577214CE9FE677F680BC2223E8EAB413BCA81884
SHA-512:	9ECE35593585AF549A1CBBDA408379AF8E8335391179F74F90D459C0C4B910D72372B26E53C6990B94B46D2C7CAB258D4F5BABEE0C5C2D8D72B86F7A3CA3B7F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\CA\VendorCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11802
Entropy (8bit):	3.375867252592748
Encrypted:	false
SSDEEP:	96:uDTQL9WjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjW52a:vkFwOlcJP2ZzTw
MD5:	24397BEEB0A9FA8655FA8B6F69328185
SHA1:	A50F8AE8F03C721B6F6AF13D3DD9806C3ACF7E26
SHA-256:	282683445B62ABD7A42AE3E475DC6498D581BB41E8EFFC58B166E956152F8EFD
SHA-512:	57F23150002340BBDBAEF4151633AFD5BD9FBBE5403E59ED100EC1209BE7B4C2BEE2EA39A06C088A00265A681875319D8FEF4538CAD2A6BCF7BC889EC621B467
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Account.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.385828093280008
Encrypted:	false
SSDEEP:	96:uDTGWyW+WsWMWTW3WPWnlWfWoWnWFRxyxmW3W8iWxhofS:0REX9
MD5:	1683427F2A9E604FC547E2AF1FCC887D
SHA1:	329087DD3E93D911E01F4016BA8CA4B353F01472
SHA-256:	B2EC6DA369E892D257A698E8122976FB18E16A539FC0A40B95B4921C65B3B117
SHA-512:	E7E8B451D83AA6E6D1995E60B8700393179635C4FF81D4319D80508018E4CC905819F91D70B94E583EC04D96D81E7B6F60E24CA046E166270CCF02B8388F9E68
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.T.T.Y.P.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.N.u.m.b.e.r.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Bill.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15344
Entropy (8bit):	3.387950593600828
Encrypted:	false
SSDEEP:	96:uDTsGWJnW7KWJWkW4oWjUXWPWyWYW1WoWDtWjRWBWBWgXcJXWSWkWDWRW0WGW52h:2BULJcJw2ZNEjw
MD5:	095636ACB47CC26ACD619DD62811FB6F
SHA1:	40900F2D4594B5D9FE191A746328B4CD56786291
SHA-256:	E9BFA8A45BE8F09A966EC9FE1BE504017F7517978339D59111214982BE6D653E
SHA-512:	A2D7DA83B518230E9008F646643EC7E83B1A6ECA1C87EB27FD938FE6B8461CFD03DB5E0D64FBFA9A8F49D2494B8AA7471EEE584C4C3C46DD8E7CB666EF052FD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Check.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12946
Entropy (8bit):	3.394060848942431
Encrypted:	false
SSDEEP:	96:uDTs9vWAWW1zW7KWJWzW43WjUXWPWxWYW1WOrWDtWjAWNWBWgXcJXWSWkWvWRW0A:VJkUGucJP2ZiEYw
MD5:	6B27345C734DF6D78E8EBA63B75F9E80
SHA1:	73610EE6AFA7AA8D505733F6EAD59FD041C5FB49
SHA-256:	9671C838047B628731F03E1D0E00C387B8B769711B148C85DB8DFB0BDAA6DF61
SHA-512:	E967133531E17A09898D63CB1AC2332DF6B3A138364A65D7B48597C771366B0D2E5570F6F8991E851D6E265A5F7B19DFB20DB4C082B528BCC27DEDCAB0322267
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Class.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	3.401438369594957
Encrypted:	false
SSDEEP:	24:QlL+6DTL5yoRUWVVyVW1j2UWLgu7yXtW1j2UWkAnjyzAnFRUfb:y+6DTL1RUWVsPUW8FPUWhnRnFRUfb
MD5:	007E9D4F8D2CDB310A2CB00ABC66D554
SHA1:	EC650348913B8C76BB9BF634FBFF0FAB6059F2D9
SHA-256:	CB5A78911D96EC31A5D458C36816591BE8983F2A9DD0E4E315DA5473124992CA
SHA-512:	9F796B251EB560C39F6359B82715EF94D83325A00FBC9ECEACF6A84BEAEC9B767A36021D4C3C1972DDEE8B707A1E904B50170C3414A169A004D7829D1189F506
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\CreditCardCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10730
Entropy (8bit):	3.3973078263426566
Encrypted:	false
SSDEEP:	96:uDTs2WNggW1nW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjAWBWBWgXcJXWSWkWDWRWo:PBFwbqcJj2ZFw
MD5:	05489A893E54DDC5FB6CF04CB6E694C6
SHA1:	3127D4D44195A71A0E4747777BC897050C7E8ABC
SHA-256:	69F89A746D7C56D9208A3E78C5A73528DDB1608982EE88890E23A497F8ECAD41
SHA-512:	F8186EF3DB6EF7B04F60E31F20CDD7BCF7DF00934B4F43A5895EEDB37447A335B7E268DC9D7F944E2446178CC036B59567A614ADDD0072DD9B0FBCAC4ED029CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\CreditMemo.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23068
Entropy (8bit):	3.397580751364641
Encrypted:	false
SSDEEP:	96:uDTsHqW2+PXW7KWOrWBWDtWjAWPWwWtWyObW0WjW526TMW3dUWZVgIW3GWPaWaqb:64Gh2ZGd/Q/EkQ3qoQiPZsAw
MD5:	0CD8B2D4E3EC5E9C2F79D6910DCA7BBD
SHA1:	811188337FDA66CF1109A0391E59BCC595A6BF44
SHA-256:	2809658D7E0DE5B09CDFA780F2354A25B0E288ADDC1D6D7C5AD1653D26313B84
SHA-512:	9EEAD1170B869BB61504CDFA5E69F797162D6B00F474F8FE46E647A07903BE48F1187D1F33F4C4D197B67FEE74AC54B469D9F8EA396F150FC2278491BB3DC0B6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Customer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17704
Entropy (8bit):	3.3778298617907954
Encrypted:	false
SSDEEP:	96:uDTjuWfWnW/CnWpjWYW9WHWaWNWimWZRoW9GWVWW5WWwW2zWLEP5WVDyDoW8EmUH:CvC/0Fr8YXNT2pr6ww
MD5:	AB72B1394124E9E1118E15E8EF4E511A
SHA1:	5EC1BAC179E30696F1AD70AE3A93AF810020BECD
SHA-256:	B0B47D9BFF22CD109523E2E1E85EFA1D026B57AA2A6D74D27E6000EED52D1C9E
SHA-512:	1855DFE41F1B8D56E2B341EA7D106C9A45E5E933D89AEEF0BB6796CD2220395CE73DA5245E066D6FFD2A2006D7EAB4E8B216122C9A1BBB3F9378B91876DAFCDB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Deposit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6156
Entropy (8bit):	3.4137444628644134
Encrypted:	false
SSDEEP:	96:uDTs4UW7G7WPHlWyW8WBWdcDvWoWqFWwTW+gHkW+HArW+RC9W/qWBSWn2WT2VXWW:ocDYw
MD5:	1803FFF728F97073799C80B67C8FDEE7
SHA1:	0E643BBEFACC62B6661B37C62A66DBAA8658217D
SHA-256:	321392B689C4F31E1C684FB21DB11CFDF832AC047D206EAC28CD28565D3E08C0
SHA-512:	28EDC510A58A87A67B183ABA6953F3242021A517E53FCB06AF98F9615FEF9A878B7055AF15D44519BD174EF528F8BCF09C8FF593151F87B35580F30BDBF7A3FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Employee.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	3.3517687010608053
Encrypted:	false
SSDEEP:	96:uDTnWGW/CnWpjWYGMrWfWDWpWrW9W4AaWJWpWnWOEtWZZW5mWnWyWDUWtoWkUWw+:xCUgAB6x/LebT2iw
MD5:	F3C984C4AE1632BC89840291BEB00358
SHA1:	5DF688B375EE3938472534F937695E49C454ADC5
SHA-256:	3A639B3086EB68D7252C9BEFBDDE1B30B65EB48BBB8B3C42ED3E85F920AE459D
SHA-512:	D4B0D0FAD035E049F68D74EBE21F2CC7A077B0F83D3C1546B4D2758058826868639E8E52936F33EAE0807DBF1D650E63160641AFDBF1561B83F024BDB409E40C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.I.R.S.T.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Estimate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18398
Entropy (8bit):	3.3839688551388196
Encrypted:	false
SSDEEP:	96:uDTsDJW2+PXW7piWOrWDtWjAWPWtWfW0WjW526TMW3GWPaWaqWlaWimWVWZRoW9T:bX4iE72OVd/Q/UkQLZsAw
MD5:	341CF2CF665673DAF34D8D2F2E5588E3
SHA1:	A81D0913EC0CD932745EBA0E63AF993CC6D58150
SHA-256:	E0A00EA9FF43381DD90AD30F8698A1006055F6307F21EE4679BD8A5D3ACE004F
SHA-512:	7537BF4412647F2A495B1DD194C82E2BD6AF345192C28882C17E728B76887215924590DE9596237F47385EBF777D63606E4192F6264BE7B3F0C6F79B008D6444
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Invoice.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10153
Entropy (8bit):	4.757512621728147
Encrypted:	false
SSDEEP:	192:tWlPvKZ66qEVSLoH4VdrjJlYYANFbHZGBJ1gN7J/NTx+JohknTZl+N9O3ZyxBwaH:tWlPvKZ66qEVSLoH4VdrjJlYYANFbHZ/
MD5:	C67C6FA1BE699190A935B1E7F92607B1
SHA1:	6D8BFE09A3E9F3E419DD5BF9E37C5467F6F8C78E
SHA-256:	9F001FBCB2FF3B2DBF888058104FCAEFF86CE1AE1A2883BEB263D4D8F56F3906
SHA-512:	A41521002C8150D096B6742BDF99A7D8BB1CC1E4841E32A9B1250241ED33534AED0F323781DE792247F55FBA485D76B9C943C0EC5BE6F6DAE564144E7CF735AD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>TRNS: DOCNUM</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>TRNS: NAME</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>TRNS: DATE</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>SPL: INVITEM</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>SPL: QNTY</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeader>SPL: PRICE</Fi

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\ItemReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11698
Entropy (8bit):	3.396173076147388
Encrypted:	false
SSDEEP:	96:uDTs2WJnW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjRWBWBWgXcJXWSWkWDWRW0WjWU:GBFwbJcJj2Zqw
MD5:	A73CDF57131CBFDAB6681AB305AA80F5
SHA1:	F48F228AC5063EACF3ADF97DA6294C0C0758B87C
SHA-256:	A0FE24F35C8B60E21CC3EAC5703436C9D6B48700F10191C083FD6CDEDFAD2A9D
SHA-512:	AEF52B61FC72666A09748CDD5AA8F447AB93DF3D9FF88DDFA70DD9F71005D8821C3506FE8843789A406D9E477F295FA2487C5589FED122B3A3E89065BED1CAEB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\JournalEntry.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5624
Entropy (8bit):	3.401160832913635
Encrypted:	false
SSDEEP:	96:uDTsg1WbWWp7W4WAWzWWpWcWNWxWoW4WnWmWiWn2WT2VXW8iWxhofb:/w
MD5:	DE18D67EC219EE8784CB915380231A69
SHA1:	D7CE005E0E38B03D67293BEEE56AA84B3A92D1E0
SHA-256:	4CEE9DB7E008DC632EEC4AC53C3BB48DF60EEE13289227BEBFBD775EC025D141
SHA-512:	78A52F9E4D0D8854EBA021E4BF3907DFBFCEE3E26D50278993814DE4FCC62669D1161EB97C82931A702BD116D7E563C595B55F14C6EFD2B13AE1870334B24814
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.e.n.t.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\OtherName.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.371180909495819
Encrypted:	false
SSDEEP:	96:uDTGWPWfWnW/CnWpjWYW3WKW52WxooWeOWcWaZrEWAWVbIFbbW3W1kSEWrW3W8ip:JCIUw
MD5:	4724BDA353907F831C9EE02CC56F0589
SHA1:	05F9763BE0CA8893A63541BBD4CC882420DE2900
SHA-256:	5E2931C298FCC22D481DF7F2ADECA18B2C7BAE222C909F02C2E592C0112A38FF
SHA-512:	6094FC542D8A2116A0B51531602C9D98996140BA081C2E06C84FC90620B6469ACE40B7DD5561D0CBF8325A47E9254760A36F221C18638F86F993D302B09A90A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.O.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\PriceLevel.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3780
Entropy (8bit):	3.383914597363917
Encrypted:	false
SSDEEP:	96:uDT7XWn2WcyW4WRWiWikWTvsW3W8iWxhofb:AjbvXw
MD5:	D366551F82B5F038C3D0A4C98AB63141
SHA1:	8F9FE782CA5C2B505410BFBA637D03DB81FFFC7C
SHA-256:	357AC25AA7A8570F6983805C251085879555D3EE0B04EAFA51053CB6125AE1C2
SHA-512:	16DCDBCA2F384C588953235C2CCE601FBA6FD664CF4CD9AB72D6F9BA9F80A67B74C9BF9E0E62A4587B3EC66A968D378A67835573B06B0EF7966D5BF16AD583E9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.A.L.U.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\PurchaseOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16308
Entropy (8bit):	3.39751102690321
Encrypted:	false
SSDEEP:	96:uDTsUWJnW7KWOJWhWDfWjuWzW6WjWgXVQXWxWRW0WjW526TMW3GWeaWTqWIaWVm1:2kVQT2OvaZsHw
MD5:	4A2597CFF83C4C0C42E2ECCE4E29776E
SHA1:	49D3B3FEAEA5AB634B36BBFEEAB4686F0281A76D
SHA-256:	1C037EE6E31DE8A7DC485E67BA2B836F86837D8B55E311DFCA7C980F9D82C8BC
SHA-512:	10430F3309FB9BFD7EB54773E8CF1B6F6BEC58497D2CC02A02270483EC3298788D9AC19DE99A9AD3CDB1E496348B7858E9E8CDE510CBD47704E31A15B7F416F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\SalesReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23052
Entropy (8bit):	3.3903928257479117
Encrypted:	false
SSDEEP:	96:uDTs/W2+PXW7eWoWOrWDtWjAWPWwWtWfW0WjW526TMW3GWPaWaqWlaWimWVWZRoE:J4pp2Ofd/Q/FkQaqoQ+cDSZsOw
MD5:	F295C0759C32D5A4705FDDB505B52E0D
SHA1:	C92D3A2848860E98D68F889A7772531532AD1831
SHA-256:	1C19E74632C0803EA4B3D5D8D0F56CD9EC98D4AC84F44D6886CDFF4FF2431B19
SHA-512:	B7836D171302E522115EA61E65401C9025FABFF8E281E34590EB9FC4DEA8FCA3B6970892E481ABB96BF02993F76A0BF09C8E7F8FC18C8676821CFD092DC8E9A2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Transfer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	3.425055648101356
Encrypted:	false
SSDEEP:	48:y+6DTLfDRUWJfcRUW+RUW3qRUWHfjRUWGRUW8FPUWhnRnFRUfb:uDT7KWRLWhW3dW/qW5W8iWxhofb
MD5:	2E942AB54EC0B0FDF9B26C6BF8809DEC
SHA1:	B774A60BA12055E3ED472D19680EA7A76A3B2B03
SHA-256:	E6E1B5547E1FB85BE8A1A8700772C47249804B47E7516FE51DA1130023C6A184
SHA-512:	97E795DDB4DBE5FE815F0D6BE55014637E2A48CF14D738F96CE4F9741483E6D4F8A31F6E23EF2C5650AEACFF501BD51F79E97D8D58E912A7015C31369C52C5B0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\Vendor.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13726
Entropy (8bit):	3.3711405370788805
Encrypted:	false
SSDEEP:	96:uDTiWfWnW/CnWpjWYW7IaW9WQWxWmWVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDyDN:6CbIP8wT2XrTpw
MD5:	1D3FBC50FA064BE05D3CE6BDB3D9742F
SHA1:	41879CCBB18FB42D23E64F12711D20622E46FA9E
SHA-256:	43B97088050C7A5D64FF8B5DB96D3A740BC32721B745D3E6F794964D673A936B
SHA-512:	AFFD9B5FD27F359E9FCB7442B3BAAAF68E9BB9EB0AC6A111A3F52D73C5483B7EB9FC5F9FB116ADA85CCCD1BB7FE357415E43C03553055AAC6B5FFBE239092362
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_CA\VendorCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	3.3886826903517617
Encrypted:	false
SSDEEP:	96:uDTQL9WJnW7KWJWkW43WjFwXWPWyWYW1WoWDtWjAWBWBWgXcJXWSWkWDWRW0WjWb:LkFwLqcJj2ZZw
MD5:	B04B6EDB6B582A743361788847CF0BCD
SHA1:	3F3815AFA4A67477747C74EF0488A1DC2015C323
SHA-256:	A215A41010A602B5B702EA8AC6604F847C32A83A4B5D2878297075F21C3314FB
SHA-512:	45E2F77CB6EC77129E8602E21C350E03A1C46A6B4DEA9CC3E5313A779D4DDA9A0BFC84A6DAAF732CF0D88D118270A44FF775163951BE19E705BA1AC3FB6975AD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Account.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.385828093280008
Encrypted:	false
SSDEEP:	96:uDTGWyW+WsWMWTW3WPWnlWfWoWnWFRxyxmW3W8iWxhofS:0REX9
MD5:	1683427F2A9E604FC547E2AF1FCC887D
SHA1:	329087DD3E93D911E01F4016BA8CA4B353F01472
SHA-256:	B2EC6DA369E892D257A698E8122976FB18E16A539FC0A40B95B4921C65B3B117
SHA-512:	E7E8B451D83AA6E6D1995E60B8700393179635C4FF81D4319D80508018E4CC905819F91D70B94E583EC04D96D81E7B6F60E24CA046E166270CCF02B8388F9E68
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.T.T.Y.P.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.N.u.m.b.e.r.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Bill.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15344
Entropy (8bit):	3.387950593600828
Encrypted:	false
SSDEEP:	96:uDTsGWJnW7KWJWkW4oWjUXWPWyWYW1WoWDtWjRWBWBWgXcJXWSWkWDWRW0WGW52h:2BULJcJw2ZNEjw
MD5:	095636ACB47CC26ACD619DD62811FB6F
SHA1:	40900F2D4594B5D9FE191A746328B4CD56786291
SHA-256:	E9BFA8A45BE8F09A966EC9FE1BE504017F7517978339D59111214982BE6D653E
SHA-512:	A2D7DA83B518230E9008F646643EC7E83B1A6ECA1C87EB27FD938FE6B8461CFD03DB5E0D64FBFA9A8F49D2494B8AA7471EEE584C4C3C46DD8E7CB666EF052FD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Check.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12946
Entropy (8bit):	3.394060848942431
Encrypted:	false
SSDEEP:	96:uDTs9vWAWW1zW7KWJWzW43WjUXWPWxWYW1WOrWDtWjAWNWBWgXcJXWSWkWvWRW0A:VJkUGucJP2ZiEYw
MD5:	6B27345C734DF6D78E8EBA63B75F9E80
SHA1:	73610EE6AFA7AA8D505733F6EAD59FD041C5FB49
SHA-256:	9671C838047B628731F03E1D0E00C387B8B769711B148C85DB8DFB0BDAA6DF61
SHA-512:	E967133531E17A09898D63CB1AC2332DF6B3A138364A65D7B48597C771366B0D2E5570F6F8991E851D6E265A5F7B19DFB20DB4C082B528BCC27DEDCAB0322267
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Class.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	3.401438369594957
Encrypted:	false
SSDEEP:	24:QlL+6DTL5yoRUWVVyVW1j2UWLgu7yXtW1j2UWkAnjyzAnFRUfb:y+6DTL1RUWVsPUW8FPUWhnRnFRUfb
MD5:	007E9D4F8D2CDB310A2CB00ABC66D554
SHA1:	EC650348913B8C76BB9BF634FBFF0FAB6059F2D9
SHA-256:	CB5A78911D96EC31A5D458C36816591BE8983F2A9DD0E4E315DA5473124992CA
SHA-512:	9F796B251EB560C39F6359B82715EF94D83325A00FBC9ECEACF6A84BEAEC9B767A36021D4C3C1972DDEE8B707A1E904B50170C3414A169A004D7829D1189F506
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\CreditMemo.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23068
Entropy (8bit):	3.397580751364641
Encrypted:	false
SSDEEP:	96:uDTsHqW2+PXW7KWOrWBWDtWjAWPWwWtWyObW0WjW526TMW3dUWZVgIW3GWPaWaqb:64Gh2ZGd/Q/EkQ3qoQiPZsAw
MD5:	0CD8B2D4E3EC5E9C2F79D6910DCA7BBD
SHA1:	811188337FDA66CF1109A0391E59BCC595A6BF44
SHA-256:	2809658D7E0DE5B09CDFA780F2354A25B0E288ADDC1D6D7C5AD1653D26313B84
SHA-512:	9EEAD1170B869BB61504CDFA5E69F797162D6B00F474F8FE46E647A07903BE48F1187D1F33F4C4D197B67FEE74AC54B469D9F8EA396F150FC2278491BB3DC0B6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Customer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17704
Entropy (8bit):	3.3778298617907954
Encrypted:	false
SSDEEP:	96:uDTjuWfWnW/CnWpjWYW9WHWaWNWimWZRoW9GWVWW5WWwW2zWLEP5WVDyDoW8EmUH:CvC/0Fr8YXNT2pr6ww
MD5:	AB72B1394124E9E1118E15E8EF4E511A
SHA1:	5EC1BAC179E30696F1AD70AE3A93AF810020BECD
SHA-256:	B0B47D9BFF22CD109523E2E1E85EFA1D026B57AA2A6D74D27E6000EED52D1C9E
SHA-512:	1855DFE41F1B8D56E2B341EA7D106C9A45E5E933D89AEEF0BB6796CD2220395CE73DA5245E066D6FFD2A2006D7EAB4E8B216122C9A1BBB3F9378B91876DAFCDB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Deposit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6156
Entropy (8bit):	3.4137444628644134
Encrypted:	false
SSDEEP:	96:uDTs4UW7G7WPHlWyW8WBWdcDvWoWqFWwTW+gHkW+HArW+RC9W/qWBSWn2WT2VXWW:ocDYw
MD5:	1803FFF728F97073799C80B67C8FDEE7
SHA1:	0E643BBEFACC62B6661B37C62A66DBAA8658217D
SHA-256:	321392B689C4F31E1C684FB21DB11CFDF832AC047D206EAC28CD28565D3E08C0
SHA-512:	28EDC510A58A87A67B183ABA6953F3242021A517E53FCB06AF98F9615FEF9A878B7055AF15D44519BD174EF528F8BCF09C8FF593151F87B35580F30BDBF7A3FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Employee.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	3.3517687010608053
Encrypted:	false
SSDEEP:	96:uDTnWGW/CnWpjWYGMrWfWDWpWrW9W4AaWJWpWnWOEtWZZW5mWnWyWDUWtoWkUWw+:xCUgAB6x/LebT2iw
MD5:	F3C984C4AE1632BC89840291BEB00358
SHA1:	5DF688B375EE3938472534F937695E49C454ADC5
SHA-256:	3A639B3086EB68D7252C9BEFBDDE1B30B65EB48BBB8B3C42ED3E85F920AE459D
SHA-512:	D4B0D0FAD035E049F68D74EBE21F2CC7A077B0F83D3C1546B4D2758058826868639E8E52936F33EAE0807DBF1D650E63160641AFDBF1561B83F024BDB409E40C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.I.R.S.T.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Estimate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18398
Entropy (8bit):	3.3839688551388196
Encrypted:	false
SSDEEP:	96:uDTsDJW2+PXW7piWOrWDtWjAWPWtWfW0WjW526TMW3GWPaWaqWlaWimWVWZRoW9T:bX4iE72OVd/Q/UkQLZsAw
MD5:	341CF2CF665673DAF34D8D2F2E5588E3
SHA1:	A81D0913EC0CD932745EBA0E63AF993CC6D58150
SHA-256:	E0A00EA9FF43381DD90AD30F8698A1006055F6307F21EE4679BD8A5D3ACE004F
SHA-512:	7537BF4412647F2A495B1DD194C82E2BD6AF345192C28882C17E728B76887215924590DE9596237F47385EBF777D63606E4192F6264BE7B3F0C6F79B008D6444
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Invoice.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10153
Entropy (8bit):	4.757512621728147
Encrypted:	false
SSDEEP:	192:tWlPvKZ66qEVSLoH4VdrjJlYYANFbHZGBJ1gN7J/NTx+JohknTZl+N9O3ZyxBwaH:tWlPvKZ66qEVSLoH4VdrjJlYYANFbHZ/
MD5:	C67C6FA1BE699190A935B1E7F92607B1
SHA1:	6D8BFE09A3E9F3E419DD5BF9E37C5467F6F8C78E
SHA-256:	9F001FBCB2FF3B2DBF888058104FCAEFF86CE1AE1A2883BEB263D4D8F56F3906
SHA-512:	A41521002C8150D096B6742BDF99A7D8BB1CC1E4841E32A9B1250241ED33534AED0F323781DE792247F55FBA485D76B9C943C0EC5BE6F6DAE564144E7CF735AD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>TRNS: DOCNUM</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>TRNS: NAME</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>TRNS: DATE</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>SPL: INVITEM</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>SPL: QNTY</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeader>SPL: PRICE</Fi

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\ItemReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11698
Entropy (8bit):	3.396173076147388
Encrypted:	false
SSDEEP:	96:uDTs2WJnW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjRWBWBWgXcJXWSWkWDWRW0WjWU:GBFwbJcJj2Zqw
MD5:	A73CDF57131CBFDAB6681AB305AA80F5
SHA1:	F48F228AC5063EACF3ADF97DA6294C0C0758B87C
SHA-256:	A0FE24F35C8B60E21CC3EAC5703436C9D6B48700F10191C083FD6CDEDFAD2A9D
SHA-512:	AEF52B61FC72666A09748CDD5AA8F447AB93DF3D9FF88DDFA70DD9F71005D8821C3506FE8843789A406D9E477F295FA2487C5589FED122B3A3E89065BED1CAEB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\JournalEntry.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5624
Entropy (8bit):	3.401160832913635
Encrypted:	false
SSDEEP:	96:uDTsg1WbWWp7W4WAWzWWpWcWNWxWoW4WnWmWiWn2WT2VXW8iWxhofb:/w
MD5:	DE18D67EC219EE8784CB915380231A69
SHA1:	D7CE005E0E38B03D67293BEEE56AA84B3A92D1E0
SHA-256:	4CEE9DB7E008DC632EEC4AC53C3BB48DF60EEE13289227BEBFBD775EC025D141
SHA-512:	78A52F9E4D0D8854EBA021E4BF3907DFBFCEE3E26D50278993814DE4FCC62669D1161EB97C82931A702BD116D7E563C595B55F14C6EFD2B13AE1870334B24814
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.e.n.t.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\OtherName.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.371180909495819
Encrypted:	false
SSDEEP:	96:uDTGWPWfWnW/CnWpjWYW3WKW52WxooWeOWcWaZrEWAWVbIFbbW3W1kSEWrW3W8ip:JCIUw
MD5:	4724BDA353907F831C9EE02CC56F0589
SHA1:	05F9763BE0CA8893A63541BBD4CC882420DE2900
SHA-256:	5E2931C298FCC22D481DF7F2ADECA18B2C7BAE222C909F02C2E592C0112A38FF
SHA-512:	6094FC542D8A2116A0B51531602C9D98996140BA081C2E06C84FC90620B6469ACE40B7DD5561D0CBF8325A47E9254760A36F221C18638F86F993D302B09A90A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.O.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\PriceLevel.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3780
Entropy (8bit):	3.383914597363917
Encrypted:	false
SSDEEP:	96:uDT7XWn2WcyW4WRWiWikWTvsW3W8iWxhofb:AjbvXw
MD5:	D366551F82B5F038C3D0A4C98AB63141
SHA1:	8F9FE782CA5C2B505410BFBA637D03DB81FFFC7C
SHA-256:	357AC25AA7A8570F6983805C251085879555D3EE0B04EAFA51053CB6125AE1C2
SHA-512:	16DCDBCA2F384C588953235C2CCE601FBA6FD664CF4CD9AB72D6F9BA9F80A67B74C9BF9E0E62A4587B3EC66A968D378A67835573B06B0EF7966D5BF16AD583E9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.A.L.U.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\PurchaseOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16308
Entropy (8bit):	3.39751102690321
Encrypted:	false
SSDEEP:	96:uDTsUWJnW7KWOJWhWDfWjuWzW6WjWgXVQXWxWRW0WjW526TMW3GWeaWTqWIaWVm1:2kVQT2OvaZsHw
MD5:	4A2597CFF83C4C0C42E2ECCE4E29776E
SHA1:	49D3B3FEAEA5AB634B36BBFEEAB4686F0281A76D
SHA-256:	1C037EE6E31DE8A7DC485E67BA2B836F86837D8B55E311DFCA7C980F9D82C8BC
SHA-512:	10430F3309FB9BFD7EB54773E8CF1B6F6BEC58497D2CC02A02270483EC3298788D9AC19DE99A9AD3CDB1E496348B7858E9E8CDE510CBD47704E31A15B7F416F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Transfer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	3.425055648101356
Encrypted:	false
SSDEEP:	48:y+6DTLfDRUWJfcRUW+RUW3qRUWHfjRUWGRUW8FPUWhnRnFRUfb:uDT7KWRLWhW3dW/qW5W8iWxhofb
MD5:	2E942AB54EC0B0FDF9B26C6BF8809DEC
SHA1:	B774A60BA12055E3ED472D19680EA7A76A3B2B03
SHA-256:	E6E1B5547E1FB85BE8A1A8700772C47249804B47E7516FE51DA1130023C6A184
SHA-512:	97E795DDB4DBE5FE815F0D6BE55014637E2A48CF14D738F96CE4F9741483E6D4F8A31F6E23EF2C5650AEACFF501BD51F79E97D8D58E912A7015C31369C52C5B0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_UK\Vendor.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13726
Entropy (8bit):	3.3711405370788805
Encrypted:	false
SSDEEP:	96:uDTiWfWnW/CnWpjWYW7IaW9WQWxWmWVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDyDN:6CbIP8wT2XrTpw
MD5:	1D3FBC50FA064BE05D3CE6BDB3D9742F
SHA1:	41879CCBB18FB42D23E64F12711D20622E46FA9E
SHA-256:	43B97088050C7A5D64FF8B5DB96D3A740BC32721B745D3E6F794964D673A936B
SHA-512:	AFFD9B5FD27F359E9FCB7442B3BAAAF68E9BB9EB0AC6A111A3F52D73C5483B7EB9FC5F9FB116ADA85CCCD1BB7FE357415E43C03553055AAC6B5FFBE239092362
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Account.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.385828093280008
Encrypted:	false
SSDEEP:	96:uDTGWyW+WsWMWTW3WPWnlWfWoWnWFRxyxmW3W8iWxhofS:0REX9
MD5:	1683427F2A9E604FC547E2AF1FCC887D
SHA1:	329087DD3E93D911E01F4016BA8CA4B353F01472
SHA-256:	B2EC6DA369E892D257A698E8122976FB18E16A539FC0A40B95B4921C65B3B117
SHA-512:	E7E8B451D83AA6E6D1995E60B8700393179635C4FF81D4319D80508018E4CC905819F91D70B94E583EC04D96D81E7B6F60E24CA046E166270CCF02B8388F9E68
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.T.T.Y.P.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.N.u.m.b.e.r.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Bill.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15344
Entropy (8bit):	3.387950593600828
Encrypted:	false
SSDEEP:	96:uDTsGWJnW7KWJWkW4oWjUXWPWyWYW1WoWDtWjRWBWBWgXcJXWSWkWDWRW0WGW52h:2BULJcJw2ZNEjw
MD5:	095636ACB47CC26ACD619DD62811FB6F
SHA1:	40900F2D4594B5D9FE191A746328B4CD56786291
SHA-256:	E9BFA8A45BE8F09A966EC9FE1BE504017F7517978339D59111214982BE6D653E
SHA-512:	A2D7DA83B518230E9008F646643EC7E83B1A6ECA1C87EB27FD938FE6B8461CFD03DB5E0D64FBFA9A8F49D2494B8AA7471EEE584C4C3C46DD8E7CB666EF052FD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Check.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12946
Entropy (8bit):	3.394060848942431
Encrypted:	false
SSDEEP:	96:uDTs9vWAWW1zW7KWJWzW43WjUXWPWxWYW1WOrWDtWjAWNWBWgXcJXWSWkWvWRW0A:VJkUGucJP2ZiEYw
MD5:	6B27345C734DF6D78E8EBA63B75F9E80
SHA1:	73610EE6AFA7AA8D505733F6EAD59FD041C5FB49
SHA-256:	9671C838047B628731F03E1D0E00C387B8B769711B148C85DB8DFB0BDAA6DF61
SHA-512:	E967133531E17A09898D63CB1AC2332DF6B3A138364A65D7B48597C771366B0D2E5570F6F8991E851D6E265A5F7B19DFB20DB4C082B528BCC27DEDCAB0322267
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Class.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	3.401438369594957
Encrypted:	false
SSDEEP:	24:QlL+6DTL5yoRUWVVyVW1j2UWLgu7yXtW1j2UWkAnjyzAnFRUfb:y+6DTL1RUWVsPUW8FPUWhnRnFRUfb
MD5:	007E9D4F8D2CDB310A2CB00ABC66D554
SHA1:	EC650348913B8C76BB9BF634FBFF0FAB6059F2D9
SHA-256:	CB5A78911D96EC31A5D458C36816591BE8983F2A9DD0E4E315DA5473124992CA
SHA-512:	9F796B251EB560C39F6359B82715EF94D83325A00FBC9ECEACF6A84BEAEC9B767A36021D4C3C1972DDEE8B707A1E904B50170C3414A169A004D7829D1189F506
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\CreditCardCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10730
Entropy (8bit):	3.3973078263426566
Encrypted:	false
SSDEEP:	96:uDTs2WNggW1nW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjAWBWBWgXcJXWSWkWDWRWo:PBFwbqcJj2ZFw
MD5:	05489A893E54DDC5FB6CF04CB6E694C6
SHA1:	3127D4D44195A71A0E4747777BC897050C7E8ABC
SHA-256:	69F89A746D7C56D9208A3E78C5A73528DDB1608982EE88890E23A497F8ECAD41
SHA-512:	F8186EF3DB6EF7B04F60E31F20CDD7BCF7DF00934B4F43A5895EEDB37447A335B7E268DC9D7F944E2446178CC036B59567A614ADDD0072DD9B0FBCAC4ED029CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\CreditMemo.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23042
Entropy (8bit):	3.398223768542637
Encrypted:	false
SSDEEP:	96:uDTsHqW2+PXW7KWOrWBWDtWjAWPWwWtWFbW0WjW526TMW3dUWZVgIW3GWPaWaqWC:64Gf2ZGd/Q/EkQ3qoQiPZsAw
MD5:	9D370170D4ACF993A9B35110DCCCF56D
SHA1:	1E83299B41D3191307126BBEBD0ED6B6736752DB
SHA-256:	F95D179C9EABBC684050AE0CB40055F1A3F67FCFEB95FADCFDD792E879E5AAD1
SHA-512:	5EE5F8F08FD556A58FEF02E5BDC0AA1B618B660C853288488E2C4FE62F7070D8B243454D9DFAD912130A022945D3B1CC52B5D55603240F5ABFEED7755143FDCD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Customer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17704
Entropy (8bit):	3.3778298617907954
Encrypted:	false
SSDEEP:	96:uDTjuWfWnW/CnWpjWYW9WHWaWNWimWZRoW9GWVWW5WWwW2zWLEP5WVDyDoW8EmUH:CvC/0Fr8YXNT2pr6ww
MD5:	AB72B1394124E9E1118E15E8EF4E511A
SHA1:	5EC1BAC179E30696F1AD70AE3A93AF810020BECD
SHA-256:	B0B47D9BFF22CD109523E2E1E85EFA1D026B57AA2A6D74D27E6000EED52D1C9E
SHA-512:	1855DFE41F1B8D56E2B341EA7D106C9A45E5E933D89AEEF0BB6796CD2220395CE73DA5245E066D6FFD2A2006D7EAB4E8B216122C9A1BBB3F9378B91876DAFCDB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Deposit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6156
Entropy (8bit):	3.4137444628644134
Encrypted:	false
SSDEEP:	96:uDTs4UW7G7WPHlWyW8WBWdcDvWoWqFWwTW+gHkW+HArW+RC9W/qWBSWn2WT2VXWW:ocDYw
MD5:	1803FFF728F97073799C80B67C8FDEE7
SHA1:	0E643BBEFACC62B6661B37C62A66DBAA8658217D
SHA-256:	321392B689C4F31E1C684FB21DB11CFDF832AC047D206EAC28CD28565D3E08C0
SHA-512:	28EDC510A58A87A67B183ABA6953F3242021A517E53FCB06AF98F9615FEF9A878B7055AF15D44519BD174EF528F8BCF09C8FF593151F87B35580F30BDBF7A3FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Employee.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	3.3517687010608053
Encrypted:	false
SSDEEP:	96:uDTnWGW/CnWpjWYGMrWfWDWpWrW9W4AaWJWpWnWOEtWZZW5mWnWyWDUWtoWkUWw+:xCUgAB6x/LebT2iw
MD5:	F3C984C4AE1632BC89840291BEB00358
SHA1:	5DF688B375EE3938472534F937695E49C454ADC5
SHA-256:	3A639B3086EB68D7252C9BEFBDDE1B30B65EB48BBB8B3C42ED3E85F920AE459D
SHA-512:	D4B0D0FAD035E049F68D74EBE21F2CC7A077B0F83D3C1546B4D2758058826868639E8E52936F33EAE0807DBF1D650E63160641AFDBF1561B83F024BDB409E40C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.I.R.S.T.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Estimate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18352
Entropy (8bit):	3.384551124984066
Encrypted:	false
SSDEEP:	96:uDTsDJW2+PXW7piWOrWDtWjAWPWtWFbW0WjW526TMW3GWPaWaqWlaWimWVWZRoWx:bX4iE92OVd/Q/UkQLZsAw
MD5:	62AE25FBDDDC98DB1A4B1CEDD59F708E
SHA1:	34F4D1D40DD74D089F812AC82696D767F074C33F
SHA-256:	6DFE8B6D0E73BB9B92556B43F0A1926F658E8D3C3B56733331B865B948B96ECD
SHA-512:	8BC81FFD54DCF4E659EA0DCCD27A78460EB4E67546F597789883B4D71539E694B8F774EB03BA5E25E6BFF0591A1DF94DAC8AF9146CBDF2A48618059860716874
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Invoice.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10140
Entropy (8bit):	4.758739425022912
Encrypted:	false
SSDEEP:	192:tWlPvKZ66qEVSLY9H4VdrjJlYYANFbHZGBJ1gN7J/NTx+JohknTZl+N9O3ZyxBwE:tWlPvKZ66qEVSLY9H4VdrjJlYYANFbHh
MD5:	52AFA928FD6D0FD9268EB16B131E519A
SHA1:	F41C216F86A999BBE40E24F05D7B9A69F3C089C7
SHA-256:	2386EF38E0ED0D2CFD93B21B5E38B8236D25FBE0D48B8542D714BF3FB9B9B98E
SHA-512:	0D0537C7B425DF0E5F7EE6B8BE9A28B121DA8A399FC3295BF0957A346736B369C9BEB7725F5B5ABBF2D5C59872D6EC0C111A40E312C9F56D3DA5ABE9CDC65BD1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>TRNS: DOCNUM</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>TRNS: NAME</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>TRNS: DATE</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>SPL: INVITEM</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>SPL: QNTY</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeader>SPL: PRICE</Fi

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\ItemReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11698
Entropy (8bit):	3.396173076147388
Encrypted:	false
SSDEEP:	96:uDTs2WJnW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjRWBWBWgXcJXWSWkWDWRW0WjWU:GBFwbJcJj2Zqw
MD5:	A73CDF57131CBFDAB6681AB305AA80F5
SHA1:	F48F228AC5063EACF3ADF97DA6294C0C0758B87C
SHA-256:	A0FE24F35C8B60E21CC3EAC5703436C9D6B48700F10191C083FD6CDEDFAD2A9D
SHA-512:	AEF52B61FC72666A09748CDD5AA8F447AB93DF3D9FF88DDFA70DD9F71005D8821C3506FE8843789A406D9E477F295FA2487C5589FED122B3A3E89065BED1CAEB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\JournalEntry.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5634
Entropy (8bit):	3.4039784593921643
Encrypted:	false
SSDEEP:	96:uDTsg1WbNWp7W4WAWzWWpWcWNWxWoW4WnWmWiWn2WT2VXW8iWxhofb:Iw
MD5:	4AA435BFA1FA43EB61347CBA9D610796
SHA1:	C84B868C5C3B9C9DB67968B4DB925C9A6B9B68CC
SHA-256:	7C492BA1526A8E88CBD927A28BD1BD5974864F0DEB8C604C26E7C57AC77A7878
SHA-512:	B102C9C696A5642EFC270A5450F638EFEF2147610CBDAFA57081C72B6CF46C3899BB34E8C8C6AE681E56BA0F4B0BAFC7B61772D0FE556A985EBF1088431B3427
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.e.n.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\OtherName.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.371180909495819
Encrypted:	false
SSDEEP:	96:uDTGWPWfWnW/CnWpjWYW3WKW52WxooWeOWcWaZrEWAWVbIFbbW3W1kSEWrW3W8ip:JCIUw
MD5:	4724BDA353907F831C9EE02CC56F0589
SHA1:	05F9763BE0CA8893A63541BBD4CC882420DE2900
SHA-256:	5E2931C298FCC22D481DF7F2ADECA18B2C7BAE222C909F02C2E592C0112A38FF
SHA-512:	6094FC542D8A2116A0B51531602C9D98996140BA081C2E06C84FC90620B6469ACE40B7DD5561D0CBF8325A47E9254760A36F221C18638F86F993D302B09A90A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.O.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\PriceLevel.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3780
Entropy (8bit):	3.383914597363917
Encrypted:	false
SSDEEP:	96:uDT7XWn2WcyW4WRWiWikWTvsW3W8iWxhofb:AjbvXw
MD5:	D366551F82B5F038C3D0A4C98AB63141
SHA1:	8F9FE782CA5C2B505410BFBA637D03DB81FFFC7C
SHA-256:	357AC25AA7A8570F6983805C251085879555D3EE0B04EAFA51053CB6125AE1C2
SHA-512:	16DCDBCA2F384C588953235C2CCE601FBA6FD664CF4CD9AB72D6F9BA9F80A67B74C9BF9E0E62A4587B3EC66A968D378A67835573B06B0EF7966D5BF16AD583E9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.A.L.U.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\PurchaseOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16308
Entropy (8bit):	3.39751102690321
Encrypted:	false
SSDEEP:	96:uDTsUWJnW7KWOJWhWDfWjuWzW6WjWgXVQXWxWRW0WjW526TMW3GWeaWTqWIaWVm1:2kVQT2OvaZsHw
MD5:	4A2597CFF83C4C0C42E2ECCE4E29776E
SHA1:	49D3B3FEAEA5AB634B36BBFEEAB4686F0281A76D
SHA-256:	1C037EE6E31DE8A7DC485E67BA2B836F86837D8B55E311DFCA7C980F9D82C8BC
SHA-512:	10430F3309FB9BFD7EB54773E8CF1B6F6BEC58497D2CC02A02270483EC3298788D9AC19DE99A9AD3CDB1E496348B7858E9E8CDE510CBD47704E31A15B7F416F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\SalesReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23006
Entropy (8bit):	3.3910042780355365
Encrypted:	false
SSDEEP:	96:uDTs/W2+PXW7eWoWOrWDtWjAWPWwWtWFbW0WjW526TMW3GWPaWaqWlaWimWVWZRD:J4pf2Ofd/Q/FkQaqoQ+cDSZsOw
MD5:	9A8BE944D08BEBB64947BD99658E3F94
SHA1:	AC50E83F4FF5E2901B94ADCDBA7DE79B2C1ADF7B
SHA-256:	8D036545AE9FDDD19A67EF6CCF8E305C6A93C2089577166DEAB49C3B10DC0038
SHA-512:	4FCFD63CAADDD73AFA7679BA7E713F8A145E70662890184FE41A0195870E1480DDA4FD2449923A9C2A9F78941ECF9CE4958299D24B73EF2815B01735888BBB21
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Transfer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	3.425055648101356
Encrypted:	false
SSDEEP:	48:y+6DTLfDRUWJfcRUW+RUW3qRUWHfjRUWGRUW8FPUWhnRnFRUfb:uDT7KWRLWhW3dW/qW5W8iWxhofb
MD5:	2E942AB54EC0B0FDF9B26C6BF8809DEC
SHA1:	B774A60BA12055E3ED472D19680EA7A76A3B2B03
SHA-256:	E6E1B5547E1FB85BE8A1A8700772C47249804B47E7516FE51DA1130023C6A184
SHA-512:	97E795DDB4DBE5FE815F0D6BE55014637E2A48CF14D738F96CE4F9741483E6D4F8A31F6E23EF2C5650AEACFF501BD51F79E97D8D58E912A7015C31369C52C5B0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\Vendor.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13726
Entropy (8bit):	3.3711405370788805
Encrypted:	false
SSDEEP:	96:uDTiWfWnW/CnWpjWYW7IaW9WQWxWmWVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDyDN:6CbIP8wT2XrTpw
MD5:	1D3FBC50FA064BE05D3CE6BDB3D9742F
SHA1:	41879CCBB18FB42D23E64F12711D20622E46FA9E
SHA-256:	43B97088050C7A5D64FF8B5DB96D3A740BC32721B745D3E6F794964D673A936B
SHA-512:	AFFD9B5FD27F359E9FCB7442B3BAAAF68E9BB9EB0AC6A111A3F52D73C5483B7EB9FC5F9FB116ADA85CCCD1BB7FE357415E43C03553055AAC6B5FFBE239092362
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\IIF_US\VendorCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	3.3886826903517617
Encrypted:	false
SSDEEP:	96:uDTQL9WJnW7KWJWkW43WjFwXWPWyWYW1WoWDtWjAWBWBWgXcJXWSWkWDWRW0WjWb:LkFwLqcJj2ZZw
MD5:	B04B6EDB6B582A743361788847CF0BCD
SHA1:	3F3815AFA4A67477747C74EF0488A1DC2015C323
SHA-256:	A215A41010A602B5B702EA8AC6604F847C32A83A4B5D2878297075F21C3314FB
SHA-512:	45E2F77CB6EC77129E8602E21C350E03A1C46A6B4DEA9CC3E5313A779D4DDA9A0BFC84A6DAAF732CF0D88D118270A44FF775163951BE19E705BA1AC3FB6975AD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_CA\BuildAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_CA\TrialBalance.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	3.368119197538534
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRU2EyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWo2EyFWKWHWUWb1KxfS
MD5:	99992F30FCF428E325882BEC39FA7727
SHA1:	2CB68A9D3AB9FBA2A44815AF2BAD507316900034
SHA-256:	EF3BF42B4A3642C7B4BF153EEDA3875FD44C1C0F144F45BA91993014A5FA4E32
SHA-512:	6D8B04C92990AC392F523011AE2E3F9372BC2E3919FBE2614F82B7BCFF98E4B006632EEAC0EDF281CA7580B7A009EACF3C692C5A24CEE5972869D8BA8F241587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Account.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5792
Entropy (8bit):	3.3622697024380717
Encrypted:	false
SSDEEP:	96:uDTmW3WTW8iW3iW829WgWpW9WZWfWoWnWPWn+WFRxyxmWxhoW6fS:DTwREr
MD5:	1094EA931F3228AE0450C44CADE8C415
SHA1:	E3DB82BC7982BE8E9F4F788AEE12D250278B294E
SHA-256:	CF59567B8378D0CCAFF19AEC467C8EF9600A47311F8FEE341809FD4124C23B0C
SHA-512:	C579D3ADADB846DD474A8392B665317151BA89D36420E705AE69D35072D730DEE7402B77A383DF311BBDE838DB6DA50FA72C1A33DE9220E96EFFCB6382DFA50B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\BankStatement.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4482
Entropy (8bit):	3.3663632280569527
Encrypted:	false
SSDEEP:	96:uDTxWpWXW+W0Wdch1WiWYWEW4HWn2WT2VXWJWQWxhoW6fb:9chtW
MD5:	CC4DBDEA078F6484B0CF91D3D6FFA2DD
SHA1:	965011FD19CB3E7AD46AF88818594829957547A9
SHA-256:	53F767AB2BE37986F58FAAF03FEEF7135EB64E1732F75DEA3D48C32C51B15FBC
SHA-512:	8338341AB8D32410FECDB49018D3E3FAD892CD46CD19887FEE390E6610788E3650D7F71551AE2DA4AD71C1D7DD4406B8395972825CA6618AC486B495EEA6D017
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Bill.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16276
Entropy (8bit):	3.3740950819729782
Encrypted:	false
SSDEEP:	96:uDTyWTW8iW3iWn+WDEWnWxWPWgWgWZWGW/WsWV2WCWWYWy7oWnWVW3+f7fT2T2VY:uTC+zl0NgoL250KO
MD5:	998C8DD49546210651C9BB0677FC45FA
SHA1:	24BB4F17404DDE4F3801CDE955D8DE2A7F48FC70
SHA-256:	2F063207A76A744A5427204D32177C3F933B804FA3C63EB9A5CA68A808C952CC
SHA-512:	0F0DA15DC59634CDF7A5105BBB6FB6BF333B6345DDAEA1169B80C635C2D63FFA62B7DE2671748EFEA606ADFED8FD0A64D7528BD8C21CCD3F6AB8892A475D30F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.u.p.p.l.i.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.u.p.p.l.i.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\BillPayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6838
Entropy (8bit):	3.3752646064246767
Encrypted:	false
SSDEEP:	96:uDTaWvW8iW3iWBWn+WeoFWDEWnWoWOG3WDW/W0WbWuDWVWT2VXWhWxhoW6fb:qTf
MD5:	061D00C38600B344CE47882A204D5B86
SHA1:	65374C7318D49CB977B82686138A86B9CEA4857D
SHA-256:	293F97DEE01AE4C799A78829D90A283224064EAB897BCEEE32DED98CF9C01443
SHA-512:	7A90A20C04C467753EE75FFD1C3AA1229BA11806528506F891B43D3854F4DACB6258E77249E317E370DBF5E6B30623EAFB0CA01973D9BA04AE98030E1B037893
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\BuildAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Check.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15204
Entropy (8bit):	3.382036012256892
Encrypted:	false
SSDEEP:	96:uDTozvWXWn+WDEW8iW3iWBWhWkWdWKW/WSWFW52WeWWsWO7oWEWVW3+f7fTGT2VT:xzCTp+zV0NgTL250KA
MD5:	2794A04A222647601A2ED808F2390F20
SHA1:	71827D660BDE3287D6BDC3363E4363AFD09DD54E
SHA-256:	609FAF2FF97316A3A15129093909C5655A6BF76B57042001C6168BF094AE322D
SHA-512:	78E4A0A793F548B558D1230449734B8EFDA85B2A5A1FE4B3EEFF7C7FCF877E5EA8EF40D341C0466753E94FA554FAD79DFFABA8BB3F59D32761A0EF3DB250E955
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.2.>.R.e.f. .N.o. .(.E.x.p.e.n.s.e. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.2.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Class.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	3.370965852197276
Encrypted:	false
SSDEEP:	48:y+6DT/RUW0RUWVsPUW8FPUW3FPUWhnRnFRUW4+RUfb:uDTmWTW3W8iW3iWxhoW6fb
MD5:	1D6F76A597104B9BDB89549161182C43
SHA1:	5B1BF53CE5FF8DA0CA0B615595F211BAC2431091
SHA-256:	E6571C5EC4F6439EC922CE7C2506AB0D9EEECADE5E97B03D338E132B89ED166E
SHA-512:	7C17B3C7BA6C2A41AFE1262056D9C3EF09967BE22FB0128077416507369ADAAEF5FCB81E803F04F006F705D14D2E7DC9061FCF6B8FDB940C53B29B90A05CFA45
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\CreditCardCharge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14050
Entropy (8bit):	3.3856332790702326
Encrypted:	false
SSDEEP:	96:uDTKWXWn+WDEW8iW3iWBWiW3WMWVsWCwEwWaWrCKWpWVW3+f7fTGT2VXW0WUW4Hr:MTREu+zV0NgTL250KQ
MD5:	1C678D96111618D0C26501AE6D40206D
SHA1:	0F4A1AABE9CF3F55DE7878A1A75DB29A6674AEE8
SHA-256:	4683D60AD577FB5FEC59C2BD9E149F0D626ADEB1F90965F1C0116F953CCEEE9D
SHA-512:	42972E25CE111A7B45540A4B4AA94969A737F877A583C916CC792B34DBEED76D6FB51CAE550C5AC9922CA641FC7A3D5ED25D422137DB751A2BB3FDF6C3BE3F3D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.2.>.R.e.f. .N.o. .(.E.x.p.e.n.s.e. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.2.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\CreditCardCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11434
Entropy (8bit):	3.387192525085206
Encrypted:	false
SSDEEP:	96:uDTYUxUPWXWn+WDEW8iW3iWBWHWVW3+f7fu2T2VXWEWsW4PWjFwXW/WyWYW1WoWK:sTo+zG8FwjL250KQ
MD5:	DF2CAA93CA26EA57ADF640B69A69989A
SHA1:	E91A6F8C10229F8A189905802A42C542F11594E9
SHA-256:	E64FB558FFE528CA8C59B56CD5EAC705D849F534C5612A81170969D6EC2A8BD3
SHA-512:	86B47821138F62EAA739B9B54042B9A4D50F61249E60B0B41154877A0120871E8D82DFD71F37C42839418FD8D9B27561570614A9756A6DAB5DA646D053C17A89
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o. .(.C.r.e.d.i.t. .C.a.r.d. .C.r.e.d.i.t. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o. .(.C.r.e.d.i.t. .C.a.r.d. .C.r.e.d.i.t. .N.o.).<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\CreditMemo.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23680
Entropy (8bit):	3.3731705563248626
Encrypted:	false
SSDEEP:	96:uDT6W2VQXW8iW3iWHXRWPWgWoWBWLWIWZWQP5WhawWGFzWLEP5W4XhWVDyDoW8Ef:zVQ5TF+z4s26XqoQAZsu
MD5:	0543F2A7EBF3FF8854782C477637AAD8
SHA1:	55142487E5BA3FD583236B9D4A6D738DD3A3F5F8
SHA-256:	EABA8237AD2EB63F353B92E713E41E36197DE7135873E836F12018B89E034512
SHA-512:	7051627E6BD57FBECF31B27A012801EA18F8208E193E3E3ABE33F03C2F13274E4FCCFC97F73B65483152A6F6918B2CB9720D2B0BE5F0F3B098C20B6C912B21FB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.d.j.u.s.t.m.e.n.t. .N.o.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.d.j.u.s.t.m.e.n.t. .N.o.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Customer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18960
Entropy (8bit):	3.3557377518968856
Encrypted:	false
SSDEEP:	96:uDTmW3WwsXW8iW3iW5W3WlW/qnWpTWgW9W9WRW2tgnWgWfWMrWrWQWrWfWVbobvz:Os5TIqvtgWqgXmT2SfbDo8p
MD5:	982BF0B90F3B69D38474EEBE8D40A06A
SHA1:	D2BDD9E5E427783B90EB86886D6C96AA99B8385D
SHA-256:	542DF251AD28C3DCF1B21C77549D4B4290BC61474F51FC56A58D8CBD3139D03E
SHA-512:	144A6C3E32014E0B71B14A92224C6932D49A0F1D36EA5747E3B8FADE9BC6004656598F8715D6B779FE44F9DBE93BE0D1CAE0FC6B10CE170B0463DF77F7B13DE1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Deposit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6824
Entropy (8bit):	3.3691860583535695
Encrypted:	false
SSDEEP:	96:uDTXNUW8iW3iWxWsclWyW8WOWn+W82FWdmWVWT2VXWYW7WbWLW+AroW+nALW+xC/:bTUw
MD5:	176DC126A1928E489CB6EB5687674384
SHA1:	E56F482269ABEF9A07FA01F004DA5C5D2E355DB1
SHA-256:	76DD99D53105F3F75D8B753E89747814A41EAD1D8E356D54EC1E2D247286FFB1
SHA-512:	47559F1CE35DF13D357319731B3B519BF939106943C74887F24FBF291DA5A80D005D8663BB0239AF75D7551BBC05448E81871E1CF782AD375113696E50812416
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Employee.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13590
Entropy (8bit):	3.3412945079031697
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgW3W8iW3iWMrWfWDWpWrW9W4AaWJW2WsWOEtWZZW5mWSWPWD2c:jqxTggAprHLubT2n
MD5:	0FFF92529C11FC47C77700A6871F984F
SHA1:	5D1266326C606FC5B6B8223F714578EAC994B97F
SHA-256:	91FC15123341F7FB53FD9E6EE8409D7E0C12AA596052E8701381C4E2D505232B
SHA-512:	9652CB73D1EFDC1A5D468CF2E5623D7178A13ECEF2693A1797D8E089978B99F8C0A7EA4467EEF7D4E6525EE504F0684FA602B17474E7E684E2505FE672C3BC18
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Estimate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19344
Entropy (8bit):	3.370716304274053
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQXW8iW3iWD+iWfWgWoWBWLWxWQP5WhawWGFzWLEP5W4u8WVDyDoW8EF:/LXVQ5TP+/+z4Iz2yZs5
MD5:	BDFF06279B961E1380A598E8F67DE77F
SHA1:	BCF15C78857A61DE2F00565B4DDEB716F79CDF94
SHA-256:	DCED382B253463E1500DC15769880DB2BCCB258AD0E83E4A971B86980A625B07
SHA-512:	8D608EE0E1B34200658C2E46F730EA69A87A0E406B4B603F7BDA6261AD5AEE94E83FEBAA385788B1C5AEBB6046D3D9112347B34EDC31808E06E566E9003247CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\InventorySite.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.3344046683217523
Encrypted:	false
SSDEEP:	96:uDTmW3W8iW3iW2WpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrL4:uTcZwvGcUDTjQpm/0
MD5:	38F7BF511F9302B7E16811738EFA7C5F
SHA1:	3AD17C3DC404A00F89BCA63836E45D388CF0782D
SHA-256:	32ACD47EA14F8297F9B986184A67984F691DF3D2DC5CA5F3DAC7276800069566
SHA-512:	D42366B22A107A816667BDDA7381DFA742B465DFF5A4F9295FDBC7CD1529857957F18B150F8812657E024812AD723A0CDB4736F94DE3BAECAE9F330FE6A78359
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Invoice.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10866
Entropy (8bit):	4.734476536802812
Encrypted:	false
SSDEEP:	192:3bVN8S8jXOWXTZ4I3KDFO9EfuPopKYSNFbHNGXJtgb7N/NTf+Johknq8D8u9Cq8z:3bVqZjXOWXTZ4igFO9EfuPopKYSNFbHt
MD5:	33B1ACBF43AD3B24EEDE54BEDE18D502
SHA1:	4104229CBE7EC9E98734D76F169F6D51D457F093
SHA-256:	D8E9C6AA6E3BC105EC8D4D2D873AEB825BE8C6C0725582B991B54C0BAFFCE5A4
SHA-512:	8CD613F913931A5377F9C0F8DCA3AE05842C000CD699DB5C595C59DC852A5E127B48C653D7E2D056358F92B15DA0B8E17369861F70E35C45500E825D3C9DFE72
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>SalesRep</Key>.. <FileHeader>Sales Rep</FileHeader>.. <Display>Sales Rep</Display>.. </MappingLine>.. <MappingLine>.. <Key>CreatedDate</Key>.. <FileHeader>Created Date</FileHeader>.. <Display>Created Date</Display>.. <HideImport>true</HideImport>.. </MappingLine>.. <MappingLine>.. <Key>ModifiedDate</Key>.. <FileHeader>Modified Date</FileHeader>.. <Display>Modified Date</Display>.. <HideImport>true</HideImport>.. </MappingLine>.. <MappingLine>.. <Key>Currency</Key>.. <FileHeader>Currency Code</FileHeader>.. <Display>Currency Code</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>DueD

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Item.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6888
Entropy (8bit):	3.3830657329856835
Encrypted:	false
SSDEEP:	96:uDTmWwWTW5QZW6W/WSWyHWMWYWIWCKWb8WtWkWEW5W7WoWwMWT7sWxhoW6fb:5Qz
MD5:	F68AC62FD505C258DC552A91754FA53F
SHA1:	3F41D5EA849CB48E998D2191990061FCE0BEC8FA
SHA-256:	B741CA57E6865D1D86B3C81FC0E31A1FA66EE3643A6D0765C1867D51280C5980
SHA-512:	ACE40115B026C9512BA8B5AB114CA23DDE0DBECA29DB011CA94B8A7BF86BC33658FE2B8ED8CFB8CE711C1D77C8FA79BFB9A3B60AC8650E557B80B506E7930B4D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .P.r.o.d.u.c.t./.S.e.r.v.i.c.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .P.r.o.d.u.c.t./.S.e.r.v.i.c.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\ItemReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16214
Entropy (8bit):	3.3738899226403234
Encrypted:	false
SSDEEP:	96:uDTyWTW8iW3iWn+WDEWnWxWPWgWgWZWGW/WsWV2WCWWYWy7oWnWVW3+f7fTGT2VY:uTC+z9kFw4L250KO
MD5:	34D5C389606A683765F2A837DD548449
SHA1:	C346DF69FD8E03A79088715CD16EE4C443552DAF
SHA-256:	A33D395F928E718818E20F9B4141E5AF1BE81D956853506DA9E20D3089F40071
SHA-512:	1172206011B8E43803A035B0D1D7F55F02DB4C01116AABCF598BAB9746BB415B1ED563E6ED66E2FCAA91B4E83E44160BFD382B75D40CE53556BCC9C8A7927D16
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.u.p.p.l.i.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.u.p.p.l.i.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\JournalEntry.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6074
Entropy (8bit):	3.3715186577194176
Encrypted:	false
SSDEEP:	96:uDTgBKUO8iW3iW1Bx7W4WAWzWWn+WT2VXWEW/GWxWoWVWbWW4WnW5WxhoW6fb:ZtTpL
MD5:	4410F2DD5BD3A7711522568DC24E0CA1
SHA1:	3FD5828AA87D39F072EE394154328C0B0EC8D7BB
SHA-256:	8C17BB26A9D99BFF4CF1C0838F817C9FDD273CDD64443DF28F19306DA74A5BDE
SHA-512:	6E3D4C39815425DA710C6EE43B0A90EA342267BDB1DA054F7A51880D5D7228C131871993FB74247AA79DBC5EDF38D3AAD6C11BC339CCB20E5247A421BF97E20E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\PurchaseOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17098
Entropy (8bit):	3.3742686642140094
Encrypted:	false
SSDEEP:	96:uDTSW8iW3iWjWn+WDEWshJWxWgWPWQP5WhawWGFzWLEP5W4u8WVDyDoW8EmUWaW4:DTS+znN2Gm0KYZs7
MD5:	4513FFEEAB8E358BC0A663DFB893DEC1
SHA1:	B8B049EB5F66E2568572522DD57D0B43061116BD
SHA-256:	35D0224931E7C353B7740FDF82F40D8CA52679F1F9E0C8EEE8404CBEFC797536
SHA-512:	2133A893F1C21EF76FE4A909FD31CBBEEED19A205B7D943355F1E6CD46E54A8AC5826376DFDCEC4D62FBD5CB67FC99473AA26FDF835107C73C726CC8D19936DB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.O. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.O. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\ReceivePayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11520
Entropy (8bit):	3.389144927052971
Encrypted:	false
SSDEEP:	96:uDTaW2VQXW8iW3iWneWeoF2BWoWdcDvW/z8QWxBKUW8WDWVWT2VXWTWsZgWDMuWX:TVQ5TFcD4z8b1qoQOrGooq
MD5:	9102C940AB537289E2E55E087BF0EFE4
SHA1:	AD22720A3DD829C47728592CAB21A65D75BC1B1D
SHA-256:	AD628C5DC8EC44CC269CDEED1AFFA08D556F8598DFB1DF2B76A1AAF177E83DFA
SHA-512:	3AC7DE0669A6527A256E1F424815F81855A9141EB0D41145B65817886E4AB8F2751044D790380EF1FD8B1CD1F8417CA907E66D867DB475545213DC23C569435C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\SalesReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23956
Entropy (8bit):	3.3733144637301145
Encrypted:	false
SSDEEP:	96:uDTqW2VQXW8iW3iWhWPWoWdcDvWIWsPiWHYiWQP5WhawWGFzWLEP5W4u8WVDyDo2:DVQ5T1cDd+z4Hz2qqoQIZs5
MD5:	BF248225D709E333B5BB029A84A88D5E
SHA1:	5EBAD513447B2571A0ED350D264AB901B57E4464
SHA-256:	B483687AD25B3AAA505C107D0AE762CAC5A279F7ABFEC10E4D8C410880FD9586
SHA-512:	53945BECE5A6E196B8EFB3790B281F1599349A629DE7111378A140D35091F9B462E03EC6C45585AD6AA46366AE58202C7679BACCC5941798AE68D0BEAF961867
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\TimeTracking.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5228
Entropy (8bit):	3.3312632604164807
Encrypted:	false
SSDEEP:	96:uDT8iW3iWxWbWW2VQXW4W5WxWCWIWcKhMWtW5W3WTWyWxhoW6fb:nT3VQn
MD5:	BC8061D537EB095089CBB963B1657C58
SHA1:	8C679F5E3F2361F0ED9D4ADF842F185EC8BA0537
SHA-256:	8D8BB80D55A74BAA93E943752160BAC0BCD9AEFE9C8C37597E08E2A22FD5576A
SHA-512:	5F443817ECB560DE37B403E875348F934D7A23B590BAFC41A865719DC6A43A3243F210B06D5AF4A9E2CD08E703EF6112423146EF74A01EEAF4BF52EFF4065F6F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Transfer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	3.3644021823593775
Encrypted:	false
SSDEEP:	48:y+6DT8FPUW3FPUWuRUWsRUWhRUWVbqRUWGRUWSRUWhnRnFRUW4+RUfb:uDT8iW3iWxW7W0WVbdW5WVWxhoW6fb
MD5:	80EBC42FB64CE0CB75E2A5E45EAAC4D5
SHA1:	8CEE564F15EEC95E094E73B3EB6122E4945307F0
SHA-256:	B24CD5F18D133265BB08BE5A9912D319013F8B50848DEB82866A55B476E0238F
SHA-512:	F2C370EB01EC00D651DDB40E2394CD959F5D3B97396A7970A1450C63B9EFA6D6C8C3A3E489FF72BF530642FE0A145C6ECF2CEB9D695B5FADE6DB811D05539C1E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\TrialBalance.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2896
Entropy (8bit):	3.368697128468666
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRUGEyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWoGEyFWKWHWUWb1KxfS
MD5:	EFC5F768E3D06E52B694549ABCFD8B87
SHA1:	4622C4188EA88C0188FBB5EB16EC70A1C7359047
SHA-256:	9A4EF4F77EEA239DEC61155ACCD233D778A82A9DA99A07412160A0ED47FDEA70
SHA-512:	F1253652D4F19BBEAF86DD17150D5CAA6103EB75B13D7EBE5A0FEA5DD7DBC961312A86790062E08167965889FEADF715270F3CA216276F5E7AB31F8496DE4F9F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\Vendor.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14516
Entropy (8bit):	3.3512642591933046
Encrypted:	false
SSDEEP:	96:uDTmW3W8iW3iW523WlW/qnWpTWgWNW9WfWMrWrWQWrWfWVbobvbbWaWaTcPciWwK:eTIqDgT2gPAkrh
MD5:	563C2000DE9C73F326A70831999C3F47
SHA1:	B8ED53B84A2BE9AAFADE94C51AD7E6B871FA4AB8
SHA-256:	AB54F2F1796D55E6906C50F7382E23CE8E233778974E4E43EE72A9EC4E14CD1A
SHA-512:	A54BBA81F2FA7403BB0412F253984155BC98FF94560C1D20D3FC892227833F26ED88A8FDEA4B1F82B66F8933361F0132D7FF3D4427FF71A0C70BCE8FAED6B2C8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_UK\VendorCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11802
Entropy (8bit):	3.3635322583092297
Encrypted:	false
SSDEEP:	96:uDTUVPWjWn+WDEW8iW3iWBWPWVW3+f7fT2T2VXWEWsW4PWjFwXW/WyWYW1WYWshb:ATg+zN8FwT725eLZ
MD5:	503AA2B56942DB1A0BF393BCB99CD042
SHA1:	7CBBE1224933D74452D43F96BA0DDDF95CD797FA
SHA-256:	70EF94A538BAC4E49F3600740E842802A421B505B9FB80EB09508356FCE9F558
SHA-512:	341741709EEB93E8ED8DECE4C3CED1391EDFA8E63A19AAA5A515F3E199DF98561A04F90996CB2AD0ABF20C8DE4FEBA9B7AF62FB8EBA97C94B2680840760C9FB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o. .(.V.e.n.d.o.r. .C.r.e.d.i.t. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o. .(.V.e.n.d.o.r. .C.r.e.d.i.t. .N.o.).<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Account.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5948
Entropy (8bit):	3.3665643291273986
Encrypted:	false
SSDEEP:	96:uDTmW3WTW8iW3iW829WTWgWpWTW3WfWoWnWn+WFRxyxmWxhoW6eS:DTsREq
MD5:	C8E5FA74F502C698DDB2D799312E9308
SHA1:	8B30703D6E893916799913FADF102BB12B13EE0D
SHA-256:	CBEAC68EED7DFF6E68ABC30259C3EFFE249D1B8115E3059ED35E5D22E47BF7D3
SHA-512:	EF77BBBDA8E0E6B1204B2844FEEE8DFEBF0A25F4887B9F5761DB790529DD0974AD9C13EB7C93B32E8E1A9FB11EB8C5F3CBDE5FF424FEF0225B26B60073999CB9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Bill.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15340
Entropy (8bit):	3.3709446462459436
Encrypted:	false
SSDEEP:	96:uDTyWjW8iW3iWn+WDEWnWxWPWgWgWZWGW/WsWV2WCWWwWy7oWnWVWT2VXW0WUW4x:+TL0NgCL250Kh
MD5:	B43C2A30FE330A6B0BA2EAF378F1A673
SHA1:	4F9D8D2AC44F642355B18F65998811B43E5F77ED
SHA-256:	1072BBBCC74FDC6742BE0CF5859A12729DF6556A98C23407CA885C4CE80D09EF
SHA-512:	13ACC17AD11D1015E2B4E1591FEA11162A92DFE6C0E5CCBB1DFD37610348B2FB7AC3ACA43E72FF7A1B2115856962612FEE2793E188F316237E549B660AB3A3EF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\BillPayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6566
Entropy (8bit):	3.3744363698719724
Encrypted:	false
SSDEEP:	96:uDTaWvW8iW3iWBWn+WeoFWDEWoWO23WDW/W0WbWuDWVWT2VXWhWxhoW6fb:qTu
MD5:	A0F0F9CCCD207884B19626FA44E82A86
SHA1:	C89FD3D2FF571EB5F51AC4C3F3AB94689A686BFB
SHA-256:	9E590599CE0AC7C0D7B07AE37C6830FC81893A696E67D8808A33D0F786ACDDD6
SHA-512:	75F64F1E4D00E2B9B37F8D3EDE7CC7FFFF86538D2D0A84E97D1E01986BA2F416C27A6C0AAAF98E8A794DFD20D2257C2C730759F17D01CDFA9C50758AC1AF5BFA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\BuildAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Check.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13144
Entropy (8bit):	3.3748979246593174
Encrypted:	false
SSDEEP:	96:uDTozvWXWn+WDEW8iW3iWBWhWkWdWKW52WeWWEWO7oWEWVWT2VXW0WUW4HWjNgX8:xzCTW0NgpL250Kr
MD5:	F70F96040CB042120BEE06217A3DB222
SHA1:	316FA86C9EFCD6F00752D9B2DFA96E54586E0803
SHA-256:	E47F5A6253F8F52072509FF3D340564F5E08FB25ABB01822856F246703700AB9
SHA-512:	59B1AF8FC562F38067DACC49513A7367983B63FE4B3A0940617042B88576791B74A3CA86F9A6007C1D0E4739CC48AE3153928FC447B149E17223E6451723CD74
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.2.>.R.e.f. .N.o. .(.E.x.p.e.n.s.e. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.2.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Class.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	3.370965852197276
Encrypted:	false
SSDEEP:	48:y+6DT/RUW0RUWVsPUW8FPUW3FPUWhnRnFRUW4+RUfb:uDTmWTW3W8iW3iWxhoW6fb
MD5:	1D6F76A597104B9BDB89549161182C43
SHA1:	5B1BF53CE5FF8DA0CA0B615595F211BAC2431091
SHA-256:	E6571C5EC4F6439EC922CE7C2506AB0D9EEECADE5E97B03D338E132B89ED166E
SHA-512:	7C17B3C7BA6C2A41AFE1262056D9C3EF09967BE22FB0128077416507369ADAAEF5FCB81E803F04F006F705D14D2E7DC9061FCF6B8FDB940C53B29B90A05CFA45
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\CreditCardCharge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13370
Entropy (8bit):	3.381974245874192
Encrypted:	false
SSDEEP:	96:uDTKWX2n+WDEW8iW3iWBWXWiW3WMWVsWCwEwWaWrCKWpWVWT2VXW0WUW4HWjNgX8:cTOEf0NgpL250Kr
MD5:	59F76EB7257986570FBCB2FA4DDCEF1C
SHA1:	5B70B19BD6780E4DB72EBDF46FE29C5210D74DCC
SHA-256:	DB25161AB1BB8FF2A2AAD5CE6E787DE62E2C9F87A0B80DB12C4C8E17AE2F81B0
SHA-512:	4D740A1D35999F6B88BE56F80B885FECF84B5E9484672ECADE057F75714D2012890817C4AE5785F0DF32C5191F92D6C7F8B31A84A59D15BCB37AAA7B7B2B0CD0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.2.>.R.e.f. .N.o. .(.E.x.p.e.n.s.e. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.2.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\CreditCardCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10444
Entropy (8bit):	3.3839866501304536
Encrypted:	false
SSDEEP:	96:uDTYUxUPWXWn+WDEW8iW3iWBWHWVWT2VXWEWsW4PWjFwXW/WyW1WoWshJWjWDWWq:sTB8FwhL250Kr
MD5:	CD725CF1F4292B93C88432DD5E09B573
SHA1:	152D42A38A301C228643928AB1AE452D6C37C957
SHA-256:	FF70215080EE9983DD4292966A20222325E84ED3C1EB1B5BFEA1A0F1FF73DACC
SHA-512:	C523C4FCB4865580A7B1D6B183D42DE4259949B86C7D4C04D34FC403FF4500B4F30AD3E25B86951C3FEAC32E1F14A321FA30D5753BE61CD9833E0DBD7DECBF57
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o. .(.C.r.e.d.i.t. .C.a.r.d. .C.r.e.d.i.t. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o. .(.C.r.e.d.i.t. .C.a.r.d. .C.r.e.d.i.t. .N.o.).<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\CreditMemo.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23742
Entropy (8bit):	3.3710665625685428
Encrypted:	false
SSDEEP:	96:uDTQQqW2VQXW8iW3iWHXRWPWgWLWoWBWIWZWQP5WhawWGFzWLEP5W4XhWVDyDoWo:jVQ5TTs26XqoQVZsO
MD5:	0C2323EA24ED6D3BDB39AF9057CE9363
SHA1:	9B6045712E8BA6AB99AC8FBF5848AC6CBB728311
SHA-256:	1BB092A97596DA55C0636BF41792129F0624B61CDF773CE0BB511BFB5E3ED425
SHA-512:	CBA8D5F3B942D824DAC20AB057CEE9730063F6675448B635B84AC56CB23C6ABC54E6B18F49D3214310919D236139D75FCC8D38F141F2439A847A456BC380F059
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Customer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19118
Entropy (8bit):	3.3505397352027924
Encrypted:	false
SSDEEP:	96:uDTmW3WwsXW8iW3iW5W3WlW/qnWpTWgW9WwsXWdWRW2tgnWgWfWMrWrWQWrWfWVU:Os5TIqts9tgWKgXmT2SfbDo8p
MD5:	BBFEF6AD9B59F99B7491DA44DE601646
SHA1:	A28352DC4A1B11C41A71DD44B9B65AB13F4953E0
SHA-256:	3053428D0BA298B21F6CB3110971FA1EA26769552127C4D629C545896828263A
SHA-512:	C24C76D0202E35BEABFDDD6DE5BEFEAF39A08825145E908FA2871F4604C517619DC4D75BCC23041CB2B9BA941ED159532203B4F263125A85F236E1AA3A257743
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Deposit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6808
Entropy (8bit):	3.370844466431515
Encrypted:	false
SSDEEP:	96:uDTXNUW8iW3iWxWsclWyW8WOWn+W82FWdmWVWT2VXWYWO8FWbWLW+AroW+HArW+I:bTUw
MD5:	222101515CCF8969C6E42DEC34F51204
SHA1:	9F0D733FDE3ACBD84399D1A03299715C23078CB4
SHA-256:	9C05DF4C60AF916834EAEEAC32F607B00C043C710C2E3CB3D131E53BF90774B0
SHA-512:	9F87DF7751A1616116D1D7B861146D05E4951F9EFB8851A4AAA1B3FE0F3E57525E7B1E790A63841193836189CA3A6E0E79EDB021E35D48E2AFDCCE9EF8FB9268
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Employee.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13800
Entropy (8bit):	3.337124079779447
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgW3W8iW3iWMrWfWDWpWrW9W4AaWJWUW2WsWOEtWZZW5mWSWPWl:jqxTggAX7HLubT2n
MD5:	BC65925321AD453B19E0DA0EDDF5537E
SHA1:	9C04FE56239821C7E3EB2A32BAC73F5678657629
SHA-256:	AABB13247DF4B4462A32FAD4CC80CF0DB9832A9BF18133FC332B9D10C6B83B74
SHA-512:	2A21EECC7454F2E0B2B7FFF7078F7A8BC88A076D028DE99430B18B7D25E91D59B65BA6DFCD74014705075989924550B115499C8E05E2A0FF2207036417546D71
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Estimate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19474
Entropy (8bit):	3.365735542234896
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQXW8iW3iWD+iWfWgOgWBWLWjW6WQP5WhawWGFzWLEP5W4XhWVDyDoW6:/LXVQ5TP+6WFuz2fZsT
MD5:	407425E490A422D83EF8CE54B5477D5D
SHA1:	33FE94CC6F0EF2D53F58842248B34134A6DC7D7C
SHA-256:	20DCE888ACBF1BF01478E1BF28A58A145E3EE2DB0927334E91ADD140AA496AA8
SHA-512:	87171585F2A81205D994B358D6708ACEA089FD58DAE842A5B8793B0A6FC14C9FEF0497325008F3B1EBE4263F9AAE8539300CA0405A991DC2A374C86A01737ED9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\InventorySite.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.3344046683217523
Encrypted:	false
SSDEEP:	96:uDTmW3W8iW3iW2WpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrL4:uTcZwvGcUDTjQpm/0
MD5:	38F7BF511F9302B7E16811738EFA7C5F
SHA1:	3AD17C3DC404A00F89BCA63836E45D388CF0782D
SHA-256:	32ACD47EA14F8297F9B986184A67984F691DF3D2DC5CA5F3DAC7276800069566
SHA-512:	D42366B22A107A816667BDDA7381DFA742B465DFF5A4F9295FDBC7CD1529857957F18B150F8812657E024812AD723A0CDB4736F94DE3BAECAE9F330FE6A78359
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Invoice.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11223
Entropy (8bit):	4.72693857971157
Encrypted:	false
SSDEEP:	192:3bVN8S8jXOWXTZkZFO9EfuPopKYANFbHNGXJtgb7J/NTx+JohknESD8r4D8+wCq9:3bVqZjXOWXTZkZFO9EfuPopKYANFbHNH
MD5:	EE79782B35552A19B9B85D35969F815F
SHA1:	57A6F42FB46ECF278610DA9CEAF110779A877149
SHA-256:	8D6B5F5E9DEAD967A5C013DF1A2444E6E4721CFE47C30FCC3818C8E89180F392
SHA-512:	AF7B6162D426902BFA0304509E8A989EE5FA491334DE0FAC44B347B2B932F6B89D69F63BF8DD2D31E145DA2851398003864CE176F81DE20BC79CA329C84F8F4D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>SalesRep</Key>.. <FileHeader>Sales Rep</FileHeader>.. <Display>Sales Rep</Display>.. </MappingLine>.. <MappingLine>.. <Key>CreatedDate</Key>.. <FileHeader>Created Date</FileHeader>.. <Display>Created Date</Display>.. <HideImport>true</HideImport>.. </MappingLine>.. <MappingLine>.. <Key>ModifiedDate</Key>.. <FileHeader>Modified Date</FileHeader>.. <Display>Modified Date</Display>.. <HideImport>true</HideImport>.. </MappingLine>.. <MappingLine>.. <Key>Currency</Key>.. <FileHeader>Currency Code</FileHeader>.. <Display>Currency Code</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>DueD

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Item.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6574
Entropy (8bit):	3.3811808795521547
Encrypted:	false
SSDEEP:	96:uDTmWwWTW5QZW6W/WyHWMWYWIWCKWb8WtWkWEW5W7WoWwMWT7sWxhoW6fb:5Q3
MD5:	7B12E6D5E0C83AD56719211AE3010D74
SHA1:	FEA0A3FC1B9F896BC11D1123479B03B4CA71DFCC
SHA-256:	8821B3B6987227D25B1CFA35A0CB9AFF1D0ADCBE53E516B58200F9219ACA7527
SHA-512:	1F36478589E3840E5BB77582D56E630D40C66DB09D0F85F3B03AC3C5C8F229D11E5ACF4E4E303569A0C12F48D2C4D9A11499C238C5B7DEABF5FDAB9634F90989
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .P.r.o.d.u.c.t./.S.e.r.v.i.c.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .P.r.o.d.u.c.t./.S.e.r.v.i.c.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\ItemSites.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3916
Entropy (8bit):	3.374542512973868
Encrypted:	false
SSDEEP:	96:uDTG2hmWXmWrWrDWW0W9WUW8iW3iWxhofS:vD7T9
MD5:	B9392F01A5EA82613C44D5A927D0519E
SHA1:	6092CE8987AA338905065BD93C67755FAC98491B
SHA-256:	BB30D9193473EF4C42B2E04BCDBC53126A93177C575A5D67AA047CF01FAC5CA8
SHA-512:	5C3B97EA9F369BFAF7428EB4ABB8BF7DD274A60716137D515FDC74F4D47F8006E366EFF5DB48C1FA4844E7724AAEF28E395A2828EBC5046841719CA6B36DAE0D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.A.s.s.e.m.b.l.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.D.i.s.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\JournalEntry.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5812
Entropy (8bit):	3.3717861513230543
Encrypted:	false
SSDEEP:	96:uDTgBKUO8iW3iW1Bx7W4WAWzWWn+WT2VXWEW/GWxWoWVWbWW4W5WxhoW6fb:ZtTpC
MD5:	859DDE645AC0E0BB106C6FDE1C6BA93D
SHA1:	BEEC47C1B2D5E05D3DC4352A363DCFCD49C38DC0
SHA-256:	8A357C6760983437D66771EC9796F01EE021C12A3CEC1A0116F456B3995E5413
SHA-512:	823A45407B2C012904C60032B54213800F47EA247310E244DD314B4D82C513F59CFBE32C11D95D6BDE2F68031DC06A3DFBDF6A27F85FC4851338CF4D890EC101
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\PurchaseOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16302
Entropy (8bit):	3.3665138800940686
Encrypted:	false
SSDEEP:	96:uDTSW8iW3iWjWn+WDEW0WxWgWPWQP5WhawWGFzWLEP5W4XhWVDyDoW8EmUWaWgWJ:DTBd2Gm06pZs7
MD5:	76D25250A040F1C083D5C5590916A707
SHA1:	30CC239C720700FEE325FFC6FCF85EDB52117C25
SHA-256:	9CFE2E401D363D4A401558833F4CAE8188C9695DC7DFB875FC6F28B7FFF17E4A
SHA-512:	38F60796C278D1C69E959914FFF1FCDEB9B6EF059F838AF61369A82FF665D15CFB3FF6072521DF7EEC43E4ACC4A47E54624B7AA7099E3AA9A4D3C25BFB0F8EEF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.O. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.O. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\ReceivePayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11520
Entropy (8bit):	3.389144927052971
Encrypted:	false
SSDEEP:	96:uDTaW2VQXW8iW3iWneWeoF2BWoWdcDvW/z8QWxBKUW8WDWVWT2VXWTWsZgWDMuWX:TVQ5TFcD4z8b1qoQOrGooq
MD5:	9102C940AB537289E2E55E087BF0EFE4
SHA1:	AD22720A3DD829C47728592CAB21A65D75BC1B1D
SHA-256:	AD628C5DC8EC44CC269CDEED1AFFA08D556F8598DFB1DF2B76A1AAF177E83DFA
SHA-512:	3AC7DE0669A6527A256E1F424815F81855A9141EB0D41145B65817886E4AB8F2751044D790380EF1FD8B1CD1F8417CA907E66D867DB475545213DC23C569435C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\SalesReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24030
Entropy (8bit):	3.3732184604313367
Encrypted:	false
SSDEEP:	96:uDTqW2VQXW8iW3iWhWPWdeWoWIWsPiWHYiWQP5WhawWGFzWLEP5W4XhWVDyDoW8d:DVQ5THukQdz2SqoQtZs5
MD5:	F63F1C2BADFE3EF960FE7C6C2DD376E3
SHA1:	04A5A11AC88A17249F8BFC086F62ACF400EB0D7E
SHA-256:	DC50B220CA0AD6FB42C6030FB2A7478752917F91E8614F58B8BC23F4825D4965
SHA-512:	3B69031E8012435606B7C07A2560C1BAA8E153D2A2F022621D493AD965AEB2C82482E8799D377B2745BB61923841701239910CC4C9176DCBEBAE6F480337C1FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Transfer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	3.3644021823593775
Encrypted:	false
SSDEEP:	48:y+6DT8FPUW3FPUWuRUWsRUWhRUWVbqRUWGRUWSRUWhnRnFRUW4+RUfb:uDT8iW3iWxW7W0WVbdW5WVWxhoW6fb
MD5:	80EBC42FB64CE0CB75E2A5E45EAAC4D5
SHA1:	8CEE564F15EEC95E094E73B3EB6122E4945307F0
SHA-256:	B24CD5F18D133265BB08BE5A9912D319013F8B50848DEB82866A55B476E0238F
SHA-512:	F2C370EB01EC00D651DDB40E2394CD959F5D3B97396A7970A1450C63B9EFA6D6C8C3A3E489FF72BF530642FE0A145C6ECF2CEB9D695B5FADE6DB811D05539C1E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\TrialBalance.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	3.368119197538534
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRU2EyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWo2EyFWKWHWUWb1KxfS
MD5:	99992F30FCF428E325882BEC39FA7727
SHA1:	2CB68A9D3AB9FBA2A44815AF2BAD507316900034
SHA-256:	EF3BF42B4A3642C7B4BF153EEDA3875FD44C1C0F144F45BA91993014A5FA4E32
SHA-512:	6D8B04C92990AC392F523011AE2E3F9372BC2E3919FBE2614F82B7BCFF98E4B006632EEAC0EDF281CA7580B7A009EACF3C692C5A24CEE5972869D8BA8F241587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\Vendor.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14168
Entropy (8bit):	3.348340921298541
Encrypted:	false
SSDEEP:	96:uDTmW3W8iW3iW523WlW/qnWpTWgWNW9WfWMrWrWQWrWfWVbobvbbWaWaTcPciWwD:eTIqDgT2IPAkr0
MD5:	E1E00B29905DC0B5F4E002ACB75A1FAB
SHA1:	72F8870A9F015D270DE0CCD071013199C1A4EF1A
SHA-256:	B1E2C201AA97C68B9079D6BB341D42DD43B50FD90FB44BEF0365821ED757A462
SHA-512:	72DD025B8C341031E25D1D472C0A3A7CC30DEC4A0484A801592AC0EF7D71A752B994121996C3F9E5EFFF00FE914F13B15BC1D3FFC049835A31DEB39B2D6FFF2A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\QBO_US\VendorCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10838
Entropy (8bit):	3.360882080826649
Encrypted:	false
SSDEEP:	96:uDTUVPWjWn+WDEW8iW3iWBWPWVWT2VXWEWsW4PWjFwXW/WyW1WYWshJWjWD2WjRs:ATZ8Fwx725eLO
MD5:	6393AC6A3B58AE9064F559C337612A13
SHA1:	26868DCBB2AE1A7B5C2074A72A58C9629C4F5812
SHA-256:	AF050ED9150BE0008DF4F70713160D9DA4844037D3ACCF51ED1A564F51CB2565
SHA-512:	A3DBFB3E0C7895B0AAAB212319506D7B3481F7587A3B70924FE3626135E23D29EFFB27BAD284434837C15C9A85B5B6995CFA99EE805239A8169EBBD62D6812D5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o. .(.V.e.n.d.o.r. .C.r.e.d.i.t. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o. .(.V.e.n.d.o.r. .C.r.e.d.i.t. .N.o.).<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Account.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5696
Entropy (8bit):	3.36440461691417
Encrypted:	false
SSDEEP:	96:uDTmW8W9WgWpWTW3WPWYWn+WfWoWnWFRxyxmW3W8iW3iWxhofS:/REXT9
MD5:	7EBA5CF892154F4C8222C7873DD57995
SHA1:	99E430DD08CD422B9A975C7C52017C3254FC688C
SHA-256:	0EF03F6573B01186EBAF3884F1F2BB3C08CEA16FD22683269BAE4DEFA7F5305F
SHA-512:	AAFC9DE9E748AADEA93A9C1AB156F28845ECF2F16234917DA5C933B51F4B6E12738BA0C55B7C0E5E61F7070758381025F71396035E362D8F2398F94182D195B4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\BankStatement.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4202
Entropy (8bit):	3.362023315280313
Encrypted:	false
SSDEEP:	96:uDT+WXWxWEW0WJWQWpWdch1WYW4HWiWn2WT2VXWxhofb:gchvr
MD5:	F2809696DBE87E6EF86A224E1E0FB224
SHA1:	4404A5547D4EB9CE3D1A2B40781FCAA28C817433
SHA-256:	13B541A6C7A627B15E10E7EC1F1B5619B64893DB6169133D9940CE099D2A3F42
SHA-512:	40348944CFBD0A7F72BE8FE0703023D1A4E29C05BC63D4D93D0A2C1186A5E8B1F84B9D49B965D368330969BFE62748F882FE2E9960E2A29BB80F7AFB7F74AF7E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Bill.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16472
Entropy (8bit):	3.369506101034054
Encrypted:	false
SSDEEP:	96:uDTyWjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WGW526Ts:nkFwOlcJs2ZNEXTw
MD5:	22DD5C191418AE042D685CC551171670
SHA1:	519D05FE41A605BA9D0842E55CE19895D3979850
SHA-256:	E2DC130B0EB63C5DA641143164DFFC6F46646CA3C19150986C659111CECE27F2
SHA-512:	7EDB9106C2E2A186F6DC6CEF9309DE4E356E7E5554B49D312F55A645BADC9911BAC0661096F697CA176B9765BB1DBC78EFDEA9278D486D57796767EF471F214B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.x.p.e.n.s.e. .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\BillPayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXW3WDWxW+WBKgWoW0WbWuDWVWn2WT2VXWnWcG3W/WeoFWDEW8iW3iWxhk:df2Tw
MD5:	9822C955955BB940E0E48E5DF1DCEBA9
SHA1:	C39B2B3CB49F85FA90E22751A28AC98B4578FAB9
SHA-256:	5BA02DF7D3BF6D12899E58D9EBF9C20FF6AF11AF15A5CA5B465D8E157D2AD0CD
SHA-512:	9356CFE1B171E671364E91ECD1C6962760A031E1638D7F836E276E576C551FD55BC791BDFF4F478C2BB5F7F29F5343A7C9A4F7168653C55B9C5F6BDF07FBDB93
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.m.o.u.n.t.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\BillPaymentCheck.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3WeoFWDEW/W8iW3iWxhk:df+Tw
MD5:	119EEA3B83228CF4AF90DB3DA987393D
SHA1:	36E1EE9BFD06B5DB21E8057D6B0A94046805F927
SHA-256:	5BE92994641722A1CAD46DFC600645960E53C3928B2833CA296CDFE865B71118
SHA-512:	367416667D7660D6ADA00DA018FC90DCF6F1035E394B637E75AD26163D9B878902BCA03BBA5FEEC8E2C301A9B3CC60AA10A3F4FDF82593BC418AFFADAC967DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\BillPaymentCreditCard.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3W/WeoFWDEW8iW3iWxhk:dfuTw
MD5:	CCF424242AE506049732FBF1BFFDBC8E
SHA1:	82B5FD23AB9978D8FC24E887C69E126A8597F80E
SHA-256:	40D96F01472756C1C1D6429F629F097C0DE1BEB94AB80CAF1E8F4A4F787327CB
SHA-512:	23A2769384B4A921D921345BF1B02AC7FCDEC923AEBC4C57496C8F0D8674CA3788334DA726CB94D786295C9EE139D0A8D4743C13B39DE2C462858E02F78733CC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\BuildAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Charge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	3.341511882057727
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWxWoWDWWj6yWpWDW0WjW526TMWCwWPWdW5W8iW3iWxhofb:jVQD6y2lfTw
MD5:	4DE6FBB0E4913F56506A55D2F197CD89
SHA1:	0EEC53EDF169E613317FE7FDA43A9D48043D620E
SHA-256:	8DA6DAFE0EE49B9B773956B0A108C3C40BA81A4074470D9936887381D19A0F26
SHA-512:	C76CFD7CFB9E65C902DDD55B4EB6124974B79451AF86A0EB52AB47A2563CDA4413B25716242FE79AC9868DAC86174376C0863FB7712568C8E065350B932DA3CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.e.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.e.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Check.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13386
Entropy (8bit):	3.3689913335499573
Encrypted:	false
SSDEEP:	96:uDToDvW+WXWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWy:xDRkFwOlcJP2ZAE0Tw
MD5:	1C0664D5AA1BB10BC49A85A10CFACB16
SHA1:	A2A461CD1E9317E5A640ADB2DB6CD03EA8EC24A4
SHA-256:	BD547314AE670B52125F0ABA4B051DD2086C49D8B9B8F8DE51AE35FA8D861337
SHA-512:	3407CB83AB03B5D3AFEFDAAEC44C15C131DC42E45BCEC8D24AD6509A733797F6DA189D026D74553A3511873795C3EFD68DFCE7076DF125372AE90A772AECAC44
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Class.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	3.3737628801824364
Encrypted:	false
SSDEEP:	48:y+6DTfRU2VsPUW8FPUW3FPUWhnRnFRUfb:uDTG23W8iW3iWxhofb
MD5:	8394D50FB8C4B1B44E4BFC1E85D8E90E
SHA1:	6FF949F58308BB699CD5AB6C8843F968DB9A135E
SHA-256:	3780ABC3C231B58C09AE37893FEA3AFE44AEE41F07EB503BE4BF9BE90E2204A5
SHA-512:	2C4265418371BC6D88263DB8727982545CEC9214835D8BED5C30EB7D54B51064FFE5674D51D770782899DCAA9AA8A27B6929BA09A902DBDD9837F28C7D43B417
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\CreditCardCharge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13734
Entropy (8bit):	3.3746926532041783
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWH:UkFwOlcJP2ZkEJTw
MD5:	85A3C4FF059214D7032EB18B90D67FC6
SHA1:	BBB3D13CA4CAE06E636C72E07E8C27A08322D1F1
SHA-256:	B06ABF8C753CE58FF4167D569379B0BDBC92F9AA7172F8A1E2234FF1B7D3BEC6
SHA-512:	B96B47E6033823A0D6E7082E2F2E160BD962DF2C838A31DEADE1C070CFA2E52F8BAC19221B8CFB9E32B08A6F56956A23CD0A14BF4AE8B8CA7E8DC926B5EBA682
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\CreditCardCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11192
Entropy (8bit):	3.376232314447034
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWQ:UkFwOlcJP2ZaTw
MD5:	8799B566ECB2D1BA2FF14D17AA84C271
SHA1:	1170D91A3BEDCBE0B852DFEECED775039F1E77BA
SHA-256:	8327782D98DEB9EC910666CB54E1FDC31F9FA0CC34ADCF731A8D4AC48F3BB9C4
SHA-512:	9DA64E810B494E8B3DA65374136555CC09AB5A8D9BEC90DACDB9E9FC156A26F4DC600C10C20F0F33D2EE803FEDB790C9D45643DDC92E728729ACF5FC664DFE90
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\CreditCardStatement.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	4.696241236318063
Encrypted:	false
SSDEEP:	48:3YV1LJ1mc+J1+c7ZJ1ucuJ1QcwJ1Dcu8J13cRJ1uc0kEfJ1Q3cMuYJ1bchXJ10cN:O19/2v7bGx8yuYGv/mbuuvhhVn5SQIEX
MD5:	B5F0345E4EC6B43B8E374DDCE3DFAEBE
SHA1:	C35A35015F4A9012B076F90F0F20A1ABD2F11726
SHA-256:	955FF27F62B8845D34D0D1EF414BC4371870466CEA6B92D38E20583932313EC5
SHA-512:	F5036B28BB39C68A9377BB6BD0DA99E1799EFCC329FEE433BC92FB0720741FE935E0FC3E205EDFF4C385588C5F2D83BC42C1704FF9CEFA60DE96FF4EBB206046
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Statement No</FileHeader>.. <Display>Statement No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>CardAccount</Key>.. <FileHeader>Credit Card Account</FileHeader>.. <Display>Credit Card Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Payee</Key>.. <FileHeader>Payee</FileHeader>.. <Display>Payee</Display>.. </MappingLine>.. <MappingLine>.. <Key>Account</Key>.. <FileHeader>Account</FileHeader>.. <Display>Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Memo</Key>.. <FileHeader>Statement Memo</FileHeader>.. <Display>Statement Memo</Display>.. </MappingLine>.. <MappingLine>.. <Key>ExpAmount</Key>.. <FileHeader>Amount</FileHeader>.. <Display>Amount</Display>.. </MappingLine>..

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\CreditMemo.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23580
Entropy (8bit):	3.3710777732304122
Encrypted:	false
SSDEEP:	96:uDTQQqW2VQXWxWoWBWDWWjRWjW8WhWyObW0WjW526TMW3dUWZVgIW3GWlWcWfWiQ:jVQSu2Z8d/Q/9kQfqoQvZsATw
MD5:	C25945E64B97E72C57BCC9F7379C9EF9
SHA1:	F35B6EB3E6FD0F297232D98727478989941486A6
SHA-256:	0076BABE7A06C173B633073A7B2F653C67213D5A484FAB6CFF818B51EE304979
SHA-512:	C0018D7E32DC4AF7CCCEFA6060FEB147066EC4594D3E962425A99D10A35A67B59BEAFC14C8651BCD3A428111220ACFBAC891CCD5552DE7C424AEEC59ABAB10FA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Customer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18668
Entropy (8bit):	3.352815492415269
Encrypted:	false
SSDEEP:	96:uDTn/uW3WlW/qnWpTWgW9WlWcWfWimWZRoW9GWVWQP5WhawWGFzWLEP5WVDyDoWh:2/lqX0tgrpXmT2NfbDo8tTw
MD5:	75D963B4C35917C19F3A3D8AE3B95FD9
SHA1:	F900D7C232551EF384DA4F294AEA1D0C800F2139
SHA-256:	0D542F1557DFF61EC1EB5886EF3BBE3DF3F7C0F2AB75A9A319A8C013434C5893
SHA-512:	7F07D3204EFF25B8FC0E76DCF260A93BF13FDF3CE81FCD84B2644E0B17F06C938C5D4A84AB6C16607C1CFB8537C04A3F0C6D4F292CE6AF67331C6C3A7F2E4776
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Deposit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	3.3749994451487755
Encrypted:	false
SSDEEP:	96:uDTXNUW4e7WsclWyW8WOWdcDvWoWO8FWG2TW+gHkW+HArW+RC9WVWDWn2WT2VXWa:ucDITw
MD5:	D60B6517E5C856A330029224348ADB67
SHA1:	1112AD001BA5FBC2A23CA993ACE8F2AF4F85C60B
SHA-256:	319C59A778AE176BD9B2C5232F2703DB05F90604D0AA3398F8AB76B8E5117259
SHA-512:	DF59081A0C17AF14F2B4E01CBEE5E606A744A5F81619F1BA5AFE1D12EFF3C1A4E10BE239CF06596A31D6EF84A15AFA4EA249D94CF2F9DBC108FC43AF46488B25
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Employee.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13236
Entropy (8bit):	3.335089551147612
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgGMrWfWDWpWrW9W4AaWJW2WkWOEtWZZW5mWSWPWD2WjooWkUWt:jqsgAB7/LebT2iTw
MD5:	A8F8FD205854B92DF247460D1B68AE61
SHA1:	DF84C1592E4C80910E6D7F79ED70E6DE37343737
SHA-256:	97ECFF8FDB71FA0766E53CB1C600745A4D6FDF1FFE6E19D097BAB425B98BE14C
SHA-512:	1AED2CE7FF57A93429E0EEAAD54A40130B868A07A06FF4FE9B17058A6FE63AED7C45E880520C2086DC7FD88B901E3C86EB3C11F642432E26F7AE984D0805ED81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Estimate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	3.3649585439931373
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQX2D+iWoWBWDWWjRWj2h2fW0WjW526TMO3GWlWcWfWimWVWZRoW9GW3:/LXVQM+Ao2WMd/Q/ckQLZsATo
MD5:	22CE31AB33A890C6FF4D706C363337AF
SHA1:	6BA1E90F007F927A1B1FD565226CC32B3FFCB296
SHA-256:	43431D770968E99834CDBA44B633D7A151D95F63399068A06B8D86C8644BA5F9
SHA-512:	DB3A2F147A27C626D6370473D8E4C6F000B2A3A15052B244C51A939AFC4DE1F06D3E6F5574D3D99F621C377DC285734B7405DEB288FCC32CD85C13304AF057F4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\InventoryAdjustment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6054
Entropy (8bit):	3.400534507725254
Encrypted:	false
SSDEEP:	96:uDTaW2V4vWBWEWIWHEj5WdpIWDW7W3XKWvlnWvInWZVW+W0WjWVW5hRhRde5Wxhk:zV4mjz
MD5:	305A9C370A61FAE120F187F029B7CD9B
SHA1:	31609A6107445CEAC34CEEA10455257C8DEF72DE
SHA-256:	81D3A7AEA2523FC6FDD7B2FEC8F5143C17573CB126CEA3E789E4E143152A3426
SHA-512:	197C4EE9E01220718AD3CA2972E03583CA55B7C7A99AB6051E0E4D4A74827ED5A1B7B6A8F7CE4FFBDBA10377144FBA88E8643633A0DEE5474BBBF7033C7155F4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r./.J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r./.J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\InventorySite.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8130
Entropy (8bit):	3.328234644697249
Encrypted:	false
SSDEEP:	96:uDTm2mWpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrLqW36WUCW3:5ZwvGcUDTjQpm/FTw
MD5:	0B0DC1FEB1B046A4A54166A0A1DBAA06
SHA1:	25BDA861ECE1DB4ED0B89B0665488BE12A895239
SHA-256:	D2006AC23D0AA1C25C30635019BF59B27077F1612D8E2C795425A1C38870823A
SHA-512:	5A210839D2635668F9F41C85CC1CF45D48F35783461AD42E50F3678811482305AED9CC052B89C3EBE2D154B2A7D6D93F349AD43B0F976784C983B8B8B8E607B1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.S.i.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.n.t.a.c.t.<./.K.e.y.>.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Invoice.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11467
Entropy (8bit):	4.72766178705011
Encrypted:	false
SSDEEP:	192:OmXblKXYCEHoH4VdpedUjulYYANFbHZGBJ1gN7J/NTx+JohknTZWDq8D8r4D8l+M:OmXblKXYCEHoH4VdpedUjulYYANFbHZU
MD5:	BEF17A9A4A799773B7B5CE4A8732B8AA
SHA1:	1F958CF9A80BEC654291238969C157101D9F9ABA
SHA-256:	E89D3E6E2825133B3B2B942E5F428163098B64D38A75A626BE04EB28BE2E5F7D
SHA-512:	2B7701DC1C8DAB9713166746A7278E7CC05B2823D1F9D5E6C448883730B9DAF47E3342ED0495DF92395ACDE0CBDDEAED81462D5BE392B08A3A30694CF71EE034
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Invoice No</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>Product/Service</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>Product/Service Quantity</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeade

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Item.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7666
Entropy (8bit):	3.379894943545433
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWSWyHWcWYWoWCKWb82tWkWUW5W7WoWwMW0W1WtWxWxhoWxfb:SQv
MD5:	BE43F47C14919AFAFA2AF9C33F618BEE
SHA1:	F84F7353E0FA160A091A615D88544BF09A28A153
SHA-256:	3106AC7C52CBA5CF70A69A61A53350CDFB27B164E891D109600B8BFE9D875520
SHA-512:	131E37E0B4755D8086A88633745C5CAB20B9FA4B90BAE336420630B54862BC432C0C469EAAE52417F7031374055DABCFDF962ADDB89CF5644E382FD186E65693
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemDiscount.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	3.369253287042973
Encrypted:	false
SSDEEP:	48:y+6DTnRUWYCORUW/RUW0RUWRRUWbpRUWGRUWsRUWhnRnFRUfb:uDT+WLWmWTWEWbsW5W7Wxhofb
MD5:	25CD8C4E6AF24CAA5FF6EE1B6F903C18
SHA1:	A639747DF534EA47858E4A8D4F36814DA597F533
SHA-256:	20109C74800E1A6DEDBB9D81A8F07D42A5FE12BD399870BD87C5979500188568
SHA-512:	BD4B0D2C92A3829B46021C3FF9D4CEC093D2F0436CF2C585F517C849F8541D5D7A83627A9C3D3328DE5E0AA7F6716C48F0DD5267EB91A95B9506E8810A1082A8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.i.s.c.o.u.n.t.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemFixedAsset.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8138
Entropy (8bit):	3.3590441395434176
Encrypted:	false
SSDEEP:	96:uDTmWOW5WUW5WyWWeWnWxWCLWDWQWPWRvWZaWbWX3KWeW6W6WgxMHxqW1lQQW3W/:92xMHxcbTw
MD5:	22858F010F6BBDEE70F95C304A46F36B
SHA1:	86F75CCF6C690E7FAB0C1CD08361C7D9D220E968
SHA-256:	CA8F453C6429247748AC2CB686A2798EEC84C62ED65E3F37B45F1D9BF7A778DF
SHA-512:	78C14BAA218D0BD2F9AB147E12A3D1661D7061BE18A5E4E825A2D22FD473D71275532561906EC161AE4F6EDE87DFD2F25853B17479707D1AC1AA2664C47CC2F7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.l.a.s.s.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.s.s.e.t.A.c.c.o.u.n.t.<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemGroup.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	3.362693101616319
Encrypted:	false
SSDEEP:	96:uDT2GOWpWeW4WdWDmWk/5WW3W8iW3iWxhofb:X/5xTw
MD5:	124F9AE4C966E010D53679722FFC508A
SHA1:	38C814162C4D3B7E2E6E21A48F52C1DB13B29368
SHA-256:	0D222B200446C0646679201A4CE6B458CEAC61E7365192530780254F98900FB8
SHA-512:	19068388DB1E412B5680AE2A976DEE3FFD54338FAA1A2F11EDA22540CE5A130EE96BA9BDB93624325DB8B010921357D032118519F5E036DEFB557CCE849AF1F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemInventoryAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8870
Entropy (8bit):	3.376494853568335
Encrypted:	false
SSDEEP:	96:uDTmWzW5QZW/W6WyHWcWCaWQWbsWtWUWNWwkW8WFN1IWGQFW+WDuWYW5WrBcuW1q:rQITw
MD5:	95FB5D545CD13670722D8386EA8E7BAA
SHA1:	CCBD082AB859220AB9DABACAD59E8BBF6E45478C
SHA-256:	927BC1A9BF87E7CC2D6126DDFFB7886F0234E218CEF10A431DE69DE0F3DE919B
SHA-512:	379A7C4FFE9AB0B8F65D1922740F7A145D0D14FEE56DEC612B2CD5AEE7D2856C0F2BF5D13CC3BE104D3831414729528FD1DF0125C1CE3EC2069E88D6141D1D7B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.u.r.c.h.a.s.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemNonInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemOtherCharge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	3.3808418806351264
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWyHWcWYWoWCKWbsWtWkWUW5W7WoWwMW0WxWxhofb:SQ4
MD5:	6E56495D5843EBF317452EDA48016548
SHA1:	551CD5D29B84C07CA8B5F78897EA6EC73BFC2FC8
SHA-256:	1835A35348765C761CD41B6B31A8C474EAA722CE3230065903C53C12162247C3
SHA-512:	7F51BECC13CBA14C6B6B2529D3BF538AF0DB90B3B967275F8E6D2D68B0EBFCEC1D08B12B3FB0915A9728EC528B0844C92E44D5D7E9AEA9B6FC3700E0C0492E66
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemPayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3194
Entropy (8bit):	3.363338038961555
Encrypted:	false
SSDEEP:	48:y+6DTnRUWXRUWYCORUWnFRUWscCRUWGRUWVsPUW8FPUW3FPUWhnRnFRUfb:uDT+WOWLWoWsclW5W3W8iW3iWxhofb
MD5:	A6DB6D2135E5EB9517615A4358820761
SHA1:	440BA9F51FA39CD6E402B74E17538AF699956586
SHA-256:	624D43B83672248F4B5137A6CB6671EFDCA38D5A3662D4FB4601CAB8F934355E
SHA-512:	D35FDC067F222BDC6A6E42F6E235373AFF0859199117B77DB7C681D6591DE57C333E1958934D18469F9BD84E767E72CDC95076B82E2C20BE7CF7C1D6870D24ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12122
Entropy (8bit):	3.3777404813750835
Encrypted:	false
SSDEEP:	96:uDTaWjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjW526TH:/kFwOlcJP2Z/Tw
MD5:	AD3343901A04AFAECDFF9116ED7E9E63
SHA1:	22BB309FD9019E36BD907048864A70EC4B3A4ED0
SHA-256:	F88A8A322970A8845900DE777CDA86632FEF892FC396EA7FBC46C9F7CDE7E649
SHA-512:	0AEA7E4D98940950E6C9E7118F1EBB13FADAEAAD3BCB89107A3D66E6748DBFAFF7C601D07CA397028A4716F47DBCA0630C187A572DCC0A99BA1A909A39FE665D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemSalesTax.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	3.3852199742396483
Encrypted:	false
SSDEEP:	48:y+6DTPRUWYCORUWXRUWZ02RUWhnRnFRUfb:uDTWWLWOWcWxhofb
MD5:	811428AC1C5C9D7F349A44FF0ADB98C1
SHA1:	E812DA7171B9BC5551FF11FEB994E15B6A0D5E91
SHA-256:	4FB868BD432D7966E1299570522A2BBE922633790C93606F1A5E7AEAD78FD4BF
SHA-512:	8AAF9052A27F596451C7F89A90C4C2A0E4CF002CB07091DFEE74AEF49AE7A50150EFCC9303FAFE8FE5734EAC37E491B0E7A566C31AC47B6264BFE8CCC3641786
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.a.x. .R.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.a.x. .R.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.V.e.n.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemSalesTaxGroup.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.401575726316516
Encrypted:	false
SSDEEP:	24:QlL+6DTTyEyDARUWXtdtQy2tMRUWMHoyiURUWkAnjyzAnFRUfb:y+6DTGZARUWXPCORUWMBRUWhnRnFRUfb
MD5:	48DC90036A616570B925520A1193A8DC
SHA1:	68387C07D8A2A19E6EF3AE7C90C8A13F811DC58B
SHA-256:	60314415E46AF3A6249F949619D1A4D65270FDDCC0626DA6206DDE168D91B1B2
SHA-512:	D1241237F9E427709FD644EF1AEE2E0D366E8646B17DC30A6FAB44A2FA61F66BE0024D293DDA7912B90EB04220936AC0C5F736C6AD702B49FF7387EFADF9A62A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.S.a.l.e.s.T.a.x.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemService.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ItemSites.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3054
Entropy (8bit):	3.3625349261742494
Encrypted:	false
SSDEEP:	48:y+6DTfRUWsA5VbRUWs25TNRUW4NYmRUWrDPRUWhRUW8FPUW3FPUWhnRnFRUfS:uDTGWhmWXmWrWrDWW0W8iW3iWxhofS
MD5:	F28FDB30C1D4EFEA8C8A2864BFC1E7AE
SHA1:	572F73533F73C877A17A00A675CE2CB54B3FAAC2
SHA-256:	ADC2E8C1C55AC77544252C843C979E95EB6DC24E02B04908958ADEF7DB3D298B
SHA-512:	5D15B79E756DD633B5039A1C0190B88B088D0BBF31BE8D2E691EAEB91C30D08011C70D1CB49756A705FC4C2E71E8137B2A80275DAE879092A8B670B0C99E279C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.A.s.s.e.m.b.l.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.D.i.s.p.l.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\JournalEntry.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5682
Entropy (8bit):	3.3641718817926574
Encrypted:	false
SSDEEP:	96:uDTgBgfg1WbWW1Bx7W4WAWzWWEWDWxWoW4WnWVW5Wn2WT2VXW8iW3iWxhofb:ZKWTw
MD5:	2BD5A49FAA022BC84D5235AEFF84ACA4
SHA1:	D99A02652572731F7AD54F9C5AAD6B427C5D751F
SHA-256:	DE32A8233EF7F37F50A5D87E8F583A4A44BE99CB017CEDCDE1B1D4C6F3CADA1A
SHA-512:	E7C9589DBDED56781ED3EFB27143B6B7F006752DA08F09F13808BF8C781E26F1E1C54F741E959AAA6CD4EB21FE637FDBC52687B87564568BB7B6E5EB4999141C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\OtherName.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	3.337946781523756
Encrypted:	false
SSDEEP:	96:uDTmW9W3WlW/qnWpTWgWUW9W52WxooWeOWcWaZrEWrWVbobvbbWQW1kSEWrW3W8E:JqRTw
MD5:	187288B192B130A10398FBC41051BA8B
SHA1:	7DEB39AD9AD23B32D2FE8658222D1343F9835227
SHA-256:	703DC4C12585B0C955E72F044F07CDE6243F6762C56E9C34BB555C6E700F8EF4
SHA-512:	1F31FEB3E4ED30C74EDF0D169ED8FA2A9D85AE0C27D5490A2DC926F864A99CD45CC0DAF10A02302DFCB25E7746195E4D935E38FCC950A645373706032712972E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Payment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	3.385598702293327
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWdcDvWoW/z8QWDWsclWdW0WbWuDWxhofb:DVQTcDCz8k
MD5:	3043D744FB3967BEFE237A672CFB2471
SHA1:	68BCB0189BA41DF8164EBF390C30265A8B6001A8
SHA-256:	CCAB1ADDC394CDBD187B236DEC59E8D4F3832A3C22FE3E24FD24DAF0F4EA0488
SHA-512:	3594AAE617198B350780295F41C5AB1D63EABF6D97EF130454D6DC5840458E81CE40192BA382EBCCA28A3A3DF70725692C14E1CD26D5CCA06E6E2E3FE88963E6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.h.e.c.k.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\PriceLevel.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4188
Entropy (8bit):	3.3716445400273334
Encrypted:	false
SSDEEP:	96:uDTnGXWn2WxyW4WRWiWikWTvsW3W8iW3iWxhofb:cG2bvXTw
MD5:	E614B301835CD2B26E6C71941FA38064
SHA1:	770636C8C0809AF429E4D91AB26D4771886922FC
SHA-256:	6F0A6C45B22CCAD3FB086FE2F20AA36C743C8A1DE84D441196D575655C2AC4B3
SHA-512:	D72A717563335F24C8AD3F5DFD359F352E8FC535293C3E89AF7220F43F1DEC40AAB04CBEA6F14565E778997EF6156C636BE8381DBA2FB87CDA447F1B28D29F62
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\PurchaseOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18326
Entropy (8bit):	3.362876895276993
Encrypted:	false
SSDEEP:	96:uDTyWjWxWoWhWDWWjBWNW6WsWgXVQXW/WRW0WjW526TMW3GWwW5W2WVmWwWMRoWK:7WVQl2OlNmZsHTw
MD5:	EE58050BDEAD0A0A40BF05786C1A3165
SHA1:	5961C959ED8E0E1C4CA65A84A27BDB96A8D7B8BD
SHA-256:	E4323B9241194F182515FF085AAFAB873F71EF9450E664B0FD23D4C42FD75A3D
SHA-512:	B02D9C0831AED76FD7C8BDDE2E26F4B3D89ED7997F5AE33D9729461FFB2610791CB3EA3A5EC4CBF860F32C10ECE3164EAB9EF8A94B14E2519DD4D749316AD959
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\ReceivePayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11204
Entropy (8bit):	3.387327919099585
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWoWdcDvW/z8QWxBKUW8WDWsclWDMuWBgvXWzWFW0L9WWWTW1WPio3:DVQhcD4z8bNqoQOrGoo3Tw
MD5:	A1696CBFE2413516C0624AA64CD46F90
SHA1:	AE6C8D6AE1E718106648D6AA80007EBF4A01AA24
SHA-256:	FA0AD6866FE892A9DF3027FE52EF7AACA27BC503794CD0E14DD09E8874876FBC
SHA-512:	1478A19296B2AEE18A179C9B1D9D3939BD38A164905F4B1F2DBB75450AEC7AD3930C080ACF3023C1552C2129852434C65DE6EFC599E97F1ACD8D4D564F733A8B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.m.e.n.t.M.e.t.h.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\SalesOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17966
Entropy (8bit):	3.3596296223763984
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWBWPWoWBWDWWjRWjWhWyObW0WjW526TMW3GWlWcWfWimWVWZRoW9GWZ:DVQ1Q2OVd/Q/akQSZsATw
MD5:	8DDAFEB175CD46E5266A3C7D6961A8FD
SHA1:	47D52E3E7BF2153F85D113F6B5AA1C657BEB5A73
SHA-256:	9A358650848A454410DEDFC96A5CD00C6FEC48014F84B8EB6BDD467182012A18
SHA-512:	3EE06E10AE3AB30058A16CC7964A3E516DA25B9767EF5866088F0201938AD0F1CD4C91BE26F2E4032AE2C695B66113FD5F4EE0FCB09B49AA15677367BC07B0ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\SalesReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23970
Entropy (8bit):	3.371707688246353
Encrypted:	false
SSDEEP:	96:uDTqW2VQX2hWoWoWBWDWWjRWjG8WhWfO0WjW526TMW3GWlWcWfWimWVWZRoW9GWx:DVQAe2OGd/Q/1kQ9qoQecDlZsuTw
MD5:	80CE7AA22B92382E8A92DC5497582AB1
SHA1:	9ED81F08DB5D171A4D2C8059ECB4B5796A7694B6
SHA-256:	0370942C2663D59356BAD9306A13BEB8B9E06A57070ED02754F41D0B8EAD0CF2
SHA-512:	096939544811108FCBA59E3D4BAE23CC8EA0F39B3DE17746BBA030AE550ADAFBD736B9AAD6E409C90FCCA76344043F1BC0B82FB9F53AA26FAAD0C3B8F6EA9686
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\SalesRep.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	3.3569081983689473
Encrypted:	false
SSDEEP:	48:y+6DTSS/RUWdGJGSRUWVsPUW8FPUW3FPU2hnRnFRUfS:uDTSSmWd0YW3W8iW3i2xhofS
MD5:	439F52DDFAEBE0B265BD919956ECEED5
SHA1:	8F994D34A6011651B014F0083FE4B1CCA6F1E3D4
SHA-256:	B47081FAE2FEE41F38FFF8DAF5F4DE58396132B445F113E9A488784E1F852D8A
SHA-512:	315D4FDA7304EF0A542C4F2C9939D1ACBB164D01C8987441FAA9013F8DF8252A7DE15819CCD1F89D15597566119736A6F2832AC60D16B7F7093E7E524515A5F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.p. .N.a.m.e. .<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.p. .N.a.m.e. .<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.n.i.t.i.a.l.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.p. .I.n.i.t.i.a.l.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.p. .I.n.i.t.i.a.l.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\TimeTracking.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3924
Entropy (8bit):	3.346158044789658
Encrypted:	false
SSDEEP:	96:uDTbWW2VVAWxW4WxW3WTWaW5W5W8iW3iWxhofb:zVV8Tw
MD5:	D6368DF55D96E8A243DE77C4DE5716FF
SHA1:	258C995AB1B1D637AC8A9738DC92710A12B463EF
SHA-256:	71B468801F6D0401C1D57F415E0E8CA05B5B25D535EEEF2DCE17D756F79CA76F
SHA-512:	E5B5899CE5F24559E25717675C822AC629255A3B88C13B49350F794150EEF26FA436C0F442C0C8AF301AAC90C3366446A955BA90CB6A94D8580E6B3FB59CFDC5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.a.b.l.e.S.t.a.t.u.s.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Transfer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	3.367053488969973
Encrypted:	false
SSDEEP:	48:y+6DTuRUWURUWZRUWVbqRUWSRUWGRUW8FPUW3FPUWhnRnFRUfb:uDTxWzW8WVbdWVW5W8iW3iWxhofb
MD5:	90DDFCD975DABF2BFC155FE574B62409
SHA1:	CC3B584BB4DAA913E22BE5961567E4AFD7274540
SHA-256:	5D3D38448434064F774E032558DEC06585DD61F826A1689AC73767C14D2E1512
SHA-512:	6909865128DFE719AD8106210AB55A1684E0FEA30636B1C93A067AA1300C538457B24B3F30C152C3B8B2FDA7F7C2FBF65E5F9300CD9D09EDC5EE2D7C1DB97D23
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\TransferInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4582
Entropy (8bit):	3.3680537578680694
Encrypted:	false
SSDEEP:	96:uDTaWhWQWmWtWdWGWKWZVW+W3XKWVW8iW3iWxhofb:8Tw
MD5:	E60071D0621D5A15FAD97C168E735A0A
SHA1:	26E62142851B7E8F2ACE2530F48A3997FF5D092D
SHA-256:	012A14B3230223FB17DA860E13E1CB932B2DB2D4B25C06DD463482BE4D49C9AF
SHA-512:	51296D9A2CADF0419C2C3C7C851AE23A4ABC0F74A365F3DE8D205C29A4A86C9975DFEAEE6E96EE903E14887BEBD0E2D79CCA245FFDDD6D8C418F35C587313EB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\TrialBalance.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	3.368119197538534
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRU2EyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWo2EyFWKWHWUWb1KxfS
MD5:	99992F30FCF428E325882BEC39FA7727
SHA1:	2CB68A9D3AB9FBA2A44815AF2BAD507316900034
SHA-256:	EF3BF42B4A3642C7B4BF153EEDA3875FD44C1C0F144F45BA91993014A5FA4E32
SHA-512:	6D8B04C92990AC392F523011AE2E3F9372BC2E3919FBE2614F82B7BCFF98E4B006632EEAC0EDF281CA7580B7A009EACF3C692C5A24CEE5972869D8BA8F241587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Vehicle.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2026
Entropy (8bit):	3.3590278843434818
Encrypted:	false
SSDEEP:	48:y+6DT/RUWyPCORUWVsPUW8FPUW3FPUGhnRnFRUfS:uDTmWpW3W8iW3iGxhofS
MD5:	69DA4404C8BD10DD3054119F5166C3EB
SHA1:	697AAD467353B3114F0C2B45CC869A3D914480C3
SHA-256:	DBE9632DBFE9E07BD0E63E3AD7C7938F18923CB186A4A3BDD8CB6BB7C37F2D06
SHA-512:	010F33D334C406939BDE99F5C447C705F5D24CFD2721D1CDE00550151494DFA6221C150F2377155EE8F2C9C891DA4845EC517ECA92BB240E154B451C27EC3FC0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\VehicleMileage.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4850
Entropy (8bit):	3.353849500727898
Encrypted:	false
SSDEEP:	96:uDTvWJgHHWwYjWBE7zWPWY4F4KW2VNoWIW4W5WaWyWoW8iW3iWxhofb:iYZVNHTw
MD5:	ADBB383E2E3B4626700B09388095DEF4
SHA1:	9FCA832E044CF69F39C15041D8D40D3731911A6F
SHA-256:	248DBA3F7B8AA576F43CBC8A6A709A034701BCDC121641043F9C517AA1FCFC23
SHA-512:	24E551E17871925A02AEC60DE918A8D860D4E7C9E5F7A61CDC9BAAA93962F5E6CDB14748043E216E267C17023070EADF830A5354B8D55562FFA1AE18D186BE7A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.h.i.c.l.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.S.t.a.r.t.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.E.n.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\Vendor.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14326
Entropy (8bit):	3.3493576325255554
Encrypted:	false
SSDEEP:	96:uDTGW3WlW/qnWpTWgW7IPaW9WwW5W2WVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDy4:8qjIPHgT2XrDTw
MD5:	6503E48C78ADFDFBEAECFCE42896D342
SHA1:	B2C96DE6B4BE2BA845A03D2E7712D0D7A6259491
SHA-256:	14ED4835BE5430D2D5F5B806577214CE9FE677F680BC2223E8EAB413BCA81884
SHA-512:	9ECE35593585AF549A1CBBDA408379AF8E8335391179F74F90D459C0C4B910D72372B26E53C6990B94B46D2C7CAB258D4F5BABEE0C5C2D8D72B86F7A3CA3B7F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\UK\VendorCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11802
Entropy (8bit):	3.375867252592748
Encrypted:	false
SSDEEP:	96:uDTQL9WjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjW52a:vkFwOlcJP2ZzTw
MD5:	24397BEEB0A9FA8655FA8B6F69328185
SHA1:	A50F8AE8F03C721B6F6AF13D3DD9806C3ACF7E26
SHA-256:	282683445B62ABD7A42AE3E475DC6498D581BB41E8EFFC58B166E956152F8EFD
SHA-512:	57F23150002340BBDBAEF4151633AFD5BD9FBBE5403E59ED100EC1209BE7B4C2BEE2EA39A06C088A00265A681875319D8FEF4538CAD2A6BCF7BC889EC621B467
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>.....

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Account.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5438
Entropy (8bit):	3.363475259267064
Encrypted:	false
SSDEEP:	96:uDTmv8W9WgWpWYWTW3Wn+WfWoWnmFRxyxmW3W8iW3iWxhofS:PREXT9
MD5:	360D0BC74F8F50129FADB1E1535877D3
SHA1:	BE3BB98EB180147CE128D1B3E9CC3849AC237CE6
SHA-256:	C643F8DF342C5901CA8D074461439953B390E079AE70492D67C18F090BFAE6CE
SHA-512:	06FD685A205B0813CCF53A10B6674BA97B629E82AACB9EE73184946FD4238017AA90AB3D4F100CAEBD85AF874C55280077C897DCA3D8FA73E0590D927D80EAE2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\BankStatement.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3892
Entropy (8bit):	3.3594933314149307
Encrypted:	false
SSDEEP:	96:uDT+WXWxWEW0WJWQWpWdch1WiW4HWn2WT2VXWxhofb:gchJv
MD5:	84679772B48C7AB9511AD37BC6FBDC18
SHA1:	21B7B86AEDD405145C0B4D68F425A3D8CF53C277
SHA-256:	F5181ED1DE18D1854DC6AD871DAA62B2731F55C68FCC83D10833FE45130666B2
SHA-512:	C2929284FF525B2DE07D54A0012067CB4403530074290A25B543D86F7AEBAA1E3C32B724BD986C573F48CB076132BB16285142360326902BE52D746474ED1D38
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Bill.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15188
Entropy (8bit):	3.3670458887140775
Encrypted:	false
SSDEEP:	96:uDTyWjWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WGW526TMW3dJ:nkFwMlcJN2bEiTw
MD5:	7663C4182FA8F67F5503865682360BEB
SHA1:	5EADA9C202AF7A75DB7252561BD2938E74B9C656
SHA-256:	56B5DBB56FC951C4D7D51FA822844C5367504279144AB8494357B36B92CC472A
SHA-512:	CB6C13E6FEDF65C0B0432F34A257237CEB008AFDE4FABA3A540C61D32915AA9476BB466072DB2D7AB6E7E8333D1A60BB360E5F4BE8C0C549F19063176B1ACB4B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.x.p.e.n.s.e. .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\BillPayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXW3WDWxW+WBKgWoW0WbWuDWVWn2WT2VXWnWcG3WeoFWDEW/W8iW3iWxhk:dfmTw
MD5:	A316197A5B8C458F08911F47C3963B51
SHA1:	CEA20BE2D1FFA05399B86ADF4EBC4AFDDA839921
SHA-256:	390D6876397DFACB98BE0AF57488A41FEEA115595E84DB956E628A541D6F0C12
SHA-512:	9682C85F5E3972D713D87423F67C5D4ED7AC3D8F34F786E598CF65FCE2F18167AFD9A81FE387388B99D6CC31608BEB012E118B66CCBC41BC69FCE219AF54E066
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.m.o.u.n.t.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\BillPaymentCheck.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3WeoFWDEW/W8iW3iWxhk:df+Tw
MD5:	119EEA3B83228CF4AF90DB3DA987393D
SHA1:	36E1EE9BFD06B5DB21E8057D6B0A94046805F927
SHA-256:	5BE92994641722A1CAD46DFC600645960E53C3928B2833CA296CDFE865B71118
SHA-512:	367416667D7660D6ADA00DA018FC90DCF6F1035E394B637E75AD26163D9B878902BCA03BBA5FEEC8E2C301A9B3CC60AA10A3F4FDF82593BC418AFFADAC967DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\BillPaymentCreditCard.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXW8iW3iWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3WeoFWDEW/Wxhk:df8T6
MD5:	B0BD54E925B232D10BABC76E4DB3E76E
SHA1:	8BD9BE3FEF0D8482F970C88B992B5AA3CC1D6204
SHA-256:	F6EAA273E21AD44EF18EDCD6D720D9CDDEC05E20A37DE2CC6C1F7B22834B95FD
SHA-512:	5A2059498E0AC05A5A4BD5520FCF6418C143029C29B36E230200CC5AE7DBC119CBA19D7A4CF0564AA3F7A99A126422898DAF82B54B92991020A8A6EE681B65CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\BuildAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Charge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	3.341511882057727
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWxWoWDWWj6yWpWDW0WjW526TMWCwWPWdW5W8iW3iWxhofb:jVQD6y2lfTw
MD5:	4DE6FBB0E4913F56506A55D2F197CD89
SHA1:	0EEC53EDF169E613317FE7FDA43A9D48043D620E
SHA-256:	8DA6DAFE0EE49B9B773956B0A108C3C40BA81A4074470D9936887381D19A0F26
SHA-512:	C76CFD7CFB9E65C902DDD55B4EB6124974B79451AF86A0EB52AB47A2563CDA4413B25716242FE79AC9868DAC86174376C0863FB7712568C8E065350B932DA3CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.e.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.e.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Check.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12102
Entropy (8bit):	3.36502616526145
Encrypted:	false
SSDEEP:	96:uDToDvW+WXWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526TZ:xDRkFwMlcJm22E1Tw
MD5:	3C11F4A8197ABCA19BF95E30D358CB99
SHA1:	1448716D5F22BE1B190E23241BE31D74E00B098F
SHA-256:	E898106D8823696FA67F6E5EA530A7863A79E93649C6753D5CF9ABA856DF3009
SHA-512:	29608B3C9004864851954938E5DB8A872F776BA89DA3D5657681A63E38A0FF595B80A3E54A722D563945417929089F2D9644122158CA3C4CE607C69A5994505C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Class.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	3.3737628801824364
Encrypted:	false
SSDEEP:	48:y+6DTfRU2VsPUW8FPUW3FPUWhnRnFRUfb:uDTG23W8iW3iWxhofb
MD5:	8394D50FB8C4B1B44E4BFC1E85D8E90E
SHA1:	6FF949F58308BB699CD5AB6C8843F968DB9A135E
SHA-256:	3780ABC3C231B58C09AE37893FEA3AFE44AEE41F07EB503BE4BF9BE90E2204A5
SHA-512:	2C4265418371BC6D88263DB8727982545CEC9214835D8BED5C30EB7D54B51064FFE5674D51D770782899DCAA9AA8A27B6929BA09A902DBDD9837F28C7D43B417
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\CreditCardCharge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12450
Entropy (8bit):	3.3722979297344806
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526TQ:UkFwMlcJm2yEQTw
MD5:	0B93967EEF020B5DEC9700DF4075F070
SHA1:	54B0D91792A9FF53A8B7BA418FFEFDDF0B3164EC
SHA-256:	0374107985E2BBC957535BA89FA373C7F84C2CF3FE0FD37F5E7DCE7CDFE616B0
SHA-512:	6B266F7113580060A6935982CBDE9E6CA3D08D275ADA70C94918821313DB0347DF9E210479115A8BAE90B1DB2B69E0921BE0435B48CB8E45AC5063FB1A03F185
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\CreditCardCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9908
Entropy (8bit):	3.3731464485228266
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526T3:UkFwMlcJm2RTw
MD5:	74884BEF4C0176341524937C5AEC586B
SHA1:	AD0CCA9DC8E994AA5AE99CC8A7E3C665A48E4B65
SHA-256:	1CD0CEC3CF4EE52380E0DEA49DA70EB4DCEFF980A96A7148A5C155A5A15A8117
SHA-512:	3401652C33265E156641C0C6C8F3EFBD0F6D389B939808BAD330B818473F1A21864D87CDF529FD46628F61C98B8A37F76EC1F94C99181607A49037D47F81A06E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\CreditCardStatement.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	4.692990702071966
Encrypted:	false
SSDEEP:	48:3YV1LJ1mc+J1+c7ZJ1ucuJ1QcwJ1Dcu8J13cRJ1uc0kEfJ1Q3cMuYJ1bchXJ10cF:O19/2v7bGx8yuYGv/mbuuvhn5SQIE86t
MD5:	C273CEEDC243730052117AFD713A67F5
SHA1:	03FFBD551BBD539F74EFFD7376F9940241CD49FA
SHA-256:	29EA33F57ADD9BE1C7B3C130FA09D7D8340E81B6BA4309028265A05C092257CE
SHA-512:	79CDA28A495DAA6BC3900A451EA16AE678A6490B698C6A20EA18D987F90962D8B3B4C806A576043DC84F7C19752D51BF2CFC1DDA9285DCC0B9BE636DB6DE42A4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Statement No</FileHeader>.. <Display>Statement No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>CardAccount</Key>.. <FileHeader>Credit Card Account</FileHeader>.. <Display>Credit Card Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Payee</Key>.. <FileHeader>Payee</FileHeader>.. <Display>Payee</Display>.. </MappingLine>.. <MappingLine>.. <Key>Account</Key>.. <FileHeader>Account</FileHeader>.. <Display>Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Memo</Key>.. <FileHeader>Statement Memo</FileHeader>.. <Display>Statement Memo</Display>.. </MappingLine>.. <MappingLine>.. <Key>ExpAmount</Key>.. <FileHeader>Amount</FileHeader>.. <Display>Amount</Display>.. </MappingLine>..

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\CreditMemo.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23284
Entropy (8bit):	3.3705748386357155
Encrypted:	false
SSDEEP:	96:uDTQQqW2VQXWxWoWBWDWWjRWjW8WhWyObW0WjW526TMW3dUWZVgIWlWcWfWimWVm:jVQSu2rd/Q/ckQPqoQvZsATw
MD5:	2DCEE8AD7C0910CB469E7318729DFC7B
SHA1:	9E9D1800A03118513759869B1568AD81AA9516C1
SHA-256:	588587D7C8AA1EA1FF11163271A88F21D61DDB058A8AFDBFE7C6D663FE1542D2
SHA-512:	C3B42574296CF7739D6CDD9B7CC1ECC22D5DCCBF4DB950C03516E624227DC81AD481860B80D2CC5ED168185FF3AB1C15A674FFF0A1EAFF1CE8DEFD520CF0B732
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Customer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19376
Entropy (8bit):	3.363329995765941
Encrypted:	false
SSDEEP:	96:uDTn/uW3WlW/qnWpTWgW9WlWcWfWimWZRoW9GWVWQP5WhawWGFzWLEP5WVDyDoW1:2/lqX0tgrtXmT2NfbDo8tTw
MD5:	A331DF847E4BEBDE703ACD132B40738B
SHA1:	EBCB542C7E9D7FB6917B6CDFEA5287989FB20E7D
SHA-256:	7AC73B1C2F82C60F6621B23EC14C0E0E6575A31E0E2F9A9622E6841B39EAAEE4
SHA-512:	3B2249BB6075894DE63FEE132D8B5B88C927BF824698FAADD14B54A30EA8B07EE4232A3784A476D49B54503E86C6498E4F5AB4CD7AABFE9E409DC7B7F387D2DE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Deposit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	3.3749994451487755
Encrypted:	false
SSDEEP:	96:uDTXNUW4e7WsclWyW8WOWdcDvWoWO8FWG2TW+gHkW+HArW+RC9WVWn2WT2VXWDWa:ucD4Tw
MD5:	9BE4C113361BB5E59939FB96658DE1B3
SHA1:	BDBA415164E76920BF6D65361D2578064085E355
SHA-256:	1FA789C19C30E4F4305CC49E183B68233E68BFF1A76DA769A9337360FD2E17DF
SHA-512:	AA6843DF3DF4ED507727D1AEA08ACB85ED000B4793CDDAE7717A84A6CD4089DC8821DC835D2CA218BC106A8AA0975541D37D67BA7DA347C1B91D2558A1BFC3A3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Employee.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13234
Entropy (8bit):	3.3352156476733796
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgWMrWfWDWpWrW9W4AaWJW2WkWOEtWZZW5mWSWPWD2WjooWkUWt:jqkgAB7/LebT2iTw
MD5:	3609E9EBA12E03F83E63D788610AF002
SHA1:	C0DA85E709A9F29DF8CE7175F4AB82EDE5F95650
SHA-256:	68F7E3023204FDD790E888EBF4C8542AEE40882F2BCA351C400E8C69788429B5
SHA-512:	71EAEE71C913B7837E8475FDE7C26E0409E988D104FFAEF333178D38A9D1AEB0BD3BE63FA50A59CA34035B3DEDDB2A08CFC0993B3A294C6E195FB0CF10F9D715
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Estimate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	3.3650391858722557
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQXWD+iWoOBWDWWjRWjWh2fW0WjW526TMWlWcWfWimWVWZRoW9GWQP5C:/LXVQs+A42Fd/Q/ckQLZsATw
MD5:	C51D66E1C0EB70409BFBED228E9C7469
SHA1:	A56C5BB5D6AF638DC77B66721B2F0FBE9C3BC557
SHA-256:	AFC34C9ECBAAE107ADAA0AD2F90A22989A8BED3FE01DD854893A9B778E7C5209
SHA-512:	72F5F761353DC14869B6CB5665A8678E5964D8D73DC061BAE3DE3B5A34CA514A0E57FF916298E360B74F004E94BA36C3391CD8E246F58ED4170E9BE8BA7FCB61
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\InventoryAdjustment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6054
Entropy (8bit):	3.400534507725254
Encrypted:	false
SSDEEP:	96:uDTaW2V4vWBWEWIWHEj5WdpIWDW7W3XKWvlnWvInWZVW+W0WjWVW5hRhRde5Wxhk:zV4mjz
MD5:	305A9C370A61FAE120F187F029B7CD9B
SHA1:	31609A6107445CEAC34CEEA10455257C8DEF72DE
SHA-256:	81D3A7AEA2523FC6FDD7B2FEC8F5143C17573CB126CEA3E789E4E143152A3426
SHA-512:	197C4EE9E01220718AD3CA2972E03583CA55B7C7A99AB6051E0E4D4A74827ED5A1B7B6A8F7CE4FFBDBA10377144FBA88E8643633A0DEE5474BBBF7033C7155F4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r./.J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r./.J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\InventorySite.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8128
Entropy (8bit):	3.3284430324122924
Encrypted:	false
SSDEEP:	96:uDTmGmWpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrLqW36WUCW3:5ZwvGcUDTjQpm/FTw
MD5:	FC250F86D187EBE604DBC5E6BBC05017
SHA1:	4B6588C7F9ADA8496E71F85D677AA88969E1B6CD
SHA-256:	2AB50FC9448CF90A8892BBC6F7FC839EE38C9DDC9FDC9A7A57AC88CDB2F0BAC8
SHA-512:	A572BF48826B3781B352319DAA1C979DF45027C8E2E765DABC44D479A02A1C3E1E53734DBADFC162B7283690CA2470A07EC7FD838ADF5A8B411D13D6C498056D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.S.i.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.n.t.a.c.t.<./.K.e.y.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Invoice.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11318
Entropy (8bit):	4.726707667993704
Encrypted:	false
SSDEEP:	192:OmXblKXYCEHoH4VdpeUjulYYANFbHZGBJ1gN7J/NTx+JohknTZWDq8D8r4D8l+NO:OmXblKXYCEHoH4VdpeUjulYYANFbHZGF
MD5:	AAF3F0BCFBF3EA768D0EA858569B5BC6
SHA1:	A83F30C71E979D53630A5C8FCD38CA1BBE9EB355
SHA-256:	B4E90F61B465CFCE6681DDD684BFEE6665854C32273A59AB7677372ADF4323EB
SHA-512:	434B1510AC667ED2DB3DA479EB43BF2788C7508EE5B03FFDA550A026664B34D6E45613A4CEF6F344118B6F1AA0CF05B48B63783AEB7EA800A346BB34B13C6A29
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Invoice No</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>Product/Service</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>Product/Service Quantity</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeade

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Item.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7354
Entropy (8bit):	3.378740152849802
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWyHWcWYWoWCKWb8WtWkWUW5W7WoWwMW0W1WtWxOxWxhofb:SQD
MD5:	48796B0AC6BFD66270E01F5CE3E798E8
SHA1:	A9A99317F47F7F9BC33EFA4A66F6E8BA26F2427E
SHA-256:	94DFD7AD248AAF5182BD277E2BDD173D611F89EB15F8EBB06A69F267A29183C5
SHA-512:	77C49633AB14446324DF08B5FFE82E3C674B4FBE6A5EDF30B0CAF26AB7D12B4CCFCA33E9DD85ABB19DBBA24508987B30AE766E0806DCB48D9449B31A2161DCAD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemDiscount.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	3.369253287042973
Encrypted:	false
SSDEEP:	48:y+6DTnRUWYCORUW/RUW0RUWRRUWbpRUWGRUWsRUWhnRnFRUfb:uDT+WLWmWTWEWbsW5W7Wxhofb
MD5:	25CD8C4E6AF24CAA5FF6EE1B6F903C18
SHA1:	A639747DF534EA47858E4A8D4F36814DA597F533
SHA-256:	20109C74800E1A6DEDBB9D81A8F07D42A5FE12BD399870BD87C5979500188568
SHA-512:	BD4B0D2C92A3829B46021C3FF9D4CEC093D2F0436CF2C585F517C849F8541D5D7A83627A9C3D3328DE5E0AA7F6716C48F0DD5267EB91A95B9506E8810A1082A8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.i.s.c.o.u.n.t.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemFixedAsset.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8138
Entropy (8bit):	3.3590441395434176
Encrypted:	false
SSDEEP:	96:uDTmWOW5WUW5WyWWeWnWxWCLWDWQWPWRvWZaWbWX3KWeW6W6WgxMHxqW1lQQW3W/:92xMHxcbTw
MD5:	22858F010F6BBDEE70F95C304A46F36B
SHA1:	86F75CCF6C690E7FAB0C1CD08361C7D9D220E968
SHA-256:	CA8F453C6429247748AC2CB686A2798EEC84C62ED65E3F37B45F1D9BF7A778DF
SHA-512:	78C14BAA218D0BD2F9AB147E12A3D1661D7061BE18A5E4E825A2D22FD473D71275532561906EC161AE4F6EDE87DFD2F25853B17479707D1AC1AA2664C47CC2F7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.l.a.s.s.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.s.s.e.t.A.c.c.o.u.n.t.<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemGroup.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3948
Entropy (8bit):	3.3622550575612524
Encrypted:	false
SSDEEP:	96:uDT2GOWpWeW4WdWDmWk/5WO3W8iW3iWxhofb:X/5hTw
MD5:	2D1265D24BECA138512E8D259D0364E9
SHA1:	7411E484582BCB9C94F325BAD2FCA86268848AA6
SHA-256:	685285A5D308E2504D5D3626F9287A949492C828E12BD761960C4AC73AF9B5F0
SHA-512:	2E116FA1DB2EC78D3458A1903BAF79969A1A90CAF693B639C888F725272FD2990B0E565513E08D29AE345CF453E340BB626B5B975DAF3D93966404E484172DF8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemInventoryAssembly.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8730
Entropy (8bit):	3.3724020804281607
Encrypted:	false
SSDEEP:	96:uDTmWzW5QZW/W6WyHWcWCaWQWbsWtWUWNWwkW8WFN16WGQ7W+WDuWYW5WrBcuW1q:rQgTw
MD5:	6C7D529C5BA9D7AFA50B9980AB97A8CF
SHA1:	7C45D104E9E0DDF6C54E6E377250FD5AF32872F5
SHA-256:	E6805BEEFE63690DC347DA45468D51411005D5523DC85D96DACDC72FB6C9775F
SHA-512:	BA1B858EAAE2919E5EA131D542B36019474ECB868DB0494D83382C64F496C8B54ACBE135DC30207270F118928148ECB7497BFF0C3EA827DE9FA89D83748CACAB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.u.r.c.h.a.s.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemNonInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5998
Entropy (8bit):	3.3820808987438795
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0OxWxhofb:RQW
MD5:	85B03A2C3830B3054BE00240F52E90F9
SHA1:	C983274DDE55CC804EA3394DE08C1D6C73221899
SHA-256:	F741CB945A027469B7BC6FDAC1B72451BC06944CC1E4F14D351776864665A873
SHA-512:	300D6D2F3A1E573717ED7E3E1B338C95EB024BD9F1D6187D0B2D8604BBCBCB8EB144FB46F0CEB7523951F433A7810826F41756CABBE2E4483F6BD5CB4935E2B3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemOtherCharge.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	3.3808418806351264
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWyHWcWYWoWCKWbsWtWkWUW5W7WoWwMW0WxWxhofb:SQ4
MD5:	6E56495D5843EBF317452EDA48016548
SHA1:	551CD5D29B84C07CA8B5F78897EA6EC73BFC2FC8
SHA-256:	1835A35348765C761CD41B6B31A8C474EAA722CE3230065903C53C12162247C3
SHA-512:	7F51BECC13CBA14C6B6B2529D3BF538AF0DB90B3B967275F8E6D2D68B0EBFCEC1D08B12B3FB0915A9728EC528B0844C92E44D5D7E9AEA9B6FC3700E0C0492E66
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemPayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3200
Entropy (8bit):	3.361749650440019
Encrypted:	false
SSDEEP:	48:y+6DTnRU2XRUGYCORUWnFRUWscCRUWGRUWVsPUW8FPUW3FPUWhnRnFRUfb:uDT+2OGLWoWsclW5W3W8iW3iWxhofb
MD5:	C0BBF1F8E3DB611C74BBD4E532256CA4
SHA1:	C619ACE9E5DEC1C1DA202048DD85EA920EA91326
SHA-256:	50B7ABC03DC410C299885ED35BA733184C2D5B904257CF8EE329C24D1044D803
SHA-512:	C1B3CBC91D9DBD9832D85B2788B79EC41E9F53B7964E847379DA0BDECBDD490D787EC3DEBE340697ACFE3850836A59DE56850A3147445917F87ADF0815D32CA2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10838
Entropy (8bit):	3.3747161497689007
Encrypted:	false
SSDEEP:	96:uDTaWjWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526TMW3dO:/kFwMlcJm2ITw
MD5:	CD736FD3BEFF518DAF71E58937565680
SHA1:	92D2E5FF02106E4C7690CAB4EA7D9CB578A00A47
SHA-256:	8A2DFF2C32C4BA891ECB5C249B9D4F05F026215A380DA3AFFA14858B390ED8A7
SHA-512:	8D84466EEFBF21C7624389309D6310C7762F2B295D5DDDC1EA8557E50E45F7CC22EA4EDA5DFFD3D85768A4CADC2E73E8FFAB072F0DC89BD1E4EAA3938C12E039
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemSalesTax.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	3.3852199742396483
Encrypted:	false
SSDEEP:	48:y+6DTPRUWYCORUWXRUWZ02RUWhnRnFRUfb:uDTWWLWOWcWxhofb
MD5:	811428AC1C5C9D7F349A44FF0ADB98C1
SHA1:	E812DA7171B9BC5551FF11FEB994E15B6A0D5E91
SHA-256:	4FB868BD432D7966E1299570522A2BBE922633790C93606F1A5E7AEAD78FD4BF
SHA-512:	8AAF9052A27F596451C7F89A90C4C2A0E4CF002CB07091DFEE74AEF49AE7A50150EFCC9303FAFE8FE5734EAC37E491B0E7A566C31AC47B6264BFE8CCC3641786
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.a.x. .R.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.a.x. .R.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.V.e.n.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemSalesTaxGroup.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.401575726316516
Encrypted:	false
SSDEEP:	24:QlL+6DTTyEyDARUWXtdtQy2tMRUWMHoyiURUWkAnjyzAnFRUfb:y+6DTGZARUWXPCORUWMBRUWhnRnFRUfb
MD5:	48DC90036A616570B925520A1193A8DC
SHA1:	68387C07D8A2A19E6EF3AE7C90C8A13F811DC58B
SHA-256:	60314415E46AF3A6249F949619D1A4D65270FDDCC0626DA6206DDE168D91B1B2
SHA-512:	D1241237F9E427709FD644EF1AEE2E0D366E8646B17DC30A6FAB44A2FA61F66BE0024D293DDA7912B90EB04220936AC0C5F736C6AD702B49FF7387EFADF9A62A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.S.a.l.e.s.T.a.x.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>...

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemService.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ItemSites.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3916
Entropy (8bit):	3.374542512973868
Encrypted:	false
SSDEEP:	96:uDTG2hmWXmWrWrDWW0W9WUW8iW3iWxhofS:vD7T9
MD5:	B9392F01A5EA82613C44D5A927D0519E
SHA1:	6092CE8987AA338905065BD93C67755FAC98491B
SHA-256:	BB30D9193473EF4C42B2E04BCDBC53126A93177C575A5D67AA047CF01FAC5CA8
SHA-512:	5C3B97EA9F369BFAF7428EB4ABB8BF7DD274A60716137D515FDC74F4D47F8006E366EFF5DB48C1FA4844E7724AAEF28E395A2828EBC5046841719CA6B36DAE0D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.A.s.s.e.m.b.l.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.D.i.s.p.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\JournalEntry.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5420
Entropy (8bit):	3.364352414587203
Encrypted:	false
SSDEEP:	96:uDTgBgfg1WbWW1Bx7W4WAWzWWEWDWxWoW4WVW5Wn2WT2VXW8iW3iWxhofb:ZKPTw
MD5:	76B94DCAFAA0C08CC6DAE7EC743BC43E
SHA1:	6F65CFEA1474BB60437F233D23D584B8B875FFD2
SHA-256:	3DF9906CC6458C4BEB291D99B445E23B79A34A77FEE7388614B8DC4A79C74DB5
SHA-512:	1E7260094109C872AB8605BB06ACA55704086CC6B9C570157006A4C6188D2C61EF5BF2C3DB7082790D6CE3852C9AD666925DCD71E5946A7DC6720B515CB1ED22
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\OtherName.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7030
Entropy (8bit):	3.3347023981721735
Encrypted:	false
SSDEEP:	96:uDTm29W3WlW/qnWpTWgWUW9W52WaWxooWeOWcWaZrEWrWVbobvbbWQW1kSEWrW3m:Jq1Tw
MD5:	8289DAE7CBB584CCC672DF7839C0D128
SHA1:	CC623DE9D01D2F1DAFD0B75899D10046779A06DC
SHA-256:	D6B36813DA86613BA7470F920687F87035B680AF03EFD03885FD555DBEC3A93C
SHA-512:	37C94940C4E44CCCFD04D613E1BA35A789A12B8C9CEB624B36D1143741D7D4DC67393B60F6377E80696A323D1934B9B740C46848EB593876A89A0140406FC679
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Payment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	3.385598702293327
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWdcDvWoW/z8QWDWsclWdW0WbWuDWxhofb:DVQTcDCz8k
MD5:	3043D744FB3967BEFE237A672CFB2471
SHA1:	68BCB0189BA41DF8164EBF390C30265A8B6001A8
SHA-256:	CCAB1ADDC394CDBD187B236DEC59E8D4F3832A3C22FE3E24FD24DAF0F4EA0488
SHA-512:	3594AAE617198B350780295F41C5AB1D63EABF6D97EF130454D6DC5840458E81CE40192BA382EBCCA28A3A3DF70725692C14E1CD26D5CCA06E6E2E3FE88963E6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.h.e.c.k.N.u.m.b.e.r.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\PriceLevel.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4192
Entropy (8bit):	3.370826082625971
Encrypted:	false
SSDEEP:	96:uDTnGX2n2WTvsWxyW4WRWiWikW3W8iW3iWxhofb:cG6vfxTw
MD5:	791A3385374BE38F469942E62728DB5D
SHA1:	4BA2E15ECA6A6513A55958215C42596C7D390F9F
SHA-256:	0BDFA67132C8A6FCF860F5EF62855D10433659C0142BA3E80D76839CA288B4A2
SHA-512:	6321417BA5475F9EC8C431ABE92B3247B2B2FFC808E4447434730EE3FBF1D34891DD789C8149067656DBD579304DF92F5B3C185CEBB17B9CC1F8C77FFC06AF62
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.i.c.e. .L.e.v.e.l. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\PurchaseOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17352
Entropy (8bit):	3.3597407626699654
Encrypted:	false
SSDEEP:	96:uDTyWjWxWoWhWDWWjBWNW6WsWgXVQXW/W0WjW526TMWwW5W2WVmWwWMRoWCGWQPP:7WVQc2nNGZsHTw
MD5:	8710FE941FF7003FCC7F232134E24DF1
SHA1:	2D663F025D324BC50492F3610368F6D52E8A0707
SHA-256:	4819F581063321780B645598BA2D75A209A37E879935E989FB38981B8DD049F7
SHA-512:	A2E4BD89FF47CA35DB0B92F2CE172D65BB099CC516473038564A8A07BCEF863FB37B12042BEF2A83210CA290ACF6FCA614775BA22E0D6CCEF6F442A412BED059
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\ReceivePayment.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11204
Entropy (8bit):	3.387327919099585
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWoWdcDvW/z8QWxBKUW8WDWsclWDMuWBgvXWzWFW0L9WWWTW1WPioX:DVQhcD4z8bNqoQOrGoo3Tw
MD5:	D956414E108CFA2B7A0473F7C4E86667
SHA1:	37147FA6F4527E348B2ECCF955B88FD2BE8CAD0D
SHA-256:	5699DDD81E7885EEBA1394CBC92FC4FBBB5BC4DE88534391A808F0404BFEE6BE
SHA-512:	8787F7288D612D698C216DB936C7FF30FDEDB4D9AA7AE23632776669450E4AC7FEF990F1D25A5BAC4BE8FCC22130F2A04780DD80B93B013BA7BA15398794709D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.m.e.n.t.M.e.t.h.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\SalesOrder.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17672
Entropy (8bit):	3.3588217943261576
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWBWPWoWBWDWWjRWjWhWyObW0WjW526TMWlWcWfWimWVWZRoW9GWQP54:DVQ1Q2td/Q/LkQSZsATw
MD5:	C4CD2E361EDC956B313DBEE01CACC03E
SHA1:	D6AAE22665F7A38F1F56DD39F3F1C3593081345D
SHA-256:	ACAC3608ED3DB0E53046AE6D51986296991A2590FE7C6676CC86CB66CEEB568C
SHA-512:	32DF82ED055286B455FE629EF6BC9466EEF1730968019E5EBCE60FBA3D7902678D28ACDF9F1E69D7B8DE06B88B1B0BA9EE33EDDEE60E21C05BC7BCDD97484B24
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\SalesReceipt.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23646
Entropy (8bit):	3.372245064442722
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWhWoWoWBWDWWjRWjW8WhWfW0WjW526TMWlWcWfWimWVWZRoW9GWQP5A:DVQgW2Od/Q/ckQ9qoQ+cDNZsOTw
MD5:	BD02F89803F9C531C85A24D5D58186EF
SHA1:	B273D4345066F8721A1ED18767A511488AF2768D
SHA-256:	C94A930651FB9C73BECEC8221C37D34749CEA2CD4CE4416513B1A16B8731017C
SHA-512:	125DF7E1D70F1631D0BB082C11D13EF22D1438A77F090CE3FAF6BC7A37789C8D907429477041A9ACA0DE53F5B0E2A285AD6E382FAA840FA20DF693E4E2C5A007
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\TimeTracking.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3924
Entropy (8bit):	3.346158044789658
Encrypted:	false
SSDEEP:	96:uDTbWW2VVAWxW4WxW3WTWaW5W5W8iW3iWxhofb:zVV8Tw
MD5:	D6368DF55D96E8A243DE77C4DE5716FF
SHA1:	258C995AB1B1D637AC8A9738DC92710A12B463EF
SHA-256:	71B468801F6D0401C1D57F415E0E8CA05B5B25D535EEEF2DCE17D756F79CA76F
SHA-512:	E5B5899CE5F24559E25717675C822AC629255A3B88C13B49350F794150EEF26FA436C0F442C0C8AF301AAC90C3366446A955BA90CB6A94D8580E6B3FB59CFDC5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.a.b.l.e.S.t.a.t.u.s.<./.K.e.y.>..... . . . .<.F.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Transfer.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	3.3658738196336557
Encrypted:	false
SSDEEP:	48:y+6DLuRUWURUWZRUWVbqRUWSRUWGRUG8FPUW3FPUWhnRnFRUfb:uDLxWzW8WVbdWVW5G8iW3iWxhofb
MD5:	AD10EED0BE58469F4211BD0B49BD739E
SHA1:	95C1BBFBDB5BA1BC2908546BBD89E6C8CEA64990
SHA-256:	5EBF59F236F72AB34E981557C269014F10CC2C305CF881B402DB24D465343FCF
SHA-512:	FCDEF0A646D5D51876E0F137DB3B760AF78C9FBD61F6787890842CF5D8E8764DED519EF58151B099FDE5685020F7DEF5F7E8FC987231E519AF426EC6A325964C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\TransferInventory.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4582
Entropy (8bit):	3.3680537578680694
Encrypted:	false
SSDEEP:	96:uDTaWhWQWmWtWdWGWKWZVW+W3XKWVW8iW3iWxhofb:8Tw
MD5:	E60071D0621D5A15FAD97C168E735A0A
SHA1:	26E62142851B7E8F2ACE2530F48A3997FF5D092D
SHA-256:	012A14B3230223FB17DA860E13E1CB932B2DB2D4B25C06DD463482BE4D49C9AF
SHA-512:	51296D9A2CADF0419C2C3C7C851AE23A4ABC0F74A365F3DE8D205C29A4A86C9975DFEAEE6E96EE903E14887BEBD0E2D79CCA245FFDDD6D8C418F35C587313EB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\TrialBalance.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	3.368119197538534
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRU2EyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWo2EyFWKWHWUWb1KxfS
MD5:	99992F30FCF428E325882BEC39FA7727
SHA1:	2CB68A9D3AB9FBA2A44815AF2BAD507316900034
SHA-256:	EF3BF42B4A3642C7B4BF153EEDA3875FD44C1C0F144F45BA91993014A5FA4E32
SHA-512:	6D8B04C92990AC392F523011AE2E3F9372BC2E3919FBE2614F82B7BCFF98E4B006632EEAC0EDF281CA7580B7A009EACF3C692C5A24CEE5972869D8BA8F241587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\VehicleMileage.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4850
Entropy (8bit):	3.353849500727898
Encrypted:	false
SSDEEP:	96:uDTvWJgHHWwYjWBE7zWPWY4F4KW2VNoWIW4W5WaWyWoW8iW3iWxhofb:iYZVNHTw
MD5:	ADBB383E2E3B4626700B09388095DEF4
SHA1:	9FCA832E044CF69F39C15041D8D40D3731911A6F
SHA-256:	248DBA3F7B8AA576F43CBC8A6A709A034701BCDC121641043F9C517AA1FCFC23
SHA-512:	24E551E17871925A02AEC60DE918A8D860D4E7C9E5F7A61CDC9BAAA93962F5E6CDB14748043E216E267C17023070EADF830A5354B8D55562FFA1AE18D186BE7A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.h.i.c.l.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.S.t.a.r.t.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.E.n.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\Vendor.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14054
Entropy (8bit):	3.349445787282344
Encrypted:	false
SSDEEP:	96:uDTGW3WlW/qnWpTWgW7IPaW9WwW5W2WVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDyl:8qjIPHgT2Xr6Tw
MD5:	351EFE8EAADEFB657A369883B8008058
SHA1:	39005DE89C3B07C6647BAED718992F31183C2901
SHA-256:	BD1EA761F40A5B237157895EC7B968FAF316BAA18F29CFD56331AA5A055D896F
SHA-512:	1313E70F7D267CCD80754FB657A26006F46808573C5C8E62DCF22E26BE58D1B0A931A6D93D509A1798F13C45BA10154AD4E5E0F07AFFA57A4969C11D941C0E79
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.

C:\Program Files (x86)\SaasAnt Transactions\MappingXML\US\VendorCredit.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10518
Entropy (8bit):	3.372758990102341
Encrypted:	false
SSDEEP:	96:uDTQL9WjWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526TMWU:vkFwMlcJm2UTw
MD5:	A3583B6ADFFC7EC05ED71DB9E9953C53
SHA1:	5424661D0367CB8747D64FD69DCCEF9FCFDFE181
SHA-256:	1CD0A38773CEA9C4035D3A57966847E68D2D30137B4545C1C0376EF266F8E896
SHA-512:	F238724627B46A8708BE16A05E04C9EC3F701E5E2228AD78F00B3435B87ABD38F21E777C07017927718BC35E67150BE199968CE42F8EE27AE6F769D965D2F560
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>.....

C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Practices.ServiceLocation.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18112
Entropy (8bit):	6.224403881687228
Encrypted:	false
SSDEEP:	384:D0xk42ZtyvslnQyrgbPyIH/rFzs4zwQW+p2W/1S0GftpBjcw4l:gVenwRBzwcTimwe
MD5:	92A533BE83B7FA43A1B18F009A7D450B
SHA1:	E9AC62EBB0643BFFB243D889C535A8ABCD1BA52A
SHA-256:	34005D6A80434542780C6D192E6ABD07BEA49B2EEB7E43FBFDFE90C2889986E5
SHA-512:	B7AE35D9AB96C51B50998B46B8E73BA61BFC01812853C870872A18A3AA986DB8A66D3B8E173E1D7DD58097C07B07AFB64E5297B4B894B8FA1BF565773856A491
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.gS...........!....."...........A... ...`....... ....................................@..................................A..O....`...............,..............T@............................................... ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................A......H........&..d............$..O...P .......................................J.#.....6z&2.c.d..4...L......\|.<..bK... ....\|e.u(.Q...v..D..#P.fu...........a[\%~..^..<..Y....,.{K....vE}+P.<..a.S+C...y.\..(...."..(....&...(....v(....-.(#...s....z~....o...........2~..........&...o....&...o.......0.............o............o.....s....z....................0............o...........o.....s....z.................^......(.....o.........^......(.....o.........*.0..<.......(...

C:\Program Files (x86)\SaasAnt Transactions\Microsoft.Windows.Shell.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	167808
Entropy (8bit):	6.195069659774702
Encrypted:	false
SSDEEP:	3072:J/c9acTJ2IYK8/UVry6m6ihGAoeA+Ir8qsmkmsm:vcTSKVtcGuAMqoms
MD5:	8C57270AEA8639E85B31749B0CC0A732
SHA1:	4BAE9E7C1B663DE18769C8750FA3693E6FF607C9
SHA-256:	B6E0B3380CD45473F36D3FD822B85591BC2F7D0A1475355DC35E978F412522C4
SHA-512:	F256E33A489D55B72E6DB862F5169D905804416664570CE26849FCABDF7D01DE46E3C0974C20A2DBEC9DE06C87C96BECF8B550AC66E77077EA426C3658CA7C17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L...........!.....j..........>.... ........... ...............................F....@....................................O.......x............t..............T................................................ ............... ..H............text...Dh... ...j.................. ..`.rsrc...x............l..............@..@.reloc...............r..............@..B................ .......H...........h...................P .............................................?.e..O8+r...}H...u+..(7..[>s...:..X2..Qmx...@.a..qcX.tm.L.........w....y%... ................1.'..Sh..]..XRz..E....(.........0...........{.....+.."..}....2...(...........0...........(.......-..-..-..-..,..,..o.....o......+..+....-..r...ps....z......-(...s....(....(.......s ...(!...(......+$..s"...(....(......s#...(!...(........0...........{.....+.."..}.....0...........{.....+..*"..}.

C:\Program Files (x86)\SaasAnt Transactions\NLog.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.092787469309081
Encrypted:	false
SSDEEP:	3:JLWMNHU8LdgCzMvWCFqDmJS49ZpjR+XveHIXViJS4RKbuviyiovB0z+T7R/bTl8z:JiMVBdTMqmc4fJRRYVic4subioG6SP
MD5:	B2704E1CEF8ECD1C60B5F2E19A40046C
SHA1:	B14F64D57DFABF9CBFBCF640BAE7917A6E7B4BFD
SHA-256:	B987E814F9F2382E97C2B6BDA997E8F90F5AF942D33A45C7CC900E26D2183D3A
SHA-512:	66C665EC4E771CA940AAE5ADF028D1917385F5F84E3FE50D3E36AD40DF8BF68A2912D4C29B3058C25BDAB3F6ED4A213E72643FF380911149048DCC72CCF37162
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. autoReload="false".. throwExceptions="false">..</nlog>

C:\Program Files (x86)\SaasAnt Transactions\NLog.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	694272
Entropy (8bit):	5.991317826120999
Encrypted:	false
SSDEEP:	12288:0nq3M3ufU3inL3HzT1hUfYyHrZlrnYW3Y9AxspqZ+NUsQ:0nq3M3ufU3inL36ZDY0sxNUsQ
MD5:	9BD9998FADA60EB7E157148A5D681633
SHA1:	0715F534B854AC2E3660DD073610E2C6426EF274
SHA-256:	5413095E2E536356A2F8FACFCF0818F711BC512AAD8A0034F646CBD4E9F979DF
SHA-512:	D6507DED543D5F2AD1889698067B58D05DFCBEC3613BFAE92D655F5E032A03D7AF4E79D2A2994366D14319F2611C719C61A5C50DA489907608FD906E6C265864
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$............" ..0.................. ........... ..............................."....@.................................3...O...................................d...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................g.......H........0..Pl..........4.............................................."..(......(...."..(......(......(......(.....(........0..).......~..........(C...~......oD......,..(E........................0..).......~..........(C...~......oD......,..(E......................."..(....6.(.....(......0..1.......~..........(C...~.......oF...-........,..(E.................%.......0..).......~..........(C...~....oG.......,..(E.........................0.........~..........(C...

C:\Program Files (x86)\SaasAnt Transactions\NPOI.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1624064
Entropy (8bit):	6.052571347138095
Encrypted:	false
SSDEEP:	24576:tZT15YEMnxqKjtO85VF0+hSI4s6DL/3smZ726t0+wz3Cjd:n058kKK6tsz3Cjd
MD5:	BF253C2BE785726BCD871E11A9B7A505
SHA1:	88D2D52F8F9B737BDAE5A7A4339EC07EEFF41C49
SHA-256:	96AF017990A902EFABCF0BA69B7CE07C2DE15CB45786717E15FF32A5D0252989
SHA-512:	970992D367CBFD84E5A30F45A36E06B7E1B7C196DCC049828D4F5049213F5BEA2267E4EC87FE0BA56297FADFF202943CF8799B0B87FE7D55030B2CBB070D4437
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......\.........." ..0.................. ........... ....................... ......tZ....@.................................0...O.......d............................................................................ ............... ..H............text...(.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B................d.......H...........L............u..p]..x......................................."..(...."..(....:.( .....}....6..oq...(......{....-..(.....{....-..(.+..}.....{....-..(.+..}....V.{....-..(.....{...."..}....V.{....-..(.....{...."..}......0..S........r...p(......,..u....,...t....}....+..&.r9..p(......u....,...t....}....+..&..}......0..A........{....,..{.....o....-....{.....o.......&......(.+.....&..&........(.......(...........7...........:......&...(.......0..S........{..

C:\Program Files (x86)\SaasAnt Transactions\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	525824
Entropy (8bit):	5.856165679472465
Encrypted:	false
SSDEEP:	12288:3MRKBWOcZJToYL7fxWpJd7YxQ+kBadQd:cRmU7xq7Yx0BadQd
MD5:	07E04FD870CEE6F9994921B5AF243B7F
SHA1:	0EA4611EEEE3736963CB718132099624BFEBF460
SHA-256:	52CC6DDF77990FBAAAE4DB593F655610652133CEEADB32262C122D8C9EEA1BAD
SHA-512:	4639A7F77F7A9CAFA38C632332DD5085355623F3D84475374241A64BD110569F504086B479B519E90DDBD471D4A5034239418EBC03277424212E0E6698E64418
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HP..........." ..0.................. ... ....... .......................`......-e....@.................................:...O.... ..d....................@......l...8............................................ ............... ..H............text...L.... ...................... ..`.rsrc...d.... ......................@..@.reloc.......@......................@..B................n.......H........Q..l.............................................................{...."..}......($...:.($.....}...."..(%.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(....0...........{)......(....-....(....*6..s..

C:\Program Files (x86)\SaasAnt Transactions\OFXSharp.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.4109376893062
Encrypted:	false
SSDEEP:	384:xk1dhPuj5yK+sgK+F6JsKFFOosBMR3vBvZshiN0QVyS0KL/o1ZzRSkp0dUP3y:xkBiyK+sgHxoOjMV5xshiN0QVyS0KLik
MD5:	394C8583F38AE35BCBB5C7BA3E851297
SHA1:	4A9F3E7626F8B746844A5A08CFE4389B24599614
SHA-256:	2C85D0CC9D421BD08D04BBB07D45E4CE0F364333C854D7BC888A65C0C5B36725
SHA-512:	6EB815EE65B78FBE517695CDFB2F14001893804DE48731BD5D3D7DDA62298DA750E384FF1B491F2B0694A3A03F0A2B737CD1296A3F25EBF45D1D0607AEA9D0F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..S...........!.....T...........s... ........... ....................................@.................................\|s..O...................................Dr............................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........2..<@..............=.............................................(...."..(....&...(....&...(....Z.....(.....(..........0..Y........o...../.............A...o....(........o....(........o....(........s.......&r...ps?...z............KK.......0..4.......s.......o....s ...o!.....o".....-.r+..p.o#...o$....0.."........s%......o&...(........,..o'......................."..(....j..(....-...(........(....*.0..(.......s$.........(....o.......s.......s ...o!......o.....(

C:\Program Files (x86)\SaasAnt Transactions\Quartz.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	893440
Entropy (8bit):	5.841264701919036
Encrypted:	false
SSDEEP:	12288:DUqZVbUHUqU/Al1HcQBjPvdV3q0C4ckklTZApe26A+6r7A8JbP/qJdzh+:TQ5VdqnEzr7A8Jqh
MD5:	745235D63EBACD6171AB9E3B4FA2C5C7
SHA1:	CCD090E096EBED62F1261F5E6E44D5F25198A3D6
SHA-256:	917D35FBDEC8F1CCECDB0DFCAD7DBE59067988813D712521B4AEE56107C684BC
SHA-512:	4DECB85E51E04D243BD2F917DF43E316664E20C2AA5EF54C5AE8223D47ADC3E9B2DFDA00A840C3DB445F04EEA0901A386EE87F70D3224C31877B6BA82CF72546
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o..[........... ..................... ........@.. ....................................@.................................H...L.................................................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................H.......d[...Y..............d.............................................(...."..(.......&...(......~.(.....:....r...ps....z..}.....s....z..s....z.6.{.....o......:.{......o.....2.{....o...........s....z.2.{....o.......2.{....o.........(...."..(.......:.(......(...+..0...........o.....=...............(...........0...........(....s.......(.......o...+........"..(.........(....b.(......(....(....}.........{..............................................

C:\Program Files (x86)\SaasAnt Transactions\Renci.SshNet.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	804352
Entropy (8bit):	6.347648878213304
Encrypted:	false
SSDEEP:	12288:f5lqga6rBEEKAeWgVmfedIASjLrj3xVvPTrPTrQ2irclmKJMElmMSSMs:TaPEKRGzGc5Dk1f
MD5:	100F3487B7D64026DF5B68138535B734
SHA1:	A7974031C9C6E46897DDF017824949320E251D82
SHA-256:	F6A4BE2A762FFD5A1F8D47C0DEB34C3015D479BD409D01CC96F1D2D0BE55CAA2
SHA-512:	93665D418D08F16F744F37741D50168225CD2B8D3B0DC00CD6C87438A7AA784A04C417084C3D17D833F4A2450718AEB964C4B2D4F5597DAA084F725D8683D207
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..<...........I... ...`....... ..............................[.....@.................................VI..O....`..D...........................xH..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc...D....`.......>..............@..@.reloc...............D..............@..B.................I......H.......,....h...................G........................................{#.....{$...V.(%.....}#.....}$......0..A........u;.......4.,/(&....{#....{#...o'...,.((....{$....{$...o)...... G].$ )UU.Z(&....{#...o...X )UU.Z((....{$...o+...X...0..b........r...p......%..{#......%q>....>...-.&.+...>...o,....%..{$......%q?....?...-.&.+...?...o,....(-.....{......{/...V.(%.....}......}/....0..A........u@.......4.,/(&....{.....{....o'...,.((....{/....{/...o).....*. .p. )UU.

C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3788792
Entropy (8bit):	6.803425488647004
Encrypted:	false
SSDEEP:	49152:5qV7UDbo9c/twWrrnWz0Sbpx2w+NTTGbmSecg7n:5qV7UDbTS/2HTS
MD5:	0F6452633C2790B06B482D15C47B5D0A
SHA1:	31AC756ADC5E16FBFD658E3980E0F0B5BD8BB996
SHA-256:	EEE533B378B832847AE0A60D7E16064E9CEB97E1DC71BD40D4C51888FEBB7066
SHA-512:	2261DD8A0DF69FAEB90094267FBE483FFDFBB9C10E51A59118122F3D9CD541472A8915977D3D3F4C93B050151A4182D9EEC100D61E8C62E0402A8647E6E258FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ue.................09..j.......N9.. ...`9...@.. ....................... :.....7.9...@..................................M9.K.....9..d............9..1....:.....tM9.............................................. ............... ..H............text.....9.. ...09................. ..`.sdata.......`9......49.............@....rsrc....d....9..f...69.............@..@.reloc........:.......9.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4556
Entropy (8bit):	5.132782894119603
Encrypted:	false
SSDEEP:	96:Zr7197KmWo618WhMrNGCKWKJQK5jK/KJsFK5s0KF7:Zr7z7tG18uMrhrBcstFR0C7
MD5:	8840204B9602335E03C6261C20731EBC
SHA1:	DCC6116077630315733A887CEB3D101AED5EC665
SHA-256:	53BB189A6F1696BF1ED9DFB1E7EE4FA2F6ADAF5FF3B8A67EA160A89E55072C7E
SHA-512:	30A01DABBD9BF2ACA7721B74A29BD80C6CFECC7C092D3533BEF1037E34D10B92EF69635085DCEADEDDFCFC495746C2677DE01FBBFC8129B4DAE20DB594231D08
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <configSections>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler,Log4net" />.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="SaasAntTransactions.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.... <log4net>.. <appender name="Console" type="log4net.Appender.ConsoleAppender">.. <layout type="log4net.Layout.PatternLayout">.. <conversionPattern value="%date %level [%thread] %type.%method - %message%n" />.. </layout>.. </appender>.. <appender name="FileAppender" type="log4net.Appender.RollingFileAppender">.. <file value="$

C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2212856
Entropy (8bit):	7.984882716563244
Encrypted:	false
SSDEEP:	49152:xkQTAfvy2l5gF8yChTk90rxraCvj2yzo96yvDii8wma/tMrUzXlpeAPjsm3rG:xafvpjgFQTZxjgiilKrmHeQso
MD5:	D4D3CC4AE87C1D4CC794AD864B211E3B
SHA1:	0FDD5672DBF1533C537F76844B2756DAA1BA9FAE
SHA-256:	A02B86F93D6CF2277723C1B78FDA5F119D40D156CA672CB272A1E9C3F6B573AF
SHA-512:	C3D064B98CE3F375755A3B54ED2062CD445B0E6DB37E6A22F99ECA86B1AF7FA5270A4230616F8863149DC0813CCC4BE1676D138E9DBDECE8B2E8F215983D0DA8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~..................ue....PE..L...t..P..........#................./.............@...........................!.......!.........................................P....`...q............!..1..............................................@............................................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@....rsrc....q...`...r... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactionsConsole.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.1248868457355155
Encrypted:	false
SSDEEP:	96:Zr7197Kyd518WhzDrNGCKWKJQK5jK/KJsFK5s0Kq:Zr7z7Fn18uzDrhrBcstFR0r
MD5:	3E4DA613BBE1C1049BE70B9DB52F82AB
SHA1:	52E0D7398942C4BF971B6B9B7A39FE1AC82F1644
SHA-256:	DD16015CE93A2939EE780E8B06843D78898F0AEC8AB1BAE3DCA466F9454D9560
SHA-512:	158C57557037EBEEE5D30DE7879013266C7F188E606CB000B1F2D125894E0B93EC9C1381E7D4C355ECF5260A5776354913A77004543975AFAA088C4419D499E7
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <configSections>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler,Log4net" />.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="SaasAntTransactions.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.... <log4net debug="false">.. <appender name="Console" type="log4net.Appender.ConsoleAppender">.. <layout type="log4net.Layout.PatternLayout">.. <conversionPattern value="%date %level [%thread] %type.%method - %message%n" />.. </layout>.. </appender>-->.. <appender name="FileAppender" type="log4net.Appender.RollingFileAppender">.

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\01-ETI_Desktop_Sample_Advanced_Templates_All.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	71821
Entropy (8bit):	7.792072809135735
Encrypted:	false
SSDEEP:	1536:3oX00e6wwXNAfYvaeTQPyMhAZ/mJsGvb/WfB4E0I2OWL69Mi:3Jp6fPvBOyMm4JssiB4s2DL69X
MD5:	C9CFBA3A65069FFFED935763D4A7A74C
SHA1:	676053CAC74074248341EAF9A0E16F7ECD58CAFB
SHA-256:	6B339110EC06E73580B01EFDF0B677C9C8FD0509CE16163FFA1E5CB0B825212B
SHA-512:	E6F601F03E9A8F0AB7D8DB886C7FD7E79FFC3AF841F6FDD051C6B0469DD2315EB86140F41054F03D5318D91C31355B38B2FAEF64062F23B5AF95BF218BCD5F7E
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Bank Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9409
Entropy (8bit):	6.835146893058168
Encrypted:	false
SSDEEP:	192:wc8mVxieIb3Uk7paFUlbVvevUqzGBNG7Km:wc3m13xmUlM9zG1m
MD5:	7786245F307AA5E9F53FC02D1D743AF4
SHA1:	EC55E64029FCBB70AB744C291BC2EAF05B9E045D
SHA-256:	AD495770FF19ABB285FF25A0787E53C6472E5629F0058F7369B1DE3E9977B77B
SHA-512:	69134FD79019EF64D84E7E98D3759177C0F4EC34EF03D4FD7F7D5E06E4943C9049CFF668712239F38FA465E8A54D9FC1518EA3724C8957BAE2E1E546D5129DBE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Bill Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9263
Entropy (8bit):	6.811174803774489
Encrypted:	false
SSDEEP:	192:wc8mVXEib3UnoBi5epwbaFUlbVvevUqzFRETys8FqAKY/Qgd:wc3NL3iepwoUlM9zF2TL8EAKkhd
MD5:	F4EE9D1C72D66C00502095D92B51D075
SHA1:	679329C9242F85260591330C280CC36AEC56EE0E
SHA-256:	980E3A62E7255829C7A8FD9DFED72BACA46250EDB551D149592F985E366C3CD2
SHA-512:	79810A162530880E10754A49861A9600EA26EC89ADD1FF22CE2B81B124457EA2E4BDA6CE7B4FEAA24FCF018378135BEE4CCDDA52E9EAAB12796F271C0CF6318C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Bill.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11078
Entropy (8bit):	7.002037492689051
Encrypted:	false
SSDEEP:	192:KNAHvb3UBHJmnYaFUlbVvevUqzhNlQbDj38KeOB5G1Dbzt:KNyj39UlM9zhSDwKnBSDd
MD5:	CC45E37D94AB802C4E60269C255DCAE4
SHA1:	11AC2A6900DC370CD92AF3A556FC6E9E2BE2CD83
SHA-256:	DB3CD0023FF1B155D3114970F51F9C5BB0A368C12D06D7F3E2437E0AE471D135
SHA-512:	7CFFE9E81B0E3336D87FD79430752E181EDFB36C805093FA33C33A717BF3BF4D4555639B924F7797F58CB77DD14F9AFE6411B0669C78F898E3A514863E4D3D9F
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Build Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Chart of Accounts.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9428
Entropy (8bit):	6.8346550146854295
Encrypted:	false
SSDEEP:	192:wc8mV1CMBKb3Ugo+EXSsVp9aaFUlbVvevUqzuap28N/WA5M:wc33CMo34+GPUlM9zuaptlWA5M
MD5:	E46D702786A28A22EBF3E08FFB8E7800
SHA1:	15FC3234E1F7B247A10926E1EC3C79D0B9E1326C
SHA-256:	04E46E45709212C1549A80DC1BC5C371DD5BEF1FFC6AE183392012C6D171811D
SHA-512:	246A846EBFD06BFA70B4A8563F8962511611FEC874B316D4ADA78C99B6988F1B9F187A8F8F0C36F5E4DEF3FAE2EE6E9B63B624905E8977F1EAE8F91C99702413
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Check.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10142
Entropy (8bit):	6.9469252609143055
Encrypted:	false
SSDEEP:	192:wc8mVf5U1/Ab3UGwoN8SGZaFUlbVvevUqznr3xIcuf+:wc395m/g3lwZzyUlM9znr3x3uf+
MD5:	31221D18750154962C6D16D487F6671C
SHA1:	2D4C0DAF65B97FFE8B474016EC89D041F79B6AA9
SHA-256:	337AF1B959DE3B4985C2A12F53E783D0A9A828B800CF33EA86EBEA7E8FDE1091
SHA-512:	82E0206B00F1405DA1392D6699F0604556434806B3F6C0DA7D93117DC300BAE67E717796FADB4E0C64BE089176C50863EE6DBD28E0AD7D621B9600E8B780D042
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Class.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8798
Entropy (8bit):	6.720255988540497
Encrypted:	false
SSDEEP:	192:wc8mVW08Sb3UqRo3/aFUlbVvevUqzrTJNoPnhZZjTy7:wc34y3E30UlM9zrdUhnm
MD5:	1C2DD44337B6FBDECEB7AC25CB944E0A
SHA1:	D8656BF1849FD6667D96D94353FC04278031092F
SHA-256:	A6687AB16520919EBE6AA8065C428E3C06C46B07CDE4DEEF86A53BDC75A9DB81
SHA-512:	2AFD8CCDAC7042B735E8D113F3C05F9498FFAA9F31B7A952977B2113099A1972FD33B7CE77BB957AA803F5F99165A7A58C24E466040421D10326DE09F27FA53A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Credit Card Charge.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10198
Entropy (8bit):	6.9604922120108474
Encrypted:	false
SSDEEP:	192:wc8mVE3Fb3UszomioppCaFUlbVvevUqznr3xazG9OtZdbOsCn:wc3EV3ddpTUlM9znr3xazGYh4n
MD5:	C15464404820B961E00F3A97FF282592
SHA1:	B578DB215DD25CB3A8974A1F47F788F3A36194D7
SHA-256:	0347E93B8C0FB4023B90556828937782C831E62396588355386BF61DA6788B5C
SHA-512:	BE02A4B0188CED7CEECCB678535E2B7B3189F204E33131EB9977238624D391467D4FED08A0B68FFE7783474E0406452479E7C3CBC8A2DCECB66DD72F961D25F3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Credit Card Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	6.906727391175815
Encrypted:	false
SSDEEP:	192:wc8mVFvujyb3UlS8wvqZaFUlbVvevUqzIv5Fyrdt6EuFUNZ:wc3XuS3RSyUlM9zIv5Fy5UjiNZ
MD5:	8A2EEFC6A0436D32E3EB3E5B8155A7AF
SHA1:	CDD2713936FD91DD9F1DBF3B9E61140FC9BD1A84
SHA-256:	56A6DBAF402C0418558E38F2090C0F8E2A18393DD7E2F589DDBAF416F15A1AE8
SHA-512:	59C3D8F203EA614097B39D5A33A6ABCA4E75B5FCC04022423B53136BDD428458F2A60AC1C367A585B06F84C5F070AE58AEE35A515D00EF901B3EC0107CAC8199
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Credit Card Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10209
Entropy (8bit):	6.886777504200445
Encrypted:	false
SSDEEP:	192:KhjHtZb3U3V4DvaFUlbVvevUqzDT+Y+WFdt6Elzoh:KJNx3VkUlM9zDL+mUEe
MD5:	2E35BFFA12C6E81688934CAB032D017B
SHA1:	09B5D4C370B1E28984E22F0F340AC9D8E31D65F8
SHA-256:	33167B04345362F45E2B6DEFE84C4279F776BA4ADEFE04447134ECD76A3D8CC5
SHA-512:	9C834E1D40493D5D98F893E6127DFFB0A68837EB6E54B2F4388247AA4B8A468821BE17C3B897390E5ECB9D9C5DD10209F405F90F8A6504BC4C94E9C8C231242A
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\CreditMemo.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10585
Entropy (8bit):	6.999634894317925
Encrypted:	false
SSDEEP:	192:wc8mVHY0hb3UtdCziWaFUlbVvevUqzGm81q3yjKimQmpzsw:wc3lXZ363fUlM9zGmoq3yjVmpYw
MD5:	3F22FDAEC17F3243E01D91FE93B37AD9
SHA1:	BC4D3968A68304F4CF0EA0236BED2380040461E7
SHA-256:	E0412675ABA85C69A55C8DDEAEFC537FBB723D21269283BE9650959D74E68D71
SHA-512:	CED0EB56D93D77D5C2A792FAB64291DADD657899F003C8BE9049E664FBAE0183584B05DEF6B4524DEACBAE91B59591CD8466A5DA2A2DB602899EA01E0FE4EE9D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Customer Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	6.804106873918999
Encrypted:	false
SSDEEP:	192:wc8mVurLTb3UemlF66WOMaFUlbVvevUqzQ/3Si0K:wc3Kr3QlFfWqUlM9zQ/ShK
MD5:	5A3ABC826FEDD4DDC40F28F91FF2C49A
SHA1:	5B206F8A97E70E3B36A0A16C802E7D7FF1E672D2
SHA-256:	073829AB46F6926D5D88F3356351C92F9B96BECBE647B6961D9C69EB8C068893
SHA-512:	DF6B0F193AF2ABE4AC7B127183F72880EF41869A9AD0D3D7FD29957C414FAF8CB9A5CFF88D315F484BF14F711137FD70B420665FC2733FC683967A4832C472B1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Customer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10806
Entropy (8bit):	7.00455927670836
Encrypted:	false
SSDEEP:	192:wc8mVBBjvt3kGb3UO05NfkgKBZA5aFUlbVvevUqzZJtVMuErD8hzXvp141an:wc3/Br+S39AkL3/UlM9zZJtRs8hzXvpx
MD5:	6A647229C586F23E7FD222CD8B917983
SHA1:	27B732103ABB99938B4EB6B67097491F6245E9B9
SHA-256:	CB761B527FB136E74568EC5F2D2ECCC95AF923BCC7F02EF775AC3A1E0AF1E42F
SHA-512:	58673708D6F85CEB82FB9AB704ADB0A0D69A74EB43CBF38D0CAA0EDBBEF2C2A865D35F1DECC2EE6968EE32F8AD4D7512349D33A4548FBD0102648CF1A834EAA5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Deposit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9334
Entropy (8bit):	6.8245118687473925
Encrypted:	false
SSDEEP:	192:wc8mVxA/9b3UmBFJnT7PaFUlbVvevUqzQ/3SN8W:wc3jAF3H9T7EUlM9zQ/SN8W
MD5:	6701A6B0B167EAFD0375E78A4A2658A6
SHA1:	C2999565414E306DACE2233E94B52A947C66FEA5
SHA-256:	E4E0253ED8B4635ABF5716343C743FBD628447D3942697EEED65685CFFB36A1A
SHA-512:	65FB16429AB0B71C63E7E93DA677A9D897F72F4772EBB8CF4AF6EB2D75A30B6224916BD06C8458697C113A05FA99B3C0DD918E3366C82D1DAB6649BF2B90A368
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Employee.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.021013113154668
Encrypted:	false
SSDEEP:	192:wc8mVBeKnoY8++b3UtVuXgw1gEQ4aGAoaFUlbVvevUqzjBYSHskTMQWbZc5X:wc3XLz8F3xHwG+UlM9z4kTMtZc5X
MD5:	9558B568CD1DEEC125BF9881EADC96E2
SHA1:	438BB1F4CE19852ABF5957A7A9FEEBB820FF9F74
SHA-256:	B6A39B7FDC8CDA82A9B70689F3F1F61354C3C2C0B7BEA8FAB49A85B577CA2AFD
SHA-512:	A85B4060013DB56740BD11F43918BFC12FB018D40F9A8BB680ABEC2720B499751148AFB536BAE6EB8BC3A3D896185934DE0F66DD930FB7B6DB82A3D2B125065D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Estimate.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11408
Entropy (8bit):	7.040857250327687
Encrypted:	false
SSDEEP:	192:KllCb3U+aoT/BrkgfMnaFUlbVvevUqzMWHn9SloDjLOZdjW:K7G3/T/BrkglUlM9zMWH9SkHOZ4
MD5:	EB6F2173E89241455666BC81605A3744
SHA1:	AB4399313AC083E0DFF06419982C7F64C5F0DDC7
SHA-256:	0A9DAC5514807986E50D3BFD5755B11BDC233EB334B851262A1FCB94DDB7E99D
SHA-512:	9BB78F77DDD2AC0A7EA0FF57EFCE8F6A09FBF5990C0C63C12938300171B24DBBE1A3898434B5BAF01E639684D346AFF476092A5BA2F6570DC43A708B75A653C3
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Inventory Adustment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9310
Entropy (8bit):	6.8189561680744255
Encrypted:	false
SSDEEP:	192:wc8mVXQMQgub3UkOqujnLaFUlbVvevUqzQ/3S2Zn6:wc3Xx63XujnYUlM9zQ/S2V6
MD5:	B97EEF588202369F8B876F1423663195
SHA1:	6BADAF761D637C9EB332E9119594EF3576986A27
SHA-256:	9D60D238304CD104A2FC7C17CEFB87CBE802AD0F08D43C955E9D6B0A605F02A6
SHA-512:	3523A17765CD859E046F5B6DDF9E38EE916B0935EB88A7E8510194448C75B7542E1A11C8BE3FDA35CF27EE50B9C92F377D719C3E9379C2DFA8954FFC691C1CAF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Invoice.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11340
Entropy (8bit):	7.034558168346158
Encrypted:	false
SSDEEP:	192:K8L+Yhb3UF8Ds6WFLoaFUlbVvevUqz0zH5eK6z+WlE5a:K8+43iBLlUlM9z65eV+/w
MD5:	D74C95A1AD48C9964B1B27682B3E4E17
SHA1:	47C3DA361C430B40028CBCA998EEB65AFF882D85
SHA-256:	FDDD98280EFA3941D16DEAFE85BB1FB87800D181249478E18BC8110B60300A5C
SHA-512:	3BC69B80D9CF29E2C7E9AAE137AEDFDB552180C6E050A6472E31854ACF7822DECDD08AA293944BF4D0C9B862C2115DACAD918B73B5B093BA3DC71B6D6FF1034E
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Item Discount.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10751
Entropy (8bit):	6.934760300038226
Encrypted:	false
SSDEEP:	192:D0+b3UPnosMuaFUlbVvevUqz2WPpnRxFGMUf0/:D0q3HsgUlM9z2AnfFhUM
MD5:	A19B8A630EDB8370A3B709FB4598A590
SHA1:	FC168E56503A9EFE0E60FDB605A93EB7CA3EEAAC
SHA-256:	79A459642999B71E377F01A021FADA955870EDD4A63B92449A8024FA36A2C2D9
SHA-512:	22F87F18BFE2AFAEB06ED4F90F505598AEEF0D8CFBC62E0CD5422CFB619FCCDCB82A46B9AEEE4AA8DD4CCC0DB6167B3EA623551C2C79FC6CA91A19FD2D8A546D
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Item Fixed Asset.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9636
Entropy (8bit):	6.874857397593093
Encrypted:	false
SSDEEP:	192:wc8mVbS1F4b3URlQzyPertXcaFUlbVvevUqzQ/3SjReK5tr:wc3l6Y3+QzyPktXRUlM9zQ/SjYK5tr
MD5:	6C97C50570FDEAE69D921048FF063ABD
SHA1:	925E4EDCE6D10E67330D04100251829F53C13CA5
SHA-256:	E7B3B3269A7137D9A4784E60B87E72AB94397F822609457D4BAF32778C61EC36
SHA-512:	B2122793F0838B98C87C131A40617FC7B340445FC7B251D50CE6CA134FB388FF867B7964142ED7F7C7FD8901D3A328143C0C3B711C4E767F4BD190D405EAEEA8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Item Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9008
Entropy (8bit):	6.758581176481423
Encrypted:	false
SSDEEP:	192:wc8mVCFDb3UnzaFUlbVvevUqzxk1xQPkM5nsOoD:wc3kf3kgUlM9zLcusOoD
MD5:	6E37867EEE64D3892AEA74BB73483925
SHA1:	CCFCEB314F72660035B3E7C274D40C28D9F08464
SHA-256:	A0EAEF42ABE9CD0BFA595CA90230A22C2B0B0D5B39F6D084DD1882F715D459F0
SHA-512:	C8075365204D8A1B7C8129D2D06D55DCC1F60434259F9E2E9C61A99EC1C2AD7DFAE2941867DB69E98DE9B83EEE0C7BBFCAA7666D4EEE5E3314C5C847A36D04D8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Item Inventory Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9535
Entropy (8bit):	6.8571626406180215
Encrypted:	false
SSDEEP:	192:wc8mV+jfUb3UT5BvhYCsiiaFUlbVvevUqzQ/3SJE/BUSaS:wc3N3IzsWUlM9zQ/S0BLaS
MD5:	79B005C4A9081B3FC61EC5298A62600D
SHA1:	5683FD5645D84EE3181639BB3D404D6661825DA2
SHA-256:	72FDBAC8A845D8FFD09E90050F88F2663783439EB86BEAF04E15044B891BAC7A
SHA-512:	A61DF7D4028DD005B04A6B77175EF337DF07177FD6B4B292552387354F13BFE6A07240766132B7CFF49ABA2FC8EF3108CDC16B1411E6A665E0980E7C4F5CF89A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Item Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8902
Entropy (8bit):	6.741515570203868
Encrypted:	false
SSDEEP:	192:wc8mVdCwiTFb3UL6p3aFUlbVvevUqzxk1xEtN9s:wc3ST3XpMUlM9z9tbs
MD5:	0897DD514B3B8F24F6B54ED967D819F1
SHA1:	B16A9940546B96913E1EA4035C0AEBBF0F9B378E
SHA-256:	019EB7073ADE81163CD299BCFF07F452DA9EE09CD492B699713277D113A8BA36
SHA-512:	B91FFE144D0446A726EE7CEF428E40EF69AC414842B70C896396476D9EBD6332E36723C7115D35721D598B671938E52DEF6024ED9DAB50007BF47CD867D98726
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Item Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	6.898973088547867
Encrypted:	false
SSDEEP:	192:wc8mVK9c/9kV/4jb3UAayghAa9aFUlbVvevUqzMWHn9SR8vFhDTBDq:wc3Aen/3wygOPUlM9zMWH9SR8vFNFDq
MD5:	AD2D0719A7082ADD252ED93DF29DBEA3
SHA1:	9B0ABDFAD5AEC4558A69819BAA4BD4E2C49C4F7A
SHA-256:	CB7F87885506C4C12431257FDDF5456967E5A573927A44CC48278F41D9E138E7
SHA-512:	99962543896C322D06064B92AC3C8865202D1D7DBE192BD1FE5BD8347F1A3B1BF83EF15DF2F3CA2C2E6C4BB538984946ACDDEE0F4E09004FF6772150A0DFDD85
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Item.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9572
Entropy (8bit):	6.8591410772456065
Encrypted:	false
SSDEEP:	192:wc8mVePgw4db3U3cNgSYmIaFUlbVvevUqzxk1x1uydHctD7ecx:wc3UYw4t3qFmFUlM9zfPD7ecx
MD5:	E1CCA320B79E4FE363C2510493B6099C
SHA1:	97AA9F4D525025A73A9E798B98017095EE1E1053
SHA-256:	054E620A0930293871A2789AE706FDC3245E36887625FA5B7DF6E020A164E833
SHA-512:	D0CE5D966C4D0C2A4476C5C2E2727404920561046C3AB2E8F5D608C94C6531C2BDC30FB462A185D1BB18666ACA288B514F90BA5F7966C522A9B725323C1ED245
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Journal Entry.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9165
Entropy (8bit):	6.790829628817651
Encrypted:	false
SSDEEP:	192:wc8mVUUKb3UGRsjMaFUlbVvevUqz32f7J8D76:wc36UO3lsBUlM9z367iD76
MD5:	5BA3282AA143B09BB4C749AC9F59A778
SHA1:	1CD45042BF16ECF82F10B2F1E26217B16A40017B
SHA-256:	D0CC6D919667209BBDEA1CB6E14CFD90720D89849D9BA33A82E2D05E905C4BC1
SHA-512:	265B9130CE8E03D6A48B08F8024B0EDA82180AEBF7A42FE10D3DF53EC1B7CCA0A89C9E9CD04071D2A2B0342CE95B5B0A789E8B5FF4B763443B2162B1AC900342
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Other Name.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9942
Entropy (8bit):	6.880574321203129
Encrypted:	false
SSDEEP:	192:wc8mVIVP5gb3UiE3/+ycaFUlbVvevUqzvMJbjBWNkMf/2oKVGD:wc32G3qRUlM9z4UNFX2oKMD
MD5:	1EFD320BB319BEC7314C291AB4844DC3
SHA1:	D07899C98E925FF095F777E13B260311CE1EA1CB
SHA-256:	6F6DC81D587C005625D282223BDFE046BF377F6C810713325F10FC7F7EE9AB92
SHA-512:	DA13B789D2F95D7AD0D81BC75209DBE08394CBDC89873247442D7E997999B4EEA351C55E4E52F49D105182E815CFA70F70C1B9F225BC073ECD0B80B87E406088
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Price Level.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9107
Entropy (8bit):	6.779691843621978
Encrypted:	false
SSDEEP:	192:wc8mVc8zb3USVx5p1joaFUlbVvevUqzxk1xfTd7P:wc328v3XxvxlUlM9zC7P
MD5:	DDB1A777F2BFE417F8D0D1DE53662C05
SHA1:	04A40137A4D32E177E302AE4DF988DF8E1A996F1
SHA-256:	9CB1C01D2C72B8A36A0749BF12AC7ED7E2C60EEFD32090B5874A0D7520CABFB9
SHA-512:	754126DCB416564CEAAE0194852966999148DC733E6D71FDE84CDA16A75A322A59A500AAC05494AB8BB53F3C59AF7757B61DCBC42495FCF926A973F9E9E4FADC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Purchase Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10212
Entropy (8bit):	6.9585940246465805
Encrypted:	false
SSDEEP:	192:wc8mVIBTanb3Uxj5kmaCU+aFUlbVvevUqzYDxeGZL:wc3mBTab3WjlaC8UlM9zYDAGZL
MD5:	CB19033D56B615821E7A14DA7FA94A24
SHA1:	D19DEE1C92DA51BD909D06C7755484A88C4F0822
SHA-256:	D07DD5808CF886316EC12DF0DFDA21611C1296C0758B0310618F0711A3276B22
SHA-512:	1A58418DF5EAD2D67B46E9220B4853278C1628554F47E65D008569EDA3DA593162B88D803DC9B879D37D3952475ADA7F0EA28153B8D66A0F10331B45248681B2
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Sales Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	6.993302047378494
Encrypted:	false
SSDEEP:	192:wc8mVKaagb3UopdpwaFUlbVvevUqzYDxZWP6cvnzNFfXAW:wc3ga3PpdLUlM9zYD3WP6szzfAW
MD5:	A51DEBCCE7CCE3AEDCB4BBC96DBBA8EF
SHA1:	CA9C083F72AC92059785B7356919DB38C424ACD9
SHA-256:	787C092492F3293CE06B875976E3B25C6B57FC5786FD070958BBC5B059713798
SHA-512:	EB649DE96C0F0843005103D5D8984D2C53F69D4902B5FC410F097BDB9CA7CAFD81164EFE7B1EA81B49849EA2AB459817D7080DAD68B5DA24E075277EEF4719ED
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Sales Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10563
Entropy (8bit):	7.000994706243713
Encrypted:	false
SSDEEP:	192:wc8mVPS29jRb3U0Ma/cj4ing8ooaFUlbVvevUqzYDx5TSTm3IEX:wc3U2j3PMOZFUlM9zYDD53hX
MD5:	A6AF62DC0A1B0D64B62B92F2A394A903
SHA1:	368BDAF6D16882018C5C058F36AD7EAD98C5E569
SHA-256:	C320E36C1C63F0111F87A610252BBD77C651E15208D33A7C4208BDF5144D7375
SHA-512:	EB383F99ED44CE5AD1AB5719A0047388BE9FBF9A4FD8BFA99F0BE1FD0E3C54AE6CF823E56F4FC6698976F83A224A030D645488252568F341BA8A4430B24B23B6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Sales Tax Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8878
Entropy (8bit):	6.738910117567037
Encrypted:	false
SSDEEP:	192:wc8mVK4qNU6g5b3UXnhhzsaFUlbVvevUqzxk1xcoasbBKE:wc38tgR30nZUlM9z/ENKE
MD5:	57A1600221F6BAF16D271409A90E6961
SHA1:	5AE582F5D78661B93FC13B5CFDCB3A243A41EB66
SHA-256:	45A1D852E6D465C9FDA030C8B621B74075EBF9B4FA45EBDCAB53A7ABE7C65075
SHA-512:	48E01EF950EC6B3AB4523A46DF961BBD6F177EB1D7F65F1843AE21C371BE94A73B1E3B802CEB881EB687340323818882801E7E4BF3466341094C7BC2A7320F7E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Sales Tax.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8877
Entropy (8bit):	6.731786945467423
Encrypted:	false
SSDEEP:	192:wc8mVEtuXjzrb3U08xkyamaFUlbVvevUqzxk1xpwpppdn:wc3wmzn3AFavUlM9zgwpndn
MD5:	2E40D56C244D5BC0BD2E33345167DE2D
SHA1:	6759D0A8E6A710417BB5396278323989B7050EF8
SHA-256:	5F07DDEB0383EDD7140C065C1619CC257A99CB10AACFA6F53615575F971BA188
SHA-512:	8D7E18C7952A0A8CA8E888531D2A92C9AF1A497179B83D0E796569BB6BD2697CB4F2B3DF596EEE422B7819F40411401F5FB31C2FDDF8B2AE9112D7B58DBEB1BD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Statement Charges.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9195
Entropy (8bit):	6.80403615435195
Encrypted:	false
SSDEEP:	192:wc8mVcmuIub3U6DbISLaFUlbVvevUqzQ/3SsLlZk1/:wc32I63FbuUlM9zQ/SSZk5
MD5:	D59FDFD946BEDA6FEF78DBB5573BDFBC
SHA1:	E05EC9E34694CB6CAC2033643774B438CF1DE3D1
SHA-256:	A844F3925A61BD5689D3FFC577F2FEC536E968B42930DD1C648DC8C95C53E8E5
SHA-512:	DCD44F952C450A235E9EA64F978D93068990BF6326017E54A2D3E9F15ECFFA8BCAB94AA195AC63BEB15ECC4CAE9D672B686A1D9D3A7E275BFEE6BE3F7AE112B5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Time Tracking.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9030
Entropy (8bit):	6.765434751177057
Encrypted:	false
SSDEEP:	192:wc8mVsib3U6jjcycyoaFUlbVvevUqzoDmhoCnoyQ:wc32m3BjHUlM9z8CoyQ
MD5:	A99CC77D26C2F03CA5AA587DF34A9501
SHA1:	949F9E0697F5CAAAEEF5E1D42488DC046FD4B50D
SHA-256:	17BFBEF2D1546F59C7BD072D3DF13FC619FBC68745963D98B332EAC6F3A2038B
SHA-512:	D32FFA9A66EAFD3A3F2A52152B58CAF9C8CBEB9EE8F6CEE0FEF16AAAB60E9259C15DB8922A2CEB653C069B50003583B3B0D1F4184A391E2B94CA75569B1DC997
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Transfer Inventory.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9079
Entropy (8bit):	6.780184862313751
Encrypted:	false
SSDEEP:	192:wc8mVyQl5b3UCsHvJFcpaFUlbVvevUqzQ/3SDnlhY:wc3kQf3UICUlM9zQ/SDnlhY
MD5:	5176457989D44739BD45A5AFFE8C76BA
SHA1:	5D260894372376DD3B98D935743EEF67AA68121C
SHA-256:	DE1711A1DAEA88F2F7778B2F7BA7BFBC12E207D03A6B3D88C462003E9D1E1640
SHA-512:	35B1A24EA2A2BFB11C6FB7168D1C4F96A3D31C3B4CD563D65F07EC44529951B433E74B603C7EC9C746C54515A64C461FAD2F316156C1A15C942DECFDF95A371C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Transfer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8927
Entropy (8bit):	6.7447222021488455
Encrypted:	false
SSDEEP:	192:wc8mV5b3UpCehQWaFUlbVvevUqzoDmhecRWxsBo:wc3P3yhuUlM9z6cR24o
MD5:	D931EF04D1779CDD007C3C0BA5201DD0
SHA1:	801A29AABEF972C41A9186D256B058FDF942F26E
SHA-256:	D01BDBC91EAB65E485DCA7C91FE6C47620BEDFF99B6E3B5F7B9060FAF072E929
SHA-512:	21506B3B2376068133A1C5CA061FD3BCB8B4A72CFCCB882FAD9B7BACCF4A82240933ED6F6A7B06D13238CB5DA0D31FB3921B883E7428E6DF22CD56988842CEE1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Trial Balance.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Vehicle Milege.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9141
Entropy (8bit):	6.782145844796253
Encrypted:	false
SSDEEP:	192:wc8mVadAb3UxeFFaFUlbVvevUqzQ/3SBBBosPiu1:wc3AS3n2UlM9zQ/SBjos6u1
MD5:	A0403054E8EC020532ADB27CD91E1604
SHA1:	49FE13F6CB42F28579FEDF768F1F10312407B00A
SHA-256:	EAAB2188E3128256846E56C6D42BF921E3286A06E05DAF993197F0829CE8A155
SHA-512:	3649310E6023FBD26FBC2548F1BBDCB3EFCF4837B8B5D90372E7A4DA2FA588FCE876558478ECA83C504A27094A4B6EF8DFEC33BC629897E517594E1B6EA3B24A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Vendor Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9788
Entropy (8bit):	6.890099926914943
Encrypted:	false
SSDEEP:	192:wc8mVakT+SYb3U5bA7EafaFUlbVvevUqzMWHn9SDGtNjci11:wc3kI+S43SEqUlM9zMWH9SytOi11
MD5:	AF3C6C8E2D69E51B391806619BD49937
SHA1:	FCC8AE968EB274339923B88686EF229E278DB991
SHA-256:	1842387ECDDB1432025D6BB501A901F0F8D4F2D23C00CC303CB2F36E56E42395
SHA-512:	F7D8EA3A96096735FF849B0257EA7914D54176D22D1CC5BBF87F2B159B767A0B4FEB37E531DD4F8876E0F5E7E8BCFEC3AF4A5E6DC7A2E2B234EBEC05835E2743
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Advanced\Vendor.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10521
Entropy (8bit):	6.960581353008388
Encrypted:	false
SSDEEP:	192:wc8mV5BMPb3UFfcYipGSyaFUlbVvevUqz0aO5GDSoloZY45Mth:wc3Ji3Zn8SDUlM9zjTBl2Y4Gth
MD5:	93F43677DAF2D9348053DA5512A6A667
SHA1:	05CA5E521C9DD38FA63AA644EFE1595564F3FC68
SHA-256:	C074167D13B825ECCE798A1C861665E9494561B64895096F26F0B3C43A4476E5
SHA-512:	3E315E75DE816E8D7DFF055352E2B3D5B0559640EDBE7230096D4D3DA3B3B5237727AA030E6BD0E795983C61B2361817172E6D654C5A4AEC49F44F92A86FF9D5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\01-ETI_Desktop_Sample_Basic_Templates_All.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	60608
Entropy (8bit):	7.72158777055586
Encrypted:	false
SSDEEP:	1536:xEjn/qO0hC6y2mwU4NKf/QWHcIfRij037fXKkvb/UjDUj6T7:xEjaC6hdU4G4WHnE0rvHiUj6T7
MD5:	2FC2034D6E43283CBDAEE5625C29388A
SHA1:	51431CCB4B3645690F32B90FB89767BF21CEF86E
SHA-256:	ED8C776FAF95DB425BF2FD1EE4DA5521FC40FBD051A345B5FF2FB7727A3BF219
SHA-512:	A6A30231DAE53D79B1D38C7B0EFB33D724CABA83C2F83DE2A9B2F8F4203935CD2EBE74624C3D9386572EE432204992CFE9CA366A841B87D4346FF88237B10E77
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Bank Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9179
Entropy (8bit):	6.794915179830353
Encrypted:	false
SSDEEP:	192:wc8mV8pOvxKwRkib3Ue6gS2KkxaFUlbVvevUqzGuPK8I:wc36gp530/2BKUlM9zGx8I
MD5:	A9F59D704F0046C9DDF4BC78AFE0602E
SHA1:	642BFAA1A38C106BD33200BFF3156A20731BC922
SHA-256:	07C8A96AC8204EB1067781D38AD07A2ACA03AD892A01D1C10CE2DAFC33A2D7A0
SHA-512:	248328CE90C2F316BCBD26C200031001D13F08768C23A8CC56D918D14CC2FAC82A11439379A2929F8D13C85B4E49B19D251AD302F5C535FC48B19AD72B7A6AFD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Bill Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9137
Entropy (8bit):	6.792737999962153
Encrypted:	false
SSDEEP:	192:wc8mVsTu3zb3UOc8aFUlbVvevUqzFRETysPnDr6gEZ:wc3yTu3v3yxUlM9zF2TLPnDXi
MD5:	12DC3AEB3063E4CD6D2EEE73254AA628
SHA1:	3B8B1C277D40112E34E0D22FBDF5CA7DF325D00B
SHA-256:	7E7B631CD1A09AB185EFC2D6DBC2B195830A29659EB99E8E9C06C3AE336FFE6F
SHA-512:	5C1A6AC09F388E49FEBF5FF28D26D15F627E53E7DBE7AB4AE51B723440CE88BC95CE316F0D777CD8ED61DE4F49482D9EBB357178C6EA455FFFC083CE54C19D4B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Bill.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10310
Entropy (8bit):	6.902085495948442
Encrypted:	false
SSDEEP:	192:KD1+gb3UAP7lAaFUlbVvevUqzhNlQbDj3qZnRDbzi:KZ+A3HP7l9UlM9zhSD+ZRDS
MD5:	C7AE2C022CA8C673A89C837DE7E9141D
SHA1:	43D508EDCA6A9809E7691240F6314396A66997BF
SHA-256:	1B5F8058535D5454D6C4A81258784D6CB874AD2506EE4F15CF8AFEE33940879F
SHA-512:	9AF3203737D2A79041B356CA93C4F70C733FAF8462F6D6D80B3901046C6F9D2A74EDE85CA8EBE0F708CA67FEBD1F5E9C02284066AB8E1FBBAD177D02290052E5
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Build Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Chart of Accounts.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9364
Entropy (8bit):	6.821970615427216
Encrypted:	false
SSDEEP:	192:wc8mVHw0B6db3UMY1ZFo7T4aFUlbVvevUqzuaToA5HaE:wc35w0E3gHoVUlM9zuakA5HJ
MD5:	09E8A762CE42B56F03B800563478CD10
SHA1:	80FF7AEEA1DA861732DB3F0D1D17F3144F3D979A
SHA-256:	DFBB8620DECC816F2085D2FEC636C3CDB928CD0EB25CB3492B200DEC39ACE84B
SHA-512:	09A0A3A5EE8962E023DE27DB5C99B1F2276078524E2CB1352528BDE1EE2F2F8A6CF60C71B5CEE3639B09CBADD2C9D1637E9B2886C439C35C0E3D361F90A820FB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Check.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9279
Entropy (8bit):	6.811763392150569
Encrypted:	false
SSDEEP:	192:wc8mVSFrLeGMmb3UlbVPgh/aFUlbVvevUqznr3xae/xL6nz:wc34rrN3ydgh0UlM9znr3xae/x6z
MD5:	54A0DB0C902D4940B94C3BC1A06523E1
SHA1:	0C875F23CD656DB873FCCC1D80095144F0AB310C
SHA-256:	37D5A0526FBED14A7D290975C3FF57DC1F55404091C3F3FA0FAA63E1D5AAA1A6
SHA-512:	A8CB79E0B7B6CB40999A698FF26CF3B8CAA6E8B888F78D46BB010B3BBB6F5590C4713B45466CB8391C7A54CCB38A9ADA44D20490E79731B1A06E6ACF2D0451ED
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Class.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8830
Entropy (8bit):	6.729273799907828
Encrypted:	false
SSDEEP:	192:wc8mVnT42Xb3Ub3C0aFUlbVvevUqzrTJNoPnhhTqJ:wc3G2r3bUlM9zrdUhxo
MD5:	6F0F3638E5D2A4D9FDBADB93A620AE5E
SHA1:	52ECC7CD6C4F98712D414909EF8F86F893958DF3
SHA-256:	7413628012ED627A283149A01B7273BD900330CF917B524319F73DD34D7E71D7
SHA-512:	D4B6526D8FCA703196834775AD24A22B53E093BA93B0379B970839568E1F67FCA68C0B682214052994971CA558DB5290662B82496A1DDA9BAD5A7665B29CD1DF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Credit Card Charge.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9423
Entropy (8bit):	6.839785295716797
Encrypted:	false
SSDEEP:	192:wc8mVJ4HUIkGCb3UOGW95ZlnaaFUlbVvevUqznr3xSFbOsCK9:wc3ge3FZlnLUlM9znr3xY4U
MD5:	AF5B372522E9D8654675DEFA4F408156
SHA1:	513AB2B83145F3AB267C16906CB234962A473A21
SHA-256:	76FFC405EE86CA3314BBB6EF1108A8ABDEFD4D5C718A1FD63A69AF736808D3DB
SHA-512:	312719ED149D193044396BF9234F069F3F3C01185DC2139DB9C6FD0B1820C373576F7FEE94148701F9A1B20B5CD3788AC3FE4E45B07815EEDFCD14605EFCBA08
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Credit Card Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9300
Entropy (8bit):	6.813928011985626
Encrypted:	false
SSDEEP:	192:wc8mV7hC9d3Cb3UorVFraFUlbVvevUqzI41y/LxI:wc3Zc73G3HAUlM9zI2cxI
MD5:	2ACEB40AEC0AEEBA1C0AEAC2029D846F
SHA1:	F64308248680B91371053134B6A1BD5A745D45EB
SHA-256:	5CEB84B7E74F7C17B43B9605E6BCC9A54C43213E9DD01D930521CC05933C98B2
SHA-512:	22150751FF4B387F0CB7BA401220260E4C6C97E7881661F9F52273311B92A06957591DA87FE09EED06D2F08008EA3CB17C86485CBB9A1396633DBC470EF3EC63
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Credit Card Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10042
Entropy (8bit):	6.860852476669272
Encrypted:	false
SSDEEP:	192:K93SOA1Lwcb3UxpkiaFUlbVvevUqzDVN+Wvy/MzX0:K93y1UE3NzUlM9zDL+sfj0
MD5:	D5C2BB7A2A6AAFA67A5CEC0851F1279C
SHA1:	4ED0A99525B8617B34A34F3E8CE3963248E9188A
SHA-256:	FBA508F6B2733B9D9CF2DE93A09B0E6EA7F75AF08AE11A323E4F17E662FC5371
SHA-512:	81C8DE579826ACED62EF053ABE18083E7720FC9B9ADEF61A6F6B463257CD18BD99920AF78EEABF228756D30E4ABA176911D9063446082E177EA396AC15F9D771
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\CreditMemo.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9271
Entropy (8bit):	6.811643027566105
Encrypted:	false
SSDEEP:	192:wc8mVf2U35b3UAZTaFUlbVvevUqzmpPhEYoxR9ss9:wc3Z2ER3jZAUlM9zE5m9H9
MD5:	CCFE8245FF49E0FE0D036E51BF7D3F63
SHA1:	55CE309D4FEC86D442EB345CF0B81FCD149EEBA3
SHA-256:	9A43623D564057B84AB29AFBA4288EEC96CE2FA18106DA572C67CC0844F11AEC
SHA-512:	5C4391D145FDAA8B568B0E6F06C3B5D385E6EF351C7ABE83422CA5549FC1B86A9396445EE919D0EC0DEA5BDFF8ACEAA5CDF17AB41BE4899AA0741BC67A1E0333
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Customer Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9105
Entropy (8bit):	6.781014209396833
Encrypted:	false
SSDEEP:	192:wc8mVvURb3Umzlp+aFUlbVvevUqzQ/3S7O/xLUy:wc3Y39lVUlM9zQ/S7O/xUy
MD5:	1B0657CB32BEBB1FD5DD1C2FB1B749C3
SHA1:	7BAEAA0FB0885C0F004CDE7443E8183D828DFE28
SHA-256:	37D8820AE95851BC491E32275B57B2D8BE84DBBA016A4358C5D7F50C377B0B9B
SHA-512:	5CDE34D9A602E4F9942250A434844DFAF95E9C7C6C9E23C3AC3780837A0F7A770C765B13856271C75431465F07999051B794AEE56A9737CA219779F8FD3702FB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Customer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	6.865386475865739
Encrypted:	false
SSDEEP:	192:wc8mVt+6DKPv9+b3UiKpaFUlbVvevUqzZJtVMNSX5I41663:wc3Piv83zfUlM9zZJtTX571663
MD5:	08057568E24A84432911C7480B9BA2F8
SHA1:	D35A457F40D2116417108295718214C67DBFC56C
SHA-256:	653929EB88C5F7526D51CE15C5E95D0005EB071509E5185CDB4A04C7E31D6C3B
SHA-512:	1BA361B34327CC831B5F4F1F2FC6429E81C8F28A1B158790D4798027BC9EF19F69CBBA48B2C4F043C1E92AD970FCBB3EDAFD2ACE9F68D344EE680817848CEE78
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Deposit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9174
Entropy (8bit):	6.7924481974634565
Encrypted:	false
SSDEEP:	192:wc8mVi3b3UMTFaFUlbVvevUqzQ/3SFsw5:wc3UL3B2UlM9zQ/SCw5
MD5:	6A72B5C256385E38490AB05902A2A3B0
SHA1:	EE772D71C3596FBDDAD106051A5D101B794F55B2
SHA-256:	DDB241E0E9064DA7443D8876B27A9A69D06CA6669D4FA5E281EA1A9C5CD56684
SHA-512:	546B143348EB1A45D9A620C663F96DF90C0056DE2593ED7C7909B3913DBE0BDCF05FD549ABCB1DDC1D9AF7A65A46880F17A0A03A6FC0C26392514F9AB9878F60
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Employee.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10662
Entropy (8bit):	6.978039342816095
Encrypted:	false
SSDEEP:	192:wc8mV76EzJb3Uz2Q/m6aFUlbVvevUqzjBYSHjYVQWmHgrxG:wc3sE93WyUlM9zrjYVoArxG
MD5:	B14A9C7D27DD7712A0B8788A45B7BDD1
SHA1:	17C3203A89ADE5D0D6A2666F2F96355002A5D158
SHA-256:	3C0B72549EA06721309266918917A8827703CB25FB0E9B13998BE25ACE9BD820
SHA-512:	E502E0B643CF69DF67D27FC7735B17FF5FC089AF5BB1A5321DD654604FF121929C234919564AE4ABBA9656C62367534DFFE3607DFA3A13427584BE290C9C8668
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Estimate.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10179
Entropy (8bit):	6.878884512140004
Encrypted:	false
SSDEEP:	192:K+v3LU/Mrb3UHL8aFUlbVvevUqzMWHn9SyWv+xLVS:K+v3L+Mn3YLxUlM9zMWH9SyWv+xQ
MD5:	111DC57DAE120885E74B1A2E22FC42CF
SHA1:	916CF01E9CAD15CF072F0121B3B75571C4FAC98A
SHA-256:	01E72D36A12BB15310D91DBBBA126A8BF292E24DF5511907752A4BEA27CEE4F3
SHA-512:	92A28A0D08DC161B35C3A6C19BC3B141CDAB69380A089517AF4B1F251FA193B53A0AD9E0140C07ECA414CCFB2C8B8B85AE197BBE93075FFD173C91DA2C2886DF
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Inventory Adustment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9205
Entropy (8bit):	6.800891004632689
Encrypted:	false
SSDEEP:	192:wc8mViLvVab3U5Knw7m0YaFUlbVvevUqzQ/3Sjmvun1:wc3sE35w62UlM9zQ/S91
MD5:	989A01BD9C8C7239F25814AAC66E462D
SHA1:	54E62D002F5DABAAA38849F40323DC7A3876491B
SHA-256:	2C1DAA59560CB8248D9D8DD4F1B526AFDAD8F0B7F044F78D7091B1DDB42E5779
SHA-512:	B5981FAB999D5C67D11EB1CD1098530E18C0181D982F00CC01303E0B11D53EE4207F2A0E1BBE4491775355E35D57F99C7A035ABCFB65F5A9C732178CDC3D6CDC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Invoice.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10311
Entropy (8bit):	6.902523632816974
Encrypted:	false
SSDEEP:	192:KlQnZsb3UFdNmiaFUlbVvevUqz0zP7+WX6Y9+:KYZ03CeUlM9zE7+M19+
MD5:	E0E05A34B4EED3129E3DFFC054D1F070
SHA1:	1593B64E4185A1FEBF3FD6CD5DD3152ECB260B76
SHA-256:	E163E2DEBB21D40EFFF3196F1427923CBD8DEBC92D4A10B6E645D27B92D5E68F
SHA-512:	798AC0AAD0A4571E58606FA476F28D596D5B753365C00807BD09578985C647F2E2B53108483982D5B66386A707B5FE6423C12F2B7C75BC8A35E71391E2B8B619
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Item Discount.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	6.910242705829882
Encrypted:	false
SSDEEP:	192:DK7Y3k6b3U+FBN4BaFUlbVvevUqz2RIMpQc6Omow7:DKk3J3vV4aUlM9z2OMpQ7f
MD5:	32B22473DEFDD10651778BFE40BA7F38
SHA1:	2238007231F2DCF3AE7765F62872936DE662508D
SHA-256:	DB5C17DCCB68E77BE29FD9F237918BB72661D88D76629889663B7935F492DC8F
SHA-512:	CA1E16A6816031BB980DAA92CD252494B726E3875151E386AE747CA56B6C524AD1EB0BA543FC729B7E8781E3A3702349C4E0502E624B01446BA93279260A0057
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Item Fixed Asset.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10342
Entropy (8bit):	6.908061401318368
Encrypted:	false
SSDEEP:	192:Krsb3UFi7jscVaFUlbVvevUqzQ/3SjeFFtQTeKfz:Kr03iinsTUlM9zQ/SjevNKfz
MD5:	274DC88AA87B2FFB6A900B9569F25AC3
SHA1:	356AF0CBB48026F0989F71E6A443601FE4106E72
SHA-256:	A0821C5ADAC4CA9B0F95B470B9DA09F22695B0C1B645C437C6729DC919C2FC58
SHA-512:	493A40314200F831EB11E010C15AA2470373D02E17918D79208E341EA568EDF0E244A10EE2DBD991A2F679E9B68A7BA260FEF28C43447BD01BACAD9DE2A671AE
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Item Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8939
Entropy (8bit):	6.751801640397702
Encrypted:	false
SSDEEP:	192:wc8mVhHmW+yM41b3US32wraFUlbVvevUqzxk1xQMH5nsOoEJn:wc3+t8l3X32w4UlM9zTMZsOo2n
MD5:	5F268BD22DF45BA9C0D41CDBAC0F10AC
SHA1:	AC4C7E080F58E4F4B22EA6C1217C54009F6D90FC
SHA-256:	A3710B7AC9F8FBF6A2D59477A7CE708E52215C1DBCC5A1164FDB19799D7A4BCF
SHA-512:	7E77DFA1D17378EFC7514EB152C0CFE4B06A7CCA1732E63617E84B67A69BD75503F5AE49F75199D75CC42278EAC07992FC960D76DE46C41F1216D9162C786749
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Item Inventory Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9301
Entropy (8bit):	6.8182471050909585
Encrypted:	false
SSDEEP:	192:wc8mVxj7v8b3UXMZZDoaFUlbVvevUqzxk1xJOF1wA:wc3H3k36MvDlUlM9zlaA
MD5:	220029E3F585B178E6FD911D95CC8161
SHA1:	B6F0373EC85C3C59ED954D198E0DAE49905B8B98
SHA-256:	95D82427661DCD43BE1139A010524E2572CDD65005CD3BA3BC30E71E891761E5
SHA-512:	DA67C32A8F12CA26C2DFD8E03FB77743A980E61D9FD7B82CD4B1C9032A9A85F463496B65A14AD96DBCB47B2107E963BA450354EEDA938A74A84DB70F55BE0A62
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Item Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8904
Entropy (8bit):	6.741967696983345
Encrypted:	false
SSDEEP:	192:wc8mV6aK2bb3UZ5lE0aFUlbVvevUqzxk1xh0PC:wc3Uc33EoUlM9zLPC
MD5:	511021BBC919910B7BFE88EDD692FE9F
SHA1:	A3F5F0276F944D2F110C4B5B67B1E5379649DC13
SHA-256:	CF048FB4F41EAFFA959CB6CFA378981D84C5BB0998B49686303573DCAFBA591E
SHA-512:	CB27226285CFC60CCC5C0ED9323D3E154F9D3A214AC5D08CED4215622098CEE30C3A12D46E370DF30F361AAD752DC973BB4EAD0A1466F04A6A69B2514EAB4768
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Item Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9159
Entropy (8bit):	6.790575326802142
Encrypted:	false
SSDEEP:	192:wc8mVd0llCnb3UOFn4u6aFUlbVvevUqzMWHn9SmngBPI:wc3f0f23P54aUlM9zMWH9SnA
MD5:	F988A3154CFC4A0A24B40D4DADD6B165
SHA1:	1FA4289E808748C3A65A4CB7A5F4FA93D6F76163
SHA-256:	9388FBEBDA3CAC8B4B44C4AD4B90376F3A678BEB8182C5EBB5EB2E6713A89909
SHA-512:	458E108052968AFA9C4944133D6DEF95D82773BD39EE0F75923F71828822E12EAE89811B0063E945B281ED8A6F0683ED3D2E56CBE5E8210335948BA76CC26334
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Item.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9293
Entropy (8bit):	6.8141719578289255
Encrypted:	false
SSDEEP:	192:wc8mVDC9NMb3UkNFC+/SNMaFUlbVvevUqzxk1x2D+HtD7CP:wc3FC9S3fB/0BUlM9zrmD7m
MD5:	2FC32E74CF43FD1CC9F15B4D6FAD6F23
SHA1:	5B6018F0660F03A0AEC7CD79CDF06B5724AEEC87
SHA-256:	31D1F2BCDF03328C577F42F412557018C75A44F113AFAA230B1B8D43E3DD2AD5
SHA-512:	73FF985EF939D89A1CECE9A582744B92C400B1742CEF5440846AD88881CF36D0A2E7B619BF85A34EC04126EEE1A08A2FBF0FC0E493432A09D746DD5C3CD6B81F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Journal Entry.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9093
Entropy (8bit):	6.77631031314201
Encrypted:	false
SSDEEP:	192:wc8mVcKEXb3UB7n2tyaFUlbVvevUqz32fNPR7b8fU:wc3a33GnWDUlM9z36NJcs
MD5:	43FD14A8C807C600DA56C934B028AC62
SHA1:	104B533622E0706C09C3E8DC54710B1F82D2A21C
SHA-256:	91D6391C2DD44B951DDFD136AA7ACEC0EFB298796C19557EF1E7AD587D312C19
SHA-512:	0004BAD639F2A45E4AF3EF08DB8D635829AEE60072C80E5CB12E037AA5529BE2D3FA10541C907DA40D032808DA45E1A58808578E4C0D4BC77AB5819FBE339089
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Other Name.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9977
Entropy (8bit):	6.881824897442895
Encrypted:	false
SSDEEP:	192:wc8mVgF6skEmb3U8rpU4yaFUlbVvevUqzvMJbjBWNkMfBR7VoK2ej:wc3C6sE3du4DUlM9z4UNFHhoKfj
MD5:	350480A984ACB80CF21F542D4CDE9823
SHA1:	00091FA7BED5E8BC6D4D32AC9F5BCB6FA06B07F6
SHA-256:	311A12234259B32BACD59FA164CE5BE2023786DE3BDBDE1FF1DBD6F31ACB11F8
SHA-512:	1C54C073A5D4212699BA136A1D9B91A8E725BE6E8541F23823FCDBC7805A197791D3FD839AC8FA58C077C1B877F1F3ABF528D25EE04DFA31DAA03508994F7D9F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Price Level.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9142
Entropy (8bit):	6.782431923212374
Encrypted:	false
SSDEEP:	192:wc8mViNEB6Qb3Uyim/9fetaFUlbVvevUqzxk1xKhnJ1q8f6VY:wc3jBF345+UlM9z3d7SVY
MD5:	2506630D2BEEA9C1868E7741DEE13D2B
SHA1:	0C2FFE451D4C10AA5A08B415CA8E88D03B03C55F
SHA-256:	6A667EB4303F007954E8E51A2D8D06729C4D18982EBDC53DB81D571D2A99A887
SHA-512:	90C7E14D51657AC8385DC023F4101398E7F6392ECEB0D76A058ED1D2E809C50BF057B0F09BA7986EC19F6391B5C507405EE3F4B5F0B3B4FE33B10C825955E50F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Purchase Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9250
Entropy (8bit):	6.808163260128793
Encrypted:	false
SSDEEP:	192:wc8mV0+NRb3UbKsIQaFUlbVvevUqzYDxX++fqa2:wc3FNp35UlM9zYD3ya2
MD5:	7A3007D4C7D6A735AADAD4272E05BA64
SHA1:	1571CBD2207B346AD1E3540CF31C6B27094988FA
SHA-256:	D1418C308F1D895E88BC9F7293E72D03D05AF01368E37E9E3032BD7A14F0C17B
SHA-512:	5F8F33A6292A6C03E45D4BBB38BD60DCB9AF32E9C23705F78AD2070074AF6344CD64404BFD97E215DAA247284B5A67DE2C5B3E0793C68BEF17E83B2BEBC34099
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Sales Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9262
Entropy (8bit):	6.806043299070465
Encrypted:	false
SSDEEP:	192:wc8mVXZb3Uw86AAkaFUlbVvevUqzYDxcgSQfXBa:wc3Bx3xRAuUlM9zYDTLfBa
MD5:	DFABD8959A1CF9284CBC958557A6BC11
SHA1:	D2701208198885731EF8FE25D9D2BADD6C422E23
SHA-256:	FF80F6BFD07318A31225C0BFBBBE9D92A40A2F9A474FF228105EAE2C302DB1F9
SHA-512:	572744C2AA9FFE5DB9935D60B668D3DF917569A4B78EE1C3269E3426297F926DEB53F30AE508688094438F393D8A216B9D701E347D9B9897F58217F3F79D73C6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Sales Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9212
Entropy (8bit):	6.79823789885158
Encrypted:	false
SSDEEP:	192:wc8mVeuWugPb3Ulhj1OhaFUlbVvevUqzMWHn9SBpRKhOIEIS:wc3EFx3ghO6UlM9zMWH9SPRKhOhf
MD5:	17357BDF06F4DB40706B6FE701830D4D
SHA1:	80105281255CB887BBD56DD1CAB9BACC9CB0F8F4
SHA-256:	2080703D1094096953772CEAC224A8C5CBA1470E8CA0B214AEF0910C61E59B32
SHA-512:	9AE1A8085F92F1BCB444239AB6FF9B1EACFE60197F6054C15FAEB2015D0B84D73CA5D3DA266F91BB3D3EFF7F146C0A20C3AC982E6187B4804B5700EFDB465717
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Sales Tax Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8903
Entropy (8bit):	6.746206691996274
Encrypted:	false
SSDEEP:	192:wc8mVVRZC3+b3U/1xMaFUlbVvevUqzxk1xccOasbB2:wc3nR43q3s/UlM9z/hN2
MD5:	F4E307557F1304745D2221BE28BDAC8F
SHA1:	E37F9CA0B0DC157C2ED14021536594A834543E84
SHA-256:	87177848091C9392F8681B54CE82FD8897ED1A50A03CAB6FB493C13422E1A62E
SHA-512:	9677FECC6EF16172BEDDD661342F7A62ACFD8D67BF7783878CCF0BC3772AF3B418811C9F6EFE0ECFE95172273FEFA99579C66BAAB3595AACA71960A7EF795874
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Sales Tax.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8905
Entropy (8bit):	6.745897938150198
Encrypted:	false
SSDEEP:	192:wc8mVCg6xRcb3UQn0XaFUlbVvevUqzxk1xpGpb:wc3Q5DE3znhUlM9zgqb
MD5:	EB8F39AB8EE40E48CDD5191AAE8ED020
SHA1:	23EB3219094EC7DB1607EF900B7C4E6D53153680
SHA-256:	E67EAC32A26A25FD2EA2FE4601F4D42CEB5031494A47A383BC272071F5C3005A
SHA-512:	D8B3CF08CAA5AC3E92BAFDEEBD04B604A6AEB9E56A7062427A8A404B93C39B4C2AED107EC650A89CC27F9ACCAC75BF767FC622EB08925EC37BC20C6C88484324
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Statement Charges.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9102
Entropy (8bit):	6.7850184234097215
Encrypted:	false
SSDEEP:	192:wc8mV5UtZ2Ub3UxPseGxvTaFUlbVvevUqzQ/3SIJ5i:wc3f2M83ctc4UlM9zQ/SY5i
MD5:	DAF53A1E6A82439CBAB24CBC7356365D
SHA1:	A84BC61A1CD6ADDF6FC3E146CBB51173E24D5BAE
SHA-256:	2110753916F77DDFC14B1379F0BB2B010E8AC828EDDEB3AB111B0E9A44F5B9AD
SHA-512:	39999E226CB4FD2E9CE0E1AEAEA8D6AEB7CCC735DFFA26F25F0F152EB0FF37C702B890FAD7F06FBF7F1668D949CB34EB77447789A009EE05CD1636113A1BA0F9
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Time Tracking.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9034
Entropy (8bit):	6.769753878312157
Encrypted:	false
SSDEEP:	192:wc8mV/cGYDrWb3U1oEipaFUlbVvevUqzoDmh1veK5noy5R:wc3hcGWW3SiCUlM9zleQoyv
MD5:	67B314265F3E444E28B6AE3B8215BEF6
SHA1:	844568E31FDA53C40B7A47B9CCA7B07BFA51EE84
SHA-256:	4ECCB5D5F240EC7FA276B8962E8E0F16EB9E4F3DA7E702DD67DDA9724F6A718C
SHA-512:	1EC806B8A9FC894C0AA7B64574983D79FFE6793B7379BE220B0155C51E2BB63CF8EC41AC9EC6FD89DC1536C30A02BE326CDEDF397379685F25BD34253A88B1AB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Transfer Inventory.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9081
Entropy (8bit):	6.779563405224094
Encrypted:	false
SSDEEP:	192:wc8mVTYJBJb3UmiaIdaFUlbVvevUqzQ/3SuyylhS8:wc3O13HdUlM9zQ/Suyylhv
MD5:	C2DB2CBD357B3AF84F47456F4210E3AF
SHA1:	595E4FF7467CDF793C70BF82C02BAD5C840A4E6B
SHA-256:	C18ED83E70DF157700C1A608E612325FC79622F7A3728B045C9CA5BFF6BB0ACC
SHA-512:	116C655938D358B5B5A644C7975F38BB2355AEEE6AF3056F94331BA88C575F4501334D2B60EEE036F14DF3C4D04267F41119A518522A378EC9209100D3461663
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Transfer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8933
Entropy (8bit):	6.7475711333237465
Encrypted:	false
SSDEEP:	192:wc8mV4yybeeuUb3Ufkx3R3NaFUlbVvevUqzoDmh64:wc3+eeu83HMUlM9zm4
MD5:	FEE9D3BDED7551DAE9FFD5A560BEB49B
SHA1:	F3D16C4AE99AE1A5EFE9956A7E763072E3C8049A
SHA-256:	E61C23FE64FE8A7A2FF9AF1C9C930444F499F2000154DDED356ADE81685E2BC6
SHA-512:	3004A79F8242260FBAFE0051928906C0CC7061E735852485A975672E9E9C1590B5B02B76017C5BAEF04B060F34196867DBB3493474CF637F22A3B8D3260974D2
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Trial Balance.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Vehicle Milege.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9069
Entropy (8bit):	6.775976988880308
Encrypted:	false
SSDEEP:	192:wc8mVSgx68b3Un4T92bqi/aFUlbVvevUqzQ/3SzYPi8q:wc3Ugx6k3vTfUlM9zQ/S868q
MD5:	46CBF18F2A34DEC0D2A552F7D29B172D
SHA1:	E2277962AD39FA3E2258C48CB0260DE3AAEF3311
SHA-256:	B942929F61942CC36C5D1BACA8D432E9798A639BAB630FEB10501ED31F18CD02
SHA-512:	594BA58DA7F2E97344CBC2132BE6845EEAD70F966EC9D3A83448C0DF8200ED62919FAA2E8FA424A6285A2D478EC03D8B8A096DDE81E9F19E3EAAC1C21B9959AE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Vendor Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	6.79917826988387
Encrypted:	false
SSDEEP:	192:wc8mV2s/ypEb3UauTu/b7yaFUlbVvevUqzMWHn9SL0ciT:wc3s6F3huTyb7DUlM9zMWH9SLbiT
MD5:	A2537669E02FD8E38CEE1FB144B2B5D5
SHA1:	841E29BA7C6B41BA94E4BFCF913290F356DAB431
SHA-256:	6D8C3D2EC8BE937FFB7EF0EEF5AF207893C15CA41147BCE2EBC9ADF9447C8CDE
SHA-512:	D2844FB50CF9B639113325F9AADF118B1E688D50E28D8EB37DBD96B215F57845B88E9B91BD0622D3E9B36C8EA5377BDD3F12F71587605605A1CEB601A8934E9E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Basic\Vendor.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10550
Entropy (8bit):	6.970001374614585
Encrypted:	false
SSDEEP:	192:wc8mVQzfnb3UbkxdBxTi7KaFUlbVvevUqz0aO5GDSvY4OiW:wc3SzD3jovUlM9zjTgY4OiW
MD5:	41F22C302B54096D0FF445534616A9BF
SHA1:	7256BD503A3906AE16B0990DD5CDA48FF52EDF1A
SHA-256:	F6B059ADBF7F18CA8795E1C8CC730BF6D11A228871EF20D4DF1DADB90787BB72
SHA-512:	CAF25BD0FD91B665633BF87808A31EEB6406A501A62936A1B9041D008AF7D7F7E15A534FED9C5708768E3F595F1727C7AC5A99605CF0B3544BA1A7E228DFCD2D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\CA\Lookup\LookupSample.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	6.819620975894779
Encrypted:	false
SSDEEP:	192:iRhjwAvOb8XpS0iaFUlbVvevUqzDCiMzg65AtgfFvof:iRhHOypbUlM9zWiMtWOfGf
MD5:	F36B43F28EF0C3ED040587F011567BFB
SHA1:	4D6535CE089E6CA11571C84A28B38BBDF82733C1
SHA-256:	EB1172F0C1BF6D6D5ECD22FB08B48D148F8C20D07CD9039B4DE8C3516E3459E0
SHA-512:	0374F75FB3DDCF2BEC7DFC6A00C059FB823F55A48641FDD021E81DD71D5D54D472C51B42ADECB3D4020E5F2E3F21F001359B90F8A9A8C4563020DD4F3B21F0A9
Malicious:	false
Preview:	PK..........!.....d...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.....U.S..0M.....7.....C#.$......`....@.Q...~qc....f+.h.+E...\.q.R.O..;.!)....J.......p....g;,EM....Fa..8...(..8.AU.5.9..ne.....Z.1.>.L--eOk..%.`Qd......kEL*WN.r.w..g...M.........`....FC6Q.^T..rm......a..J?.......W...Ai....EZ.F...>...Q...a..\|I.D..?q..;..y~)...#m,....=.\...."w...~j....;.> wr...o.6;.,...\|7k..v.)pv..3.t..Lsm........PK..........!..U0#....L......._rels/.rels ...(.............................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\01-ETI_Desktop_Sample_Advanced_Templates_All.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	71782
Entropy (8bit):	7.791937463737708
Encrypted:	false
SSDEEP:	1536:z/X00e6wwXNAfYvaeTQPyMhAZ/mJB/Gvb/WfB4E0jWL6B5:wp6fPvBOyMm4JB/siB4WL6B5
MD5:	F9C39F66AB7282AF2B0FF81B6DC740EE
SHA1:	23C0995F93DF582935C68989353B1BE57544093F
SHA-256:	7B09E43366AD6847BE39788FCD9A8E825B19279A86F48EB492E96AE5689EFC43
SHA-512:	FEB8DF39A0AFBB197C261F3EF6994FE74A98851D53FE3C3AD517A60CF3F8CA02FF31DA383C15DFB3FFFF51106198B935F62EA8EA1CEA567B97413D3DBA4CA2B4
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Bank Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9409
Entropy (8bit):	6.835146893058168
Encrypted:	false
SSDEEP:	192:wc8mVxieIb3Uk7paFUlbVvevUqzGBNG7Km:wc3m13xmUlM9zG1m
MD5:	7786245F307AA5E9F53FC02D1D743AF4
SHA1:	EC55E64029FCBB70AB744C291BC2EAF05B9E045D
SHA-256:	AD495770FF19ABB285FF25A0787E53C6472E5629F0058F7369B1DE3E9977B77B
SHA-512:	69134FD79019EF64D84E7E98D3759177C0F4EC34EF03D4FD7F7D5E06E4943C9049CFF668712239F38FA465E8A54D9FC1518EA3724C8957BAE2E1E546D5129DBE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Bill Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9263
Entropy (8bit):	6.811174803774489
Encrypted:	false
SSDEEP:	192:wc8mVXEib3UnoBi5epwbaFUlbVvevUqzFRETys8FqAKY/Qgd:wc3NL3iepwoUlM9zF2TL8EAKkhd
MD5:	F4EE9D1C72D66C00502095D92B51D075
SHA1:	679329C9242F85260591330C280CC36AEC56EE0E
SHA-256:	980E3A62E7255829C7A8FD9DFED72BACA46250EDB551D149592F985E366C3CD2
SHA-512:	79810A162530880E10754A49861A9600EA26EC89ADD1FF22CE2B81B124457EA2E4BDA6CE7B4FEAA24FCF018378135BEE4CCDDA52E9EAAB12796F271C0CF6318C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Bill.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11078
Entropy (8bit):	7.002037492689051
Encrypted:	false
SSDEEP:	192:KNAHvb3UBHJmnYaFUlbVvevUqzhNlQbDj38KeOB5G1Dbzt:KNyj39UlM9zhSDwKnBSDd
MD5:	CC45E37D94AB802C4E60269C255DCAE4
SHA1:	11AC2A6900DC370CD92AF3A556FC6E9E2BE2CD83
SHA-256:	DB3CD0023FF1B155D3114970F51F9C5BB0A368C12D06D7F3E2437E0AE471D135
SHA-512:	7CFFE9E81B0E3336D87FD79430752E181EDFB36C805093FA33C33A717BF3BF4D4555639B924F7797F58CB77DD14F9AFE6411B0669C78F898E3A514863E4D3D9F
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Build Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Chart of Accounts.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9428
Entropy (8bit):	6.8346550146854295
Encrypted:	false
SSDEEP:	192:wc8mV1CMBKb3Ugo+EXSsVp9aaFUlbVvevUqzuap28N/WA5M:wc33CMo34+GPUlM9zuaptlWA5M
MD5:	E46D702786A28A22EBF3E08FFB8E7800
SHA1:	15FC3234E1F7B247A10926E1EC3C79D0B9E1326C
SHA-256:	04E46E45709212C1549A80DC1BC5C371DD5BEF1FFC6AE183392012C6D171811D
SHA-512:	246A846EBFD06BFA70B4A8563F8962511611FEC874B316D4ADA78C99B6988F1B9F187A8F8F0C36F5E4DEF3FAE2EE6E9B63B624905E8977F1EAE8F91C99702413
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Check.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10142
Entropy (8bit):	6.9469252609143055
Encrypted:	false
SSDEEP:	192:wc8mVf5U1/Ab3UGwoN8SGZaFUlbVvevUqznr3xIcuf+:wc395m/g3lwZzyUlM9znr3x3uf+
MD5:	31221D18750154962C6D16D487F6671C
SHA1:	2D4C0DAF65B97FFE8B474016EC89D041F79B6AA9
SHA-256:	337AF1B959DE3B4985C2A12F53E783D0A9A828B800CF33EA86EBEA7E8FDE1091
SHA-512:	82E0206B00F1405DA1392D6699F0604556434806B3F6C0DA7D93117DC300BAE67E717796FADB4E0C64BE089176C50863EE6DBD28E0AD7D621B9600E8B780D042
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Class.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8798
Entropy (8bit):	6.720255988540497
Encrypted:	false
SSDEEP:	192:wc8mVW08Sb3UqRo3/aFUlbVvevUqzrTJNoPnhZZjTy7:wc34y3E30UlM9zrdUhnm
MD5:	1C2DD44337B6FBDECEB7AC25CB944E0A
SHA1:	D8656BF1849FD6667D96D94353FC04278031092F
SHA-256:	A6687AB16520919EBE6AA8065C428E3C06C46B07CDE4DEEF86A53BDC75A9DB81
SHA-512:	2AFD8CCDAC7042B735E8D113F3C05F9498FFAA9F31B7A952977B2113099A1972FD33B7CE77BB957AA803F5F99165A7A58C24E466040421D10326DE09F27FA53A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Credit Card Charge.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10198
Entropy (8bit):	6.9604922120108474
Encrypted:	false
SSDEEP:	192:wc8mVE3Fb3UszomioppCaFUlbVvevUqznr3xazG9OtZdbOsCn:wc3EV3ddpTUlM9znr3xazGYh4n
MD5:	C15464404820B961E00F3A97FF282592
SHA1:	B578DB215DD25CB3A8974A1F47F788F3A36194D7
SHA-256:	0347E93B8C0FB4023B90556828937782C831E62396588355386BF61DA6788B5C
SHA-512:	BE02A4B0188CED7CEECCB678535E2B7B3189F204E33131EB9977238624D391467D4FED08A0B68FFE7783474E0406452479E7C3CBC8A2DCECB66DD72F961D25F3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Credit Card Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	6.906727391175815
Encrypted:	false
SSDEEP:	192:wc8mVFvujyb3UlS8wvqZaFUlbVvevUqzIv5Fyrdt6EuFUNZ:wc3XuS3RSyUlM9zIv5Fy5UjiNZ
MD5:	8A2EEFC6A0436D32E3EB3E5B8155A7AF
SHA1:	CDD2713936FD91DD9F1DBF3B9E61140FC9BD1A84
SHA-256:	56A6DBAF402C0418558E38F2090C0F8E2A18393DD7E2F589DDBAF416F15A1AE8
SHA-512:	59C3D8F203EA614097B39D5A33A6ABCA4E75B5FCC04022423B53136BDD428458F2A60AC1C367A585B06F84C5F070AE58AEE35A515D00EF901B3EC0107CAC8199
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Credit Card Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10209
Entropy (8bit):	6.886777504200445
Encrypted:	false
SSDEEP:	192:KhjHtZb3U3V4DvaFUlbVvevUqzDT+Y+WFdt6Elzoh:KJNx3VkUlM9zDL+mUEe
MD5:	2E35BFFA12C6E81688934CAB032D017B
SHA1:	09B5D4C370B1E28984E22F0F340AC9D8E31D65F8
SHA-256:	33167B04345362F45E2B6DEFE84C4279F776BA4ADEFE04447134ECD76A3D8CC5
SHA-512:	9C834E1D40493D5D98F893E6127DFFB0A68837EB6E54B2F4388247AA4B8A468821BE17C3B897390E5ECB9D9C5DD10209F405F90F8A6504BC4C94E9C8C231242A
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\CreditMemo.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10585
Entropy (8bit):	6.999634894317925
Encrypted:	false
SSDEEP:	192:wc8mVHY0hb3UtdCziWaFUlbVvevUqzGm81q3yjKimQmpzsw:wc3lXZ363fUlM9zGmoq3yjVmpYw
MD5:	3F22FDAEC17F3243E01D91FE93B37AD9
SHA1:	BC4D3968A68304F4CF0EA0236BED2380040461E7
SHA-256:	E0412675ABA85C69A55C8DDEAEFC537FBB723D21269283BE9650959D74E68D71
SHA-512:	CED0EB56D93D77D5C2A792FAB64291DADD657899F003C8BE9049E664FBAE0183584B05DEF6B4524DEACBAE91B59591CD8466A5DA2A2DB602899EA01E0FE4EE9D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Customer Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	6.804106873918999
Encrypted:	false
SSDEEP:	192:wc8mVurLTb3UemlF66WOMaFUlbVvevUqzQ/3Si0K:wc3Kr3QlFfWqUlM9zQ/ShK
MD5:	5A3ABC826FEDD4DDC40F28F91FF2C49A
SHA1:	5B206F8A97E70E3B36A0A16C802E7D7FF1E672D2
SHA-256:	073829AB46F6926D5D88F3356351C92F9B96BECBE647B6961D9C69EB8C068893
SHA-512:	DF6B0F193AF2ABE4AC7B127183F72880EF41869A9AD0D3D7FD29957C414FAF8CB9A5CFF88D315F484BF14F711137FD70B420665FC2733FC683967A4832C472B1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Customer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10806
Entropy (8bit):	7.00455927670836
Encrypted:	false
SSDEEP:	192:wc8mVBBjvt3kGb3UO05NfkgKBZA5aFUlbVvevUqzZJtVMuErD8hzXvp141an:wc3/Br+S39AkL3/UlM9zZJtRs8hzXvpx
MD5:	6A647229C586F23E7FD222CD8B917983
SHA1:	27B732103ABB99938B4EB6B67097491F6245E9B9
SHA-256:	CB761B527FB136E74568EC5F2D2ECCC95AF923BCC7F02EF775AC3A1E0AF1E42F
SHA-512:	58673708D6F85CEB82FB9AB704ADB0A0D69A74EB43CBF38D0CAA0EDBBEF2C2A865D35F1DECC2EE6968EE32F8AD4D7512349D33A4548FBD0102648CF1A834EAA5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Deposit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9334
Entropy (8bit):	6.8245118687473925
Encrypted:	false
SSDEEP:	192:wc8mVxA/9b3UmBFJnT7PaFUlbVvevUqzQ/3SN8W:wc3jAF3H9T7EUlM9zQ/SN8W
MD5:	6701A6B0B167EAFD0375E78A4A2658A6
SHA1:	C2999565414E306DACE2233E94B52A947C66FEA5
SHA-256:	E4E0253ED8B4635ABF5716343C743FBD628447D3942697EEED65685CFFB36A1A
SHA-512:	65FB16429AB0B71C63E7E93DA677A9D897F72F4772EBB8CF4AF6EB2D75A30B6224916BD06C8458697C113A05FA99B3C0DD918E3366C82D1DAB6649BF2B90A368
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Employee.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.021013113154668
Encrypted:	false
SSDEEP:	192:wc8mVBeKnoY8++b3UtVuXgw1gEQ4aGAoaFUlbVvevUqzjBYSHskTMQWbZc5X:wc3XLz8F3xHwG+UlM9z4kTMtZc5X
MD5:	9558B568CD1DEEC125BF9881EADC96E2
SHA1:	438BB1F4CE19852ABF5957A7A9FEEBB820FF9F74
SHA-256:	B6A39B7FDC8CDA82A9B70689F3F1F61354C3C2C0B7BEA8FAB49A85B577CA2AFD
SHA-512:	A85B4060013DB56740BD11F43918BFC12FB018D40F9A8BB680ABEC2720B499751148AFB536BAE6EB8BC3A3D896185934DE0F66DD930FB7B6DB82A3D2B125065D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Estimate.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11408
Entropy (8bit):	7.040857250327687
Encrypted:	false
SSDEEP:	192:KllCb3U+aoT/BrkgfMnaFUlbVvevUqzMWHn9SloDjLOZdjW:K7G3/T/BrkglUlM9zMWH9SkHOZ4
MD5:	EB6F2173E89241455666BC81605A3744
SHA1:	AB4399313AC083E0DFF06419982C7F64C5F0DDC7
SHA-256:	0A9DAC5514807986E50D3BFD5755B11BDC233EB334B851262A1FCB94DDB7E99D
SHA-512:	9BB78F77DDD2AC0A7EA0FF57EFCE8F6A09FBF5990C0C63C12938300171B24DBBE1A3898434B5BAF01E639684D346AFF476092A5BA2F6570DC43A708B75A653C3
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Inventory Adustment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9310
Entropy (8bit):	6.8189561680744255
Encrypted:	false
SSDEEP:	192:wc8mVXQMQgub3UkOqujnLaFUlbVvevUqzQ/3S2Zn6:wc3Xx63XujnYUlM9zQ/S2V6
MD5:	B97EEF588202369F8B876F1423663195
SHA1:	6BADAF761D637C9EB332E9119594EF3576986A27
SHA-256:	9D60D238304CD104A2FC7C17CEFB87CBE802AD0F08D43C955E9D6B0A605F02A6
SHA-512:	3523A17765CD859E046F5B6DDF9E38EE916B0935EB88A7E8510194448C75B7542E1A11C8BE3FDA35CF27EE50B9C92F377D719C3E9379C2DFA8954FFC691C1CAF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Invoice.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11340
Entropy (8bit):	7.034558168346158
Encrypted:	false
SSDEEP:	192:K8L+Yhb3UF8Ds6WFLoaFUlbVvevUqz0zH5eK6z+WlE5a:K8+43iBLlUlM9z65eV+/w
MD5:	D74C95A1AD48C9964B1B27682B3E4E17
SHA1:	47C3DA361C430B40028CBCA998EEB65AFF882D85
SHA-256:	FDDD98280EFA3941D16DEAFE85BB1FB87800D181249478E18BC8110B60300A5C
SHA-512:	3BC69B80D9CF29E2C7E9AAE137AEDFDB552180C6E050A6472E31854ACF7822DECDD08AA293944BF4D0C9B862C2115DACAD918B73B5B093BA3DC71B6D6FF1034E
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Item Discount.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10751
Entropy (8bit):	6.934760300038226
Encrypted:	false
SSDEEP:	192:D0+b3UPnosMuaFUlbVvevUqz2WPpnRxFGMUf0/:D0q3HsgUlM9z2AnfFhUM
MD5:	A19B8A630EDB8370A3B709FB4598A590
SHA1:	FC168E56503A9EFE0E60FDB605A93EB7CA3EEAAC
SHA-256:	79A459642999B71E377F01A021FADA955870EDD4A63B92449A8024FA36A2C2D9
SHA-512:	22F87F18BFE2AFAEB06ED4F90F505598AEEF0D8CFBC62E0CD5422CFB619FCCDCB82A46B9AEEE4AA8DD4CCC0DB6167B3EA623551C2C79FC6CA91A19FD2D8A546D
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Item Fixed Asset.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9636
Entropy (8bit):	6.874857397593093
Encrypted:	false
SSDEEP:	192:wc8mVbS1F4b3URlQzyPertXcaFUlbVvevUqzQ/3SjReK5tr:wc3l6Y3+QzyPktXRUlM9zQ/SjYK5tr
MD5:	6C97C50570FDEAE69D921048FF063ABD
SHA1:	925E4EDCE6D10E67330D04100251829F53C13CA5
SHA-256:	E7B3B3269A7137D9A4784E60B87E72AB94397F822609457D4BAF32778C61EC36
SHA-512:	B2122793F0838B98C87C131A40617FC7B340445FC7B251D50CE6CA134FB388FF867B7964142ED7F7C7FD8901D3A328143C0C3B711C4E767F4BD190D405EAEEA8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Item Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9008
Entropy (8bit):	6.758581176481423
Encrypted:	false
SSDEEP:	192:wc8mVCFDb3UnzaFUlbVvevUqzxk1xQPkM5nsOoD:wc3kf3kgUlM9zLcusOoD
MD5:	6E37867EEE64D3892AEA74BB73483925
SHA1:	CCFCEB314F72660035B3E7C274D40C28D9F08464
SHA-256:	A0EAEF42ABE9CD0BFA595CA90230A22C2B0B0D5B39F6D084DD1882F715D459F0
SHA-512:	C8075365204D8A1B7C8129D2D06D55DCC1F60434259F9E2E9C61A99EC1C2AD7DFAE2941867DB69E98DE9B83EEE0C7BBFCAA7666D4EEE5E3314C5C847A36D04D8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Item Inventory Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9535
Entropy (8bit):	6.856166349790785
Encrypted:	false
SSDEEP:	192:wc8mVAAHb3UT5BvhYCsiiaFUlbVvevUqzQ/3SJEnpW:wc3qA73IzsWUlM9zQ/SYpW
MD5:	2C3695A087699206B586BEAB488BBFE8
SHA1:	9B2C4C4E40F1B73F759817B9816E4206FC10381C
SHA-256:	26DE8AA89E3BD37E9416348713241EDC1434D0E520F22687316924B7792A1C22
SHA-512:	87F10CC5FEFBC50C95BBFF6596A88B416002A5266D7B534C968D7CA05707F5041F1D4BB24DD7993F48E3377D4B409163BAACB33A000B9B927B46D1BA86768E84
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Item Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8902
Entropy (8bit):	6.741515570203868
Encrypted:	false
SSDEEP:	192:wc8mVdCwiTFb3UL6p3aFUlbVvevUqzxk1xEtN9s:wc3ST3XpMUlM9z9tbs
MD5:	0897DD514B3B8F24F6B54ED967D819F1
SHA1:	B16A9940546B96913E1EA4035C0AEBBF0F9B378E
SHA-256:	019EB7073ADE81163CD299BCFF07F452DA9EE09CD492B699713277D113A8BA36
SHA-512:	B91FFE144D0446A726EE7CEF428E40EF69AC414842B70C896396476D9EBD6332E36723C7115D35721D598B671938E52DEF6024ED9DAB50007BF47CD867D98726
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Item Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	6.898973088547867
Encrypted:	false
SSDEEP:	192:wc8mVK9c/9kV/4jb3UAayghAa9aFUlbVvevUqzMWHn9SR8vFhDTBDq:wc3Aen/3wygOPUlM9zMWH9SR8vFNFDq
MD5:	AD2D0719A7082ADD252ED93DF29DBEA3
SHA1:	9B0ABDFAD5AEC4558A69819BAA4BD4E2C49C4F7A
SHA-256:	CB7F87885506C4C12431257FDDF5456967E5A573927A44CC48278F41D9E138E7
SHA-512:	99962543896C322D06064B92AC3C8865202D1D7DBE192BD1FE5BD8347F1A3B1BF83EF15DF2F3CA2C2E6C4BB538984946ACDDEE0F4E09004FF6772150A0DFDD85
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Item.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9572
Entropy (8bit):	6.8591410772456065
Encrypted:	false
SSDEEP:	192:wc8mVePgw4db3U3cNgSYmIaFUlbVvevUqzxk1x1uydHctD7ecx:wc3UYw4t3qFmFUlM9zfPD7ecx
MD5:	E1CCA320B79E4FE363C2510493B6099C
SHA1:	97AA9F4D525025A73A9E798B98017095EE1E1053
SHA-256:	054E620A0930293871A2789AE706FDC3245E36887625FA5B7DF6E020A164E833
SHA-512:	D0CE5D966C4D0C2A4476C5C2E2727404920561046C3AB2E8F5D608C94C6531C2BDC30FB462A185D1BB18666ACA288B514F90BA5F7966C522A9B725323C1ED245
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Journal Entry.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9165
Entropy (8bit):	6.790829628817651
Encrypted:	false
SSDEEP:	192:wc8mVUUKb3UGRsjMaFUlbVvevUqz32f7J8D76:wc36UO3lsBUlM9z367iD76
MD5:	5BA3282AA143B09BB4C749AC9F59A778
SHA1:	1CD45042BF16ECF82F10B2F1E26217B16A40017B
SHA-256:	D0CC6D919667209BBDEA1CB6E14CFD90720D89849D9BA33A82E2D05E905C4BC1
SHA-512:	265B9130CE8E03D6A48B08F8024B0EDA82180AEBF7A42FE10D3DF53EC1B7CCA0A89C9E9CD04071D2A2B0342CE95B5B0A789E8B5FF4B763443B2162B1AC900342
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Other Name.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9942
Entropy (8bit):	6.880574321203129
Encrypted:	false
SSDEEP:	192:wc8mVIVP5gb3UiE3/+ycaFUlbVvevUqzvMJbjBWNkMf/2oKVGD:wc32G3qRUlM9z4UNFX2oKMD
MD5:	1EFD320BB319BEC7314C291AB4844DC3
SHA1:	D07899C98E925FF095F777E13B260311CE1EA1CB
SHA-256:	6F6DC81D587C005625D282223BDFE046BF377F6C810713325F10FC7F7EE9AB92
SHA-512:	DA13B789D2F95D7AD0D81BC75209DBE08394CBDC89873247442D7E997999B4EEA351C55E4E52F49D105182E815CFA70F70C1B9F225BC073ECD0B80B87E406088
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Price Level.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9107
Entropy (8bit):	6.779691843621978
Encrypted:	false
SSDEEP:	192:wc8mVc8zb3USVx5p1joaFUlbVvevUqzxk1xfTd7P:wc328v3XxvxlUlM9zC7P
MD5:	DDB1A777F2BFE417F8D0D1DE53662C05
SHA1:	04A40137A4D32E177E302AE4DF988DF8E1A996F1
SHA-256:	9CB1C01D2C72B8A36A0749BF12AC7ED7E2C60EEFD32090B5874A0D7520CABFB9
SHA-512:	754126DCB416564CEAAE0194852966999148DC733E6D71FDE84CDA16A75A322A59A500AAC05494AB8BB53F3C59AF7757B61DCBC42495FCF926A973F9E9E4FADC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Purchase Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10212
Entropy (8bit):	6.9585940246465805
Encrypted:	false
SSDEEP:	192:wc8mVIBTanb3Uxj5kmaCU+aFUlbVvevUqzYDxeGZL:wc3mBTab3WjlaC8UlM9zYDAGZL
MD5:	CB19033D56B615821E7A14DA7FA94A24
SHA1:	D19DEE1C92DA51BD909D06C7755484A88C4F0822
SHA-256:	D07DD5808CF886316EC12DF0DFDA21611C1296C0758B0310618F0711A3276B22
SHA-512:	1A58418DF5EAD2D67B46E9220B4853278C1628554F47E65D008569EDA3DA593162B88D803DC9B879D37D3952475ADA7F0EA28153B8D66A0F10331B45248681B2
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Sales Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	6.993302047378494
Encrypted:	false
SSDEEP:	192:wc8mVKaagb3UopdpwaFUlbVvevUqzYDxZWP6cvnzNFfXAW:wc3ga3PpdLUlM9zYD3WP6szzfAW
MD5:	A51DEBCCE7CCE3AEDCB4BBC96DBBA8EF
SHA1:	CA9C083F72AC92059785B7356919DB38C424ACD9
SHA-256:	787C092492F3293CE06B875976E3B25C6B57FC5786FD070958BBC5B059713798
SHA-512:	EB649DE96C0F0843005103D5D8984D2C53F69D4902B5FC410F097BDB9CA7CAFD81164EFE7B1EA81B49849EA2AB459817D7080DAD68B5DA24E075277EEF4719ED
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Sales Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10563
Entropy (8bit):	7.000994706243713
Encrypted:	false
SSDEEP:	192:wc8mVPS29jRb3U0Ma/cj4ing8ooaFUlbVvevUqzYDx5TSTm3IEX:wc3U2j3PMOZFUlM9zYDD53hX
MD5:	A6AF62DC0A1B0D64B62B92F2A394A903
SHA1:	368BDAF6D16882018C5C058F36AD7EAD98C5E569
SHA-256:	C320E36C1C63F0111F87A610252BBD77C651E15208D33A7C4208BDF5144D7375
SHA-512:	EB383F99ED44CE5AD1AB5719A0047388BE9FBF9A4FD8BFA99F0BE1FD0E3C54AE6CF823E56F4FC6698976F83A224A030D645488252568F341BA8A4430B24B23B6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Sales Tax Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8878
Entropy (8bit):	6.738910117567037
Encrypted:	false
SSDEEP:	192:wc8mVK4qNU6g5b3UXnhhzsaFUlbVvevUqzxk1xcoasbBKE:wc38tgR30nZUlM9z/ENKE
MD5:	57A1600221F6BAF16D271409A90E6961
SHA1:	5AE582F5D78661B93FC13B5CFDCB3A243A41EB66
SHA-256:	45A1D852E6D465C9FDA030C8B621B74075EBF9B4FA45EBDCAB53A7ABE7C65075
SHA-512:	48E01EF950EC6B3AB4523A46DF961BBD6F177EB1D7F65F1843AE21C371BE94A73B1E3B802CEB881EB687340323818882801E7E4BF3466341094C7BC2A7320F7E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Sales Tax.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8877
Entropy (8bit):	6.731786945467423
Encrypted:	false
SSDEEP:	192:wc8mVEtuXjzrb3U08xkyamaFUlbVvevUqzxk1xpwpppdn:wc3wmzn3AFavUlM9zgwpndn
MD5:	2E40D56C244D5BC0BD2E33345167DE2D
SHA1:	6759D0A8E6A710417BB5396278323989B7050EF8
SHA-256:	5F07DDEB0383EDD7140C065C1619CC257A99CB10AACFA6F53615575F971BA188
SHA-512:	8D7E18C7952A0A8CA8E888531D2A92C9AF1A497179B83D0E796569BB6BD2697CB4F2B3DF596EEE422B7819F40411401F5FB31C2FDDF8B2AE9112D7B58DBEB1BD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Statement Charges.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9195
Entropy (8bit):	6.80403615435195
Encrypted:	false
SSDEEP:	192:wc8mVcmuIub3U6DbISLaFUlbVvevUqzQ/3SsLlZk1/:wc32I63FbuUlM9zQ/SSZk5
MD5:	D59FDFD946BEDA6FEF78DBB5573BDFBC
SHA1:	E05EC9E34694CB6CAC2033643774B438CF1DE3D1
SHA-256:	A844F3925A61BD5689D3FFC577F2FEC536E968B42930DD1C648DC8C95C53E8E5
SHA-512:	DCD44F952C450A235E9EA64F978D93068990BF6326017E54A2D3E9F15ECFFA8BCAB94AA195AC63BEB15ECC4CAE9D672B686A1D9D3A7E275BFEE6BE3F7AE112B5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Time Tracking.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9030
Entropy (8bit):	6.765434751177057
Encrypted:	false
SSDEEP:	192:wc8mVsib3U6jjcycyoaFUlbVvevUqzoDmhoCnoyQ:wc32m3BjHUlM9z8CoyQ
MD5:	A99CC77D26C2F03CA5AA587DF34A9501
SHA1:	949F9E0697F5CAAAEEF5E1D42488DC046FD4B50D
SHA-256:	17BFBEF2D1546F59C7BD072D3DF13FC619FBC68745963D98B332EAC6F3A2038B
SHA-512:	D32FFA9A66EAFD3A3F2A52152B58CAF9C8CBEB9EE8F6CEE0FEF16AAAB60E9259C15DB8922A2CEB653C069B50003583B3B0D1F4184A391E2B94CA75569B1DC997
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Transfer Inventory.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9079
Entropy (8bit):	6.780184862313751
Encrypted:	false
SSDEEP:	192:wc8mVyQl5b3UCsHvJFcpaFUlbVvevUqzQ/3SDnlhY:wc3kQf3UICUlM9zQ/SDnlhY
MD5:	5176457989D44739BD45A5AFFE8C76BA
SHA1:	5D260894372376DD3B98D935743EEF67AA68121C
SHA-256:	DE1711A1DAEA88F2F7778B2F7BA7BFBC12E207D03A6B3D88C462003E9D1E1640
SHA-512:	35B1A24EA2A2BFB11C6FB7168D1C4F96A3D31C3B4CD563D65F07EC44529951B433E74B603C7EC9C746C54515A64C461FAD2F316156C1A15C942DECFDF95A371C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Transfer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8927
Entropy (8bit):	6.7447222021488455
Encrypted:	false
SSDEEP:	192:wc8mV5b3UpCehQWaFUlbVvevUqzoDmhecRWxsBo:wc3P3yhuUlM9z6cR24o
MD5:	D931EF04D1779CDD007C3C0BA5201DD0
SHA1:	801A29AABEF972C41A9186D256B058FDF942F26E
SHA-256:	D01BDBC91EAB65E485DCA7C91FE6C47620BEDFF99B6E3B5F7B9060FAF072E929
SHA-512:	21506B3B2376068133A1C5CA061FD3BCB8B4A72CFCCB882FAD9B7BACCF4A82240933ED6F6A7B06D13238CB5DA0D31FB3921B883E7428E6DF22CD56988842CEE1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Trial Balance.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Vehicle Milege.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9141
Entropy (8bit):	6.782145844796253
Encrypted:	false
SSDEEP:	192:wc8mVadAb3UxeFFaFUlbVvevUqzQ/3SBBBosPiu1:wc3AS3n2UlM9zQ/SBjos6u1
MD5:	A0403054E8EC020532ADB27CD91E1604
SHA1:	49FE13F6CB42F28579FEDF768F1F10312407B00A
SHA-256:	EAAB2188E3128256846E56C6D42BF921E3286A06E05DAF993197F0829CE8A155
SHA-512:	3649310E6023FBD26FBC2548F1BBDCB3EFCF4837B8B5D90372E7A4DA2FA588FCE876558478ECA83C504A27094A4B6EF8DFEC33BC629897E517594E1B6EA3B24A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Vendor Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9788
Entropy (8bit):	6.890099926914943
Encrypted:	false
SSDEEP:	192:wc8mVakT+SYb3U5bA7EafaFUlbVvevUqzMWHn9SDGtNjci11:wc3kI+S43SEqUlM9zMWH9SytOi11
MD5:	AF3C6C8E2D69E51B391806619BD49937
SHA1:	FCC8AE968EB274339923B88686EF229E278DB991
SHA-256:	1842387ECDDB1432025D6BB501A901F0F8D4F2D23C00CC303CB2F36E56E42395
SHA-512:	F7D8EA3A96096735FF849B0257EA7914D54176D22D1CC5BBF87F2B159B767A0B4FEB37E531DD4F8876E0F5E7E8BCFEC3AF4A5E6DC7A2E2B234EBEC05835E2743
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Advanced\Vendor.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10521
Entropy (8bit):	6.960581353008388
Encrypted:	false
SSDEEP:	192:wc8mV5BMPb3UFfcYipGSyaFUlbVvevUqz0aO5GDSoloZY45Mth:wc3Ji3Zn8SDUlM9zjTBl2Y4Gth
MD5:	93F43677DAF2D9348053DA5512A6A667
SHA1:	05CA5E521C9DD38FA63AA644EFE1595564F3FC68
SHA-256:	C074167D13B825ECCE798A1C861665E9494561B64895096F26F0B3C43A4476E5
SHA-512:	3E315E75DE816E8D7DFF055352E2B3D5B0559640EDBE7230096D4D3DA3B3B5237727AA030E6BD0E795983C61B2361817172E6D654C5A4AEC49F44F92A86FF9D5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\01-ETI_Desktop_Sample_Basic_Templates_All.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	60608
Entropy (8bit):	7.72158777055586
Encrypted:	false
SSDEEP:	1536:xEjn/qO0hC6y2mwU4NKf/QWHcIfRij037fXKkvb/UjDUj6T7:xEjaC6hdU4G4WHnE0rvHiUj6T7
MD5:	2FC2034D6E43283CBDAEE5625C29388A
SHA1:	51431CCB4B3645690F32B90FB89767BF21CEF86E
SHA-256:	ED8C776FAF95DB425BF2FD1EE4DA5521FC40FBD051A345B5FF2FB7727A3BF219
SHA-512:	A6A30231DAE53D79B1D38C7B0EFB33D724CABA83C2F83DE2A9B2F8F4203935CD2EBE74624C3D9386572EE432204992CFE9CA366A841B87D4346FF88237B10E77
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Bank Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9179
Entropy (8bit):	6.794915179830353
Encrypted:	false
SSDEEP:	192:wc8mV8pOvxKwRkib3Ue6gS2KkxaFUlbVvevUqzGuPK8I:wc36gp530/2BKUlM9zGx8I
MD5:	A9F59D704F0046C9DDF4BC78AFE0602E
SHA1:	642BFAA1A38C106BD33200BFF3156A20731BC922
SHA-256:	07C8A96AC8204EB1067781D38AD07A2ACA03AD892A01D1C10CE2DAFC33A2D7A0
SHA-512:	248328CE90C2F316BCBD26C200031001D13F08768C23A8CC56D918D14CC2FAC82A11439379A2929F8D13C85B4E49B19D251AD302F5C535FC48B19AD72B7A6AFD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Bill Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9137
Entropy (8bit):	6.792737999962153
Encrypted:	false
SSDEEP:	192:wc8mVsTu3zb3UOc8aFUlbVvevUqzFRETysPnDr6gEZ:wc3yTu3v3yxUlM9zF2TLPnDXi
MD5:	12DC3AEB3063E4CD6D2EEE73254AA628
SHA1:	3B8B1C277D40112E34E0D22FBDF5CA7DF325D00B
SHA-256:	7E7B631CD1A09AB185EFC2D6DBC2B195830A29659EB99E8E9C06C3AE336FFE6F
SHA-512:	5C1A6AC09F388E49FEBF5FF28D26D15F627E53E7DBE7AB4AE51B723440CE88BC95CE316F0D777CD8ED61DE4F49482D9EBB357178C6EA455FFFC083CE54C19D4B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Bill.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10310
Entropy (8bit):	6.902085495948442
Encrypted:	false
SSDEEP:	192:KD1+gb3UAP7lAaFUlbVvevUqzhNlQbDj3qZnRDbzi:KZ+A3HP7l9UlM9zhSD+ZRDS
MD5:	C7AE2C022CA8C673A89C837DE7E9141D
SHA1:	43D508EDCA6A9809E7691240F6314396A66997BF
SHA-256:	1B5F8058535D5454D6C4A81258784D6CB874AD2506EE4F15CF8AFEE33940879F
SHA-512:	9AF3203737D2A79041B356CA93C4F70C733FAF8462F6D6D80B3901046C6F9D2A74EDE85CA8EBE0F708CA67FEBD1F5E9C02284066AB8E1FBBAD177D02290052E5
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Build Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Chart of Accounts.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9364
Entropy (8bit):	6.821970615427216
Encrypted:	false
SSDEEP:	192:wc8mVHw0B6db3UMY1ZFo7T4aFUlbVvevUqzuaToA5HaE:wc35w0E3gHoVUlM9zuakA5HJ
MD5:	09E8A762CE42B56F03B800563478CD10
SHA1:	80FF7AEEA1DA861732DB3F0D1D17F3144F3D979A
SHA-256:	DFBB8620DECC816F2085D2FEC636C3CDB928CD0EB25CB3492B200DEC39ACE84B
SHA-512:	09A0A3A5EE8962E023DE27DB5C99B1F2276078524E2CB1352528BDE1EE2F2F8A6CF60C71B5CEE3639B09CBADD2C9D1637E9B2886C439C35C0E3D361F90A820FB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Check.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9279
Entropy (8bit):	6.811763392150569
Encrypted:	false
SSDEEP:	192:wc8mVSFrLeGMmb3UlbVPgh/aFUlbVvevUqznr3xae/xL6nz:wc34rrN3ydgh0UlM9znr3xae/x6z
MD5:	54A0DB0C902D4940B94C3BC1A06523E1
SHA1:	0C875F23CD656DB873FCCC1D80095144F0AB310C
SHA-256:	37D5A0526FBED14A7D290975C3FF57DC1F55404091C3F3FA0FAA63E1D5AAA1A6
SHA-512:	A8CB79E0B7B6CB40999A698FF26CF3B8CAA6E8B888F78D46BB010B3BBB6F5590C4713B45466CB8391C7A54CCB38A9ADA44D20490E79731B1A06E6ACF2D0451ED
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Class.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8830
Entropy (8bit):	6.729273799907828
Encrypted:	false
SSDEEP:	192:wc8mVnT42Xb3Ub3C0aFUlbVvevUqzrTJNoPnhhTqJ:wc3G2r3bUlM9zrdUhxo
MD5:	6F0F3638E5D2A4D9FDBADB93A620AE5E
SHA1:	52ECC7CD6C4F98712D414909EF8F86F893958DF3
SHA-256:	7413628012ED627A283149A01B7273BD900330CF917B524319F73DD34D7E71D7
SHA-512:	D4B6526D8FCA703196834775AD24A22B53E093BA93B0379B970839568E1F67FCA68C0B682214052994971CA558DB5290662B82496A1DDA9BAD5A7665B29CD1DF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Credit Card Charge.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9423
Entropy (8bit):	6.839785295716797
Encrypted:	false
SSDEEP:	192:wc8mVJ4HUIkGCb3UOGW95ZlnaaFUlbVvevUqznr3xSFbOsCK9:wc3ge3FZlnLUlM9znr3xY4U
MD5:	AF5B372522E9D8654675DEFA4F408156
SHA1:	513AB2B83145F3AB267C16906CB234962A473A21
SHA-256:	76FFC405EE86CA3314BBB6EF1108A8ABDEFD4D5C718A1FD63A69AF736808D3DB
SHA-512:	312719ED149D193044396BF9234F069F3F3C01185DC2139DB9C6FD0B1820C373576F7FEE94148701F9A1B20B5CD3788AC3FE4E45B07815EEDFCD14605EFCBA08
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Credit Card Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9300
Entropy (8bit):	6.813928011985626
Encrypted:	false
SSDEEP:	192:wc8mV7hC9d3Cb3UorVFraFUlbVvevUqzI41y/LxI:wc3Zc73G3HAUlM9zI2cxI
MD5:	2ACEB40AEC0AEEBA1C0AEAC2029D846F
SHA1:	F64308248680B91371053134B6A1BD5A745D45EB
SHA-256:	5CEB84B7E74F7C17B43B9605E6BCC9A54C43213E9DD01D930521CC05933C98B2
SHA-512:	22150751FF4B387F0CB7BA401220260E4C6C97E7881661F9F52273311B92A06957591DA87FE09EED06D2F08008EA3CB17C86485CBB9A1396633DBC470EF3EC63
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Credit Card Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10042
Entropy (8bit):	6.860852476669272
Encrypted:	false
SSDEEP:	192:K93SOA1Lwcb3UxpkiaFUlbVvevUqzDVN+Wvy/MzX0:K93y1UE3NzUlM9zDL+sfj0
MD5:	D5C2BB7A2A6AAFA67A5CEC0851F1279C
SHA1:	4ED0A99525B8617B34A34F3E8CE3963248E9188A
SHA-256:	FBA508F6B2733B9D9CF2DE93A09B0E6EA7F75AF08AE11A323E4F17E662FC5371
SHA-512:	81C8DE579826ACED62EF053ABE18083E7720FC9B9ADEF61A6F6B463257CD18BD99920AF78EEABF228756D30E4ABA176911D9063446082E177EA396AC15F9D771
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\CreditMemo.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9271
Entropy (8bit):	6.811643027566105
Encrypted:	false
SSDEEP:	192:wc8mVf2U35b3UAZTaFUlbVvevUqzmpPhEYoxR9ss9:wc3Z2ER3jZAUlM9zE5m9H9
MD5:	CCFE8245FF49E0FE0D036E51BF7D3F63
SHA1:	55CE309D4FEC86D442EB345CF0B81FCD149EEBA3
SHA-256:	9A43623D564057B84AB29AFBA4288EEC96CE2FA18106DA572C67CC0844F11AEC
SHA-512:	5C4391D145FDAA8B568B0E6F06C3B5D385E6EF351C7ABE83422CA5549FC1B86A9396445EE919D0EC0DEA5BDFF8ACEAA5CDF17AB41BE4899AA0741BC67A1E0333
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Customer Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9105
Entropy (8bit):	6.781014209396833
Encrypted:	false
SSDEEP:	192:wc8mVvURb3Umzlp+aFUlbVvevUqzQ/3S7O/xLUy:wc3Y39lVUlM9zQ/S7O/xUy
MD5:	1B0657CB32BEBB1FD5DD1C2FB1B749C3
SHA1:	7BAEAA0FB0885C0F004CDE7443E8183D828DFE28
SHA-256:	37D8820AE95851BC491E32275B57B2D8BE84DBBA016A4358C5D7F50C377B0B9B
SHA-512:	5CDE34D9A602E4F9942250A434844DFAF95E9C7C6C9E23C3AC3780837A0F7A770C765B13856271C75431465F07999051B794AEE56A9737CA219779F8FD3702FB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Customer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	6.865386475865739
Encrypted:	false
SSDEEP:	192:wc8mVt+6DKPv9+b3UiKpaFUlbVvevUqzZJtVMNSX5I41663:wc3Piv83zfUlM9zZJtTX571663
MD5:	08057568E24A84432911C7480B9BA2F8
SHA1:	D35A457F40D2116417108295718214C67DBFC56C
SHA-256:	653929EB88C5F7526D51CE15C5E95D0005EB071509E5185CDB4A04C7E31D6C3B
SHA-512:	1BA361B34327CC831B5F4F1F2FC6429E81C8F28A1B158790D4798027BC9EF19F69CBBA48B2C4F043C1E92AD970FCBB3EDAFD2ACE9F68D344EE680817848CEE78
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Deposit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9174
Entropy (8bit):	6.7924481974634565
Encrypted:	false
SSDEEP:	192:wc8mVi3b3UMTFaFUlbVvevUqzQ/3SFsw5:wc3UL3B2UlM9zQ/SCw5
MD5:	6A72B5C256385E38490AB05902A2A3B0
SHA1:	EE772D71C3596FBDDAD106051A5D101B794F55B2
SHA-256:	DDB241E0E9064DA7443D8876B27A9A69D06CA6669D4FA5E281EA1A9C5CD56684
SHA-512:	546B143348EB1A45D9A620C663F96DF90C0056DE2593ED7C7909B3913DBE0BDCF05FD549ABCB1DDC1D9AF7A65A46880F17A0A03A6FC0C26392514F9AB9878F60
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Employee.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10662
Entropy (8bit):	6.978039342816095
Encrypted:	false
SSDEEP:	192:wc8mV76EzJb3Uz2Q/m6aFUlbVvevUqzjBYSHjYVQWmHgrxG:wc3sE93WyUlM9zrjYVoArxG
MD5:	B14A9C7D27DD7712A0B8788A45B7BDD1
SHA1:	17C3203A89ADE5D0D6A2666F2F96355002A5D158
SHA-256:	3C0B72549EA06721309266918917A8827703CB25FB0E9B13998BE25ACE9BD820
SHA-512:	E502E0B643CF69DF67D27FC7735B17FF5FC089AF5BB1A5321DD654604FF121929C234919564AE4ABBA9656C62367534DFFE3607DFA3A13427584BE290C9C8668
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Estimate.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10179
Entropy (8bit):	6.878884512140004
Encrypted:	false
SSDEEP:	192:K+v3LU/Mrb3UHL8aFUlbVvevUqzMWHn9SyWv+xLVS:K+v3L+Mn3YLxUlM9zMWH9SyWv+xQ
MD5:	111DC57DAE120885E74B1A2E22FC42CF
SHA1:	916CF01E9CAD15CF072F0121B3B75571C4FAC98A
SHA-256:	01E72D36A12BB15310D91DBBBA126A8BF292E24DF5511907752A4BEA27CEE4F3
SHA-512:	92A28A0D08DC161B35C3A6C19BC3B141CDAB69380A089517AF4B1F251FA193B53A0AD9E0140C07ECA414CCFB2C8B8B85AE197BBE93075FFD173C91DA2C2886DF
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Inventory Adustment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9205
Entropy (8bit):	6.800891004632689
Encrypted:	false
SSDEEP:	192:wc8mViLvVab3U5Knw7m0YaFUlbVvevUqzQ/3Sjmvun1:wc3sE35w62UlM9zQ/S91
MD5:	989A01BD9C8C7239F25814AAC66E462D
SHA1:	54E62D002F5DABAAA38849F40323DC7A3876491B
SHA-256:	2C1DAA59560CB8248D9D8DD4F1B526AFDAD8F0B7F044F78D7091B1DDB42E5779
SHA-512:	B5981FAB999D5C67D11EB1CD1098530E18C0181D982F00CC01303E0B11D53EE4207F2A0E1BBE4491775355E35D57F99C7A035ABCFB65F5A9C732178CDC3D6CDC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Invoice.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10311
Entropy (8bit):	6.902523632816974
Encrypted:	false
SSDEEP:	192:KlQnZsb3UFdNmiaFUlbVvevUqz0zP7+WX6Y9+:KYZ03CeUlM9zE7+M19+
MD5:	E0E05A34B4EED3129E3DFFC054D1F070
SHA1:	1593B64E4185A1FEBF3FD6CD5DD3152ECB260B76
SHA-256:	E163E2DEBB21D40EFFF3196F1427923CBD8DEBC92D4A10B6E645D27B92D5E68F
SHA-512:	798AC0AAD0A4571E58606FA476F28D596D5B753365C00807BD09578985C647F2E2B53108483982D5B66386A707B5FE6423C12F2B7C75BC8A35E71391E2B8B619
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Item Discount.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	6.910242705829882
Encrypted:	false
SSDEEP:	192:DK7Y3k6b3U+FBN4BaFUlbVvevUqz2RIMpQc6Omow7:DKk3J3vV4aUlM9z2OMpQ7f
MD5:	32B22473DEFDD10651778BFE40BA7F38
SHA1:	2238007231F2DCF3AE7765F62872936DE662508D
SHA-256:	DB5C17DCCB68E77BE29FD9F237918BB72661D88D76629889663B7935F492DC8F
SHA-512:	CA1E16A6816031BB980DAA92CD252494B726E3875151E386AE747CA56B6C524AD1EB0BA543FC729B7E8781E3A3702349C4E0502E624B01446BA93279260A0057
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Item Fixed Asset.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10342
Entropy (8bit):	6.908061401318368
Encrypted:	false
SSDEEP:	192:Krsb3UFi7jscVaFUlbVvevUqzQ/3SjeFFtQTeKfz:Kr03iinsTUlM9zQ/SjevNKfz
MD5:	274DC88AA87B2FFB6A900B9569F25AC3
SHA1:	356AF0CBB48026F0989F71E6A443601FE4106E72
SHA-256:	A0821C5ADAC4CA9B0F95B470B9DA09F22695B0C1B645C437C6729DC919C2FC58
SHA-512:	493A40314200F831EB11E010C15AA2470373D02E17918D79208E341EA568EDF0E244A10EE2DBD991A2F679E9B68A7BA260FEF28C43447BD01BACAD9DE2A671AE
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Item Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8939
Entropy (8bit):	6.751801640397702
Encrypted:	false
SSDEEP:	192:wc8mVhHmW+yM41b3US32wraFUlbVvevUqzxk1xQMH5nsOoEJn:wc3+t8l3X32w4UlM9zTMZsOo2n
MD5:	5F268BD22DF45BA9C0D41CDBAC0F10AC
SHA1:	AC4C7E080F58E4F4B22EA6C1217C54009F6D90FC
SHA-256:	A3710B7AC9F8FBF6A2D59477A7CE708E52215C1DBCC5A1164FDB19799D7A4BCF
SHA-512:	7E77DFA1D17378EFC7514EB152C0CFE4B06A7CCA1732E63617E84B67A69BD75503F5AE49F75199D75CC42278EAC07992FC960D76DE46C41F1216D9162C786749
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Item Inventory Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9302
Entropy (8bit):	6.818788409862115
Encrypted:	false
SSDEEP:	192:wc8mV8LNAb3UXMZZDoaFUlbVvevUqzxk1xJOWrh:wc3ig36MvDlUlM9zih
MD5:	652CD5C190512D8D08D81C561EEE2103
SHA1:	89575FF7865DC5B0AC26DB9F100C53AEA8A0E51D
SHA-256:	A0F2C4AE896841461B8BD886BD1698613263AD8131B678ACA1EF375ECB160B35
SHA-512:	504788FEE9E6E752779E1FE252104B3FEBDA4C6AA85B3BA4CFC875A5B2957CBB50905E05030A4C517975618CB32F0D6519D34FFCC3A79D3F213339FB44C80514
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Item Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8904
Entropy (8bit):	6.741967696983345
Encrypted:	false
SSDEEP:	192:wc8mV6aK2bb3UZ5lE0aFUlbVvevUqzxk1xh0PC:wc3Uc33EoUlM9zLPC
MD5:	511021BBC919910B7BFE88EDD692FE9F
SHA1:	A3F5F0276F944D2F110C4B5B67B1E5379649DC13
SHA-256:	CF048FB4F41EAFFA959CB6CFA378981D84C5BB0998B49686303573DCAFBA591E
SHA-512:	CB27226285CFC60CCC5C0ED9323D3E154F9D3A214AC5D08CED4215622098CEE30C3A12D46E370DF30F361AAD752DC973BB4EAD0A1466F04A6A69B2514EAB4768
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Item Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9159
Entropy (8bit):	6.790575326802142
Encrypted:	false
SSDEEP:	192:wc8mVd0llCnb3UOFn4u6aFUlbVvevUqzMWHn9SmngBPI:wc3f0f23P54aUlM9zMWH9SnA
MD5:	F988A3154CFC4A0A24B40D4DADD6B165
SHA1:	1FA4289E808748C3A65A4CB7A5F4FA93D6F76163
SHA-256:	9388FBEBDA3CAC8B4B44C4AD4B90376F3A678BEB8182C5EBB5EB2E6713A89909
SHA-512:	458E108052968AFA9C4944133D6DEF95D82773BD39EE0F75923F71828822E12EAE89811B0063E945B281ED8A6F0683ED3D2E56CBE5E8210335948BA76CC26334
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Item.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9293
Entropy (8bit):	6.8141719578289255
Encrypted:	false
SSDEEP:	192:wc8mVDC9NMb3UkNFC+/SNMaFUlbVvevUqzxk1x2D+HtD7CP:wc3FC9S3fB/0BUlM9zrmD7m
MD5:	2FC32E74CF43FD1CC9F15B4D6FAD6F23
SHA1:	5B6018F0660F03A0AEC7CD79CDF06B5724AEEC87
SHA-256:	31D1F2BCDF03328C577F42F412557018C75A44F113AFAA230B1B8D43E3DD2AD5
SHA-512:	73FF985EF939D89A1CECE9A582744B92C400B1742CEF5440846AD88881CF36D0A2E7B619BF85A34EC04126EEE1A08A2FBF0FC0E493432A09D746DD5C3CD6B81F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Journal Entry.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9093
Entropy (8bit):	6.77631031314201
Encrypted:	false
SSDEEP:	192:wc8mVcKEXb3UB7n2tyaFUlbVvevUqz32fNPR7b8fU:wc3a33GnWDUlM9z36NJcs
MD5:	43FD14A8C807C600DA56C934B028AC62
SHA1:	104B533622E0706C09C3E8DC54710B1F82D2A21C
SHA-256:	91D6391C2DD44B951DDFD136AA7ACEC0EFB298796C19557EF1E7AD587D312C19
SHA-512:	0004BAD639F2A45E4AF3EF08DB8D635829AEE60072C80E5CB12E037AA5529BE2D3FA10541C907DA40D032808DA45E1A58808578E4C0D4BC77AB5819FBE339089
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Other Name.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9977
Entropy (8bit):	6.881824897442895
Encrypted:	false
SSDEEP:	192:wc8mVgF6skEmb3U8rpU4yaFUlbVvevUqzvMJbjBWNkMfBR7VoK2ej:wc3C6sE3du4DUlM9z4UNFHhoKfj
MD5:	350480A984ACB80CF21F542D4CDE9823
SHA1:	00091FA7BED5E8BC6D4D32AC9F5BCB6FA06B07F6
SHA-256:	311A12234259B32BACD59FA164CE5BE2023786DE3BDBDE1FF1DBD6F31ACB11F8
SHA-512:	1C54C073A5D4212699BA136A1D9B91A8E725BE6E8541F23823FCDBC7805A197791D3FD839AC8FA58C077C1B877F1F3ABF528D25EE04DFA31DAA03508994F7D9F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Price Level.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9142
Entropy (8bit):	6.782431923212374
Encrypted:	false
SSDEEP:	192:wc8mViNEB6Qb3Uyim/9fetaFUlbVvevUqzxk1xKhnJ1q8f6VY:wc3jBF345+UlM9z3d7SVY
MD5:	2506630D2BEEA9C1868E7741DEE13D2B
SHA1:	0C2FFE451D4C10AA5A08B415CA8E88D03B03C55F
SHA-256:	6A667EB4303F007954E8E51A2D8D06729C4D18982EBDC53DB81D571D2A99A887
SHA-512:	90C7E14D51657AC8385DC023F4101398E7F6392ECEB0D76A058ED1D2E809C50BF057B0F09BA7986EC19F6391B5C507405EE3F4B5F0B3B4FE33B10C825955E50F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Purchase Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9250
Entropy (8bit):	6.808163260128793
Encrypted:	false
SSDEEP:	192:wc8mV0+NRb3UbKsIQaFUlbVvevUqzYDxX++fqa2:wc3FNp35UlM9zYD3ya2
MD5:	7A3007D4C7D6A735AADAD4272E05BA64
SHA1:	1571CBD2207B346AD1E3540CF31C6B27094988FA
SHA-256:	D1418C308F1D895E88BC9F7293E72D03D05AF01368E37E9E3032BD7A14F0C17B
SHA-512:	5F8F33A6292A6C03E45D4BBB38BD60DCB9AF32E9C23705F78AD2070074AF6344CD64404BFD97E215DAA247284B5A67DE2C5B3E0793C68BEF17E83B2BEBC34099
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Sales Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9262
Entropy (8bit):	6.806043299070465
Encrypted:	false
SSDEEP:	192:wc8mVXZb3Uw86AAkaFUlbVvevUqzYDxcgSQfXBa:wc3Bx3xRAuUlM9zYDTLfBa
MD5:	DFABD8959A1CF9284CBC958557A6BC11
SHA1:	D2701208198885731EF8FE25D9D2BADD6C422E23
SHA-256:	FF80F6BFD07318A31225C0BFBBBE9D92A40A2F9A474FF228105EAE2C302DB1F9
SHA-512:	572744C2AA9FFE5DB9935D60B668D3DF917569A4B78EE1C3269E3426297F926DEB53F30AE508688094438F393D8A216B9D701E347D9B9897F58217F3F79D73C6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Sales Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9212
Entropy (8bit):	6.79823789885158
Encrypted:	false
SSDEEP:	192:wc8mVeuWugPb3Ulhj1OhaFUlbVvevUqzMWHn9SBpRKhOIEIS:wc3EFx3ghO6UlM9zMWH9SPRKhOhf
MD5:	17357BDF06F4DB40706B6FE701830D4D
SHA1:	80105281255CB887BBD56DD1CAB9BACC9CB0F8F4
SHA-256:	2080703D1094096953772CEAC224A8C5CBA1470E8CA0B214AEF0910C61E59B32
SHA-512:	9AE1A8085F92F1BCB444239AB6FF9B1EACFE60197F6054C15FAEB2015D0B84D73CA5D3DA266F91BB3D3EFF7F146C0A20C3AC982E6187B4804B5700EFDB465717
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Sales Tax Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8903
Entropy (8bit):	6.746206691996274
Encrypted:	false
SSDEEP:	192:wc8mVVRZC3+b3U/1xMaFUlbVvevUqzxk1xccOasbB2:wc3nR43q3s/UlM9z/hN2
MD5:	F4E307557F1304745D2221BE28BDAC8F
SHA1:	E37F9CA0B0DC157C2ED14021536594A834543E84
SHA-256:	87177848091C9392F8681B54CE82FD8897ED1A50A03CAB6FB493C13422E1A62E
SHA-512:	9677FECC6EF16172BEDDD661342F7A62ACFD8D67BF7783878CCF0BC3772AF3B418811C9F6EFE0ECFE95172273FEFA99579C66BAAB3595AACA71960A7EF795874
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Sales Tax.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8905
Entropy (8bit):	6.745897938150198
Encrypted:	false
SSDEEP:	192:wc8mVCg6xRcb3UQn0XaFUlbVvevUqzxk1xpGpb:wc3Q5DE3znhUlM9zgqb
MD5:	EB8F39AB8EE40E48CDD5191AAE8ED020
SHA1:	23EB3219094EC7DB1607EF900B7C4E6D53153680
SHA-256:	E67EAC32A26A25FD2EA2FE4601F4D42CEB5031494A47A383BC272071F5C3005A
SHA-512:	D8B3CF08CAA5AC3E92BAFDEEBD04B604A6AEB9E56A7062427A8A404B93C39B4C2AED107EC650A89CC27F9ACCAC75BF767FC622EB08925EC37BC20C6C88484324
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Statement Charges.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9102
Entropy (8bit):	6.7850184234097215
Encrypted:	false
SSDEEP:	192:wc8mV5UtZ2Ub3UxPseGxvTaFUlbVvevUqzQ/3SIJ5i:wc3f2M83ctc4UlM9zQ/SY5i
MD5:	DAF53A1E6A82439CBAB24CBC7356365D
SHA1:	A84BC61A1CD6ADDF6FC3E146CBB51173E24D5BAE
SHA-256:	2110753916F77DDFC14B1379F0BB2B010E8AC828EDDEB3AB111B0E9A44F5B9AD
SHA-512:	39999E226CB4FD2E9CE0E1AEAEA8D6AEB7CCC735DFFA26F25F0F152EB0FF37C702B890FAD7F06FBF7F1668D949CB34EB77447789A009EE05CD1636113A1BA0F9
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Time Tracking.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9034
Entropy (8bit):	6.769753878312157
Encrypted:	false
SSDEEP:	192:wc8mV/cGYDrWb3U1oEipaFUlbVvevUqzoDmh1veK5noy5R:wc3hcGWW3SiCUlM9zleQoyv
MD5:	67B314265F3E444E28B6AE3B8215BEF6
SHA1:	844568E31FDA53C40B7A47B9CCA7B07BFA51EE84
SHA-256:	4ECCB5D5F240EC7FA276B8962E8E0F16EB9E4F3DA7E702DD67DDA9724F6A718C
SHA-512:	1EC806B8A9FC894C0AA7B64574983D79FFE6793B7379BE220B0155C51E2BB63CF8EC41AC9EC6FD89DC1536C30A02BE326CDEDF397379685F25BD34253A88B1AB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Transfer Inventory.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9081
Entropy (8bit):	6.779563405224094
Encrypted:	false
SSDEEP:	192:wc8mVTYJBJb3UmiaIdaFUlbVvevUqzQ/3SuyylhS8:wc3O13HdUlM9zQ/Suyylhv
MD5:	C2DB2CBD357B3AF84F47456F4210E3AF
SHA1:	595E4FF7467CDF793C70BF82C02BAD5C840A4E6B
SHA-256:	C18ED83E70DF157700C1A608E612325FC79622F7A3728B045C9CA5BFF6BB0ACC
SHA-512:	116C655938D358B5B5A644C7975F38BB2355AEEE6AF3056F94331BA88C575F4501334D2B60EEE036F14DF3C4D04267F41119A518522A378EC9209100D3461663
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Transfer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8933
Entropy (8bit):	6.7475711333237465
Encrypted:	false
SSDEEP:	192:wc8mV4yybeeuUb3Ufkx3R3NaFUlbVvevUqzoDmh64:wc3+eeu83HMUlM9zm4
MD5:	FEE9D3BDED7551DAE9FFD5A560BEB49B
SHA1:	F3D16C4AE99AE1A5EFE9956A7E763072E3C8049A
SHA-256:	E61C23FE64FE8A7A2FF9AF1C9C930444F499F2000154DDED356ADE81685E2BC6
SHA-512:	3004A79F8242260FBAFE0051928906C0CC7061E735852485A975672E9E9C1590B5B02B76017C5BAEF04B060F34196867DBB3493474CF637F22A3B8D3260974D2
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Trial Balance.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Vehicle Milege.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9069
Entropy (8bit):	6.775976988880308
Encrypted:	false
SSDEEP:	192:wc8mVSgx68b3Un4T92bqi/aFUlbVvevUqzQ/3SzYPi8q:wc3Ugx6k3vTfUlM9zQ/S868q
MD5:	46CBF18F2A34DEC0D2A552F7D29B172D
SHA1:	E2277962AD39FA3E2258C48CB0260DE3AAEF3311
SHA-256:	B942929F61942CC36C5D1BACA8D432E9798A639BAB630FEB10501ED31F18CD02
SHA-512:	594BA58DA7F2E97344CBC2132BE6845EEAD70F966EC9D3A83448C0DF8200ED62919FAA2E8FA424A6285A2D478EC03D8B8A096DDE81E9F19E3EAAC1C21B9959AE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Vendor Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	6.79917826988387
Encrypted:	false
SSDEEP:	192:wc8mV2s/ypEb3UauTu/b7yaFUlbVvevUqzMWHn9SL0ciT:wc3s6F3huTyb7DUlM9zMWH9SLbiT
MD5:	A2537669E02FD8E38CEE1FB144B2B5D5
SHA1:	841E29BA7C6B41BA94E4BFCF913290F356DAB431
SHA-256:	6D8C3D2EC8BE937FFB7EF0EEF5AF207893C15CA41147BCE2EBC9ADF9447C8CDE
SHA-512:	D2844FB50CF9B639113325F9AADF118B1E688D50E28D8EB37DBD96B215F57845B88E9B91BD0622D3E9B36C8EA5377BDD3F12F71587605605A1CEB601A8934E9E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Basic\Vendor.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10550
Entropy (8bit):	6.970001374614585
Encrypted:	false
SSDEEP:	192:wc8mVQzfnb3UbkxdBxTi7KaFUlbVvevUqz0aO5GDSvY4OiW:wc3SzD3jovUlM9zjTgY4OiW
MD5:	41F22C302B54096D0FF445534616A9BF
SHA1:	7256BD503A3906AE16B0990DD5CDA48FF52EDF1A
SHA-256:	F6B059ADBF7F18CA8795E1C8CC730BF6D11A228871EF20D4DF1DADB90787BB72
SHA-512:	CAF25BD0FD91B665633BF87808A31EEB6406A501A62936A1B9041D008AF7D7F7E15A534FED9C5708768E3F595F1727C7AC5A99605CF0B3544BA1A7E228DFCD2D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\UK\Lookup\LookupSample.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	6.819620975894779
Encrypted:	false
SSDEEP:	192:iRhjwAvOb8XpS0iaFUlbVvevUqzDCiMzg65AtgfFvof:iRhHOypbUlM9zWiMtWOfGf
MD5:	F36B43F28EF0C3ED040587F011567BFB
SHA1:	4D6535CE089E6CA11571C84A28B38BBDF82733C1
SHA-256:	EB1172F0C1BF6D6D5ECD22FB08B48D148F8C20D07CD9039B4DE8C3516E3459E0
SHA-512:	0374F75FB3DDCF2BEC7DFC6A00C059FB823F55A48641FDD021E81DD71D5D54D472C51B42ADECB3D4020E5F2E3F21F001359B90F8A9A8C4563020DD4F3B21F0A9
Malicious:	false
Preview:	PK..........!.....d...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.....U.S..0M.....7.....C#.$......`....@.Q...~qc....f+.h.+E...\.q.R.O..;.!)....J.......p....g;,EM....Fa..8...(..8.AU.5.9..ne.....Z.1.>.L--eOk..%.`Qd......kEL*WN.r.w..g...M.........`....FC6Q.^T..rm......a..J?.......W...Ai....EZ.F...>...Q...a..\|I.D..?q..;..y~)...#m,....=.\...."w...~j....;.> wr...o.6;.,...\|7k..v.)pv..3.t..Lsm........PK..........!..U0#....L......._rels/.rels ...(.............................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\01-ETI_Desktop_Sample_Advanced_Templates_All.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	69537
Entropy (8bit):	7.781602475716056
Encrypted:	false
SSDEEP:	1536:liFPa3mMXjxKTeKatratJDmJGvb/OCrWL67p/:rtNKiKoZJs7iL67F
MD5:	6B5BECB26F3F77D4C8C596EAA999BB54
SHA1:	C33155760AB71588E3E6B1E94D1D23C7D7F197F2
SHA-256:	46FD6F5B94C8A2A3E688BE21B3237BFF20169D5BE895C4DA76E5B2F369190650
SHA-512:	3C2617B009F2857D2A0DDA10C4718FFA472ED2D08F4334BBDAE84FE3416E8A0B41AF1C81443B26BE610D0A98EB599FA6BE5AE3CD5CF7C40A45135818D365035A
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Bank Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9406
Entropy (8bit):	6.835780316286597
Encrypted:	false
SSDEEP:	192:wc8mVAlJXb3UQ5nBuJaFUlbVvevUqzGUupHg/PKo:wc3ulJr3H5nBXUlM9zGUKA/yo
MD5:	F89D82AF5DB2FD07BF4D2FBBC979643D
SHA1:	B86FB7F6D1C1B73987B3CBF1DE8A267FA036650E
SHA-256:	49E1272D5A05AA0F6B19ED0BCE6A7C82C634C4A944799C06F841C12CDA1B8F8C
SHA-512:	6E9BE4336CFFA9898EAA3F5B723E30C7538A7E43BCF02C3C535FE38CF2BEE2E2F4856C7AAD8DDF5BABE9CA2E4367B9DE777659520046D72A362F46DC8443422B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Bill Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9290
Entropy (8bit):	6.814926896364427
Encrypted:	false
SSDEEP:	192:wc8mVyQOubGcb3UoLTaFUlbVvevUqzFRETys8FqAK5wgm:wc3ouaE3EUlM9zF2TL8EAKTm
MD5:	D56F7A9C9BC3B8C204F7DC2297C65DCE
SHA1:	0077B73C1A33C5944A199F029D29F8993D879DC4
SHA-256:	E7EFA41AF7EDD1FA44C663D180B287F094FBB142A75D8D931750F2BF58D54776
SHA-512:	EB548C913526D92B974459D1FA70DD354308ED9CF1BC8999F27CE747C1DF741AA40CDD96DF20DE3302A8A23158A84399E5621D67A366AE1AD8BC8BAB846CEB45
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Bill.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10857
Entropy (8bit):	6.973657813330878
Encrypted:	false
SSDEEP:	192:KEFAgP9b3UosimrWOaplloiaFUlbVvevUqzhNlQbDj37NKfF/eDbzWt:KEF/F3FxQWOapHEUlM9zhSDNKfkDGt
MD5:	C9D0005ACDCF0D73BD09B173223A99E8
SHA1:	D2949B46FF22E20DDFB5E3A43B1D52A269DF380A
SHA-256:	67F6A5D73465B7D3E888A79B5A82C6797E4F663D0D612D7770FC501616C5B131
SHA-512:	42CE90427EBB67C0669F26C0A645D4754314D970DE88195534A37A9860F08C5D95073F06470138D0C39E5E934F9AF3C39786A3FB248C8A9A9C43BD201F6C079A
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Build Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Chart of Accounts.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9462
Entropy (8bit):	6.840751247149905
Encrypted:	false
SSDEEP:	192:wc8mVU5r6swQFbpb3UCbm51lsHaFUlbVvevUqzaNm+c28KXA5NK:wc3S5rzrlh3jmRUlM9zIm+ctKXA5NK
MD5:	3C5E111EC948398BC5DAC4AD68158BB8
SHA1:	ABF5FB865B5ABDB0FC40FEB58C297424B0ABD559
SHA-256:	AB6F2E768A0B8D808256FFCE2A0BBC6B776251E7C018B9C2E93FCB689F1D4E34
SHA-512:	CBCD360854A7BDF345ADE1DBAD3C0FC7A519A777CA23FE3920EA9207F535264D26A86D7883E316FB0E098796A069123E5837D2269A260F7898330E3D98ACA348
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Check.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9931
Entropy (8bit):	6.913313930370472
Encrypted:	false
SSDEEP:	192:wc8mVPy1Ecb3U18eBeoCaFUlbVvevUqznr3xyL2BFKpu:wc39y1EE3QUlM9znr3xJBkw
MD5:	1C58F837BD86500667B709CB79FDCBA5
SHA1:	791824B21143B865A1FB20C1B7186586434D7E9E
SHA-256:	6CB37FF29BDA609F1AAC32DF400272306C3F7F8014FB83DBB0701D52F39C5F08
SHA-512:	116CB8D8EC17B03B128295F5492C2287EF4EC1F2A2B42CE110891A4BEE4DC8EECDC654F6CCDE89FDA92342BF48F66C9F2FC62E1CC71DFA72C602BD077FFB8D01
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Class.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8836
Entropy (8bit):	6.729179804296002
Encrypted:	false
SSDEEP:	192:wc8mV/n6acb3U7iH4cW7aFUlbVvevUqzwz4tzPPnhjqTndG:wc3M3MA4zIUlM9zwz4hhjAs
MD5:	5AAA25682A20C68C2B6437F276317C6B
SHA1:	90112FD520FC5A11A96DA3EC6912B8855C6B9E23
SHA-256:	9BAB10472D6A373C42D87D3BD26B58A3A547A82036EBE389FA87C2FFA7F85F4A
SHA-512:	B6C69545F1DC11F697FF447B082E8BF09530C1EB16CA78E96625D3777992110A44C04012E30087BAD2CD0E1BC4C2EA2015B5D1819DC18DCEBF74321EE667C676
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Credit Card Charge.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10000
Entropy (8bit):	6.932539520886787
Encrypted:	false
SSDEEP:	192:wc8mVFUDqb3UAVMfbVXJaFUlbVvevUqznr3xP7j85bOsCyp:wc3d3nkb4UlM9znr3xn8R4M
MD5:	B723B413692FA07BB233B5377D67C3DD
SHA1:	E3D1CF3B1D16BEA1793DF084FAFCD079D2339845
SHA-256:	2800F9C0D1617067FA4FD1325D20ACCAC14C9B1F64C23676C3B6C77C956CFDA1
SHA-512:	DDE455F7F259DB33F3ABCA7A8A29F8A3BCDB2034AFE3065B46FD95BF8E2BA85AE73088C68C5A3E09BCA331E5B3916EB6ACFFB26C230476FF5A4E2D3AF2318B1E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Credit Card Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9641
Entropy (8bit):	6.871247825299292
Encrypted:	false
SSDEEP:	192:wc8mV2nb3USdEn3yUaFUlbVvevUqzIm1ktoOGZoaFS:wc34b3XiAUlM9zIrtoOGZoaFS
MD5:	7268F44A5F76D10E16AD3CDA2016418B
SHA1:	C93B9DCB35B62FAA7083D8A272A5CD0C3E1F306D
SHA-256:	AD8093BC81F3579D5CFBD503C4795EAC180EED3ACD2870DC7D957BB76E4DFC5B
SHA-512:	242DEEA9FF63DBFF0B6604F9FB7CBA56A8B25EBC10A6EC95D5F13749D2682D20A4190A6CFC8BBBC2DD31567296233EBCFB4E6EE48E5E605BD836CFBE446EC488
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Credit Card Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10212
Entropy (8bit):	6.883765631338095
Encrypted:	false
SSDEEP:	192:K5Gqg7LDb3UNyHLbaFUlbVvevUqzDzf9+WbezP:KUff3/HLoUlM9zDzf9+Uej
MD5:	EA8B994DF804D0548ED5977306A69B29
SHA1:	45945B4E5CD9F935C1672F54C938E11975245F84
SHA-256:	43C6C13AED397390AC165C072FD351E0C8CF6B455764DEEA169F45EA0688C1DD
SHA-512:	42B18FFEFD7E75A947246B159F0E74EFFB47BDC431C80EF51D49E9261E7D14583CAB55A8DAC170215BD0F725B6C94A7999122BAC5E8A4DE846DD4837E76083AE
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\CreditMemo.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10450
Entropy (8bit):	6.98431100151026
Encrypted:	false
SSDEEP:	192:wc8mVblb+b3U31Jox4EaFUlbVvevUqzGm8cS+3G+QlsO:wc3Tbq3aJfUlM9zGm95GJiO
MD5:	DB0630FBC51EA7D46870288E6A0DEA3E
SHA1:	4ED906C86930F3CCD2FF5C0BD687D793250C1200
SHA-256:	B2D05E3DAB88C12C664D2429565EC7F90C484609138F5C7928996F4542722A84
SHA-512:	CDB047D9748358C16E5A0A8B07A8A37206CB4C8735B3B99CE401BA50A738604721B0B0CEBE38DCDCDCDB82C0266FE7A78E9EB79365978276598F2B1B3EFF809B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Customer Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9273
Entropy (8bit):	6.809555086031053
Encrypted:	false
SSDEEP:	192:wc8mVG/Fab3Ula/QkvxwRaFUlbVvevUqzQ/3Si/StO:wc3k/F+3GQUlM9zQ/SKGO
MD5:	928E331D3F0871812817101A9C3271A7
SHA1:	7EBB3051FD13F778D68C9235B14472645099A651
SHA-256:	DEA7F88C233505387756D31DC1EF50ED2DC5C0002DEE1F19A2ADE43B2779D6F1
SHA-512:	50F64160411D255B97FAF6B6E796F802111D7EBCF06CACFE97B72DF8A4175F5D7500DED10489E8EB21D401DD0A819E00C9ED12A3E181FDE04912664D91844E9B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Customer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10836
Entropy (8bit):	6.999274692126049
Encrypted:	false
SSDEEP:	192:wc8mVTQb3Uhy3MvEajfaFUlbVvevUqzZJtVMuErD8hzXJT9S241QB:wc3pQ3A8SUUlM9zZJtRs8hzXJxu1QB
MD5:	D3937D1A626F0A965D1CC42C0A0980DA
SHA1:	46FD746B76D6BBA7AF6206CE741E5B803775692A
SHA-256:	40A6F9FCAE2FF1DFAB6F2D6AAF613DD64262240EC3E120F34501C345C137BB17
SHA-512:	932055B365A9EF339428CCE3F70B8754385AA152D9DBA480FE67C1EC2BB29B91BD1B7981BC87FA293A482839E223AECDE970876FE714BDE330700D131DC47844
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Deposit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9362
Entropy (8bit):	6.826945412783724
Encrypted:	false
SSDEEP:	192:wc8mVlMBb3UTJ1Jx1faFUlbVvevUqzQ/3SNDp+c8A4:wc3O3WiUlM9zQ/SNDpWA4
MD5:	ADEF4B3F15F611034D66243AF19A1FFD
SHA1:	437196B1F7304AA9410A7330E16742D21531CE18
SHA-256:	38CA1CEBF500EE80B84E3C880D7F0A5B17D5450DEEEAEE5C4AAAD1C8AB98624F
SHA-512:	7BE70A6A71617D63F0134D07CCEDC245D9417CD18F153FE45968B3FA513FF85B471C1E4460C6F29405B39C1CAC9FA8EBF38431210FFCB553E22C09619265811E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Employee.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11009
Entropy (8bit):	7.01736060620506
Encrypted:	false
SSDEEP:	192:wc8mVV9wNvlb3UyDCjKJdA54psaFUlbVvevUqzfneGskTMQWEqQZVH:wc3rc93LC8A5cUlM9zP8kTMqqQZVH
MD5:	84E455CA030846364B2724BED1419F53
SHA1:	9CE8F5EE2BABF46BC47C9E475E5A1C818C789603
SHA-256:	1C270A2AB4084D1201BB9D3B596E7B00B592D1BE03B46A31044345F876794F5A
SHA-512:	06F17713D08EB334EEEAF50BF92CCB12A20BFDFAD30837FCDFA691C8904D27EECE02850226696D3836BC443EF9D9E07B068243613861DDE113E9E56A706D29B3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Estimate.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.023651414159856
Encrypted:	false
SSDEEP:	192:Kv3Lk9b3UE/9gVcEJaFUlbVvevUqzMWHn9SX7ucpX:KPQN3T/9tUlM9zMWH9SXa4
MD5:	7D5524C94B4883203FA99661E64FA5BC
SHA1:	6283ED1416344804D77DA5C76EA36850F24157FB
SHA-256:	4AB3C2FFFC6574151A557248E4195C3F8600AE7F60FE19A57110E6AB65C07372
SHA-512:	D8342CE797326200554187FEB9D962CB7F5A92479A1934AEBC227A546F76E1150DB85542E42CBAAC68DC092119088B8DB3C794E1A7BF715E407534895A296FE7
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Inventory Adustment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9339
Entropy (8bit):	6.822004521163334
Encrypted:	false
SSDEEP:	192:wc8mVBfsDb3UJ/aFUlbVvevUqzQ/3S2OUtaInz:wc3HC33UlM9zQ/S2OUQsz
MD5:	325BC35550BAB21E167E3D866CB95914
SHA1:	350AD1DEFD9775A77FA2883E113B6A264002107E
SHA-256:	BB080D63D368851409F24A6015F7D7A60C3741E9AD3F1A57A2FADDB6493E717F
SHA-512:	35EA3002C38FBC398DA4D5D153133A75BFE82BEE58CBE4217CB516ADD850B08AFBC6F7CE7DBD28388E1C480E7E67EAD44EEBA60835D799E740AA36F22EFB0037
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Invoice.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11221
Entropy (8bit):	7.017877426256738
Encrypted:	false
SSDEEP:	192:KokIJb3UaTAfyZSrmJaFUlbVvevUqz/sKHPTIBTjCG+WOccEX3z:K7IB3/A6YhUlM9z/sKHLbG+1Ez
MD5:	99647F86C82486B700D005E89442F8E1
SHA1:	EFFA198001F467453CE5002AECE9C153576EC9F7
SHA-256:	97E37AEEA44807D049FBB62BE73BFE9B9D8E8E942443926735828CA0CEDC363B
SHA-512:	FC1326034829BF3FA20D8D8733602C3252578BD94C27D7C5D9AFE899A0AE3AB47C5D9B0C024360291DB176C2F8BC0E797479DB4B1EB6F638951B24FFC593A63A
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Item Discount.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10779
Entropy (8bit):	6.9418222152063835
Encrypted:	false
SSDEEP:	192:DpRYUkb3U24qH6+xaFUlbVvevUqz2WPsZyIm/Yf/Hg/r:Dzs3iqHSUlM9z2Nv/AT
MD5:	3F30397DA5968557AD9F0DE0B65C9910
SHA1:	318E5E4163320D854D4D303B17255CCEFE82B5BC
SHA-256:	344BF0B3BFEEFBD8BF4BA1DA7E0547696D9404E0886CF0B810C9D3378929297F
SHA-512:	E1DA955F5F252C9BB9C39FBAF8DC2C672051E63FC8D0F38B82FB6DB053FFD637B9A015079E3338F6433B636A61483B2605628FDCB0A8E77D63E13A9A09B4635A
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Item Fixed Asset.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	6.876856042487015
Encrypted:	false
SSDEEP:	192:wc8mVZbaAOAb3U5uesSoaFUlbVvevUqzQ/3STW/TeK5tG:wc3rbv33auzSlUlM9zQ/STdK5tG
MD5:	D3C913F017E8D277C0444E44F20F1E02
SHA1:	9DD03B6E3A8135C14B8C6B4839F2DC846B52BDF7
SHA-256:	6B0AD1417661B8670F7E384B7D3006531A1B823ED5CB6B7297BE8799B95A13F5
SHA-512:	5996199DDEF897332CA14757184D56C9D9A4151D491444AB6A53D560471C3AEFB9E8F60AC6FF99BCC043EF73F103A52B35C290D2B5F3D8F4562F9EDCCA6F9579
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Item Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9032
Entropy (8bit):	6.767608632033993
Encrypted:	false
SSDEEP:	192:wc8mVHvTYVb3UR6UeOJySaFUlbVvevUqzxk1xQPw1+Qq5nsOo4a:wc35vI3s6bUlM9zLo1JwsOoH
MD5:	B505ED5DC1D5905A7CADBE7617068B47
SHA1:	D287258EB1AE1A5A65FDBDB12C05E5B69EFB89A0
SHA-256:	503E9C8D39F69700260E3283C9BB2EB5C37B9521146B96E1ED81D1C91CA8C492
SHA-512:	0B5221AC4FC49B615384EC815264F991C04F748D47A22329CF1DA1938E38D9C794E2F32FDD76000CB9FD06A1E9FE4B130B8DD98AF5399545E68D88F99B9D3909
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Item Inventory Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9535
Entropy (8bit):	6.861523063048331
Encrypted:	false
SSDEEP:	192:wc8mVDtuTJmzBTzub3UlaFUlbVvevUqzQ/3SJESiQDW:wc39tCUBS3FUlM9zQ/SFDW
MD5:	56A91BC00571ADDE20E3BBC3616DEB55
SHA1:	72696B180F91707F3BBE6C96B45FD66B18D46DD7
SHA-256:	646D1B194C31B96167A9E1C5B2783DA9E5575712A42EFFA48C9D94D7BACB5A77
SHA-512:	9DA710D6A05943492A18F6895F8CB6F1138700CCBF8E25E142E6CACF85CC772847C0755122B978B7CCBC1A038FC83594B13CE3B5639FA331E00C06806D858E88
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Item Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8925
Entropy (8bit):	6.744063773910199
Encrypted:	false
SSDEEP:	192:wc8mVaoDDb3U2zZmaFUlbVvevUqzxk1xYaQaT:wc35Df3dxUlM9zjaQaT
MD5:	D704B54740776163E2B818AF48057A36
SHA1:	7A32C73EBB38BB0C25B916865AD2D1174FDDA9D6
SHA-256:	54C1FBF6DA1CCAC0F709D0A0278E686BD11A6861914320D23534532F05295832
SHA-512:	4462E73623BB5F9BBDD87B10152F7563DE66A851CE50C434F03BE4A971F050DECAAE03B3FC3AF39A45BCBC263A3731513DAC99B2E1FAB456B4CB1E6098D7284B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Item Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9629
Entropy (8bit):	6.871624988147625
Encrypted:	false
SSDEEP:	192:wc8mVoKEYb3URte7jsWLsUaFUlbVvevUqzMWHn9SIZEV0cBjW:wc3x3CtEAUlM9zMWH9SPTjW
MD5:	B4FE893271AE9945D88266425B57DC79
SHA1:	EACC02E665FC484E7B04723D2902B11D52C06020
SHA-256:	85CDBD7FC55F251AD04D1752B1BF67076326B56E10DC0B8CB13BF23AFD2C3948
SHA-512:	CA6879822D78127CA07E412C9F35D875058101C1C6264388536CBFDD97719E4D42779A2DFBC916FCE8EAA21DAA82CEE9BF1BF92466B08DA9626D6007F4D64C61
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Item.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9597
Entropy (8bit):	6.859256483337967
Encrypted:	false
SSDEEP:	192:wc8mV+J1BUb3UAUk7keaFUlbVvevUqzxk1xrEBn7wHgmtD73o:wc3gjO3bDMUlM9zOEZwA8D73o
MD5:	4EC22FBC3BB0115FE5DB88B1CA929B03
SHA1:	8F4F37013E3E6EC5B716E9E8F1F08610F6B7123A
SHA-256:	8B779B79536FCF700259299BE2CBD7521D3D67605594C793875D0C4B79D9B8B3
SHA-512:	2CC9CD6F8189F27582BAD6FD88990BCED8AC4330EE5A3E6DD4BA7DFC8A2CB05B01C4BA264CDCCBC2EF0FC8F7F3C57BD4E3ACD606F93DBD21CBED0DF9FDC0639C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Journal Entry.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9160
Entropy (8bit):	6.7900209701185945
Encrypted:	false
SSDEEP:	192:wc8mVvTn5cHb3UnXP8CaFUlbVvevUqz32fXoEtax81w:wc3J5u3CXgUlM9z36XoEQK1w
MD5:	7AF9E358CF778FA63006A21CA40F1E22
SHA1:	D35D66C6F69236F7A724D11BBD79DC4D7A7977D8
SHA-256:	F8B39FFA5AC39BF5E9F90343A40E995E94596C485913E52432D52864F35D9815
SHA-512:	DF6F4CB70547FCDD5BD980173902E4FF8A0ACB7C137E425B0A3B273B200932759342ABDDE57F6E37FC2B1E571F5461FC7A3426F5E0374835F58C546F044C11F5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Other Name.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9968
Entropy (8bit):	6.880867618821103
Encrypted:	false
SSDEEP:	192:wc8mVe5ZQIb3UQC2aFUlbVvevUqzvMJbjBWNkMfjiLoK63G:wc3tI3iUlM9z4UNFbAoKqG
MD5:	6ACBEF4FD24CFF80F6322CA881F4A2C6
SHA1:	5A1B79443C117E16C6B2EA41E9D28F192E444E5D
SHA-256:	CA09A44C36559A08E1298B2786C68A69F54516394BED1EB949D168BBC723663C
SHA-512:	41C4A1D1D1D7BEA260536C36653B0030854C20A737F56DC78F6E8C1F5FAB049E3C3FBCCB1D2255F68C9FF4EC0DB23207EA57CEA8322F9B69E4A2D495C52F6B7D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Price Level.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9140
Entropy (8bit):	6.781150851973323
Encrypted:	false
SSDEEP:	192:wc8mVYDp8Qb3UXrBKKMaFUlbVvevUqzxk1xfT5f:wc3e+Q3CBUlM9zMf
MD5:	89601CF9F60AA7E68DD4381BBAE7AADF
SHA1:	B161B14BF6D60ED1ECFA94B0ECD005C55400EE1F
SHA-256:	91C850E21A3587ED9AFB10D26EBA0683D53B543B3BF0C45108A0078809A0096E
SHA-512:	1DB27677DD450245F8AAAB2730C49B3C297E5294FE3805CC8B549483B93773166C18EF6D3190817F14DC129F0757F80F6E99F60AA3072B4A434039550B104235
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Purchase Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10037
Entropy (8bit):	6.929733981691885
Encrypted:	false
SSDEEP:	192:wc8mVRlaHjjb3UqojALwaFUlbVvevUqzYDx9KA:wc3TlaHj/3xLtUlM9zYDfKA
MD5:	FA9A4541F27427CBA61D64FB697C8929
SHA1:	EAAD44B40CB2A67CDFAA7ACD24B1E02A30B463EB
SHA-256:	9F8AE5F217D7019560EB32EE8F5391EEC920DAA85246FBCA1E56B82184D41C15
SHA-512:	AD59D548920774F69F726873EA0FD754559ED608E6AC8158227277F544EBAF8F3636D64DE571A1B1945DA27309E361D27F088CE1772DEDC0CFAEF613AC944314
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Sales Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10401
Entropy (8bit):	6.980672917702035
Encrypted:	false
SSDEEP:	192:wc8mV2KYEb3UjQPlA92fKOaFUlbVvevUqzYDxqcw1pEP3fX1:wc3X/3aQPi95UlM9zYD+G3f1
MD5:	199D8E109ACE39A00ABBE5BE7F9D99B4
SHA1:	F1F267D00E6441D3512436255951DF3D27003434
SHA-256:	DD6DE0C75058A184C927D4425D6E15D98C72DE5B5C66241575C7C495200CFC8A
SHA-512:	D0C1B5601DBD77FF311A7007DE3FD4179C990EC8CBF1EB2969689DBB73B21FDAFB7EA2970EA388759832D85844B2CE6A16D81B5B3DEB90DC1B8A8B7E1A3780FC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Sales Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10432
Entropy (8bit):	6.980892950521402
Encrypted:	false
SSDEEP:	192:wc8mV/Oxeb3UZPW/kT8v3HWaJAaFUlbVvevUqzYDxqvT44W5DIEa:wc3IxK3sPWi8frJ9UlM9zYDf4Cha
MD5:	82FFA7B163050D4383BF1ACA4BB4E7DA
SHA1:	D1B6DA0C3EF0D7665CC41367F966A47BE058DCAD
SHA-256:	0B5AD6E76C48ABBC1754FA80993E0FBDF9790A78F9162DC177EF70097FE03226
SHA-512:	81EC91768B824F7B6C1AA1A8C5EE5F974AD7CDDAAA144A3DF4BC5C4A1C873FF4299A3588FBFD412C2578A038419BC7D9FBF89FA9DEB22C8B82F41AB2CFF87F15
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Sales Tax Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8901
Entropy (8bit):	6.743101482786187
Encrypted:	false
SSDEEP:	192:wc8mVWbYalMb3UbdPzaFUlbVvevUqzxk1xcfLasbBT:wc3oNU3wgUlM9z/LNT
MD5:	BF50AAB66AFC90B24ECC25614C9DC93A
SHA1:	F3C1EEB360C1C749F4099921576D98F6B2DB4A99
SHA-256:	8CF123DA00F60A3FB3EB125FA8183374FA13AAA402D4EC24206EFDBD2BB53B59
SHA-512:	6CA2B94F10B8E5A537960370102CCDDCA5E939B73E1A6CCB99DF78F3BAC8F931F85036DFACB3FBA4CE958C61CE5BEAF2F6421F3775729747A4CC695BCC2B5DE1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Sales Tax.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8905
Entropy (8bit):	6.7404901435281905
Encrypted:	false
SSDEEP:	192:wc8mV9boSDn6xpb3UrcHaFUlbVvevUqzxk1xpDk5pT:wc37bPU35cUlM9zgDk3T
MD5:	F78BF8DA44261C881965FCF15DD224BF
SHA1:	CF170B195F04A92B84299EA5625FCA8BF62D4EE4
SHA-256:	B9160091F043FFD3D12FF4E5CE1E257E34D7ED76978EB5523EFB3D93E69BCD16
SHA-512:	DD31CFBE802FE572AC426A287A3F876E7635406284A61C4CE44B7538D6C613C5610F87C38B1C688A836617B934C0139C8D0F0966E23C0381A353B4737939F826
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Statement Charges.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9224
Entropy (8bit):	6.799542843318275
Encrypted:	false
SSDEEP:	192:wc8mVJoNpb3UixBqbosaFUlbVvevUqzQ/3SsLakqO:wc3q398EUlM9zQ/SnkqO
MD5:	EC69EDD7F173B26A11EA8CEE46B4D382
SHA1:	7493B0D9D201E1AC4F86A76A4EE72A91F0B2FAD7
SHA-256:	7A2658BC20BD82BF53682211F4DDEE91BCA2DBE44263FC6BBFAA06C2EE02D008
SHA-512:	177F870279216E16D503D0D44668DA0DF2B9EFC3A94F1A988A7B2A3C9DC434033062F95D6C3717742E8642231E744F2617C7789918E4AFDD86D29DA2742E43FA
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Time Tracking.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9056
Entropy (8bit):	6.7690723733388065
Encrypted:	false
SSDEEP:	192:wc8mVduesZb3UIECXiB2oaFUlbVvevUqzoDmhoInoy2:wc3OZx34Cy2UlM9z8Ioy2
MD5:	3B89E70C4E18AD6369C0CB4E899C6D79
SHA1:	7B6E9EA66AA9700F376B9210DAAF6936AAA23944
SHA-256:	63F7327783B3DBEA7D69AD028580609FE3577B9E43200702D4FE8C067ADCDF49
SHA-512:	78C3C73FE98A37693F4D5153DC319FFEEE374AD436EB652214CF29D36C0F99C431EEA6826D07AA8D879235C5A5584F1C506628A1D65803F3099A6569EC4DD460
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Transfer Inventory.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9106
Entropy (8bit):	6.784389292421563
Encrypted:	false
SSDEEP:	192:wc8mVklSHl+b3UyGXLjKaFUlbVvevUqzQ/3Srlhkn:wc3ilSFq3Q7UlM9zQ/Srlhkn
MD5:	80037AA7AE2CF8709C2F24782E7B92AF
SHA1:	BD74EFFD2A639724FFF81177DEB9BB65D3ADE063
SHA-256:	827007B90EE09729AAA6D6BB4A1DD46290AB65F2BD07D03AB99CE62D9FCA70BF
SHA-512:	E71DD40867257A6056092D43E09521FC939F9B72AD441B137B8E8043C03FFC3CF38F5A92D2ABC365C60A542D2861B98363DBE2C20DB2C960E98FF6C3AA7C3029
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Transfer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8950
Entropy (8bit):	6.751180788127307
Encrypted:	false
SSDEEP:	192:wc8mVJ2cTyWb3UXyblaFUlbVvevUqzoDmhecRWx9yCsh:wc35TyC3QUlM9z6cR27u
MD5:	AB36C0F9542013A11BB6CBA2B9E93931
SHA1:	75B89BD6AEBFD438AAC322357666E8EA0EFC7D0E
SHA-256:	2F93A834E787A9457511C384E80FD45E05606ADD0B290C5E9D1068E2795C0B29
SHA-512:	9CA3D1B2E22E4D883BC7732445F31219761D8D3839B1E3DDA7F7F6410CE8AE184DA0C1816E041212CBC36281087E351526A11C7C07B3010956AFF9D1692153B9
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Trial Balance.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Vehicle Milege.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9166
Entropy (8bit):	6.7896252842101115
Encrypted:	false
SSDEEP:	192:wc8mVHZcHTb3UM4K9aNqvaFUlbVvevUqzQ/3SBBVPiJh:wc33cv3H9a3UlM9zQ/SBT6Jh
MD5:	537591EA3150CFA2C1A60EC7094F8BE0
SHA1:	C099CF61376038D4E682D7FB3CD73CF495604388
SHA-256:	339C67145A35E04E0FFE7F0501B15856A49292AA5BD63B55A8016A807ECD8F52
SHA-512:	2AABBCDAE0419F76471A1E7458898ECD6B5203A101AFF5DEFA4112D6CAD29789B3B3B039C87E013B6BD4723CDD1E4402828D96B6FE7C7323BCEBA3A099298F73
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Vendor Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9581
Entropy (8bit):	6.861554982818282
Encrypted:	false
SSDEEP:	192:wc8mV7n/TxR6b3U0BQ343aFUlbVvevUqzMWHn9SzcipUK:wc311Re3ZBlMUlM9zMWH9Sgipb
MD5:	D7207B7C8FBB90760C7280131102B620
SHA1:	556365446DF478F00674DE2559B272528A55090B
SHA-256:	728A7F334F540137F5D7F99CF8246073E802B3A013FD6F6D9F9902258542F00F
SHA-512:	D814EFBCF6A650004D0FE2609B193208B51D528EA96D81E1B2F74D5AB6E4542EEA92CF38BCD1E3BDBB0863BC29775B203B41032B5AD4D57A7DD11BAC405AB345
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Advanced\Vendor.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10546
Entropy (8bit):	6.966579022301526
Encrypted:	false
SSDEEP:	192:wc8mVUDr3lApGpb3UPTimNqbgaFUlbVvevUqz0aO5GDSItWY4Ua:wc32lApGh3oim8ZUlM9zjTAY4Ua
MD5:	C202DFADA9AA9B1849F72158ADFD0F85
SHA1:	DBA13C1B98038DB530F189FDA58D428F97F6BA5B
SHA-256:	7A183F7D689FE81D5E6091CA3FBFE44DF477693176E9A046AB6A5714E24DF4AF
SHA-512:	88C1F6E4DC42D06CA831D6BD905605E3418AD718939AE21A5A7393F9F6D92F3B799F5E9B8A551AAA6652609B0A5567E7DD2BAC90E1CDF6395E68595ABC01FEDD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\01-ETI_Desktop_Sample_Basic_Templates_All.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	61066
Entropy (8bit):	7.725568502316254
Encrypted:	false
SSDEEP:	768:9r2XBXUGW43srZBSaFs/GAshl5McPsX9AHQmvEk/cw5/NezZltbgviTn:Uxo48tX4Ke9XmQmvb/cwIvtU6Tn
MD5:	FD72AE69A9CD138E657F177EB71E50AF
SHA1:	46DB4037F55DA40FE0F25EEC28A705E24E6A4C5E
SHA-256:	70E546E140E465E2AD083FBFB3394E16446F85AD712A9D4379246A5579703D9F
SHA-512:	2F18A42854E661A4A70083B53B11926BA02CAC54AA226592B8AC95C3D9E0BC29B9ADB8E5A07F2C338F9AFD1305212FE2F52D2400F2F8124352FD78A1D1832E20
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Bank Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9184
Entropy (8bit):	6.799097466445164
Encrypted:	false
SSDEEP:	192:wc8mVYTEF1b3UGUg3whaFUlbVvevUqzGmKQp:wc3GIFl3vw6UlM9zGtG
MD5:	CE5F7CCB47AF31F73CE769337EED8E90
SHA1:	F8A7EF192050ABA6024C4A373DF1CC95F18B0764
SHA-256:	05AEEB77B1A830D1E7015790BD0DD166D8C9621C900C04F6EAB9028D077E75B3
SHA-512:	71FA9A4658542E58EBBCE74BD2FB4CDAEED6A5BAF078BAB4B8B7F0CDB5092BD2777B8258B30C0C8B56D12E5512D9698BBB85DCB840DCE50AAAE0996A48CD856E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Bill Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9135
Entropy (8bit):	6.791930714923156
Encrypted:	false
SSDEEP:	192:wc8mV4Ecrob3UGgLaFUlbVvevUqzFRETysPnDzGLsgo:wc3ig3OYUlM9zF2TLPnDzSlo
MD5:	192B8F44FA177EA0FFDB8460630830A3
SHA1:	145DA91DDBC60B81180B0A3A88096A0FC518AF73
SHA-256:	BE9421EAC4C17095B25D5BA803BE784F6E92E43409A2C1236D011BD0563716EF
SHA-512:	C1E2A6630207173A813ED1A12DB43E5EEBABCBD5EF02011C286E109F0E593FE7BF6AC716B71365E003777758C699E742B3C8E4204D6D04098021FB40D4E80495
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Bill.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10213
Entropy (8bit):	6.890529533133892
Encrypted:	false
SSDEEP:	192:KIQ/jYtbb3UtJlaFUlbVvevUqzhNlQbDj30yMqDbzz:KljA33vUlM9zhSDKqDD
MD5:	BDF397CAFB2FF47591D2C49A7C5FF230
SHA1:	423BC617BC0F02B155359AB2D2332CEDC47057E5
SHA-256:	57C5C629B2B5A78A176F2CCB1389BCA55EC2601CDE9D1177B8DE0F621211042E
SHA-512:	40E536B524724F6DF41EEDA8D07E3CE12DD8E1806B0407356DD680F6C33689EF64B4394E565CADDABDE863FA66FDA3E7FB35EBABEF88DD56BBE47627B629779C
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Build Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Chart of Accounts.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9369
Entropy (8bit):	6.820004824747073
Encrypted:	false
SSDEEP:	192:wc8mV8Rb3UrnX2rta1ngRaFUlbVvevUqzaNm+JbA5d:wc3K3GXgtaVgqUlM9zIm+NA5d
MD5:	40E861F530FA90654EDEAEC57EB78259
SHA1:	A357577AF40310250D1D327C9C0B0471AFC75CD1
SHA-256:	2BE05E08A5A64348B9075D2CD6806A81281D9552E091E142851CF777DFE328B0
SHA-512:	D32A0F4B4E28EDCE14B6FC5BE2FF1F63B0C93B435A36BAC53CC4C65C07FCB9F56397026B89C7315B13352715DA77428A51E23A29FF8987D54E3D6D8BD8C2BAEE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Check.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9194
Entropy (8bit):	6.794556375149265
Encrypted:	false
SSDEEP:	192:wc8mVKMFXb3UqxZ+naFUlbVvevUqznr3xDKG9:wc3Nr3rj+8UlM9znr3xD39
MD5:	8406148C8D072ACD5181A28EF422536D
SHA1:	DE995904787D00B6CC9D0ED4341CEF9B79C30178
SHA-256:	374767BC567F75A914D105A8F1F24F2026AA833393EA1939CC18DE8538827ED8
SHA-512:	57271BDEC904EF903851F8742B50C2E2B46F9F6AD4AA549D85385B534910ACA4BAB0E64B351C5CE7C8428460D066E4B9334B49A2B1658F1F9291637EAFDC30B8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Class.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8836
Entropy (8bit):	6.731437216389898
Encrypted:	false
SSDEEP:	192:wc8mVLTIyb3ULY93aFUlbVvevUqzwz4tzPPnhwRc2xTQD:wc3R0W3aY9MUlM9zwz4hhwuY8
MD5:	468174A45289B92A9539A43E04E41432
SHA1:	47EF75923A676C238994ED796A66B5A5A2CFC998
SHA-256:	42B269D5FF693E25E33B5E9E80CF937CC5FFEE51B0070B5B717F7C4DCBB83F11
SHA-512:	4992E2A092D2CD3F893CD579B84E89BF5A95C47749DE84CEA172BD6F725EE272261322A5446D78F5ECB81E6E4571C978490FD6882D07D23CACE172BC5645A0B1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Credit Card Charge.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9353
Entropy (8bit):	6.8266239151092805
Encrypted:	false
SSDEEP:	192:wc8mVl3FbQIAb3UDUbMwWRoaFUlbVvevUqznr3xljbOsCXY:wc373FbQP3hbSUlM9znr3xlX4XY
MD5:	7C492D1132BDCF34AE0F0BCE636AA633
SHA1:	E92182622DC46E6E941D449C782CE83EB2464A55
SHA-256:	D6B222686B69187951120576193388845C9D8484C1CAA7BC2C20B2477636900F
SHA-512:	BDCA77E241B675C66F25498FF64E605DA18B5DF03BB2691677354431547DFC69F19CEE4F52B616F29184C689153CFC1692FD103BB81187CDDA9E50406683F180
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Credit Card Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9203
Entropy (8bit):	6.796497021864688
Encrypted:	false
SSDEEP:	192:wc8mVrQj6GIEQb3UnfJIWFAmaFUlbVvevUqzI/4a:wc3NQj9S3bWkUlM9zI/4a
MD5:	4B4F3EF66E93972E8F99245A758CA0E9
SHA1:	11EBD0F894EAA4037D47EC6F562861DC74E6D4CA
SHA-256:	D9C8AD247AB7B050FF991FEC49AE5A41B57ACF09BD5942E5DAA0DE8C2B6AA2EB
SHA-512:	B20237EF9C8FBE82D1E420D9D895BB0AEEA1131EAE78E1B446D9E4A4619E08F48AB13A896E30DA9279639A3FF39AC561EDC9360C9F1CAC65F1942D0D07674D94
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Credit Card Statement.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10043
Entropy (8bit):	6.855789206815509
Encrypted:	false
SSDEEP:	192:KLmT2b3UUBkCaFUlbVvevUqzDVN+WHp+c8bzP:KiTi3AUlM9zDL+4pWbT
MD5:	600277C1E0C0ED5B89158D021471D218
SHA1:	6C8A1D7A395BE12514604A1434BDEEC3FE619DA4
SHA-256:	356397D0EBB8BB1520D2F7D32C2275D955DA9C5CBFAD99CC051506DA480FF91F
SHA-512:	3A4CD3916660A44F6DF37F452E746B3CD9E81B0D009F7BFD375B9AE0A01B9269D349448E7ACBEED072ACFA8417A6DB3B27122EBF9F0E3852F6374F0B9D6A6538
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\CreditMemo.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	6.804033887715217
Encrypted:	false
SSDEEP:	192:wc8mV0OtFb3UESMC4CaFUlbVvevUqzmpPhEYot1isr:wc3CWV32CUlM9zE5+lr
MD5:	D8A27A9E4CCCAEA9A920B1DC6C1A119B
SHA1:	E065CAF0AAA56F5331423E66340A0F5A38184B1B
SHA-256:	36AB013D0F3E1AC207A7BDF5D57F3F202857E1711EFF16B69B19321A61D55225
SHA-512:	6B255A8057616A9B9A8D27F60DE1649F376A801CC99814A4D69B88DD9613109290E288A5CB6C68F5DD715E6584AE6EA2426E98A45374982A69A6453225809250
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Customer Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9107
Entropy (8bit):	6.778806112720085
Encrypted:	false
SSDEEP:	192:wc8mVESHTTteb3Ulxj+I7aFUlbVvevUqzQ/3S7+Zkh:wc3fvtK3Cxj+XUlM9zQ/S73h
MD5:	BC59FA63BF1FE00967005768578BF425
SHA1:	FBCFA4ED201CD174E007E758AB5B8474AC7833C7
SHA-256:	FDF9CC7D78AA342DC8558ED7C9ED12E6C64771156366AF085833E2DA35C5BF03
SHA-512:	20F2C9A6506B6D105F0A31D2A8C912822EA4776FB31766691A193ABBDB3B0A8398339484FB1F9FF0A65319A861A5B8C7DC87DC1072A2F306DE6B4DD85C51D4F3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Customer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9813
Entropy (8bit):	6.860671425936742
Encrypted:	false
SSDEEP:	192:wc8mVnJeb3UyKopmaFUlbVvevUqzZJtVMNSXnGLY41LLg:wc363/KavUlM9zZJtTXnSr1ng
MD5:	24FD891870D191BCED85E80CACD647B9
SHA1:	FE21A94DAC5899CEDC9D661065D0B9A7F3136CD6
SHA-256:	18ABEEFF3359B16923C25BAED92C4BA4313CBBA7589F7C832C468F9AAF0A9499
SHA-512:	1BBCE47C787FF0F6C299D1D4ACF947E82BA7B49946EBF877E6C60D124F5E438544CA67682D7BE6367F501D1F60720A4E1C14E697B39E86D1ACBA9A6B8A5D2616
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Deposit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9165
Entropy (8bit):	6.788062247325982
Encrypted:	false
SSDEEP:	192:wc8mV+C9Pnb3UfbMPsW5aFUlbVvevUqzQ/3S+GL2+nT:wc30CN3MkpSUlM9zQ/S+S2+T
MD5:	2D312CB10F08B78BE0820C7F3874B266
SHA1:	02DCAEB6B4D79E039D64FC4A18007D1FBBA0FA29
SHA-256:	D7FC270A3FA93E714C8C39DD8A176709708EE6B7C73A7F64C981998BEDAA434A
SHA-512:	CC700D1A2239783BF61B1D38D90E724E83B39E6376EB283A1BDB0B1830927E4E118BE82DF147F5584BB0E2DCF29DAEF11B7E442911F56766AB53F46BD8CAC061
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Employee.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10671
Entropy (8bit):	6.986459582747118
Encrypted:	false
SSDEEP:	192:wc8mV9pfCb3UgK9AKRAaFUlbVvevUqzfneKjYVQWhGLvDj:wc3U3HK9Aw9UlM9zP3jYVHSvDj
MD5:	8CE6E3E912C77074A303D7C2E9B54B3D
SHA1:	188B639451C2CEB4F3E9CF192000FDC1AB007974
SHA-256:	FBAE185C3B14C3A7D7DC0A4983AF801475791009535D4EF7C4A57C3B6EF2584B
SHA-512:	8698E31160710223DDFCC5E094F01EC898ADD4E9D71DB3911696486AC59C3D587B17BB68C10F35DABA4814C8B0B8B73C3B13F9B9FE163F840A70DDB501819864
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Estimate.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10166
Entropy (8bit):	6.878077026613522
Encrypted:	false
SSDEEP:	192:K+EB7kb3UDo7SvfpaFUlbVvevUqzMWHn9SFjtlgNSWL:KDq3R7TUlM9zMWH9SFvg/
MD5:	92A188443B48D573523158EBF1C335F2
SHA1:	558046F03685225C6AA76B1303A3190937EACE4A
SHA-256:	BB1F898699D5A2D3B63E85833BF4C30CE254E141CA6E5B9B1B0257EA7EE2B75B
SHA-512:	EE79B41DDBC58086B395BCB7265E743946ECD3CB9BC7396E11C84DA7EE6CF47517379A818C2B92787F3D0092AA81F21B49F68E9AA7D31327C191D588E39C415F
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Inventory Adustment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9198
Entropy (8bit):	6.796468832739139
Encrypted:	false
SSDEEP:	192:wc8mV2+uub3UhbbObGiNaFUlbVvevUqzQ/3SjmFunTH:wc3ll3wKxeUlM9zQ/SpTH
MD5:	33F6770ECFBA78F163373ADFABA060CF
SHA1:	B0139602B76831B5FC08C51DFA21F5453361B320
SHA-256:	6EBF787D74B085FD9502EBF246A71CCFB09271D26E509A779C2FA721DE16C0AA
SHA-512:	9169BAA6EC288EBEE795620CD3E9C7D2D2AE61721F8B4D46508332BBDA8A6D462CC7C68136A38FC0ABD879155A06BE1D618E8E76FC4B3EAEB60AF456399180BB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Invoice.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10308
Entropy (8bit):	6.903411153340173
Encrypted:	false
SSDEEP:	192:KrTEC9b3Uhe4aaFUlbVvevUqz/sKHPTII+W1Um:KrTECN3DCUlM9z/sKHL7+tm
MD5:	632A50F9622433E866CABCE5C4AF5BCF
SHA1:	93FE7731008623651573D66E95CE91195D6B7C1F
SHA-256:	20AF6E2667E931B6F8CDF2493CC503D1C3F978EFFEACBCD275271D3C6BD2F714
SHA-512:	C2D17C4CCDB80384C177AEB94FE91BF4453444515DD02B0F29A329FF1064DE1478B14277AC762DD201939426B895EB724B402472BFA97DEB9294679A566DD4B6
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Item Discount.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10553
Entropy (8bit):	6.906479889381009
Encrypted:	false
SSDEEP:	192:D7XYYYb3UBazsaFUlbVvevUqz2RIMpQcqjz4B/D:D0Y43xUlM9z2OMpQHmL
MD5:	9EAF0A9C1A73EECD7A04C5BA04E8B602
SHA1:	339C3D6332368B2E5C243A48ABCFFBFC00FBB9F9
SHA-256:	33FF9A0444BD7966BC8229FE2810CABCBDCD79F9A7500C169F03CF5CC9B6F0E8
SHA-512:	4F51A78C4973B4B3A6FAA5D0AB85DC2A90297F1E4C14AE6A3DC7865124727A73EB2E2DD6993CB9B14B4DBFFB2E54438BCF37987FE4E8DD174962D80F3F967A8E
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Item Fixed Asset.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10339
Entropy (8bit):	6.901061806810003
Encrypted:	false
SSDEEP:	192:Kb4ZZyb3UqzYbkeaFUlbVvevUqzQ/3SjeFFtr6qeKjU:KUW370wnUlM9zQ/SjevteKjU
MD5:	570B66738D1554DF311D890B916E0F8B
SHA1:	5FDD69E2F3BFD5E27863F4CC4E029C091A2D7E70
SHA-256:	AA4670232A2FAE2262B4E4A454EE316B35631A76EFBF393F949A65219389B26A
SHA-512:	7A615E63CD1A4B4BE31D26BE92A36B4B291A4417D67ED5643A6CDA41A7EA9656E74D802EBA60CB5DB174E05A62D64B605BD957E17EDDFBE924B6F8C1FC041AE7
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Item Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8936
Entropy (8bit):	6.748673130020193
Encrypted:	false
SSDEEP:	192:wc8mVQshM0/Jb3UshT3OaFUlbVvevUqzxk1xQML5nsOoF:wc3OsvB3ptXUlM9zTMNsOoF
MD5:	1FE268B151BC885E9865CE977D3D6FCB
SHA1:	B45D680644FFED507926E5B056AA59FCDEE0C65E
SHA-256:	16C703F60D9C41095BCD620CEB14B479BC2B0FF1587B8FC92CEDFDF56B5B147D
SHA-512:	47440B28903C641744963FB15D937E9FCCA594B1CB3DB881D26D5B2C31DF0D8C62C0A7CD9206F0E554F2652647A779329B25A1B9F78C8C5AF36B785DAE0A001A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Item Inventory Assembly.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9326
Entropy (8bit):	6.820089794231195
Encrypted:	false
SSDEEP:	192:wc8mVe6g/b3UUYlHaFUlbVvevUqzxk1xJORs08+stb9:wc3g36cUlM9zZqx
MD5:	6FB508B17C40EAFF871080C6569DFA2A
SHA1:	250C8CF05B83A5E82D11FF59F309F756242069EE
SHA-256:	64C511BC90F6B590AB837CD629861785FA3A3BD5645F722152592113C66AB99E
SHA-512:	4335B4F309C42E07022A8FF71C40AA27D6B0AA03832B8976706B6BBD86E18B562DD96CAD08AC6146D8D91738D49978513E8FCA6D0D195DCF07079105E62E2A5C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Item Payment.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8893
Entropy (8bit):	6.741464399644638
Encrypted:	false
SSDEEP:	192:wc8mVkn993b3UW0IAaFUlbVvevUqzxk1xz9:wc3kL3Rp9UlM9zG9
MD5:	86B7BDFD63EAEAD23F4FA9160C8F847D
SHA1:	BAAC7671A49437204841AC5CC60D8CAC9EEA7AC2
SHA-256:	FC95ADE85D4E81830994761FC2E5DBCAD2E4F256A38F92219FE9EF7951984559
SHA-512:	6866D18630B10C5F83CE11554987B0FF0C7CF8B6A336D37D3CE9C0E54587EE85E19AD0420F53C30E2D097B999D8BC60672DAAA3EFD9A044943715E0CBE8130BC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Item Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9153
Entropy (8bit):	6.790640553486682
Encrypted:	false
SSDEEP:	192:wc8mV5Hnpwpb3UvWYnaFUlbVvevUqzMWHn9SmnOBu:wc3Lyh3zUlM9zMWH9S3u
MD5:	9666585613B610BA36F6E339C5A99C18
SHA1:	6252C24CFBC55771972B2DB9BC350C390371C21A
SHA-256:	BEF12CFD50FC027278B710C9A8AD3F6724702BFB6090352685E42997D18E3193
SHA-512:	8496C978C515EF12954DA362ED68887F0EF87BDACFDC63066F04373B44A255E543C5711D67ECE9A3361D379ED368D5BD65038ED329B1350FD6FB8CB70EB7A4D1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Item.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9287
Entropy (8bit):	6.808545659750705
Encrypted:	false
SSDEEP:	192:wc8mV3+vIh2b3UVPV6eIXvaFUlbVvevUqzxk1x2D+kseytD7HX/:wc3Ygc3NeIXkUlM9zrseYD7P
MD5:	D57BCC7552FD94814BABD06C3A5A728C
SHA1:	437A50990D69E36D59C30D1281C2245DEFA26293
SHA-256:	F7448BB9D137B93957C1DCF4E77EC168141CBC8A2DE9D722E4E6B6B27C57E67D
SHA-512:	3ACDFF5E40087190D6B33B6682CB6A9873973DB8F1984E6551EEF9E3D165ECCB00A84FFE27C96645298364E00C76D5DCD0795385EA3E84613A16F1234D691D6D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Journal Entry.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9088
Entropy (8bit):	6.774778798840462
Encrypted:	false
SSDEEP:	192:wc8mV5B0JgszMPb3U2WcaFUlbVvevUqz32fFqn80C:wc3fB0HzQ3vCUlM9z36o87
MD5:	7A5F633598A8638830E46565968205CD
SHA1:	2D87350D7B9988437CB975851A15FFB0A7B66645
SHA-256:	B7FDCF7A7625909ED588C89ED2B760216DCC64BA886F3066BEDFF524D0176EE9
SHA-512:	5BF05B03FB8504E523BD2CFEC5A7CB8FFDF22068A2026278E4A54EE9FC8904D9C97079E92F2ABB58C088C0D4FB48FE66F025B93A0CA29F28A649DC6ABEDBB1B3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Other Name.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9973
Entropy (8bit):	6.882467303186888
Encrypted:	false
SSDEEP:	192:wc8mVpv6Kb3U0VjjRnaFUlbVvevUqzvMJbjBWNkMfYkeoK0t3:wc3x33J8UlM9z4UNFAkeoK23
MD5:	B9A5FB817878602B1E0BC1AC1E573070
SHA1:	FEF3038BA16B96C4F3241E48FFF3D882F0FA8EF4
SHA-256:	A308567D4DBBBDA556812C559297567785CBE082CEDAD70103FBCFD02A970377
SHA-512:	A85271658C2E0945AE07414C2E8F93C979FF5DC6486630AFF817F54C5C70001714392B5A3D935FED624C528D6AE5F40697136CE5522F869C4E6F589864E42DD4
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Price Level.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9138
Entropy (8bit):	6.777464816597789
Encrypted:	false
SSDEEP:	192:wc8mVXZBXyoRb3UWrKJgPpaFUlbVvevUqzxk1xKhnJ1qlY:wc3dF35KuKUlM9z3d0Y
MD5:	477128674AA8AAA769DC9B043B0C9734
SHA1:	8FB69498EA8BCFCC6A2AAEB004982D1520453D6F
SHA-256:	1F378230DDA0EE5D3006F39B1A501280DC907443861CC5192B97759CD1BCF5D5
SHA-512:	7F65836D0357FCD6E246A1593ACF22E221EFB0B34DBFB4B55247EA61F50FB16C5A66DA784802FCBD222FE536AD4BA11A8A2EA371912226AB9DFF5A1DBA88136D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Purchase Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9228
Entropy (8bit):	6.804200759490604
Encrypted:	false
SSDEEP:	192:wc8mVn2ROb3UGEGaFUlbVvevUqzYDx8SHWV:wc3YM398UlM9zYDP2V
MD5:	5EE240E36B72BB16061AE308B09CDD5A
SHA1:	D1BC3F912DF6D7917D9E120D9004A4C45891AEE7
SHA-256:	2C6D807AD0885410665968F89A30E54AD0D41F94EB716A3B098AF8859A736545
SHA-512:	B10084E887E79CC0D9F65320C3315F44219BFEC638B9C8B548CD659D6541356D23AEE7F976C92438C4399391C26FDCB62AD75CC70BE83E617BE3D81AE052A488
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Sales Order.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9304
Entropy (8bit):	6.815093622466568
Encrypted:	false
SSDEEP:	192:wc8mV/ndJYu88b3Uyi54/hB+TaFUlbVvevUqzYDxcgEfXr:wc3ZdJDv3i4/hB+AUlM9zYDTEfr
MD5:	512B87331D781AA63E85D0C0B92A948E
SHA1:	32335A46CFC1D88D3C2CD355C4959666901FF485
SHA-256:	CEDBD8EDF4A5A8453008884EECC4253EE5ADC13101CC0E354A687168AFB66888
SHA-512:	D6A19550A2CD06769D552E0E28461A68DF60384186C16224C937C81CAF7EE64B59CBB157D16131CB0F9EEDD772DA73BD3C47A856289035915DD25FA541EBB291
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Sales Receipt.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10013
Entropy (8bit):	6.921629504110839
Encrypted:	false
SSDEEP:	192:wc8mVuRb3UpcH/TboR8aFUlbVvevUqzYDxIIEp/:wc3Qp3K0/TsRxUlM9zYDGhp/
MD5:	4375B91B6DCC6FF545218DDFEE04578D
SHA1:	D24ECF5EF5A04BB0DD2D1C22C54E9DAA3D7A8D2A
SHA-256:	D70BB2691ACF04825C19AD4F76972B25B569A497275AC3C9FA81C1C1E5076DF9
SHA-512:	8C0A1085957BD7BFD848C86933578EBA46306BE63FF0ABE0B5547B4618E0A682CA0B3E2B5370EEF0DAE6F01B7E9697B30F2127A1A6FE58F7711DC2985DBF05EA
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Sales Tax Group.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8903
Entropy (8bit):	6.746413783682726
Encrypted:	false
SSDEEP:	192:wc8mVNh2wguyb3U47YcfzN+aFUlbVvevUqzxk1xcLjasbBh:wc3txguW3bYMHUlM9z/LbNh
MD5:	7C341F07B87A03BE583AE0EC9BD5B253
SHA1:	3E21C8E0A511AB97E24483ACD224076BF8554DCB
SHA-256:	191C5EE6BDC23F69DB2C26FEEC52E8602AD653311CCC06DD77400C338A1501F3
SHA-512:	890B2A446BC44A5597C36FF4718C60123C574528391CB5E872A2C91DFCE35004A2160D9C4271069559DD729E90876B26DEBAC12325D6ABDE3DB0AD36B1E6586C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Sales Tax.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8905
Entropy (8bit):	6.741727027305183
Encrypted:	false
SSDEEP:	192:wc8mVjib3UmVaFUlbVvevUqzxk1xpZklpB:wc3lm3uUlM9zgZkjB
MD5:	45687B6D0775709CFBE39553290627F6
SHA1:	35F6266975EFBFA5579502A40EDE5F15A65D433B
SHA-256:	8A1090CFE648F4C711A04F426BF0DC97FA9A16AFB2BFA86D40D35504512C3215
SHA-512:	72F6CAA73E8B958E4D9DAF17BC2C7EB42BBC6A7AE593249A57F476436065F72076503D74263853E050B62FE30CA4F16309EE9CCA42C850A5F032726F1AF7B5CF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Statement Charges.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9098
Entropy (8bit):	6.7833505794763465
Encrypted:	false
SSDEEP:	192:wc8mVY82zxD7Wb3UO+QAfaFUlbVvevUqzQ/3S2g7K:wc3N21D7C3ZFJUlM9zQ/S2g2
MD5:	C5412A4DD8F8823B24F08EF28220C713
SHA1:	9383048EAEAB0E738264330CCE9E796583C68DEC
SHA-256:	A66883BF9677E9485B7A63D51263E1B361F49BDD6987B1DB2B1F83DF9312A50A
SHA-512:	D3E520F378DBEC3AEA23BB52953C7A734C3301E57A0A9E5A9E42892ED917EE418FF0907EB4F9A814B6C6B52D9B9374BDCD4FB8C64CEE5A0F2AA3087A86EC07D9
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Time Tracking.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9028
Entropy (8bit):	6.763438882772652
Encrypted:	false
SSDEEP:	192:wc8mVpmD7uUI6BaSb3UXv/HoaFUlbVvevUqzoDmh1veKGnoyi:wc3ru7xI6B33qlUlM9zleDoyi
MD5:	A5FDDB650DD24C69AD6187A7CF29458B
SHA1:	541CF099BADFDF2567127E440253D8AEABD2EE4C
SHA-256:	21B55055CABA9FD52F0BEB73FF48EE254726E05359641C28AC6F72EFFBE34B1D
SHA-512:	93A699A2DA66870E8FCA3A11DCE75BA767A8EF62E6EB49F07011539F4EB901DB7F4C7CEE69421ABFEB8A5F97F6233208CAD469AF8542A8045A7DA9193DC2D0B6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Transfer Inventory.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9073
Entropy (8bit):	6.775095439636831
Encrypted:	false
SSDEEP:	192:wc8mVc1b3UsVoaFUlbVvevUqzQ/3SuyFJ8lhg:wc3s3bVlUlM9zQ/SuyUlhg
MD5:	3A0598F31A965B06BDC721A44897C61B
SHA1:	7F9BD01454B18E409200619FEC6910BFF15ACCAD
SHA-256:	4C0797371EFA059D0BB53E4038F06B8C880069E5897B9F0872BE1B39E269E4E8
SHA-512:	160D66FBA3260E04024557EBC8A0B6458A56847D5A9D15DDCF5731EE7F17A36221AAC6640DA1246AE7CF8610D145AD65AABEEE281702CFF53E0D76C375BC3F88
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Transfer.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8939
Entropy (8bit):	6.748242510526029
Encrypted:	false
SSDEEP:	192:wc8mV9Trb3Ut4WaFUlbVvevUqzoDmhWzn:wc37n384fUlM9zyzn
MD5:	96E1F7C4743E814EC91A66F0111C26E6
SHA1:	35477FA996BE87866EAF805948BB186EDA2C1C42
SHA-256:	F57D33B7A220FBD5BDA83B5B3CE2C28F54916B6B20E7F80B8657114744A4041C
SHA-512:	82941DA34BA0DCD6C56732AAC1AD03AF980A9A5490448CE6EDE65526219832614DDE27F7777851F0F02872D3923261163A00316AAD366884874AB2E530150A26
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Trial Balance.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Vehicle Milege.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9059
Entropy (8bit):	6.771509929735666
Encrypted:	false
SSDEEP:	192:wc8mVRNs7bb3UHwxQGugaFUlbVvevUqzQ/3S2PiAL:wc3zNs7333xQ1UlM9zQ/S262
MD5:	91C493B99593764501FF33B0BED060D8
SHA1:	2073076A51EEEC12D953344CE8955FADE29F0FAD
SHA-256:	7F8D3452FAB6BED5A92CD897826CB9610AEBEEC1135761FCC5B12C589B9B35E5
SHA-512:	B8F6ADF0ECCF11AA459E6346F1973488E09245156D56CD8EB86A69F1A67FEA75F191FD690267D6EECA05B97B760FD088F34E746123B6C6D0D616D1B5344D5917
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Vendor Credit.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9219
Entropy (8bit):	6.797160453567968
Encrypted:	false
SSDEEP:	192:wc8mVoFZRb3UPp7xjaFUlbVvevUqzMWHn9SLvciX:wc3m13CxQUlM9zMWH9SLUiX
MD5:	6A2282B8C611DB702E3FED15CAED45F8
SHA1:	5A19AA35F3019EB70464C1E73565936DC7F4CE81
SHA-256:	B6B330DCBB9D8815732BB629D4E6DD1BD5A7252058F36BC962DB59A2622B803C
SHA-512:	9EFF4495F1B4B7D80E4EA906D66D148BCBF47936405FD539346F940B98FF2C8938AC7683F1B36556B10323F942EB9AC4174246E335A5C26C08108EFFD877A206
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Basic\Vendor.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10549
Entropy (8bit):	6.968572308131826
Encrypted:	false
SSDEEP:	192:wc8mVGeb3Uo2tdKx2HEWoZZMoaFUlbVvevUqz0aO5GDSKk8Y43V:wc3cK3ueIkWQEUlM9zjTVk8Y43V
MD5:	B00DED87D8A3865084BEA4456D59E6EF
SHA1:	018D8B3EBDDF0AF2F1E5E1413DDB5C3E964F11A9
SHA-256:	9FB6D2CA7D4B1F39F89B118359CCD34166F82754FB3B1550DECED94711559C0F
SHA-512:	1FC86ECA0AC55CFAED5034256D9CCDC9785E8506CD10E5CC68C62A66345C64C9C9B8DB629D13877250D74AADE01A959111EEBFD9A17C81730511A916F0496166
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Program Files (x86)\SaasAnt Transactions\Sample Templates\US\Lookup\LookupSample.xlsx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	6.819620975894779
Encrypted:	false
SSDEEP:	192:iRhjwAvOb8XpS0iaFUlbVvevUqzDCiMzg65AtgfFvof:iRhHOypbUlM9zWiMtWOfGf
MD5:	F36B43F28EF0C3ED040587F011567BFB
SHA1:	4D6535CE089E6CA11571C84A28B38BBDF82733C1
SHA-256:	EB1172F0C1BF6D6D5ECD22FB08B48D148F8C20D07CD9039B4DE8C3516E3459E0
SHA-512:	0374F75FB3DDCF2BEC7DFC6A00C059FB823F55A48641FDD021E81DD71D5D54D472C51B42ADECB3D4020E5F2E3F21F001359B90F8A9A8C4563020DD4F3B21F0A9
Malicious:	false
Preview:	PK..........!.....d...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.....U.S..0M.....7.....C#.$......`....@.Q...~qc....f+.h.+E...\.q.R.O..;.!)....J.......p....g;,EM....Fa..8...(..8.AU.5.9..ne.....Z.1.>.L--eOk..%.`Qd......kEL*WN.r.w..g...M.........`....FC6Q.^T..rm......a..J?.......W...Ai....EZ.F...>...Q...a..\|I.D..?q..;..y~)...#m,....=.\...."w...~j....;.> wr...o.6;.,...\|7k..v.)pv..3.t..Lsm........PK..........!..U0#....L......._rels/.rels ...(.............................

C:\Program Files (x86)\SaasAnt Transactions\SgmlReaderDll.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	139776
Entropy (8bit):	5.692827853836015
Encrypted:	false
SSDEEP:	1536:6P+WxQktZHNSukbp+RIMq2ovFQ36U3QVbChbO+A0FvGI39qFe57IljYpH9q432Z9:K+UNmTv+3H7A0ZGTFgKYt44G9d
MD5:	8335F3672E5EBC41C4AEFFD75BF953F3
SHA1:	90B468458268783259F1AEE8F1A9332B1262624C
SHA-256:	E91531F568072C862953647071612FC598945627218FC2E5BF49747A363D45C0
SHA-512:	3A940D5DDD3B903A2F432EA82001652E0CDEEBB35FEEC193DCD9F74DD6DA9266686D6CE17365F7ED577F283930BECDB818D02A9CBD86F2B277254291448068B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w.Q...........!.................7... ...@....... ....................................@.................................x7..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H............n..........p...e..P ........................................BQ.;..[\w.t.v.E......Q.gpr.b...y.....]..\m...$?}.e\|...@.G4.{.......i".R... A......,]..Y....2s9u.@..t.. H......6{.6.....B.(..........(.........0............(............-...o(...}.....2...(........0..%..........(............-...r...po....}.........0............{.....+...0..3.................-.r...ps....z.r...p.{....o........(.......(........}......}......}.......}......,..r'..p(....+...}...

C:\Program Files (x86)\SaasAnt Transactions\StaticData\Entities.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	722
Entropy (8bit):	4.793241433689173
Encrypted:	false
SSDEEP:	12:TMHd1Yro8iKEfnSfj0SfBUSfrSfTSfh1JDwfvSfKJSfqVrmay:2dSo8P9/vbwx8T
MD5:	A379884CFA34F4DC829FC5248A423AA1
SHA1:	014160784172680F0BD3B48F401DBCAAEF8B5DC7
SHA-256:	853203C9CA696CF85B5D05110ACCA13A75A074903F69E095E409928CF4C95C2C
SHA-512:	AA37C62FEBC10DFB649C27358408D96A950D657CC31E20638B6A9A0578D4342433788C6EB1666E3686E529D706755E6BDAC0868D918B3C633A0156A85EE72440
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<ArrayOfEntityItem xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">.. <EntityItem>.. <Name>--Select--</Name>.. </EntityItem>.. <EntityItem>.. <Name>Invoice</Name>.. </EntityItem>.. <EntityItem>.. <Name>Bill</Name>.. </EntityItem>.. <EntityItem>.. <Name>Expense</Name>.. </EntityItem>.. <EntityItem>.. <Name>Customer</Name>.. </EntityItem>.. <EntityItem>.. <Name>Vendor</Name>.. </EntityItem>.. <EntityItem>.. <Name>Employee</Name>.. </EntityItem>.. <EntityItem>.. <Name>Checks</Name>.. </EntityItem>.. <EntityItem>.. <Name>Products/Services</Name>.. </EntityItem>..</ArrayOfEntityItem>

C:\Program Files (x86)\SaasAnt Transactions\System.IO.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.9270593020053415
Encrypted:	false
SSDEEP:	384:FJm/WFMrOhEZ0GftpBjMT6fMk+ILKHRN7uX6lFgJj:yaYbKi2zkmuXMw
MD5:	D552DE7D39179B914DB7CC2DBDD005C2
SHA1:	044329C6C335224BA05A4E398A5FCB204F13AC36
SHA-256:	24BD076D31DC9D363EB2ADB8B27A7D45D9F975AEEC565132D27901537E31F239
SHA-512:	B82CBD6C4B3D378FBA1793858C556EA1FDAA405905686CE219F192D16041E79AA063145C6D469AA7C15AA945D3EF344618FA0996D6611282A8718DD0DE77D64D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.T...........!.................... ...@....... ..............................%)....`..................................)..W....@...................>...`.......(............................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ......................P ............................................A...0...........k..,V....X....&i.:.l..'...P..h."....J..W_..e..MZ..}j.e....-..%....p.o..o.8.M.....R9.%.sHrQG.j\........(....BSJB............v4.0.30319......l... ...#~..........#Strings....l.......#US.t.......#GUID.......@...#Blob...........G.........%3........................................................T.M.....n.....2.....2.....2.....2.....2...1.2...H.2...e.2.....2.....2.....2.........6.#.

C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22232
Entropy (8bit):	6.834492317681642
Encrypted:	false
SSDEEP:	384:qFTI1WE5mrOhEZ0GftpBjy+ILKHRN7Fg2eSlVE32x:TtcbKiUmFg2ewEmx
MD5:	7F86A47ACD4D810AD673AF81369F2F26
SHA1:	CEA8DA1478F2DEE41ED2ECD2059B73D1C161734E
SHA-256:	9C8B87E9A950DEB7F28752F875EA82F1B55A70996AC8C12073FCEA33664B2048
SHA-512:	372A61489665BD37C552C383FAFF971FDB2D581D45664A37E5D58DBD894B26B5CC8403800A559F489BB4FA47F088E6E06553ECA65EFB16AB9867E5A80A0A7AA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..T...........!................^,... ...@....... ..............................R.....`..................................,..W....@..0................>...`...................................................... ............... ..H............text...d.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B................@,......H........ ......................P .........................................d..h..(.zr...\|,.._A....M.....uX^.h........O.y.r..6..l.q..z.x;....#...u...f...R\(...C....%{.B..._v.M.......D..%..&.t@............(....*.BSJB............v4.0.30319......l.......#~..T.......#Strings....8.......#US.@.......#GUID...P.......#Blob...........G.........%3..................................................................E...a.G...z.o.....o.....o.....o.....o.....o...!.o...>.o...].o.

C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Extensions.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (484), with CRLF line terminators
Category:	dropped
Size (bytes):	5532
Entropy (8bit):	4.7397117338606956
Encrypted:	false
SSDEEP:	48:VRbedE2vSlgOasW0GOsisYeF51aGvUlgGF51aUvklgpIyF51apIvivalW4F51Dph:VaJkJJJ7k4JD/JB
MD5:	F01EA45C5A8F07C1C4961A6D2413FBE3
SHA1:	36649C13E8E44D75E1BD6BFC6BDFA44C83D21E90
SHA-256:	9E448CB00F3E97BC73987015CA377AABF2C71E78E0E565E5A4C3FD4F9D624D8D
SHA-512:	B635549AF4EA314EE3B48425D5FA142155F6975E423A46A845C9EEB0D4D6526F94FD91DAAC5063EA0EBED29687793D99E7C3FFA1DA9EA955044EFCB40AEB7C9F
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>System.Net.Http.Extensions</name>.. </assembly>.. <members>.. <member name="T:System.Net.Http.HttpClientHandlerExtensions">.. <summary>.. Extension methods for <see cref="T:System.Net.Http.HttpClientHandler"/> which expose differences in platform specific capabilities... </summary>.. </member>.. <member name="M:System.Net.Http.HttpClientHandlerExtensions.SupportsAllowAutoRedirect(System.Net.Http.HttpClientHandler)">.. <summary>.. Gets a value that indicates if <see cref="P:System.Net.Http.HttpClientHandler.AllowAutoRedirect">HttpClientHandler.AllowAutoRedirect</see> is supported by the handler... When this property is true and <see cref="P:System.Net.Http.HttpClientHandler.SupportsRedirectConfiguration">HttpClientHandler.SupportsRedirectConfiguration</see> is false, setting <see cref="P:System.Net.Http.HttpClientHandler.AllowAutoRedire

C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21712
Entropy (8bit):	6.86182676889553
Encrypted:	false
SSDEEP:	384:4AkPMgIWkeo530GftpBjex0+ILKHRN70SlVE3y:4PMgeeriu0m0wEC
MD5:	018841345CFBF45EDA4CD1ADB74FD68B
SHA1:	F9928EF8B78F7CF2D3EB3EC68D28F36C89FFF3DA
SHA-256:	ACF0E0555AFED095CF12F719A3CD0E745435CED2575840A46A40EC61ED632265
SHA-512:	7DD159DC1D64E49A9106C2F04A46643C9AAFB83FC017D4F98F63B63D6317FC4AB370FAFB63BB512BFB6B4EC7EF2B2E6B362BB7F035A23DD1046D6DC2499EA5FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..T...........!.................... ...@....... ...................................`....................................W....@..0................>...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H........ ..t...................P .......................................K...S..........._.!."...F....Bs.`....e..-..P.N=..h.9U.icni..g{..E....v..7.Js$...y..;w..pFv..A...9.._.4..;..=~zo......XZ..7..(....*BSJB............v4.0.30319......l...L...#~......8...#Strings............#US.........#GUID.......l...#Blob...........G.........%3........................................................e.^...........C.....C.....C.....C...).C...B.C...Y.C...v.C.....C.....C.....C.............

C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.WebRequest.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27352
Entropy (8bit):	6.737660517891196
Encrypted:	false
SSDEEP:	384:b4BInjVaiyLjrxxjQa2k1lWpYm1sIVZdWE4frOhEZ0GftpBjF+ILKHRN7/a6wlCn:0CJaiy/rxxt+pVhZlobKiXm/FAcF
MD5:	1925E1654510EE0914FF3360C6C94765
SHA1:	A032C1456DC199189310EF4DF533BCEEB6C41A92
SHA-256:	6E599D81A2B8D803CA794C25111FEA54C34356C4ED853B926C9AB42A4B0D6454
SHA-512:	1995A5F16AAA62D23D69022B613362B7CF952059CC9C4FBDDFCBE0905B94B02599DD4B5A784344A2B541457EC255B8F38BACCB7919F04F323D35B59B2E10D0D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..T...........!....."..........^A... ...`....... ...............................B....`..................................A..K....`..0............,...>...........?............................................... ............... ..H............text...d!... ...".................. ..`.rsrc...0....`.......$..............@..@.reloc.............................@..B................@A......H.......T%...............#......P ......................................x.....+r,..t.{.:h...D.Vp.h/.R6.y:+...-%.y.i..s.........+e.k.ny&..VW.Oo.=o.i3.<..z..d...`.DD..}LR..dc..&x ..0".....3M\......{....:.(......}......{....:.(......}......{....:.(......}......{....b.(....~....o......}......{....v..0.r...ps....z.(......}......{....v..0.r...ps....z.(......}......{....:.(......}....*.s....z.s....z..0..O........(....,-(....(.............r...p...r?..p..(....s....

C:\Program Files (x86)\SaasAnt Transactions\System.Net.Http.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	191152
Entropy (8bit):	6.102159727207917
Encrypted:	false
SSDEEP:	3072:Iqkc9fWChUH6XrijhU5+zWmFOAjE61zRv+Bh/aRoPtI5U:IKNXeVU5+zWmYAnq
MD5:	3002E884C5C15A15B68EAEF3C62FF254
SHA1:	D7E053AC51F562B92FD4032AD769ADEA7255230C
SHA-256:	3E71EB02AE8D01CB8159CC5F9FF3FF1976AEC5872298ED45310B58F18708EAC0
SHA-512:	0789FB15F8E062AC2AF6785A240B9B7D482B5F179FDB2E6B5EF9F841092C1A631B27F3DB7738163F73CB609D8F5918FE2BB166731107061ECE21C7A18A2A3989
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]..T...........!..................... ........... ....................... ............`.................................l...O........................>..........4................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........C..t}...........$......P ......................................a......q}......#o"..2...4v/.d..M..Z.$."....M..L~..k3....9.@.z.ft.1..b}.}0.....,8F..H.d....73U....>sL...d.!#..?.^.,.<$p...F..(.....0..3.......~.....(...., r...p.....(....o ...s!..........~.....~...........V(....r'..p~....o"...V(....re..p~....o"...V(....r...p~....o"...V(....r...p~....o"...V(....rA..p~....o"...V(....r...p~....o"...V(....r...p~....o"...V(....r%..p~....o"...*V(....re..p~....o"

C:\Program Files (x86)\SaasAnt Transactions\System.Runtime.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22176
Entropy (8bit):	6.896165715914101
Encrypted:	false
SSDEEP:	384:r+4185WiR/B0GftpBj4T+ILKHRN7YSlVQP/:sLgiWmYws
MD5:	8E4E0EA396B5452BED54E6888CB07CA1
SHA1:	1A7AFCDD7F118B3EF8F1D9761FA71FAEEE16FD2C
SHA-256:	DFEAB83E6A9555A6C18070C611D868E117FA2FEF6F815DA26E622FEB2E610254
SHA-512:	E160570F598D5FDD637725A70595A7DDC247C20AED66C031FF9816142231C8EA58C69FEF7F5EB8E10120E5E5AD68ECECB1B584054832464046209C9E04CC1AAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.T...........!..................... ...@....... ....................................`.................................D...W....@...................>...`.......-............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H.......$!......................P .......................................@.......m.1.!I%i`..>hg..w...F.2.9...o.Q.G..8d.;/.......~.H.........s.v].%....>m.I.E.`.M.C2{s.s.w..........V.^.v3.[...Oi:.(......(......{...."..}...."..(......(......(......(...."..(......(....*..BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.8.......#GUID...H.......#Blob...........W.........%3....................................................................

C:\Program Files (x86)\SaasAnt Transactions\System.Threading.Tasks.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35016
Entropy (8bit):	6.54246973766738
Encrypted:	false
SSDEEP:	384:WL0xHprBefGMOrRQY+hoZhOZkcvr3Eql38WqATrOhEZ0GftpBj1x+ILKHRN7c6lE:NRBefGBkoWjvr0VabKirxmcM+
MD5:	85F6F590B5C4B8C7253E9C403C9BE607
SHA1:	D5A9DB942A50C8821BACD7F6030202C57EC4708B
SHA-256:	D20552FD5C8C8C9759608A84DB1E216DA738F5E9F46DE9E8A3F39A0D6265CB8B
SHA-512:	9C78CB444E28618D44E9DEB23571FC7BBCE268882C2803E0CCC0E84B3E6EAB89C6AF2AAC0D81EF0D2C9FD1E9611CB35334EF3304FB16C5BA0481F6A7273C3660
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.T...........!.....@..........._... ...`....... ....................................`.................................\_..O....`...............J...>..........$^............................................... ............... ..H............text....?... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............H..............@..B................._......H.......h..../..................P .......................................#..ON.... "J.0..r....6RbR[..44....F.....E.X....1.XIE...:....5.M...Txn.\rycn.....o\|.V}...l}.1En...`.T. \(e .u..=.nA...@p:.(......}....R..r...p.(.....(...+N..r...p.(....(...+R..r...p.(.....(...+Z...r...p.(......(...+Z...r...p.(......(...+..0..$...........(...+..-...........o...........0..............(...+..-.s....z.o.......0..............(...+..-.s....z.o.......0..............(...+..-..*.

C:\Program Files (x86)\SaasAnt Transactions\System.Windows.Interactivity.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.593512133791687
Encrypted:	false
SSDEEP:	768:6MazwAgR8/XJ665bKZdxuB8DCuL5enM7JxKjuMlZCZN+R0E7E:63wBccZdxuB8mQen6JxKjrlMZgR0Eo
MD5:	3AB57A33A6E3A1476695D5A6E856C06A
SHA1:	DABB4ECFFD0C422A8EEBFF5D4EC8116A6E90D7E7
SHA-256:	4AACE8C8A330AE8429CD8CC1B6804076D3A9FFD633470F91FD36BDD25BB57876
SHA-512:	58DBFCF9199D72D370E2D98B8EF2713D74207A597C9494B0ECF5E4C7BF7CF60C5E85F4A92B2A1896DFF63D9D5107F0D81D7DDDBC7203E9E559AB7219ECA0DF92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ....................................@.................................\...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{.......0..&........(..............s....o.....s....}.......0..K........(.....{....o........,3..+&..( .........{.....o!..............X...(....2...0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Chart.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2291712
Entropy (8bit):	6.082551077519169
Encrypted:	false
SSDEEP:	24576:Z++0dx/qA5+yRGecTZFkPWwzierr1OWdA7cp1vcinKljo1XsotXZ/V3VY:Z+/x/qA5dRGhDerr1OQTnEinKXOXZ
MD5:	CEEA065D8EEE8E6E6DEA2963913095DE
SHA1:	938AA0E57437282BA8222C778AF4D0342B95AE65
SHA-256:	EDB95AF833FEB44EECED9401FC8EDC32611B4EACC6E3FED27761909991BD8AF7
SHA-512:	74D0655149352AFC49510332F0F09EB190C88C5F4578BE76F3E3CB33DA973B62B2793020617FA2601D3A11928643F4C955F7ACA02388CDC48692F7D0DDBE162F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!......"...........#.. ... #...... .......................`#.....{.#...@.................................t.#.W.... #......................@#.....<.#.............................................. ............... ..H............text.....".. ...."................. ..`.rsrc........ #.......".............@..@.reloc.......@#.......".............@..B..................#.....H...........,...........8I.....P ......................................5....<.UP.......)...jg.4b...W%..-.....`,9.?...s.K.b...R.T....^.........E....!fwc....46\....`9.......-.tL.`.5.@..9t.%.."..(B.......0...........(C...u3.....(D.....9.....r...p.o.........sE...oF....r...p.o.........sE...oF....r3..p.o....sE...oF....r?..p.o.........sE...oF....r_..p.o.....#...sE...oF....F.(C...oG...oH........0..........(I....3..o......(J....(K....rq..p"..(........0...........(..

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Charting.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2825728
Entropy (8bit):	6.22380493888006
Encrypted:	false
SSDEEP:	24576:2sLw+aG/5WJeIHhrbZ2445FSO6KDuMAvi9+5VWmCXshkM:HaQ5gM
MD5:	037882B0F47D569DE3EA49F70270F72E
SHA1:	98CC1ED0CD643E5296FF7D2AD63208AE8A4B8990
SHA-256:	A46A2AF72331FC86401424BB32BACA46F0BD56E06BE19D614D83E4209157E1FA
SHA-512:	71FC115064158170BB2B6CFF96D4BBA69CEBAAC6995A0AE08D1A70971D8E491D7086D9FCBC4A8ACBBCE25695FE61EDC9D950E6328C2A19F3FC41DB7A2971BB14
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!......+..........2+.. ...@+...... ........................+.....@.,...@..................................1+.W....@+......................`+.....\|0+.............................................. ............... ..H............text.....+.. ....+................. ..`.rsrc........@+.......+.............@..@.reloc.......`+.......+.............@..B.................1+.....H.......H.!.4..............p...P .........................................,<..:...............2`G..\|A....koP;/......p....+~. n.7..!...."1.....}n.m=;.{8.K....w Q!.[P6....=.1..E.I..,.,.L<z...........:.(......(....:.(......(....F.~....(.....2...J.~......2...(....F.~....(.....2...J.~......2...(....F.~....(.....2...J.~......2...(....F.~....(.....2...J.~......2...(......{...."..}......0..........r...p.2...( ........( ...#.......?(!....2...s"...(#........r'..p.2...( .

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.ConversationalUI.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	5.889884490451558
Encrypted:	false
SSDEEP:	3072:14rltvOzyhXpyHj2f/Y/YBLZ5M9XYvmvrx/cXzPm:14rnOzy5pyH6wwD5Mnx0Xz
MD5:	FD28473421A09A5F130AEF3ECA75D96A
SHA1:	2695E2266A67E04D5750EEE2CE85B96F880E4562
SHA-256:	D4D301DDE9A3AFBE623F44CFA07D08842852634978C5212400F3CC03735057E5
SHA-512:	D18F67903BCDAA4EE7812FBA4336396FF963E449D683EE99541054EDDD6F62DB91737119FB31766F5B588F2B3C53055A9A119B358ED75716771B53AD8C15EF4F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o.)[...........!................~.... ........... ....................................@.................................,...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................`.......H.......X.......................P .........................................v.I.....C...]V...H."..+.....3&...(......]u..\|......."..k< R.N..n.m./;....8.AJX..G=....<N].....9.k../.S...,."..eQ.+.\|..~.S8"..(....2.(....u-......B.-...(....o....B.-...(....o......(....,..(....oY...(....-..(....oY....o.......0..........(.....@.....(....9....s......r...p.(....oU...-.~ ...+..(....oU...o!...("...o#...&.r...p.(....oW....2...o!...("...o#...&.r...p.(....oQ...-.~ ...+..(....oQ...o!..

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Data.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	5.830168207129661
Encrypted:	false
SSDEEP:	6144:IAD3wLHEF9uZ3GSnmUxV9Lkg6q7UCvunRJIvySpqm:+pBIm
MD5:	02B71A017F2F3528EEEA9AA08AD028D2
SHA1:	BE129392440CB2F5B95F0FA6208B064A8BD3EB2C
SHA-256:	61B599FDCA95D6B6E6BB027FF8A538BC5717F65F975BB886592A8C21CB4480B0
SHA-512:	DB279404A5DE462B743ED07241ECED9A01021CEAF491834E69D251FAE5FFC33F64BBFBC6E1B3EC33CFBD89B20FC86139293EFA74CD5AC759A17F1D606F388F9A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!.....F...........d... ........... ...................................@..................................c..K....................................b............................................... ............... ..H............text...$D... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B.................d......H.......H...PF..............@...P ........................................!....K....}j..K......q....B..!3Y!.`.W.mb..vb...^._o..Qh.V-.8.'..(.....y..l.....B....HD.52.$c..m.w...<)...R.......aQ.%"..("...2.(#...u.......B.....($...o%.....(....B.....($...o%....0..........(&....@.....(....9....s'.....r...p.(....oC......((...()...o...&.r...p.(....o?......((...()...o...&.r...p.(....oA......((...()...o...&.r...p.(....o3.......((...()...o*...&.r...p.(....o7.......((...(

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.DataServices.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	5.698941237855971
Encrypted:	false
SSDEEP:	768:xqZI0+0X3Eib4hH1tJIpyYL0aey1c/5BBnf7wqeymQsuBRs0ai01UEOMo4Ktf4dk:xqh+0Hr0Opjzx1c/5H7Yzm0Y
MD5:	48EED0BF0C56F2539AE687466B1EBE82
SHA1:	BD45B063A3F20D829EE10290830F57958CB9AC5A
SHA-256:	9B18AAA2942938DFB5F124DFDC46F514245E026442E9EC42FE26C1900AA778EF
SHA-512:	80ED74628BDAC261D63FA23B67B3A3DE9E16A0DC7EC45B21E8BCE88B66BC1BBFB9A347746330B9232CDB942D7308DA6E8BA589D9B355F4A4ECED1CD3ABE62967
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!..................... ........... ...............................U....@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........I..tm..................P ........................................D.!WR.9e..#.......y.."..J......:..%..q...."........8#].`.....)..Z......0...g.;3.u1....6..c....0[.Kz#....o..!... ....W...0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...{....r.{.........}.....r...p(......{....r.{.........}.....r...p(......{ ...r.{ ........} ....r3..p(.......}.....(!....-.rI..ps"...z..}#.....{#...s$...}%...*"..}&..

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.GridView.Export.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.72238088528774
Encrypted:	false
SSDEEP:	768:P0VHoHwY+TFmju+BslvfqjDaukRlvMt2Wz:sC25m8vfqjDarl42Wz
MD5:	EBDE9AF6A57353D42F254DC64F5F38CC
SHA1:	8DC3CC190E9D64E2E34924F8B29E4C4D528BFEF4
SHA-256:	A93BD7830CA4D4F541BD2CA80C6938EC55B9DCDB72AB3B2AAD481DAC556B72A2
SHA-512:	7D7A68554721A74F6648E24EC7385235F1D11D4C6DD795F34E81175AF4BF2A80CFB64C9B2F2F63ACBABC1B5548021A0D3B51EA8E54D73DB29031CC26ECADD85D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!.....v..........^.... ........... ..............................J.....@.....................................S................................................................................... ............... ..H............text...dt... ...v.................. ..`.rsrc................x..............@..@.reloc...............~..............@..B................@.......H........@...R..................P .......................................W...e.1..I.N.u]....bX..ZY...Q...z.\|.B...".V2R.......\|.....\-s.$D.#........R.f.........4.Sh.}.~s.C....Vo."1.4...@.x.E<.....r..(......{....Z.{.....(....,...}......{....F.{.........}......{....Z.{.....(....,...}......{.....0..;........{.........(....l..(....l3...(......(.........+..,...}......{....Z.{.....(....,...}......{....Z.{.....(....,...}......{....F.{.........}......{....*..0..9...

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.GridView.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1121792
Entropy (8bit):	5.927642961005835
Encrypted:	false
SSDEEP:	24576:b2RDiBmd/Tsym3eklQ6teWPH8g1opoDEug:bAiBqm26tMpo
MD5:	EF51770B099A3689B49D7730CA67937D
SHA1:	699ECE14C2D68D1BEA3349A2956A811FD5E06DED
SHA-256:	A58B15EDEB0B9843CDA9AFF2DA43FC495F88890ADB863F4F65122DB1AC59EC45
SHA-512:	83C391A79EFAF8C9F12832841DB2A33606123B855BD86B125B33877BFE5813087FDCAFC4DD7F0AC3C54010F664A7274FB159FA884BA8B42A347B059E34E9D62A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!................~2... ...@....... ..............................-$....@.................................$2..W....@.......................`.......0............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`2......H...................... .......P .......................................!.5....CI..?.-.....7]......&A..4......a....Y...K]...p..H..3.O."bW...,..._R.<-....B...l.,...._...S.v...Y..\|..H7^\|... .9^&..oz.....o{...uu...(\|...,...(}....o~....3..~.....s....(....6.~.....(....6.~.....(......{........0..5........{......+.{.......}.......{....o.....r...ps....o....F.{....%-.&.{......0............}.....u......,...(....f.(....,..,..(......o......(......0..)........{.........(

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	610816
Entropy (8bit):	5.941819837876689
Encrypted:	false
SSDEEP:	12288:BeKxungHlf7219LzXKqwgJ97lFXDDGC+gNRBPS7VGkxvwnZ1:txungHlf723PKqwgJ97lxGCXNRBPS
MD5:	9615A817742CD3F4498E018DDA560B15
SHA1:	33014F658F8031A81B660BF84B46F85097BD62C8
SHA-256:	23C1E7F8D4D5582F2835DD5566CBCDEE3C04491AEB35079407A68FE7A139B3E2
SHA-512:	5772D8F9DDFA9DABF969F66E879D1212C94DE504DA93F95B59A30C5EBD5310ECD1DF161370D4F6F77157074C8B92F27CE542E2C41C74D9D3E43C8C25DFD16973
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!.....H...........g... ........... ...............................-....@.................................Lg..O....................................f............................................... ............... ..H............text....G... ...H.................. ..`.rsrc................J..............@..@.reloc...............P..............@..B.................g......H.......D....F..................P ........................................Ry/.xs1Kj.E..T'L.F?HQ.u$..7c.....aw.'..,N....&...v.hE3.8g...!.K.E.O..,4....Z.7b....?.....O+3T..._@.V.....`......jw.T.'...(5....0............o.......(6........................0..)........{.........(7...t7.....\|......(...+...3.....0..)........{.........(9...t7.....\|......(...+...3.F.~....(:...t....6.~.....(;...F.~....(:........J.~..........(;...2.~....(:...6.~.....(;.......0..&........{&.

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.Navigation.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1154560
Entropy (8bit):	5.959246694674978
Encrypted:	false
SSDEEP:	12288:qiMTOruZw5kE6bfxDftXn7Q11iOjcG/ZhzsEr3p7ErxyZoI5QklS+rpwNs76xb1V:3kbYXsErZ7ErxyZrFpJIb1uJXKDT
MD5:	D805210EA6F050817E643A049CFD7969
SHA1:	D018696C6046DF3B4938DA435D8D72F8F195C381
SHA-256:	A97A6ED736FC26FD590127DC3779D8DD07448D79E9786F8D2E4D4950E111B8BA
SHA-512:	F51A90C536BA3EC614F193131728462828C80F1F27CD9DACA295DCD38A6DADA54B3A059A79EA027215DA269E77B8942689D58B9B2EFAF5232CCCDA186A241D5B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!..................... ........... .............................. .....@.....................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......8...H...................P ......................................V.<..h........3.Y.;z.......5d{....A...HB^v..'[..U/a+5...b........e...:.R0-.Ti;t.8..C.".m.......%...>..P.F...Jk1~.O..3y...0..@........(............sJ....(K...........sL....(M...........sJ....(N............sJ...(O...........sL...(P...........sJ...(Q..."..oR.....%{.....oS...#......$@[Y}......oR...*..0...........{....#......$@[(T.....(,...,).#........7...(,...(O...+N..(,...e(O...+?.#.......@4..#...

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.VirtualGrid.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	323072
Entropy (8bit):	5.908700483089774
Encrypted:	false
SSDEEP:	6144:nTTS49+iEHX1EjLxT3GiX56IchwLEZ2E4tNbdGivJeUl9s7qlI2:nt9+iE3FiX5/cGLEmt+uzI2
MD5:	755690DC817D23AE7432331837542A87
SHA1:	AF3F9CF46C5D3A46DC09F80325F126A12EFDAA7C
SHA-256:	C63925EE541ACDCB8344B3493FE41C768888D2154379F4CC2250DD885B41F6C9
SHA-512:	7C2B7E8488FD29F1C064C5DEFC584514E703ED899134EE843731A3F6C3F12434E961ACF95622104955986EC58BEBECF310717C571C1E334217FD4EDBE0755321
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!..................... ... ....... .......................`.......7....@.................................D...W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........t...................P .......................................+M...$.q..f.A..B..h...<....wMH....f{=4.#.#.R.....46....o.Y.;...U#2[...:)..&.........K..{..A.!.6.........R$1....\|.1."..(....2.(....tu.....(.....r...p.. F.(....o ...o!.....0...........(".....(#...-..r...p..0..........($....@.....(....9....r#..p..........(....o\........o%.......(....o^........o%.......(....o`........o%.......(....oT......(&.....('....rM..p..(....((...()...~....(+...>

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3867136
Entropy (8bit):	6.254712850029527
Encrypted:	false
SSDEEP:	98304:lN7Eu6JRbbJ45j7Ha/zsS2bu5MbbzOpJbrc3Me9DMbJcioxcKK2SewFiYCJc7vfG:lN7ELJ45/9iD541R
MD5:	278E5C1218B744F6315AF408F3D26B48
SHA1:	D354CF1DF76205C87AC5D58BB7D2D4AD13B6DE41
SHA-256:	0C25B9176BBE7AEC9EFBF65865BE0016A2A3A952F77ABC3D3DA693083A35A9C7
SHA-512:	906222AE17252F29C2961EA4945107B5FBCC77A1A060764C31B12FF147C529E2DBB6ACAB437DA487565D79062D5B68ADD069EBE3DE45016754FE2CCDFC2430D7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Controls.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!......:...........;.. ... ;...... .......................`;.......;...@.................................8.;.S.... ;......................@;.......;.............................................. ............... ..H............text.....:.. ....:................. ..`.rsrc........ ;.......:.............@..@.reloc.......@;.......;.............@..B................p.;.....H.........$.ll..................P ......................................,.&.&~z.jsE..J.#.......5.&........TE.4...6...s.8/w^.....S.B-4..U.........3....\....3R....`./o...D.8....Z..x+.gD..P..F.~....o'...tk...6.~.....o(....r...p.k...()........()....s...(+..........(/.....0..)........{.........(0...tW.....\|......(...+...3.....0..)........{.........(2...tW.....\|......(...+...3...{.....~....-.s.........~....(....~.......}.....{....,..{.....~3...o4...J.r...p.(5.

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Data.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	466944
Entropy (8bit):	6.001750454195401
Encrypted:	false
SSDEEP:	12288:jawJHGqcW1UGzJiJmh1a8IxFLma8PzHbuhAGvaSAv8rYn2sPz2Wp+k7V23I1JaT/:jawJH0W1UU48UxFSa8Prbu
MD5:	3AD5CEB7C975776A54FB2E37F8104B16
SHA1:	D380F4259EFD38C85716D23F64DA1ACE90F88770
SHA-256:	E188050802404CC88A07FF88852AAA763F6DCF7650CC95604A8520AAFCD7D638
SHA-512:	AB81F0819A96AEEA3CCDB3D3A0030A2C7B0B530155B7DBF8659C686C7535564F3988991223A67CA33ABDF91B6E3BA0BEFA5EF6A8164B7903E8D9568CFFC052F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!................n5... ...@....... ..............................m}....@..................................5..S....@.......................`.......3............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P5......H........v..L............q......P ...........................................P)....OYm1....J....[v..\jc........-...p.p..(.z..X_.}./...S,.{@...>.i..{.T....^...<VL.: _%4..Y........rV.a:.,.\P.+....~............~...........>.,.(....(....^........................{...."..}......{...."..}......{...."..}....6.(..........6.(..........J.(.....(...........(@....-.r...psA...z..(......(......(....:.(C.....(D...:.(C.....(D.....(C.....(D....-.r%..psA...z..(E...>..

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Core.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	360960
Entropy (8bit):	6.209850828963233
Encrypted:	false
SSDEEP:	6144:4Upaw02OHiGZWtjp/H69xRyCWsJmqoG6MnXxjGEp8eLXASWrwIuOjzqAi8Y5Gvl9:hZOH0qJ6MnRp7ArwIuOjzqAi8Y5Gvl9
MD5:	D2A0CA7F07C028313240E7E603654549
SHA1:	CAAAC4889FEB3E2ACFD7A94BE31A0166F62D0B88
SHA-256:	E82C095B02EC21D62134D547FD8B102840B2FE283A459ACE014FB6323CB07CB2
SHA-512:	692ABE35C24E6664CC77D0DB86250FE9D0F222444CFE24F8C5F3D45BC2F6E7C60CBB14D3F2376DEE454B8B728552955BDA1AF53FC4C7D57EBF473B378DF05415
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.([...........!.....x..........N.... ........... ..............................P,....@.....................................S.................................................................................... ............... ..H............text...Tw... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B................0.......H....... ?...V..........p....5..P .............................................W...~...N.m4....)q..Rz...~..Q jH....BG.C....&z%...A...A.G..u....Z.:.:H..6.r^(6..G.H......{p..%.'....."[<\....y.....0..n.......(......-)(.....(....,..(....o ...o!...r...p("....o#...r...po$...,(.o#...r...po%...uc.....,..r...p("...,......0..........(....,...+......0..........(&.....*.0...........(......rG..p.('...-o.r...p.('...-a.rM..p.('...-S.r...p.('...-E.rS..p.('...-7.r...p.('...-).

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.FormatProviders.OpenXml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	340480
Entropy (8bit):	5.887372930731597
Encrypted:	false
SSDEEP:	6144:JouAnmKqXWOYTI4y/6Q/Okj01X4UIS0Q9/oRZovxm:JoVmFHIoyfHh
MD5:	6ED1104F558CC167944131DDCFD89AF9
SHA1:	5F3F3DB27D06C5FED511177725DD9EC8DFBC22F6
SHA-256:	E1B5360B7A471161F9BFF35B9128B1E04EE99CC2AE37591625FB336B948E3DAC
SHA-512:	94DFBFCA8C83256834AF2CD355CC46C636645F600B03E5B8C885845EDE77E9768C336A99273E2171FCF54747EED9CF6D922504801C6288D81B40E087D38841DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.([...........!.....&..........NE... ...`....... ....................................@..................................D..O....`.. ............................C............................................... ............... ..H............text...T%... ...&.................. ..`.rsrc... ....`.......(..............@..@.reloc...............0..............@..B................0E......H.......x...Lm..................P ........................................+....G..Q.."....Q..5.{.{K _.w.k%#Y..u?.3..sF..-@Z+.>,Y..[8(?f[.....O.....(a..h$.y...s....~.8....c.3_g..._..u..)...&}....{...."..}......{...."..}......(....J.(.....s....}....2.{....o....6.{.....o....J.{..........o......0..%........{.....o....u......,..u#...,.~.........0..2........{.....o....u............(....,...(.......(.....V.(......(......(......{...."..}......{...."..}......

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.FormatProviders.Pdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	5.738522033850893
Encrypted:	false
SSDEEP:	384:GmCDymrAz38UOjVca1v9XI9Yvm9rK25gXYasXkLrgUCrqFGzU26ioOQZRuuNt:dkDs4UocWv7vQrvgXYQeQZRd
MD5:	B7FDAD850F9ABB6372E86DDC771B1B1D
SHA1:	DA6ABB6A20D168DADCAFCB0DB474A84992F12D52
SHA-256:	013E37F9406055BF49405DB001DC703A19CF20227479220E0192BCEFC796CFD1
SHA-512:	9DD4029DE12815C6DEFE7EA8CD3EDB49D8A88C5CECF3395D327F5D5547FC9CBBC5AE46EB5283B5A09CE7CAC0E03BDCBBF6399B3BF3449DA0FCC770E012FA0B92
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.([...........!.....r............... ........... ..............................."....@.....................................S.................................................................................... ............... ..H............text....q... ...r.................. ..`.rsrc................t..............@..@.reloc...............z..............@..B.......................H........<...R..................P ......................................... B..9r..u......6)E..y....E.!...d..+j.....y....O....r~E..R....5.r....../....h..(..e..M.i.,....2......w..].xz.p...?....8:.(......(......{...."..}........0...........(....-..o....,e.o....o.....o.......(....Z..o....o.....o.......(....Z..#........#..........s....({......o.....o....&...o......(.....s;...}......{.....s....}.....r...pf.{.....o"....{.....o .....(.....sA...}.....s....}......{...

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Documents.Spreadsheet.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1795584
Entropy (8bit):	5.810676054077962
Encrypted:	false
SSDEEP:	24576:YOf+Usnp8S5NOVKeZ9v8GcpQs1VdQRvTk:wp8S53eXbTk
MD5:	3A3C98E6DCDBF2C61DE5AE8AF7AF8A5B
SHA1:	AE8E4A12474F3A7E712B2FDAB7A7AE6510528B7F
SHA-256:	2CFFB7C33A5E2F591B032E62C63EBF9FA0D6386DBD82327E862384F3A7A50144
SHA-512:	240BAD966252213BD9C19BC1FF38C36223C52584B5E99473C5922FAE0F1AF9B7349193AF29F14E9ECC4B66582A67204AA8709A4E0B21E4B3BF1815681E573127
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.([...........!.....\..........~{... ........... ..............................4.....@.................................0{..K....................................y............................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B................`{......H........... ...................P ......................................@@... .,...w..)..2......z...8.\"w.V.\.&}..........~....$...k.E..&..b.)...i.c...'........v.${S....i.Y..k.m.4..6+...\|....(+....r...p(...+.r...p(...+..}......}.....s,...}......{......{......{......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....2.(....o......(.....r...p(...+.r-..p(...+..(......(......(......{...."..}......{...."..}....v.....(.....rK..p(

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Themes.Windows7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2603520
Entropy (8bit):	6.342737082826462
Encrypted:	false
SSDEEP:	24576:n+VH2V2FexRsBybdxp1CtvPudaDJe0GT67MeBQzp:+x2IFeAybd1yPFvGT67b
MD5:	C2041C73D7E4C18FCC3FD298EC8C919C
SHA1:	11592AC1943164ED4F2297A945201C18127FE47F
SHA-256:	C0DBAC1B65E376E15F05B89248BD5685018429FF44672E652E15D9BDCD350FFA
SHA-512:	A990A496C6C67F947949193ED9B4C4FEE648EC1EB682D7B8125C482831977B1C1FBB92B7A792BB779126072FFE7741455FCF281D1DA5BB9CBA4D460C8320BAB0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!......'...........'.. ....'...... ....................... (......(...@.................................@.'.K.....'.......................(...................................................... ............... ..H............text.....'.. ....'................. ..`.rsrc.........'.......'.............@..@.reloc........(.......'.............@..B................p.'.....H.........'.H............ .. .'.P ......................................<.v)..8.....j./.k.....a. ..w.pJ.I......P{j.\|-&P...b......)0.....W.wW#.lV$u......);....p...%c.m.Y~.6e+o.'[.4...U....."...R..(....*..'............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..t...b...]..z.....46{..N_.e...........#.,.....~^.p...0.n...v./H....w.E.g.C.c..pl.....?nr.

C:\Program Files (x86)\SaasAnt Transactions\Telerik.Windows.Zip.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	144896
Entropy (8bit):	5.94496716734926
Encrypted:	false
SSDEEP:	3072:KepFJwciefcZ4vNgdZb99nFzRePuy7C0CZfx3dWX5f28u4ESC:KoJwciekuNgdtng4WX5f283
MD5:	81E0DDAFD478911087129E7C60039B63
SHA1:	06ED10D73E27152BEDD26F757C07C2862A73BE0F
SHA-256:	9FBFB4A9084BC3F483DE06E8C792BB6A60F36B229E1687F04A36DF255020F786
SHA-512:	1C6E8B0D77F242234BECA1E1B1392D86E6A6724E9FDE978D76FC39372EE0D6699420EB0FFD80B10DE253B765E2691C1BC9DB7572C15D06B1019A0252552EC1DC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._.([...........!.....,...........K... ...`....... ..............................bI....@..................................J..S....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H.......t......................P .......................................K!_..{....a....z...i..Y.Ncj.X].Bw."....(A..DD.@...Q..MyX.z.k.}..J...+$F........n.....>....L.g...u./.....Ui...!.a8....{3.K..{......{...."..}....:..o.....(......6.(.....o..........(<....(....,...,...o....],.r...pr...ps....zb.......(..........(<...J.s....}.....(....*.0...............-.....,v.....(<.... ...._....d ...._.+J.. ....2. ....+.......Y....+....%.X... ...._X...X...X...2.. ....^.. ....

C:\Program Files (x86)\SaasAnt Transactions\log4net.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.778490068583466
Encrypted:	false
SSDEEP:	3072:++EIoS8U9BGRl9bmXPbH79EfZHpMtTOnJDI3lk3ze3XjCVnm7sNzQn7G7k+Yr4zx:bx8CBGRlhmKHpyTmUVkDe3Xjknm7kCU
MD5:	7EA1429E71D83A1CCAA0942C4D7F1C41
SHA1:	4CE6ACF4D735354B98F416B3D94D89AF0611E563
SHA-256:	EDEC54DA1901E649588E8CB52B001AB2AEC76ED0430824457A904FCC0ABD4299
SHA-512:	91C90845A12A377B617140B67639CFA71A0648300336D5EDD422AFC362E65C6CCD3A4FF4936D4262B0EAF7BAE2B9624BCD3C7EEC79F7E7CA18ABE1EC62C4C869
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.X...........!.....,..........~K... ...`....... ..............................H.....@.................................$K..W....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................`K......H...........<x...............-..P .......................................i.)V.#c....e../.`...V....j>....?.LbrzKV.x.}...........[.f)..dD`..66.61[.z....W^....>F..r...#. ..g...T...P....Ss)ii.a.v.(0.....(1...o2...s....}.......0..7........{....-%~....r...p.{....r9..p(3...(.....(.......(4.............//........{...."..}......{........0..4..........%...(5....-.~....r?..p(....+...}.......,..(6............')........{......{...."..}.......{...."..}....*.0..........

C:\Program Files (x86)\SaasAnt Transactions\setup.location

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	5.102612409361644
Encrypted:	false
SSDEEP:	3:PXZkRE8Jn6IRLUtnOyexX/MKiI2A2a9:vWf6suRY/eI2pa9
MD5:	B00FC10090C7F8A73451606527E32B88
SHA1:	2D2EDED6EC42C5A241B74674E5CD0CF6CB9D3D5C
SHA-256:	9078C1661A70CCA1C75D2297F83AB0E6CF21B0B704D7F9BA42CA6CC2745DBA7C
SHA-512:	281798694F73876E18930E34031E312DC9441D9670E9FDB1E757D947115D30C937CCAD32F61F3AA46EA8BB1FACD080848E09B57C6C57049BD363C7DD26B52C4C
Malicious:	false
Preview:	.C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.exe..

C:\ProgramData\Isolated Storage\DF250F8B\59FD041E

Download File

Process:	C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe
File Type:	data
Category:	modified
Size (bytes):	320
Entropy (8bit):	7.312489796773668
Encrypted:	false
SSDEEP:	6:AuZ1IhP88K+ZdnaVkItKyHXSNcODPz8ILzKMnjH+jlh+N8aPw6BC/VHL:DCa8K+ekIoyHXPODPYILzK4xyqC/VHL
MD5:	F650C49A71F358FEB3814401ED923601
SHA1:	5C421C857C55ECBF7E70CF5CF6F96AD5F0E0C04B
SHA-256:	C42862D90EF5E2BEE55B39F6977940502B8A8198CF3B57FFD86069D7780C42CA
SHA-512:	661A77EB4E00A2CA2E62D651A3B6CB3416876313DBBB5A301E34A0D37C70EC7740F48A5117E0D42FA2413BD269FB7A82B24C5329DC38A8B39D6259F568399204
Malicious:	false
Preview:	....~.....?O!U..;..P.P..Z.=t. e...e.}=....6.Y..4`..W...MU....f%.z.f?.TU.....Y....H.;R....&..7...O..w.V..~4.S...Z..I..%....>....<-?e:8O..&t...[.....;.U..../E.3..<..........J'jLDg\;e.xyEM...O...;.Z...Oy...T...\|..W..$[<:].b>/.....U4L..?.0.....J..'...2H.@...,.d(Yw..g...d...oj$.\|}.\_..Eg.?...fP.......I...Q.b.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaasAnt Transactions\SaasAnt Transactions.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Sun Dec 10 10:43:59 2023, mtime=Thu Dec 28 17:54:56 2023, atime=Sun Dec 10 10:43:59 2023, length=3788792, window=hide
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	4.687272302992658
Encrypted:	false
SSDEEP:	24:8DBAE6dOE+QTuZ8AUaJLwoxmdgXBoUUI4JPJRyfm:8DN6dOLnJL1gds9/
MD5:	06517B96AB02CC22A5F5414FA2EB6667
SHA1:	2707B608F6AE1ED1EE3C95FA24C631CF0476C756
SHA-256:	9EEECDF93E4456DC8405B1B8423FD23599EA71A74123CFA51EF4099B37053DF0
SHA-512:	BAC5712D705C7B59831470D60B25F7E95ABD3FC8D51D239D1842853E916F9307BD40A5FF2443103AB4DC8FEF222B94C0F8D34D4F30905609ACF9BBAC0751E103
Malicious:	false
Preview:	L..................F.... ....H.^+..N.iY.9...H.^+....9..........................P.O. .:i.....+00.../C:\.....................1......W...PROGRA~2.........O.I.W.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....r.1......W...SAASAN~1..Z......W..W...............................S.a.a.s.A.n.t. .T.r.a.n.s.a.c.t.i.o.n.s.....\|.2...9..W.] .SAASAN~1.EXE..`......W.].W.....1.....................Fw`.S.a.a.s.A.n.t.T.r.a.n.s.a.c.t.i.o.n.s...e.x.e.......r...............-.......q.............b......C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe..9.B.u.l.k. .I.m.p.o.r.t.e.r.,.D.e.l.e.t.e.r. .a.n.d. .E.x.p.o.r.t.e.r. .f.o.r. .Q.u.i.c.k.B.o.o.k.s. .D.e.s.k.t.o.p.R.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.a.a.s.A.n.t. .T.r.a.n.s.a.c.t.i.o.n.s.\.S.a.a.s.A.n.t.T.r.a.n.s.a.c.t.i.o.n.s...e.x.e.........*................@Z\|...K.J.........`.......X.......632922...........hT..CrF.f4..

C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5605720
Entropy (8bit):	6.462629310060085
Encrypted:	false
SSDEEP:	98304:+F/bhwf+r5KT19iMvK1fucWXbBJ2Z3H2L7K13icjqsNTUOJ:+nwf+rMoMS1furLWHNFF
MD5:	41C67C2E7C85536894C9E348DA79EC9F
SHA1:	E9D198342373D581166DC97A28329448052FD637
SHA-256:	E4D21DA4A6E9A9BC18E51E949814E9ED19EF9057BAD161A6DF90B2608EE8452F
SHA-512:	20C0D57385D58D9ADA3AAB2F43FB4E9120DB1293FF90A61F3953F9E20C0FCFCDC0DB1E1A5EC50195DD3ABF8D2DAFCB8BC934A3DFD9EEFBB2CDB819F612CAA9FE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...%.R[.................\|9..&.......E9.......9...@...........................W.....o.U..........@........................... <..U....@.(...........`WU..1....<...............................<....................../<.......<......................text.....8.......8................. ..`.itext........8.......8............. ..`.data...0.....9.......9.............@....bss....$.....:......r:..................idata...U... <..V...r:.............@....didata.......<.......:.............@....tls....P.....<.......:..................rdata........<.......:.............@..@.reloc...1....<.......:.............@..B.rsrc...(.....@.......:.............@..@.............@V......VT.............@..@........................................................

C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.msi

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C8F3C76B-9135-4D81-AF4D-D3B6D839248C}, Number of Words: 0, Number of Pages: 200, Title: SaasAntTransactions, Subject: SaasAnt Transactions Installation, Keywords: Installer, MSI, Database, Author: SaasAnt, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	991232
Entropy (8bit):	6.324192997097148
Encrypted:	false
SSDEEP:	12288:YnLsSxuUmtFqpXBRYIjBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:6LsSxESXJW5BqPA2fc7wMz7
MD5:	90EF4CE95FBBF3C2174F8447EE770833
SHA1:	CC5D130855474D6D0D40647D02F04A23967EB919
SHA-256:	EF8584AE0B98FC724BA39CA758FD04BCAECA9EB80F0DF62738D1DBB36F7AC768
SHA-512:	2C3B5C7BDB1D0292314F50FFD118037817DFAE23F0E180A4D12986B8835705A040329D8172CB633C65645D045EB5672EDF61E50C192C6A315D1868E19644C14C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.res

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	8010621
Entropy (8bit):	6.095824757520697
Encrypted:	false
SSDEEP:	98304:AHDDYZC6Olj61KNnVzszjdZcXljpZJCjOVxBfn:AOyVxBfn
MD5:	90092A45DE9E2A26FE14E4705292832A
SHA1:	3650B13D0A14C4EC22BC17D70380001045184255
SHA-256:	2682AAAE215CA934D18AC1CF354DD22DA10B52532EB026D16FC2D6429488B339
SHA-512:	53390ACC45356A2E652EC6D147745D765D2377F0B8719AC6952FAEE0EB3E31CE0BEFB23FF856EC9A2CA3F17CD3A3C7329A2F17B93BF5D5957DCD28268496FD8A
Malicious:	false
Preview:	7z..'.....=.~+z................r...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb

C:\ProgramData\miaB83E.tmp\data\OFFLINE\1A3ADFB4\F3574DDF\NPOI.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1624064
Entropy (8bit):	6.052571347138095
Encrypted:	false
SSDEEP:	24576:tZT15YEMnxqKjtO85VF0+hSI4s6DL/3smZ726t0+wz3Cjd:n058kKK6tsz3Cjd
MD5:	BF253C2BE785726BCD871E11A9B7A505
SHA1:	88D2D52F8F9B737BDAE5A7A4339EC07EEFF41C49
SHA-256:	96AF017990A902EFABCF0BA69B7CE07C2DE15CB45786717E15FF32A5D0252989
SHA-512:	970992D367CBFD84E5A30F45A36E06B7E1B7C196DCC049828D4F5049213F5BEA2267E4EC87FE0BA56297FADFF202943CF8799B0B87FE7D55030B2CBB070D4437
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......\.........." ..0.................. ........... ....................... ......tZ....@.................................0...O.......d............................................................................ ............... ..H............text...(.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B................d.......H...........L............u..p]..x......................................."..(...."..(....:.( .....}....6..oq...(......{....-..(.....{....-..(.+..}.....{....-..(.+..}....V.{....-..(.....{...."..}....V.{....-..(.....{...."..}......0..S........r...p(......,..u....,...t....}....+..&.r9..p(......u....,...t....}....+..&..}......0..A........{....,..{.....o....-....{.....o.......&......(.+.....&..&........(.......(...........7...........:......&...(.......0..S........{..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\1A97511A\F3574DDF\System.Net.Http.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	191152
Entropy (8bit):	6.102159727207917
Encrypted:	false
SSDEEP:	3072:Iqkc9fWChUH6XrijhU5+zWmFOAjE61zRv+Bh/aRoPtI5U:IKNXeVU5+zWmYAnq
MD5:	3002E884C5C15A15B68EAEF3C62FF254
SHA1:	D7E053AC51F562B92FD4032AD769ADEA7255230C
SHA-256:	3E71EB02AE8D01CB8159CC5F9FF3FF1976AEC5872298ED45310B58F18708EAC0
SHA-512:	0789FB15F8E062AC2AF6785A240B9B7D482B5F179FDB2E6B5EF9F841092C1A631B27F3DB7738163F73CB609D8F5918FE2BB166731107061ECE21C7A18A2A3989
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]..T...........!..................... ........... ....................... ............`.................................l...O........................>..........4................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........C..t}...........$......P ......................................a......q}......#o"..2...4v/.d..M..Z.$."....M..L~..k3....9.@.z.ft.1..b}.}0.....,8F..H.d....73U....>sL...d.!#..?.^.,.<$p...F..(.....0..3.......~.....(...., r...p.....(....o ...s!..........~.....~...........V(....r'..p~....o"...V(....re..p~....o"...V(....r...p~....o"...V(....r...p~....o"...V(....rA..p~....o"...V(....r...p~....o"...V(....r...p~....o"...V(....r%..p~....o"...*V(....re..p~....o"

C:\ProgramData\miaB83E.tmp\data\OFFLINE\1B03632E\F3574DDF\Telerik.Windows.Controls.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3867136
Entropy (8bit):	6.254712850029527
Encrypted:	false
SSDEEP:	98304:lN7Eu6JRbbJ45j7Ha/zsS2bu5MbbzOpJbrc3Me9DMbJcioxcKK2SewFiYCJc7vfG:lN7ELJ45/9iD541R
MD5:	278E5C1218B744F6315AF408F3D26B48
SHA1:	D354CF1DF76205C87AC5D58BB7D2D4AD13B6DE41
SHA-256:	0C25B9176BBE7AEC9EFBF65865BE0016A2A3A952F77ABC3D3DA693083A35A9C7
SHA-512:	906222AE17252F29C2961EA4945107B5FBCC77A1A060764C31B12FF147C529E2DBB6ACAB437DA487565D79062D5B68ADD069EBE3DE45016754FE2CCDFC2430D7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\miaB83E.tmp\data\OFFLINE\1B03632E\F3574DDF\Telerik.Windows.Controls.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!......:...........;.. ... ;...... .......................`;.......;...@.................................8.;.S.... ;......................@;.......;.............................................. ............... ..H............text.....:.. ....:................. ..`.rsrc........ ;.......:.............@..@.reloc.......@;.......;.............@..B................p.;.....H.........$.ll..................P ......................................,.&.&~z.jsE..J.#.......5.&........TE.4...6...s.8/w^.....S.B-4..U.........3....\....3R....`./o...D.8....Z..x+.gD..P..F.~....o'...tk...6.~.....o(....r...p.k...()........()....s...(+..........(/.....0..)........{.........(0...tW.....\|......(...+...3.....0..)........{.........(2...tW.....\|......(...+...3...{.....~....-.s.........~....(....~.......}.....{....,..{.....~3...o4...J.r...p.(5.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\2639F99\F3574DDF\Telerik.Windows.Controls.Charting.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2825728
Entropy (8bit):	6.22380493888006
Encrypted:	false
SSDEEP:	24576:2sLw+aG/5WJeIHhrbZ2445FSO6KDuMAvi9+5VWmCXshkM:HaQ5gM
MD5:	037882B0F47D569DE3EA49F70270F72E
SHA1:	98CC1ED0CD643E5296FF7D2AD63208AE8A4B8990
SHA-256:	A46A2AF72331FC86401424BB32BACA46F0BD56E06BE19D614D83E4209157E1FA
SHA-512:	71FC115064158170BB2B6CFF96D4BBA69CEBAAC6995A0AE08D1A70971D8E491D7086D9FCBC4A8ACBBCE25695FE61EDC9D950E6328C2A19F3FC41DB7A2971BB14
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!......+..........2+.. ...@+...... ........................+.....@.,...@..................................1+.W....@+......................`+.....\|0+.............................................. ............... ..H............text.....+.. ....+................. ..`.rsrc........@+.......+.............@..@.reloc.......`+.......+.............@..B.................1+.....H.......H.!.4..............p...P .........................................,<..:...............2`G..\|A....koP;/......p....+~. n.7..!...."1.....}n.m=;.{8.K....w Q!.[P6....=.1..E.I..,.,.L<z...........:.(......(....:.(......(....F.~....(.....2...J.~......2...(....F.~....(.....2...J.~......2...(....F.~....(.....2...J.~......2...(....F.~....(.....2...J.~......2...(......{...."..}......0..........r...p.2...( ........( ...#.......?(!....2...s"...(#........r'..p.2...( .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\32755537\F3574DDF\Telerik.Windows.Controls.DataServices.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	5.698941237855971
Encrypted:	false
SSDEEP:	768:xqZI0+0X3Eib4hH1tJIpyYL0aey1c/5BBnf7wqeymQsuBRs0ai01UEOMo4Ktf4dk:xqh+0Hr0Opjzx1c/5H7Yzm0Y
MD5:	48EED0BF0C56F2539AE687466B1EBE82
SHA1:	BD45B063A3F20D829EE10290830F57958CB9AC5A
SHA-256:	9B18AAA2942938DFB5F124DFDC46F514245E026442E9EC42FE26C1900AA778EF
SHA-512:	80ED74628BDAC261D63FA23B67B3A3DE9E16A0DC7EC45B21E8BCE88B66BC1BBFB9A347746330B9232CDB942D7308DA6E8BA589D9B355F4A4ECED1CD3ABE62967
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!..................... ........... ...............................U....@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........I..tm..................P ........................................D.!WR.9e..#.......y.."..J......:..%..q...."........8#].`.....)..Z......0...g.;3.u1....6..c....0[.Kz#....o..!... ....W...0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...{....r.{.........}.....r...p(......{....r.{.........}.....r...p(......{ ...r.{ ........} ....r3..p(.......}.....(!....-.rI..ps"...z..}#.....{#...s$...}%...*"..}&..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\35677B4A\F3574DDF\System.Net.Http.Extensions.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, ASCII text, with very long lines (484), with CRLF line terminators
Category:	dropped
Size (bytes):	5532
Entropy (8bit):	4.7397117338606956
Encrypted:	false
SSDEEP:	48:VRbedE2vSlgOasW0GOsisYeF51aGvUlgGF51aUvklgpIyF51apIvivalW4F51Dph:VaJkJJJ7k4JD/JB
MD5:	F01EA45C5A8F07C1C4961A6D2413FBE3
SHA1:	36649C13E8E44D75E1BD6BFC6BDFA44C83D21E90
SHA-256:	9E448CB00F3E97BC73987015CA377AABF2C71E78E0E565E5A4C3FD4F9D624D8D
SHA-512:	B635549AF4EA314EE3B48425D5FA142155F6975E423A46A845C9EEB0D4D6526F94FD91DAAC5063EA0EBED29687793D99E7C3FFA1DA9EA955044EFCB40AEB7C9F
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>System.Net.Http.Extensions</name>.. </assembly>.. <members>.. <member name="T:System.Net.Http.HttpClientHandlerExtensions">.. <summary>.. Extension methods for <see cref="T:System.Net.Http.HttpClientHandler"/> which expose differences in platform specific capabilities... </summary>.. </member>.. <member name="M:System.Net.Http.HttpClientHandlerExtensions.SupportsAllowAutoRedirect(System.Net.Http.HttpClientHandler)">.. <summary>.. Gets a value that indicates if <see cref="P:System.Net.Http.HttpClientHandler.AllowAutoRedirect">HttpClientHandler.AllowAutoRedirect</see> is supported by the handler... When this property is true and <see cref="P:System.Net.Http.HttpClientHandler.SupportsRedirectConfiguration">HttpClientHandler.SupportsRedirectConfiguration</see> is false, setting <see cref="P:System.Net.Http.HttpClientHandler.AllowAutoRedire

C:\ProgramData\miaB83E.tmp\data\OFFLINE\3D4D0848\F3574DDF\Telerik.Windows.Documents.Spreadsheet.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1795584
Entropy (8bit):	5.810676054077962
Encrypted:	false
SSDEEP:	24576:YOf+Usnp8S5NOVKeZ9v8GcpQs1VdQRvTk:wp8S53eXbTk
MD5:	3A3C98E6DCDBF2C61DE5AE8AF7AF8A5B
SHA1:	AE8E4A12474F3A7E712B2FDAB7A7AE6510528B7F
SHA-256:	2CFFB7C33A5E2F591B032E62C63EBF9FA0D6386DBD82327E862384F3A7A50144
SHA-512:	240BAD966252213BD9C19BC1FF38C36223C52584B5E99473C5922FAE0F1AF9B7349193AF29F14E9ECC4B66582A67204AA8709A4E0B21E4B3BF1815681E573127
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.([...........!.....\..........~{... ........... ..............................4.....@.................................0{..K....................................y............................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B................`{......H........... ...................P ......................................@@... .,...w..)..2......z...8.\"w.V.\.&}..........~....$...k.E..&..b.)...i.c...'........v.${S....i.Y..k.m.4..6+...\|....(+....r...p(...+.r...p(...+..}......}.....s,...}......{......{......{......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....2.(....o......(.....r...p(...+.r-..p(...+..(......(......(......{...."..}......{...."..}....v.....(.....rK..p(

C:\ProgramData\miaB83E.tmp\data\OFFLINE\41283706\F3574DDF\Telerik.Windows.Documents.Core.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	360960
Entropy (8bit):	6.209850828963233
Encrypted:	false
SSDEEP:	6144:4Upaw02OHiGZWtjp/H69xRyCWsJmqoG6MnXxjGEp8eLXASWrwIuOjzqAi8Y5Gvl9:hZOH0qJ6MnRp7ArwIuOjzqAi8Y5Gvl9
MD5:	D2A0CA7F07C028313240E7E603654549
SHA1:	CAAAC4889FEB3E2ACFD7A94BE31A0166F62D0B88
SHA-256:	E82C095B02EC21D62134D547FD8B102840B2FE283A459ACE014FB6323CB07CB2
SHA-512:	692ABE35C24E6664CC77D0DB86250FE9D0F222444CFE24F8C5F3D45BC2F6E7C60CBB14D3F2376DEE454B8B728552955BDA1AF53FC4C7D57EBF473B378DF05415
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.([...........!.....x..........N.... ........... ..............................P,....@.....................................S.................................................................................... ............... ..H............text...Tw... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B................0.......H....... ?...V..........p....5..P .............................................W...~...N.m4....)q..Rz...~..Q jH....BG.C....&z%...A...A.G..u....Z.:.:H..6.r^(6..G.H......{p..%.'....."[<\....y.....0..n.......(......-)(.....(....,..(....o ...o!...r...p("....o#...r...po$...,(.o#...r...po%...uc.....,..r...p("...,......0..........(....,...+......0..........(&.....*.0...........(......rG..p.('...-o.r...p.('...-a.rM..p.('...-S.r...p.('...-E.rS..p.('...-7.r...p.('...-).

C:\ProgramData\miaB83E.tmp\data\OFFLINE\4625E0D0\F3574DDF\SgmlReaderDll.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	139776
Entropy (8bit):	5.692827853836015
Encrypted:	false
SSDEEP:	1536:6P+WxQktZHNSukbp+RIMq2ovFQ36U3QVbChbO+A0FvGI39qFe57IljYpH9q432Z9:K+UNmTv+3H7A0ZGTFgKYt44G9d
MD5:	8335F3672E5EBC41C4AEFFD75BF953F3
SHA1:	90B468458268783259F1AEE8F1A9332B1262624C
SHA-256:	E91531F568072C862953647071612FC598945627218FC2E5BF49747A363D45C0
SHA-512:	3A940D5DDD3B903A2F432EA82001652E0CDEEBB35FEEC193DCD9F74DD6DA9266686D6CE17365F7ED577F283930BECDB818D02A9CBD86F2B277254291448068B3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w.Q...........!.................7... ...@....... ....................................@.................................x7..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H............n..........p...e..P ........................................BQ.;..[\w.t.v.E......Q.gpr.b...y.....]..\m...$?}.e\|...@.G4.{.......i".R... A......,]..Y....2s9u.@..t.. H......6{.6.....B.(..........(.........0............(............-...o(...}.....2...(........0..%..........(............-...r...po....}.........0............{.....+...0..3.................-.r...ps....z.r...p.{....o........(.......(........}......}......}.......}......,..r'..p(....+...}...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\47DD5368\49845E8\Entities.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	722
Entropy (8bit):	4.793241433689173
Encrypted:	false
SSDEEP:	12:TMHd1Yro8iKEfnSfj0SfBUSfrSfTSfh1JDwfvSfKJSfqVrmay:2dSo8P9/vbwx8T
MD5:	A379884CFA34F4DC829FC5248A423AA1
SHA1:	014160784172680F0BD3B48F401DBCAAEF8B5DC7
SHA-256:	853203C9CA696CF85B5D05110ACCA13A75A074903F69E095E409928CF4C95C2C
SHA-512:	AA37C62FEBC10DFB649C27358408D96A950D657CC31E20638B6A9A0578D4342433788C6EB1666E3686E529D706755E6BDAC0868D918B3C633A0156A85EE72440
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<ArrayOfEntityItem xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">.. <EntityItem>.. <Name>--Select--</Name>.. </EntityItem>.. <EntityItem>.. <Name>Invoice</Name>.. </EntityItem>.. <EntityItem>.. <Name>Bill</Name>.. </EntityItem>.. <EntityItem>.. <Name>Expense</Name>.. </EntityItem>.. <EntityItem>.. <Name>Customer</Name>.. </EntityItem>.. <EntityItem>.. <Name>Vendor</Name>.. </EntityItem>.. <EntityItem>.. <Name>Employee</Name>.. </EntityItem>.. <EntityItem>.. <Name>Checks</Name>.. </EntityItem>.. <EntityItem>.. <Name>Products/Services</Name>.. </EntityItem>..</ArrayOfEntityItem>

C:\ProgramData\miaB83E.tmp\data\OFFLINE\4AD6D99\F3574DDF\Telerik.Windows.Controls.Chart.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2291712
Entropy (8bit):	6.082551077519169
Encrypted:	false
SSDEEP:	24576:Z++0dx/qA5+yRGecTZFkPWwzierr1OWdA7cp1vcinKljo1XsotXZ/V3VY:Z+/x/qA5dRGhDerr1OQTnEinKXOXZ
MD5:	CEEA065D8EEE8E6E6DEA2963913095DE
SHA1:	938AA0E57437282BA8222C778AF4D0342B95AE65
SHA-256:	EDB95AF833FEB44EECED9401FC8EDC32611B4EACC6E3FED27761909991BD8AF7
SHA-512:	74D0655149352AFC49510332F0F09EB190C88C5F4578BE76F3E3CB33DA973B62B2793020617FA2601D3A11928643F4C955F7ACA02388CDC48692F7D0DDBE162F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!......"...........#.. ... #...... .......................`#.....{.#...@.................................t.#.W.... #......................@#.....<.#.............................................. ............... ..H............text.....".. ...."................. ..`.rsrc........ #.......".............@..@.reloc.......@#.......".............@..B..................#.....H...........,...........8I.....P ......................................5....<.UP.......)...jg.4b...W%..-.....`,9.?...s.K.b...R.T....^.........E....!fwc....46\....`9.......-.tL.`.5.@..9t.%.."..(B.......0...........(C...u3.....(D.....9.....r...p.o.........sE...oF....r...p.o.........sE...oF....r3..p.o....sE...oF....r?..p.o.........sE...oF....r_..p.o.....#...sE...oF....F.(C...oG...oH........0..........(I....3..o......(J....(K....rq..p"..(........0...........(..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\4C35210E\DF6C75CE\SaasAntTransactionsConsole.exe.config

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.1248868457355155
Encrypted:	false
SSDEEP:	96:Zr7197Kyd518WhzDrNGCKWKJQK5jK/KJsFK5s0Kq:Zr7z7Fn18uzDrhrBcstFR0r
MD5:	3E4DA613BBE1C1049BE70B9DB52F82AB
SHA1:	52E0D7398942C4BF971B6B9B7A39FE1AC82F1644
SHA-256:	DD16015CE93A2939EE780E8B06843D78898F0AEC8AB1BAE3DCA466F9454D9560
SHA-512:	158C57557037EBEEE5D30DE7879013266C7F188E606CB000B1F2D125894E0B93EC9C1381E7D4C355ECF5260A5776354913A77004543975AFAA088C4419D499E7
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <configSections>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler,Log4net" />.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="SaasAntTransactions.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.... <log4net debug="false">.. <appender name="Console" type="log4net.Appender.ConsoleAppender">.. <layout type="log4net.Layout.PatternLayout">.. <conversionPattern value="%date %level [%thread] %type.%method - %message%n" />.. </layout>.. </appender>-->.. <appender name="FileAppender" type="log4net.Appender.RollingFileAppender">.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\52098B21\F3574DDF\CsvHelper.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	5.801641850177608
Encrypted:	false
SSDEEP:	1536:N1ZVFPFqL84arP8B7jXHs2APWgYLcSnqm5jsX:NdQ8nrPMrAP80L
MD5:	01E481345E306F0A3E1682066E9D63A2
SHA1:	D319F6DC778401EC9D97B466E7D296F07E024593
SHA-256:	3D1A08960B8D55C74B088A64D47966FCF77A54A65BC2171F0275EE27BB330F6D
SHA-512:	52185CF7F435AF479B9058A7D515FF962774CD323523D17013FD26FE5D775F5B9B85E1A65A560C330C086B176A850FF773B3FF788919C7B1F15BD1279D79D909
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W.........." ..0.............I... ...`....... ....................................@.................................4I..O....`...............................G............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................hI......H.......4...H...................\|G........................................{$.....{%...V.(&.....}$.....}%......0..;........u......,/('....{$....{$...o(...,.()....{%....{%...o..... .ab~ )UU.Z('....{$...o+...X )UU.Z()....{%...o,...X.0...........r...p......%..{$....................-.q.............-.&.+.......o-....%..{%....................-.q.............-.&.+.......o-....(......s....2.{....o/...2.{....o0...2.{....o1...2.{....o2...2.{....o3...:.(&.....}....*J.{.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\59E0FAE8\F3574DDF\ExcelDataReader.DataSet.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.028217051385981
Encrypted:	false
SSDEEP:	192:4e2kfGIqU83vUUUUUKE4eW8lJffpaoOSjmdgBHvTc:P24GIV8UUUUUKr+lJQoOs
MD5:	E7F246A70BF35522323150C4699D323C
SHA1:	0B86129118B7E5584E5FFC4EDDAEE1631E34ACF9
SHA-256:	6D25FA352045B5A8B9C119CAA42C04D923F140C28D27A0F70676E7612BEB90FE
SHA-512:	8A04E6DB085B4C85F6FD914C529C585D502E80C0C4052BA5E5FE4A786DFD9041F3F578CC34BF94CDBE16C7EB07584FB6E459DCA65E9C79FAFA4163D0519DC462
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............9... ...@....... ..............................Z:....@..................................9..O....@..t....................`.......8..8............................................ ............... ..H............text........ ...................... ..`.rsrc...t....@......................@..@.reloc.......`......."..............@..B.................9......H.......L%..$...................p8........................................(.....0..o........-.s.......o....s......o....-..+..o.....o......-.s.......(......o.....o.....o....-..o.....o....,..(.....o.......0..,...........+.r...p... ...(.......X..o.....o....-...0..v.......s....%.o....o......o....r...p.o....o........82....9.....o....,..o....,..o.....o.......+k.o....-..+....o....( .......(!...,..o....... ...("........(.........(#...s$...%..o%......o......o&......X.....o'...2..o(

C:\ProgramData\miaB83E.tmp\data\OFFLINE\5A32B2FE\F3574DDF\ExcelNumberFormat.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.542801291507589
Encrypted:	false
SSDEEP:	768:8OrXGzMW83eu4768a7Af+yQ48MAeXez6:lrWzMF3eA8a7lha1Xd
MD5:	0C461A4B0190B2E66999DFBB7C94C780
SHA1:	8A52572E1C3ABA10787AA3E18A73A9053C51F8F2
SHA-256:	3E03911DCAD68D01AC11879B1E50C04C231B14858BBBF19C1851C1D3FA5F54C4
SHA-512:	3BA5974DDD196095647D2334829119F945D026FADCE69D6ECBEF53D47EBA171A532A4FA163554FE355334BE26BBED9D51BA844E94AA292F78EE889D472FB90F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0............." ..0..`...........~... ........... ....................................@..................................~..O....................................}..8............................................ ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@..@.reloc...............h..............@..B.................~......H........I...3..................d}........................................{...."..}......(......{...."..}......{...."..}......0...........(......r...p(....-C.r...p(....-@.r...p(....-@.r...p(....-=.r...p(....-=.r...p(....-=+E..(........(...........(........(...........(...........(.........(......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....*.0..a...............(Y....o....3G...(.......(.......s....%.o....%.o.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Account.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.385828093280008
Encrypted:	false
SSDEEP:	96:uDTGWyW+WsWMWTW3WPWnlWfWoWnWFRxyxmW3W8iWxhofS:0REX9
MD5:	1683427F2A9E604FC547E2AF1FCC887D
SHA1:	329087DD3E93D911E01F4016BA8CA4B353F01472
SHA-256:	B2EC6DA369E892D257A698E8122976FB18E16A539FC0A40B95B4921C65B3B117
SHA-512:	E7E8B451D83AA6E6D1995E60B8700393179635C4FF81D4319D80508018E4CC905819F91D70B94E583EC04D96D81E7B6F60E24CA046E166270CCF02B8388F9E68
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.T.T.Y.P.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.N.u.m.b.e.r.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Bill.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15344
Entropy (8bit):	3.387950593600828
Encrypted:	false
SSDEEP:	96:uDTsGWJnW7KWJWkW4oWjUXWPWyWYW1WoWDtWjRWBWBWgXcJXWSWkWDWRW0WGW52h:2BULJcJw2ZNEjw
MD5:	095636ACB47CC26ACD619DD62811FB6F
SHA1:	40900F2D4594B5D9FE191A746328B4CD56786291
SHA-256:	E9BFA8A45BE8F09A966EC9FE1BE504017F7517978339D59111214982BE6D653E
SHA-512:	A2D7DA83B518230E9008F646643EC7E83B1A6ECA1C87EB27FD938FE6B8461CFD03DB5E0D64FBFA9A8F49D2494B8AA7471EEE584C4C3C46DD8E7CB666EF052FD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Check.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12946
Entropy (8bit):	3.394060848942431
Encrypted:	false
SSDEEP:	96:uDTs9vWAWW1zW7KWJWzW43WjUXWPWxWYW1WOrWDtWjAWNWBWgXcJXWSWkWvWRW0A:VJkUGucJP2ZiEYw
MD5:	6B27345C734DF6D78E8EBA63B75F9E80
SHA1:	73610EE6AFA7AA8D505733F6EAD59FD041C5FB49
SHA-256:	9671C838047B628731F03E1D0E00C387B8B769711B148C85DB8DFB0BDAA6DF61
SHA-512:	E967133531E17A09898D63CB1AC2332DF6B3A138364A65D7B48597C771366B0D2E5570F6F8991E851D6E265A5F7B19DFB20DB4C082B528BCC27DEDCAB0322267
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Class.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	3.401438369594957
Encrypted:	false
SSDEEP:	24:QlL+6DTL5yoRUWVVyVW1j2UWLgu7yXtW1j2UWkAnjyzAnFRUfb:y+6DTL1RUWVsPUW8FPUWhnRnFRUfb
MD5:	007E9D4F8D2CDB310A2CB00ABC66D554
SHA1:	EC650348913B8C76BB9BF634FBFF0FAB6059F2D9
SHA-256:	CB5A78911D96EC31A5D458C36816591BE8983F2A9DD0E4E315DA5473124992CA
SHA-512:	9F796B251EB560C39F6359B82715EF94D83325A00FBC9ECEACF6A84BEAEC9B767A36021D4C3C1972DDEE8B707A1E904B50170C3414A169A004D7829D1189F506
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\CreditCardCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10730
Entropy (8bit):	3.3973078263426566
Encrypted:	false
SSDEEP:	96:uDTs2WNggW1nW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjAWBWBWgXcJXWSWkWDWRWo:PBFwbqcJj2ZFw
MD5:	05489A893E54DDC5FB6CF04CB6E694C6
SHA1:	3127D4D44195A71A0E4747777BC897050C7E8ABC
SHA-256:	69F89A746D7C56D9208A3E78C5A73528DDB1608982EE88890E23A497F8ECAD41
SHA-512:	F8186EF3DB6EF7B04F60E31F20CDD7BCF7DF00934B4F43A5895EEDB37447A335B7E268DC9D7F944E2446178CC036B59567A614ADDD0072DD9B0FBCAC4ED029CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\CreditMemo.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23068
Entropy (8bit):	3.397580751364641
Encrypted:	false
SSDEEP:	96:uDTsHqW2+PXW7KWOrWBWDtWjAWPWwWtWyObW0WjW526TMW3dUWZVgIW3GWPaWaqb:64Gh2ZGd/Q/EkQ3qoQiPZsAw
MD5:	0CD8B2D4E3EC5E9C2F79D6910DCA7BBD
SHA1:	811188337FDA66CF1109A0391E59BCC595A6BF44
SHA-256:	2809658D7E0DE5B09CDFA780F2354A25B0E288ADDC1D6D7C5AD1653D26313B84
SHA-512:	9EEAD1170B869BB61504CDFA5E69F797162D6B00F474F8FE46E647A07903BE48F1187D1F33F4C4D197B67FEE74AC54B469D9F8EA396F150FC2278491BB3DC0B6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Customer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17704
Entropy (8bit):	3.3778298617907954
Encrypted:	false
SSDEEP:	96:uDTjuWfWnW/CnWpjWYW9WHWaWNWimWZRoW9GWVWW5WWwW2zWLEP5WVDyDoW8EmUH:CvC/0Fr8YXNT2pr6ww
MD5:	AB72B1394124E9E1118E15E8EF4E511A
SHA1:	5EC1BAC179E30696F1AD70AE3A93AF810020BECD
SHA-256:	B0B47D9BFF22CD109523E2E1E85EFA1D026B57AA2A6D74D27E6000EED52D1C9E
SHA-512:	1855DFE41F1B8D56E2B341EA7D106C9A45E5E933D89AEEF0BB6796CD2220395CE73DA5245E066D6FFD2A2006D7EAB4E8B216122C9A1BBB3F9378B91876DAFCDB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Deposit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6156
Entropy (8bit):	3.4137444628644134
Encrypted:	false
SSDEEP:	96:uDTs4UW7G7WPHlWyW8WBWdcDvWoWqFWwTW+gHkW+HArW+RC9W/qWBSWn2WT2VXWW:ocDYw
MD5:	1803FFF728F97073799C80B67C8FDEE7
SHA1:	0E643BBEFACC62B6661B37C62A66DBAA8658217D
SHA-256:	321392B689C4F31E1C684FB21DB11CFDF832AC047D206EAC28CD28565D3E08C0
SHA-512:	28EDC510A58A87A67B183ABA6953F3242021A517E53FCB06AF98F9615FEF9A878B7055AF15D44519BD174EF528F8BCF09C8FF593151F87B35580F30BDBF7A3FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Employee.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	3.3517687010608053
Encrypted:	false
SSDEEP:	96:uDTnWGW/CnWpjWYGMrWfWDWpWrW9W4AaWJWpWnWOEtWZZW5mWnWyWDUWtoWkUWw+:xCUgAB6x/LebT2iw
MD5:	F3C984C4AE1632BC89840291BEB00358
SHA1:	5DF688B375EE3938472534F937695E49C454ADC5
SHA-256:	3A639B3086EB68D7252C9BEFBDDE1B30B65EB48BBB8B3C42ED3E85F920AE459D
SHA-512:	D4B0D0FAD035E049F68D74EBE21F2CC7A077B0F83D3C1546B4D2758058826868639E8E52936F33EAE0807DBF1D650E63160641AFDBF1561B83F024BDB409E40C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.I.R.S.T.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Estimate.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18398
Entropy (8bit):	3.3839688551388196
Encrypted:	false
SSDEEP:	96:uDTsDJW2+PXW7piWOrWDtWjAWPWtWfW0WjW526TMW3GWPaWaqWlaWimWVWZRoW9T:bX4iE72OVd/Q/UkQLZsAw
MD5:	341CF2CF665673DAF34D8D2F2E5588E3
SHA1:	A81D0913EC0CD932745EBA0E63AF993CC6D58150
SHA-256:	E0A00EA9FF43381DD90AD30F8698A1006055F6307F21EE4679BD8A5D3ACE004F
SHA-512:	7537BF4412647F2A495B1DD194C82E2BD6AF345192C28882C17E728B76887215924590DE9596237F47385EBF777D63606E4192F6264BE7B3F0C6F79B008D6444
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Invoice.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10153
Entropy (8bit):	4.757512621728147
Encrypted:	false
SSDEEP:	192:tWlPvKZ66qEVSLoH4VdrjJlYYANFbHZGBJ1gN7J/NTx+JohknTZl+N9O3ZyxBwaH:tWlPvKZ66qEVSLoH4VdrjJlYYANFbHZ/
MD5:	C67C6FA1BE699190A935B1E7F92607B1
SHA1:	6D8BFE09A3E9F3E419DD5BF9E37C5467F6F8C78E
SHA-256:	9F001FBCB2FF3B2DBF888058104FCAEFF86CE1AE1A2883BEB263D4D8F56F3906
SHA-512:	A41521002C8150D096B6742BDF99A7D8BB1CC1E4841E32A9B1250241ED33534AED0F323781DE792247F55FBA485D76B9C943C0EC5BE6F6DAE564144E7CF735AD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>TRNS: DOCNUM</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>TRNS: NAME</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>TRNS: DATE</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>SPL: INVITEM</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>SPL: QNTY</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeader>SPL: PRICE</Fi

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\ItemReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11698
Entropy (8bit):	3.396173076147388
Encrypted:	false
SSDEEP:	96:uDTs2WJnW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjRWBWBWgXcJXWSWkWDWRW0WjWU:GBFwbJcJj2Zqw
MD5:	A73CDF57131CBFDAB6681AB305AA80F5
SHA1:	F48F228AC5063EACF3ADF97DA6294C0C0758B87C
SHA-256:	A0FE24F35C8B60E21CC3EAC5703436C9D6B48700F10191C083FD6CDEDFAD2A9D
SHA-512:	AEF52B61FC72666A09748CDD5AA8F447AB93DF3D9FF88DDFA70DD9F71005D8821C3506FE8843789A406D9E477F295FA2487C5589FED122B3A3E89065BED1CAEB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\JournalEntry.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5624
Entropy (8bit):	3.401160832913635
Encrypted:	false
SSDEEP:	96:uDTsg1WbWWp7W4WAWzWWpWcWNWxWoW4WnWmWiWn2WT2VXW8iWxhofb:/w
MD5:	DE18D67EC219EE8784CB915380231A69
SHA1:	D7CE005E0E38B03D67293BEEE56AA84B3A92D1E0
SHA-256:	4CEE9DB7E008DC632EEC4AC53C3BB48DF60EEE13289227BEBFBD775EC025D141
SHA-512:	78A52F9E4D0D8854EBA021E4BF3907DFBFCEE3E26D50278993814DE4FCC62669D1161EB97C82931A702BD116D7E563C595B55F14C6EFD2B13AE1870334B24814
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.e.n.t.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\OtherName.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.371180909495819
Encrypted:	false
SSDEEP:	96:uDTGWPWfWnW/CnWpjWYW3WKW52WxooWeOWcWaZrEWAWVbIFbbW3W1kSEWrW3W8ip:JCIUw
MD5:	4724BDA353907F831C9EE02CC56F0589
SHA1:	05F9763BE0CA8893A63541BBD4CC882420DE2900
SHA-256:	5E2931C298FCC22D481DF7F2ADECA18B2C7BAE222C909F02C2E592C0112A38FF
SHA-512:	6094FC542D8A2116A0B51531602C9D98996140BA081C2E06C84FC90620B6469ACE40B7DD5561D0CBF8325A47E9254760A36F221C18638F86F993D302B09A90A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.O.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\PriceLevel.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3780
Entropy (8bit):	3.383914597363917
Encrypted:	false
SSDEEP:	96:uDT7XWn2WcyW4WRWiWikWTvsW3W8iWxhofb:AjbvXw
MD5:	D366551F82B5F038C3D0A4C98AB63141
SHA1:	8F9FE782CA5C2B505410BFBA637D03DB81FFFC7C
SHA-256:	357AC25AA7A8570F6983805C251085879555D3EE0B04EAFA51053CB6125AE1C2
SHA-512:	16DCDBCA2F384C588953235C2CCE601FBA6FD664CF4CD9AB72D6F9BA9F80A67B74C9BF9E0E62A4587B3EC66A968D378A67835573B06B0EF7966D5BF16AD583E9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.A.L.U.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\PurchaseOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16308
Entropy (8bit):	3.39751102690321
Encrypted:	false
SSDEEP:	96:uDTsUWJnW7KWOJWhWDfWjuWzW6WjWgXVQXWxWRW0WjW526TMW3GWeaWTqWIaWVm1:2kVQT2OvaZsHw
MD5:	4A2597CFF83C4C0C42E2ECCE4E29776E
SHA1:	49D3B3FEAEA5AB634B36BBFEEAB4686F0281A76D
SHA-256:	1C037EE6E31DE8A7DC485E67BA2B836F86837D8B55E311DFCA7C980F9D82C8BC
SHA-512:	10430F3309FB9BFD7EB54773E8CF1B6F6BEC58497D2CC02A02270483EC3298788D9AC19DE99A9AD3CDB1E496348B7858E9E8CDE510CBD47704E31A15B7F416F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\SalesReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23052
Entropy (8bit):	3.3903928257479117
Encrypted:	false
SSDEEP:	96:uDTs/W2+PXW7eWoWOrWDtWjAWPWwWtWfW0WjW526TMW3GWPaWaqWlaWimWVWZRoE:J4pp2Ofd/Q/FkQaqoQ+cDSZsOw
MD5:	F295C0759C32D5A4705FDDB505B52E0D
SHA1:	C92D3A2848860E98D68F889A7772531532AD1831
SHA-256:	1C19E74632C0803EA4B3D5D8D0F56CD9EC98D4AC84F44D6886CDFF4FF2431B19
SHA-512:	B7836D171302E522115EA61E65401C9025FABFF8E281E34590EB9FC4DEA8FCA3B6970892E481ABB96BF02993F76A0BF09C8E7F8FC18C8676821CFD092DC8E9A2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Transfer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	3.425055648101356
Encrypted:	false
SSDEEP:	48:y+6DTLfDRUWJfcRUW+RUW3qRUWHfjRUWGRUW8FPUWhnRnFRUfb:uDT7KWRLWhW3dW/qW5W8iWxhofb
MD5:	2E942AB54EC0B0FDF9B26C6BF8809DEC
SHA1:	B774A60BA12055E3ED472D19680EA7A76A3B2B03
SHA-256:	E6E1B5547E1FB85BE8A1A8700772C47249804B47E7516FE51DA1130023C6A184
SHA-512:	97E795DDB4DBE5FE815F0D6BE55014637E2A48CF14D738F96CE4F9741483E6D4F8A31F6E23EF2C5650AEACFF501BD51F79E97D8D58E912A7015C31369C52C5B0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\Vendor.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13726
Entropy (8bit):	3.3711405370788805
Encrypted:	false
SSDEEP:	96:uDTiWfWnW/CnWpjWYW7IaW9WQWxWmWVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDyDN:6CbIP8wT2XrTpw
MD5:	1D3FBC50FA064BE05D3CE6BDB3D9742F
SHA1:	41879CCBB18FB42D23E64F12711D20622E46FA9E
SHA-256:	43B97088050C7A5D64FF8B5DB96D3A740BC32721B745D3E6F794964D673A936B
SHA-512:	AFFD9B5FD27F359E9FCB7442B3BAAAF68E9BB9EB0AC6A111A3F52D73C5483B7EB9FC5F9FB116ADA85CCCD1BB7FE357415E43C03553055AAC6B5FFBE239092362
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\2F1C881F\VendorCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	3.3886826903517617
Encrypted:	false
SSDEEP:	96:uDTQL9WJnW7KWJWkW43WjFwXWPWyWYW1WoWDtWjAWBWBWgXcJXWSWkWDWRW0WjWb:LkFwLqcJj2ZZw
MD5:	B04B6EDB6B582A743361788847CF0BCD
SHA1:	3F3815AFA4A67477747C74EF0488A1DC2015C323
SHA-256:	A215A41010A602B5B702EA8AC6604F847C32A83A4B5D2878297075F21C3314FB
SHA-512:	45E2F77CB6EC77129E8602E21C350E03A1C46A6B4DEA9CC3E5313A779D4DDA9A0BFC84A6DAAF732CF0D88D118270A44FF775163951BE19E705BA1AC3FB6975AD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Account.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5696
Entropy (8bit):	3.36440461691417
Encrypted:	false
SSDEEP:	96:uDTmW8W9WgWpWTW3WPWYWn+WfWoWnWFRxyxmW3W8iW3iWxhofS:/REXT9
MD5:	7EBA5CF892154F4C8222C7873DD57995
SHA1:	99E430DD08CD422B9A975C7C52017C3254FC688C
SHA-256:	0EF03F6573B01186EBAF3884F1F2BB3C08CEA16FD22683269BAE4DEFA7F5305F
SHA-512:	AAFC9DE9E748AADEA93A9C1AB156F28845ECF2F16234917DA5C933B51F4B6E12738BA0C55B7C0E5E61F7070758381025F71396035E362D8F2398F94182D195B4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\BankStatement.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4202
Entropy (8bit):	3.362023315280313
Encrypted:	false
SSDEEP:	96:uDT+WXWxWEW0WJWQWpWdch1WYW4HWiWn2WT2VXWxhofb:gchvr
MD5:	F2809696DBE87E6EF86A224E1E0FB224
SHA1:	4404A5547D4EB9CE3D1A2B40781FCAA28C817433
SHA-256:	13B541A6C7A627B15E10E7EC1F1B5619B64893DB6169133D9940CE099D2A3F42
SHA-512:	40348944CFBD0A7F72BE8FE0703023D1A4E29C05BC63D4D93D0A2C1186A5E8B1F84B9D49B965D368330969BFE62748F882FE2E9960E2A29BB80F7AFB7F74AF7E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Bill.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16472
Entropy (8bit):	3.369506101034054
Encrypted:	false
SSDEEP:	96:uDTyWjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WGW526Ts:nkFwOlcJs2ZNEXTw
MD5:	22DD5C191418AE042D685CC551171670
SHA1:	519D05FE41A605BA9D0842E55CE19895D3979850
SHA-256:	E2DC130B0EB63C5DA641143164DFFC6F46646CA3C19150986C659111CECE27F2
SHA-512:	7EDB9106C2E2A186F6DC6CEF9309DE4E356E7E5554B49D312F55A645BADC9911BAC0661096F697CA176B9765BB1DBC78EFDEA9278D486D57796767EF471F214B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.x.p.e.n.s.e. .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\BillPayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXW3WDWxW+WBKgWoW0WbWuDWVWn2WT2VXWnWcG3W/WeoFWDEW8iW3iWxhk:df2Tw
MD5:	9822C955955BB940E0E48E5DF1DCEBA9
SHA1:	C39B2B3CB49F85FA90E22751A28AC98B4578FAB9
SHA-256:	5BA02DF7D3BF6D12899E58D9EBF9C20FF6AF11AF15A5CA5B465D8E157D2AD0CD
SHA-512:	9356CFE1B171E671364E91ECD1C6962760A031E1638D7F836E276E576C551FD55BC791BDFF4F478C2BB5F7F29F5343A7C9A4F7168653C55B9C5F6BDF07FBDB93
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.m.o.u.n.t.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\BillPaymentCheck.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3WeoFWDEW/W8iW3iWxhk:df+Tw
MD5:	119EEA3B83228CF4AF90DB3DA987393D
SHA1:	36E1EE9BFD06B5DB21E8057D6B0A94046805F927
SHA-256:	5BE92994641722A1CAD46DFC600645960E53C3928B2833CA296CDFE865B71118
SHA-512:	367416667D7660D6ADA00DA018FC90DCF6F1035E394B637E75AD26163D9B878902BCA03BBA5FEEC8E2C301A9B3CC60AA10A3F4FDF82593BC418AFFADAC967DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\BillPaymentCreditCard.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3W/WeoFWDEW8iW3iWxhk:dfuTw
MD5:	CCF424242AE506049732FBF1BFFDBC8E
SHA1:	82B5FD23AB9978D8FC24E887C69E126A8597F80E
SHA-256:	40D96F01472756C1C1D6429F629F097C0DE1BEB94AB80CAF1E8F4A4F787327CB
SHA-512:	23A2769384B4A921D921345BF1B02AC7FCDEC923AEBC4C57496C8F0D8674CA3788334DA726CB94D786295C9EE139D0A8D4743C13B39DE2C462858E02F78733CC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\BuildAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Charge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	3.341511882057727
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWxWoWDWWj6yWpWDW0WjW526TMWCwWPWdW5W8iW3iWxhofb:jVQD6y2lfTw
MD5:	4DE6FBB0E4913F56506A55D2F197CD89
SHA1:	0EEC53EDF169E613317FE7FDA43A9D48043D620E
SHA-256:	8DA6DAFE0EE49B9B773956B0A108C3C40BA81A4074470D9936887381D19A0F26
SHA-512:	C76CFD7CFB9E65C902DDD55B4EB6124974B79451AF86A0EB52AB47A2563CDA4413B25716242FE79AC9868DAC86174376C0863FB7712568C8E065350B932DA3CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.e.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.e.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Check.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13386
Entropy (8bit):	3.3689913335499573
Encrypted:	false
SSDEEP:	96:uDToDvW+WXWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWy:xDRkFwOlcJP2ZAE0Tw
MD5:	1C0664D5AA1BB10BC49A85A10CFACB16
SHA1:	A2A461CD1E9317E5A640ADB2DB6CD03EA8EC24A4
SHA-256:	BD547314AE670B52125F0ABA4B051DD2086C49D8B9B8F8DE51AE35FA8D861337
SHA-512:	3407CB83AB03B5D3AFEFDAAEC44C15C131DC42E45BCEC8D24AD6509A733797F6DA189D026D74553A3511873795C3EFD68DFCE7076DF125372AE90A772AECAC44
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Class.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	3.3737628801824364
Encrypted:	false
SSDEEP:	48:y+6DTfRU2VsPUW8FPUW3FPUWhnRnFRUfb:uDTG23W8iW3iWxhofb
MD5:	8394D50FB8C4B1B44E4BFC1E85D8E90E
SHA1:	6FF949F58308BB699CD5AB6C8843F968DB9A135E
SHA-256:	3780ABC3C231B58C09AE37893FEA3AFE44AEE41F07EB503BE4BF9BE90E2204A5
SHA-512:	2C4265418371BC6D88263DB8727982545CEC9214835D8BED5C30EB7D54B51064FFE5674D51D770782899DCAA9AA8A27B6929BA09A902DBDD9837F28C7D43B417
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\CreditCardCharge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13734
Entropy (8bit):	3.3746926532041783
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWH:UkFwOlcJP2ZkEJTw
MD5:	85A3C4FF059214D7032EB18B90D67FC6
SHA1:	BBB3D13CA4CAE06E636C72E07E8C27A08322D1F1
SHA-256:	B06ABF8C753CE58FF4167D569379B0BDBC92F9AA7172F8A1E2234FF1B7D3BEC6
SHA-512:	B96B47E6033823A0D6E7082E2F2E160BD962DF2C838A31DEADE1C070CFA2E52F8BAC19221B8CFB9E32B08A6F56956A23CD0A14BF4AE8B8CA7E8DC926B5EBA682
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\CreditCardCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11192
Entropy (8bit):	3.376232314447034
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWQ:UkFwOlcJP2ZaTw
MD5:	8799B566ECB2D1BA2FF14D17AA84C271
SHA1:	1170D91A3BEDCBE0B852DFEECED775039F1E77BA
SHA-256:	8327782D98DEB9EC910666CB54E1FDC31F9FA0CC34ADCF731A8D4AC48F3BB9C4
SHA-512:	9DA64E810B494E8B3DA65374136555CC09AB5A8D9BEC90DACDB9E9FC156A26F4DC600C10C20F0F33D2EE803FEDB790C9D45643DDC92E728729ACF5FC664DFE90
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\CreditCardStatement.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	4.696241236318063
Encrypted:	false
SSDEEP:	48:3YV1LJ1mc+J1+c7ZJ1ucuJ1QcwJ1Dcu8J13cRJ1uc0kEfJ1Q3cMuYJ1bchXJ10cN:O19/2v7bGx8yuYGv/mbuuvhhVn5SQIEX
MD5:	B5F0345E4EC6B43B8E374DDCE3DFAEBE
SHA1:	C35A35015F4A9012B076F90F0F20A1ABD2F11726
SHA-256:	955FF27F62B8845D34D0D1EF414BC4371870466CEA6B92D38E20583932313EC5
SHA-512:	F5036B28BB39C68A9377BB6BD0DA99E1799EFCC329FEE433BC92FB0720741FE935E0FC3E205EDFF4C385588C5F2D83BC42C1704FF9CEFA60DE96FF4EBB206046
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Statement No</FileHeader>.. <Display>Statement No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>CardAccount</Key>.. <FileHeader>Credit Card Account</FileHeader>.. <Display>Credit Card Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Payee</Key>.. <FileHeader>Payee</FileHeader>.. <Display>Payee</Display>.. </MappingLine>.. <MappingLine>.. <Key>Account</Key>.. <FileHeader>Account</FileHeader>.. <Display>Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Memo</Key>.. <FileHeader>Statement Memo</FileHeader>.. <Display>Statement Memo</Display>.. </MappingLine>.. <MappingLine>.. <Key>ExpAmount</Key>.. <FileHeader>Amount</FileHeader>.. <Display>Amount</Display>.. </MappingLine>..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\CreditMemo.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23580
Entropy (8bit):	3.3710777732304122
Encrypted:	false
SSDEEP:	96:uDTQQqW2VQXWxWoWBWDWWjRWjW8WhWyObW0WjW526TMW3dUWZVgIW3GWlWcWfWiQ:jVQSu2Z8d/Q/9kQfqoQvZsATw
MD5:	C25945E64B97E72C57BCC9F7379C9EF9
SHA1:	F35B6EB3E6FD0F297232D98727478989941486A6
SHA-256:	0076BABE7A06C173B633073A7B2F653C67213D5A484FAB6CFF818B51EE304979
SHA-512:	C0018D7E32DC4AF7CCCEFA6060FEB147066EC4594D3E962425A99D10A35A67B59BEAFC14C8651BCD3A428111220ACFBAC891CCD5552DE7C424AEEC59ABAB10FA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Customer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18668
Entropy (8bit):	3.352815492415269
Encrypted:	false
SSDEEP:	96:uDTn/uW3WlW/qnWpTWgW9WlWcWfWimWZRoW9GWVWQP5WhawWGFzWLEP5WVDyDoWh:2/lqX0tgrpXmT2NfbDo8tTw
MD5:	75D963B4C35917C19F3A3D8AE3B95FD9
SHA1:	F900D7C232551EF384DA4F294AEA1D0C800F2139
SHA-256:	0D542F1557DFF61EC1EB5886EF3BBE3DF3F7C0F2AB75A9A319A8C013434C5893
SHA-512:	7F07D3204EFF25B8FC0E76DCF260A93BF13FDF3CE81FCD84B2644E0B17F06C938C5D4A84AB6C16607C1CFB8537C04A3F0C6D4F292CE6AF67331C6C3A7F2E4776
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Deposit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	3.3749994451487755
Encrypted:	false
SSDEEP:	96:uDTXNUW4e7WsclWyW8WOWdcDvWoWO8FWG2TW+gHkW+HArW+RC9WVWDWn2WT2VXWa:ucDITw
MD5:	D60B6517E5C856A330029224348ADB67
SHA1:	1112AD001BA5FBC2A23CA993ACE8F2AF4F85C60B
SHA-256:	319C59A778AE176BD9B2C5232F2703DB05F90604D0AA3398F8AB76B8E5117259
SHA-512:	DF59081A0C17AF14F2B4E01CBEE5E606A744A5F81619F1BA5AFE1D12EFF3C1A4E10BE239CF06596A31D6EF84A15AFA4EA249D94CF2F9DBC108FC43AF46488B25
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Employee.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13236
Entropy (8bit):	3.335089551147612
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgGMrWfWDWpWrW9W4AaWJW2WkWOEtWZZW5mWSWPWD2WjooWkUWt:jqsgAB7/LebT2iTw
MD5:	A8F8FD205854B92DF247460D1B68AE61
SHA1:	DF84C1592E4C80910E6D7F79ED70E6DE37343737
SHA-256:	97ECFF8FDB71FA0766E53CB1C600745A4D6FDF1FFE6E19D097BAB425B98BE14C
SHA-512:	1AED2CE7FF57A93429E0EEAAD54A40130B868A07A06FF4FE9B17058A6FE63AED7C45E880520C2086DC7FD88B901E3C86EB3C11F642432E26F7AE984D0805ED81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Estimate.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19246
Entropy (8bit):	3.365048018472737
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQX2D+iWoWBWDWWjRWj2hGfW0WjW526TMO3GWlWcWfWimWVWZRoW9GW3:/LXVQM+AY2WMd/Q/ckQLZsATo
MD5:	A982E98D2D012B5DF3855011A16CAFE1
SHA1:	211D4093AC6185B43B2B33409CADC5A0F9999DAF
SHA-256:	85075E28695BC26C00140E277478CAAAA0F7A210B8846FF57C75849DD9871347
SHA-512:	102BA71331AF0ECC14AEB046F9670994F9F945BBC66CC94856C50080BF0B5CAF00BEC3E46F5420EC92E9E47E2CF65549C22FB58B3937919B05D1343B5FFDB61F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\InventoryAdjustment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6062
Entropy (8bit):	3.3963922355007456
Encrypted:	false
SSDEEP:	96:uDTaW2V4vWBWEWIWHEj5WdpIWDW7W3XKWvlnWvInWZVW+W0WjWVW5WmWRdeeWxhk:zV4mjT
MD5:	628902A4F6736D6D5F4B9982F5ADC705
SHA1:	25914A4FB3E0EDDA415A218C7EA6DAC5E92A58B5
SHA-256:	D7AF0A4FC2D52FA29CDF6C9C19FB230ECF3D1AA904A11A175DD90ECC0FACE374
SHA-512:	364712CC3DA576AC90E543989D9FB4B5077B2E6454DAA2ED7D971D7863BA779F74FA0AF48E5C69DF1E224663B171F843E3C145CE96BC908523646B952DAFEF81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r./.J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r./.J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\InventorySite.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8130
Entropy (8bit):	3.328234644697249
Encrypted:	false
SSDEEP:	96:uDTm2mWpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrLqW36WUCW3:5ZwvGcUDTjQpm/FTw
MD5:	0B0DC1FEB1B046A4A54166A0A1DBAA06
SHA1:	25BDA861ECE1DB4ED0B89B0665488BE12A895239
SHA-256:	D2006AC23D0AA1C25C30635019BF59B27077F1612D8E2C795425A1C38870823A
SHA-512:	5A210839D2635668F9F41C85CC1CF45D48F35783461AD42E50F3678811482305AED9CC052B89C3EBE2D154B2A7D6D93F349AD43B0F976784C983B8B8B8E607B1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.S.i.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.n.t.a.c.t.<./.K.e.y.>.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Invoice.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11461
Entropy (8bit):	4.727888657534949
Encrypted:	false
SSDEEP:	192:OmXblKXYCEHoH4VdpedUjulYYANFbHZGBJ1gN7J/NTx+JohknTZWDq8D8r4D8l+4:OmXblKXYCEHoH4VdpedUjulYYANFbHZg
MD5:	7DFAE276E0DA2EE55A36D8B9682B719D
SHA1:	C63A931DCAFDEF0C95A23B897771A9DAE8D2B1AB
SHA-256:	F97501D9CAC0BAE698CF98D089979EB20C52F4F4F32B8AF192D61576C54C5798
SHA-512:	BB5D1A95BF64004AAF0B7AA60C7710C16ABF5BCE669505B6773E8E76D50E017AE2583E97803D0A3211A672422B753B92866FC6081DF1FD93E5E4423408D54DC2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Invoice No</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>Product/Service</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>Product/Service Quantity</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeade

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Item.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7666
Entropy (8bit):	3.379894943545433
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWSWyHWcWYWoWCKWb82tWkWUW5W7WoWwMW0W1WtWxWxWxhofb:SQn
MD5:	8F2342D90B7556819FDB288CBE37D7AB
SHA1:	323CD5E41E27972764825D476D3ED22AE43142C8
SHA-256:	D6169A7729C2C14D7E2B0717C3B4E03B40871D468035DABD2E857BC447D89F09
SHA-512:	CAB6BD2621285177435DA693DED203069F3B644A5B88B5F25FF5BFAB50614736A4A4DC7A1130BF1568038772D58F0AAEFF23E37BF858D20DD7324437AE5B0D3A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemDiscount.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	3.369253287042973
Encrypted:	false
SSDEEP:	48:y+6DTnRUWYCORUW/RUW0RUWRRUWbpRUWGRUWsRUWhnRnFRUfb:uDT+WLWmWTWEWbsW5W7Wxhofb
MD5:	25CD8C4E6AF24CAA5FF6EE1B6F903C18
SHA1:	A639747DF534EA47858E4A8D4F36814DA597F533
SHA-256:	20109C74800E1A6DEDBB9D81A8F07D42A5FE12BD399870BD87C5979500188568
SHA-512:	BD4B0D2C92A3829B46021C3FF9D4CEC093D2F0436CF2C585F517C849F8541D5D7A83627A9C3D3328DE5E0AA7F6716C48F0DD5267EB91A95B9506E8810A1082A8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.i.s.c.o.u.n.t.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemFixedAsset.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8138
Entropy (8bit):	3.3590441395434176
Encrypted:	false
SSDEEP:	96:uDTmWOW5WUW5WyWWeWnWxWCLWDWQWPWRvWZaWbWX3KWeW6W6WgxMHxqW1lQQW3W/:92xMHxcbTw
MD5:	22858F010F6BBDEE70F95C304A46F36B
SHA1:	86F75CCF6C690E7FAB0C1CD08361C7D9D220E968
SHA-256:	CA8F453C6429247748AC2CB686A2798EEC84C62ED65E3F37B45F1D9BF7A778DF
SHA-512:	78C14BAA218D0BD2F9AB147E12A3D1661D7061BE18A5E4E825A2D22FD473D71275532561906EC161AE4F6EDE87DFD2F25853B17479707D1AC1AA2664C47CC2F7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.l.a.s.s.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.s.s.e.t.A.c.c.o.u.n.t.<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemGroup.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	3.362693101616319
Encrypted:	false
SSDEEP:	96:uDT2GOWpWeW4WdWDmWk/5WW3W8iW3iWxhofb:X/5xTw
MD5:	124F9AE4C966E010D53679722FFC508A
SHA1:	38C814162C4D3B7E2E6E21A48F52C1DB13B29368
SHA-256:	0D222B200446C0646679201A4CE6B458CEAC61E7365192530780254F98900FB8
SHA-512:	19068388DB1E412B5680AE2A976DEE3FFD54338FAA1A2F11EDA22540CE5A130EE96BA9BDB93624325DB8B010921357D032118519F5E036DEFB557CCE849AF1F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemInventoryAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8870
Entropy (8bit):	3.376494853568335
Encrypted:	false
SSDEEP:	96:uDTmWzW5QZW/W6WyHWcWCaWQWbsWtWUWNWwkW8WFN1IWGQFW+WDuWYW5WrBcuW1q:rQITw
MD5:	95FB5D545CD13670722D8386EA8E7BAA
SHA1:	CCBD082AB859220AB9DABACAD59E8BBF6E45478C
SHA-256:	927BC1A9BF87E7CC2D6126DDFFB7886F0234E218CEF10A431DE69DE0F3DE919B
SHA-512:	379A7C4FFE9AB0B8F65D1922740F7A145D0D14FEE56DEC612B2CD5AEE7D2856C0F2BF5D13CC3BE104D3831414729528FD1DF0125C1CE3EC2069E88D6141D1D7B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.u.r.c.h.a.s.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemNonInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemOtherCharge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	3.3808418806351264
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWyHWcWYWoWCKWbsWtWkWUW5W7WoWwMW0WxWxhofb:SQ4
MD5:	6E56495D5843EBF317452EDA48016548
SHA1:	551CD5D29B84C07CA8B5F78897EA6EC73BFC2FC8
SHA-256:	1835A35348765C761CD41B6B31A8C474EAA722CE3230065903C53C12162247C3
SHA-512:	7F51BECC13CBA14C6B6B2529D3BF538AF0DB90B3B967275F8E6D2D68B0EBFCEC1D08B12B3FB0915A9728EC528B0844C92E44D5D7E9AEA9B6FC3700E0C0492E66
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemPayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3194
Entropy (8bit):	3.363338038961555
Encrypted:	false
SSDEEP:	48:y+6DTnRUWXRUWYCORUWnFRUWscCRUWGRUWVsPUW8FPUW3FPUWhnRnFRUfb:uDT+WOWLWoWsclW5W3W8iW3iWxhofb
MD5:	A6DB6D2135E5EB9517615A4358820761
SHA1:	440BA9F51FA39CD6E402B74E17538AF699956586
SHA-256:	624D43B83672248F4B5137A6CB6671EFDCA38D5A3662D4FB4601CAB8F934355E
SHA-512:	D35FDC067F222BDC6A6E42F6E235373AFF0859199117B77DB7C681D6591DE57C333E1958934D18469F9BD84E767E72CDC95076B82E2C20BE7CF7C1D6870D24ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12122
Entropy (8bit):	3.3777404813750835
Encrypted:	false
SSDEEP:	96:uDTaWjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjW526TH:/kFwOlcJP2Z/Tw
MD5:	AD3343901A04AFAECDFF9116ED7E9E63
SHA1:	22BB309FD9019E36BD907048864A70EC4B3A4ED0
SHA-256:	F88A8A322970A8845900DE777CDA86632FEF892FC396EA7FBC46C9F7CDE7E649
SHA-512:	0AEA7E4D98940950E6C9E7118F1EBB13FADAEAAD3BCB89107A3D66E6748DBFAFF7C601D07CA397028A4716F47DBCA0630C187A572DCC0A99BA1A909A39FE665D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemSalesTax.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	3.3852199742396483
Encrypted:	false
SSDEEP:	48:y+6DTPRUWYCORUWXRUWZ02RUWhnRnFRUfb:uDTWWLWOWcWxhofb
MD5:	811428AC1C5C9D7F349A44FF0ADB98C1
SHA1:	E812DA7171B9BC5551FF11FEB994E15B6A0D5E91
SHA-256:	4FB868BD432D7966E1299570522A2BBE922633790C93606F1A5E7AEAD78FD4BF
SHA-512:	8AAF9052A27F596451C7F89A90C4C2A0E4CF002CB07091DFEE74AEF49AE7A50150EFCC9303FAFE8FE5734EAC37E491B0E7A566C31AC47B6264BFE8CCC3641786
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.a.x. .R.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.a.x. .R.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.V.e.n.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemSalesTaxGroup.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.401575726316516
Encrypted:	false
SSDEEP:	24:QlL+6DTTyEyDARUWXtdtQy2tMRUWMHoyiURUWkAnjyzAnFRUfb:y+6DTGZARUWXPCORUWMBRUWhnRnFRUfb
MD5:	48DC90036A616570B925520A1193A8DC
SHA1:	68387C07D8A2A19E6EF3AE7C90C8A13F811DC58B
SHA-256:	60314415E46AF3A6249F949619D1A4D65270FDDCC0626DA6206DDE168D91B1B2
SHA-512:	D1241237F9E427709FD644EF1AEE2E0D366E8646B17DC30A6FAB44A2FA61F66BE0024D293DDA7912B90EB04220936AC0C5F736C6AD702B49FF7387EFADF9A62A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.S.a.l.e.s.T.a.x.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemService.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ItemSites.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3912
Entropy (8bit):	3.3753876657679873
Encrypted:	false
SSDEEP:	96:uDTGWhmWXmWrWrDWW0W9WUW8iW3iWxhofS:vD7T9
MD5:	C1CE6ECDBAF9310623531CC12B58EDD2
SHA1:	900177D32024BB15598C1F87B39A6EFB118DB140
SHA-256:	88B57C327CFAC295C0C7CDBE31C814EB36BB1170A5DA1CC83A22D5262C1E0107
SHA-512:	D0B8F63D8FC6A1B876676E88783490F8DD88BEF7367FFC585CE48064073AA502ACE2D1C9FA4F36E835A23A0982AA9C5A9456629612CC44A3F302453BF943C2C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.A.s.s.e.m.b.l.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.D.i.s.p.l.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\JournalEntry.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5682
Entropy (8bit):	3.3641718817926574
Encrypted:	false
SSDEEP:	96:uDTgBgfg1WbWW1Bx7W4WAWzWWEWDWxWoW4WnWVW5Wn2WT2VXW8iW3iWxhofb:ZKWTw
MD5:	2BD5A49FAA022BC84D5235AEFF84ACA4
SHA1:	D99A02652572731F7AD54F9C5AAD6B427C5D751F
SHA-256:	DE32A8233EF7F37F50A5D87E8F583A4A44BE99CB017CEDCDE1B1D4C6F3CADA1A
SHA-512:	E7C9589DBDED56781ED3EFB27143B6B7F006752DA08F09F13808BF8C781E26F1E1C54F741E959AAA6CD4EB21FE637FDBC52687B87564568BB7B6E5EB4999141C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\OtherName.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	3.337946781523756
Encrypted:	false
SSDEEP:	96:uDTmW9W3WlW/qnWpTWgWUW9W52WxooWeOWcWaZrEWrWVbobvbbWQW1kSEWrW3W8E:JqRTw
MD5:	187288B192B130A10398FBC41051BA8B
SHA1:	7DEB39AD9AD23B32D2FE8658222D1343F9835227
SHA-256:	703DC4C12585B0C955E72F044F07CDE6243F6762C56E9C34BB555C6E700F8EF4
SHA-512:	1F31FEB3E4ED30C74EDF0D169ED8FA2A9D85AE0C27D5490A2DC926F864A99CD45CC0DAF10A02302DFCB25E7746195E4D935E38FCC950A645373706032712972E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Payment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	3.385598702293327
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWdcDvWoW/z8QWDWsclWdW0WbWuDWxhofb:DVQTcDCz8k
MD5:	3043D744FB3967BEFE237A672CFB2471
SHA1:	68BCB0189BA41DF8164EBF390C30265A8B6001A8
SHA-256:	CCAB1ADDC394CDBD187B236DEC59E8D4F3832A3C22FE3E24FD24DAF0F4EA0488
SHA-512:	3594AAE617198B350780295F41C5AB1D63EABF6D97EF130454D6DC5840458E81CE40192BA382EBCCA28A3A3DF70725692C14E1CD26D5CCA06E6E2E3FE88963E6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.h.e.c.k.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\PriceLevel.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4188
Entropy (8bit):	3.3716445400273334
Encrypted:	false
SSDEEP:	96:uDTnGXWn2WxyW4WRWiWikWTvsW3W8iW3iWxhofb:cG2bvXTw
MD5:	E614B301835CD2B26E6C71941FA38064
SHA1:	770636C8C0809AF429E4D91AB26D4771886922FC
SHA-256:	6F0A6C45B22CCAD3FB086FE2F20AA36C743C8A1DE84D441196D575655C2AC4B3
SHA-512:	D72A717563335F24C8AD3F5DFD359F352E8FC535293C3E89AF7220F43F1DEC40AAB04CBEA6F14565E778997EF6156C636BE8381DBA2FB87CDA447F1B28D29F62
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\PurchaseOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18326
Entropy (8bit):	3.362876895276993
Encrypted:	false
SSDEEP:	96:uDTyWjWxWoWhWDWWjBWNW6WsWgXVQXW/WRW0WjW526TMW3GWwW5W2WVmWwWMRoWK:7WVQl2OlNmZsHTw
MD5:	EE58050BDEAD0A0A40BF05786C1A3165
SHA1:	5961C959ED8E0E1C4CA65A84A27BDB96A8D7B8BD
SHA-256:	E4323B9241194F182515FF085AAFAB873F71EF9450E664B0FD23D4C42FD75A3D
SHA-512:	B02D9C0831AED76FD7C8BDDE2E26F4B3D89ED7997F5AE33D9729461FFB2610791CB3EA3A5EC4CBF860F32C10ECE3164EAB9EF8A94B14E2519DD4D749316AD959
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\ReceivePayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11204
Entropy (8bit):	3.387327919099585
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWoWdcDvW/z8QWxBKUW8WDWsclWDMuWBgvXWzWFW0L9WWWTW1WPio3:DVQhcD4z8bNqoQOrGoo3Tw
MD5:	A1696CBFE2413516C0624AA64CD46F90
SHA1:	AE6C8D6AE1E718106648D6AA80007EBF4A01AA24
SHA-256:	FA0AD6866FE892A9DF3027FE52EF7AACA27BC503794CD0E14DD09E8874876FBC
SHA-512:	1478A19296B2AEE18A179C9B1D9D3939BD38A164905F4B1F2DBB75450AEC7AD3930C080ACF3023C1552C2129852434C65DE6EFC599E97F1ACD8D4D564F733A8B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.m.e.n.t.M.e.t.h.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\SalesOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17966
Entropy (8bit):	3.3596296223763984
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWBWPWoWBWDWWjRWjWhWyObW0WjW526TMW3GWlWcWfWimWVWZRoW9GWZ:DVQ1Q2OVd/Q/akQSZsATw
MD5:	8DDAFEB175CD46E5266A3C7D6961A8FD
SHA1:	47D52E3E7BF2153F85D113F6B5AA1C657BEB5A73
SHA-256:	9A358650848A454410DEDFC96A5CD00C6FEC48014F84B8EB6BDD467182012A18
SHA-512:	3EE06E10AE3AB30058A16CC7964A3E516DA25B9767EF5866088F0201938AD0F1CD4C91BE26F2E4032AE2C695B66113FD5F4EE0FCB09B49AA15677367BC07B0ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\SalesReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23970
Entropy (8bit):	3.371707688246353
Encrypted:	false
SSDEEP:	96:uDTqW2VQX2hWoWoWBWDWWjRWjG8WhWfO0WjW526TMW3GWlWcWfWimWVWZRoW9GWx:DVQAe2OGd/Q/1kQ9qoQecDlZsuTw
MD5:	80CE7AA22B92382E8A92DC5497582AB1
SHA1:	9ED81F08DB5D171A4D2C8059ECB4B5796A7694B6
SHA-256:	0370942C2663D59356BAD9306A13BEB8B9E06A57070ED02754F41D0B8EAD0CF2
SHA-512:	096939544811108FCBA59E3D4BAE23CC8EA0F39B3DE17746BBA030AE550ADAFBD736B9AAD6E409C90FCCA76344043F1BC0B82FB9F53AA26FAAD0C3B8F6EA9686
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\SalesRep.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	3.3569081983689473
Encrypted:	false
SSDEEP:	48:y+6DTSS/RUWdGJGSRUWVsPUW8FPUW3FPU2hnRnFRUfS:uDTSSmWd0YW3W8iW3i2xhofS
MD5:	439F52DDFAEBE0B265BD919956ECEED5
SHA1:	8F994D34A6011651B014F0083FE4B1CCA6F1E3D4
SHA-256:	B47081FAE2FEE41F38FFF8DAF5F4DE58396132B445F113E9A488784E1F852D8A
SHA-512:	315D4FDA7304EF0A542C4F2C9939D1ACBB164D01C8987441FAA9013F8DF8252A7DE15819CCD1F89D15597566119736A6F2832AC60D16B7F7093E7E524515A5F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.p. .N.a.m.e. .<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.p. .N.a.m.e. .<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.n.i.t.i.a.l.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.p. .I.n.i.t.i.a.l.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.p. .I.n.i.t.i.a.l.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\TimeTracking.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3924
Entropy (8bit):	3.346158044789658
Encrypted:	false
SSDEEP:	96:uDTbWW2VVAWxW4WxW3WTWaW5W5W8iW3iWxhofb:zVV8Tw
MD5:	D6368DF55D96E8A243DE77C4DE5716FF
SHA1:	258C995AB1B1D637AC8A9738DC92710A12B463EF
SHA-256:	71B468801F6D0401C1D57F415E0E8CA05B5B25D535EEEF2DCE17D756F79CA76F
SHA-512:	E5B5899CE5F24559E25717675C822AC629255A3B88C13B49350F794150EEF26FA436C0F442C0C8AF301AAC90C3366446A955BA90CB6A94D8580E6B3FB59CFDC5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.a.b.l.e.S.t.a.t.u.s.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Transfer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	3.367053488969973
Encrypted:	false
SSDEEP:	48:y+6DTuRUWURUWZRUWVbqRUWSRUWGRUW8FPUW3FPUWhnRnFRUfb:uDTxWzW8WVbdWVW5W8iW3iWxhofb
MD5:	90DDFCD975DABF2BFC155FE574B62409
SHA1:	CC3B584BB4DAA913E22BE5961567E4AFD7274540
SHA-256:	5D3D38448434064F774E032558DEC06585DD61F826A1689AC73767C14D2E1512
SHA-512:	6909865128DFE719AD8106210AB55A1684E0FEA30636B1C93A067AA1300C538457B24B3F30C152C3B8B2FDA7F7C2FBF65E5F9300CD9D09EDC5EE2D7C1DB97D23
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\TransferInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4582
Entropy (8bit):	3.3680537578680694
Encrypted:	false
SSDEEP:	96:uDTaWhWQWmWtWdWGWKWZVW+W3XKWVW8iW3iWxhofb:8Tw
MD5:	E60071D0621D5A15FAD97C168E735A0A
SHA1:	26E62142851B7E8F2ACE2530F48A3997FF5D092D
SHA-256:	012A14B3230223FB17DA860E13E1CB932B2DB2D4B25C06DD463482BE4D49C9AF
SHA-512:	51296D9A2CADF0419C2C3C7C851AE23A4ABC0F74A365F3DE8D205C29A4A86C9975DFEAEE6E96EE903E14887BEBD0E2D79CCA245FFDDD6D8C418F35C587313EB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\TrialBalance.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2896
Entropy (8bit):	3.368697128468666
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRUGEyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWoGEyFWKWHWUWb1KxfS
MD5:	EFC5F768E3D06E52B694549ABCFD8B87
SHA1:	4622C4188EA88C0188FBB5EB16EC70A1C7359047
SHA-256:	9A4EF4F77EEA239DEC61155ACCD233D778A82A9DA99A07412160A0ED47FDEA70
SHA-512:	F1253652D4F19BBEAF86DD17150D5CAA6103EB75B13D7EBE5A0FEA5DD7DBC961312A86790062E08167965889FEADF715270F3CA216276F5E7AB31F8496DE4F9F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Vehicle.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2026
Entropy (8bit):	3.3590278843434818
Encrypted:	false
SSDEEP:	48:y+6DT/RUWyPCORUWVsPUW8FPUW3FPUGhnRnFRUfS:uDTmWpW3W8iW3iGxhofS
MD5:	69DA4404C8BD10DD3054119F5166C3EB
SHA1:	697AAD467353B3114F0C2B45CC869A3D914480C3
SHA-256:	DBE9632DBFE9E07BD0E63E3AD7C7938F18923CB186A4A3BDD8CB6BB7C37F2D06
SHA-512:	010F33D334C406939BDE99F5C447C705F5D24CFD2721D1CDE00550151494DFA6221C150F2377155EE8F2C9C891DA4845EC517ECA92BB240E154B451C27EC3FC0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\VehicleMileage.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4850
Entropy (8bit):	3.353849500727898
Encrypted:	false
SSDEEP:	96:uDTvWJgHHWwYjWBE7zWPWY4F4KW2VNoWIW4W5WaWyWoW8iW3iWxhofb:iYZVNHTw
MD5:	ADBB383E2E3B4626700B09388095DEF4
SHA1:	9FCA832E044CF69F39C15041D8D40D3731911A6F
SHA-256:	248DBA3F7B8AA576F43CBC8A6A709A034701BCDC121641043F9C517AA1FCFC23
SHA-512:	24E551E17871925A02AEC60DE918A8D860D4E7C9E5F7A61CDC9BAAA93962F5E6CDB14748043E216E267C17023070EADF830A5354B8D55562FFA1AE18D186BE7A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.h.i.c.l.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.S.t.a.r.t.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.E.n.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\Vendor.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14326
Entropy (8bit):	3.3493576325255554
Encrypted:	false
SSDEEP:	96:uDTGW3WlW/qnWpTWgW7IPaW9WwW5W2WVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDy4:8qjIPHgT2XrDTw
MD5:	6503E48C78ADFDFBEAECFCE42896D342
SHA1:	B2C96DE6B4BE2BA845A03D2E7712D0D7A6259491
SHA-256:	14ED4835BE5430D2D5F5B806577214CE9FE677F680BC2223E8EAB413BCA81884
SHA-512:	9ECE35593585AF549A1CBBDA408379AF8E8335391179F74F90D459C0C4B910D72372B26E53C6990B94B46D2C7CAB258D4F5BABEE0C5C2D8D72B86F7A3CA3B7F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\529C6E6F\VendorCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11802
Entropy (8bit):	3.375867252592748
Encrypted:	false
SSDEEP:	96:uDTQL9WjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjW52a:vkFwOlcJP2ZzTw
MD5:	24397BEEB0A9FA8655FA8B6F69328185
SHA1:	A50F8AE8F03C721B6F6AF13D3DD9806C3ACF7E26
SHA-256:	282683445B62ABD7A42AE3E475DC6498D581BB41E8EFFC58B166E956152F8EFD
SHA-512:	57F23150002340BBDBAEF4151633AFD5BD9FBBE5403E59ED100EC1209BE7B4C2BEE2EA39A06C088A00265A681875319D8FEF4538CAD2A6BCF7BC889EC621B467
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Account.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5792
Entropy (8bit):	3.3622697024380717
Encrypted:	false
SSDEEP:	96:uDTmW3WTW8iW3iW829WgWpW9WZWfWoWnWPWn+WFRxyxmWxhoW6fS:DTwREr
MD5:	1094EA931F3228AE0450C44CADE8C415
SHA1:	E3DB82BC7982BE8E9F4F788AEE12D250278B294E
SHA-256:	CF59567B8378D0CCAFF19AEC467C8EF9600A47311F8FEE341809FD4124C23B0C
SHA-512:	C579D3ADADB846DD474A8392B665317151BA89D36420E705AE69D35072D730DEE7402B77A383DF311BBDE838DB6DA50FA72C1A33DE9220E96EFFCB6382DFA50B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\BankStatement.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4482
Entropy (8bit):	3.3663632280569527
Encrypted:	false
SSDEEP:	96:uDTxWpWXW+W0Wdch1WiWYWEW4HWn2WT2VXWJWQWxhoW6fb:9chtW
MD5:	CC4DBDEA078F6484B0CF91D3D6FFA2DD
SHA1:	965011FD19CB3E7AD46AF88818594829957547A9
SHA-256:	53F767AB2BE37986F58FAAF03FEEF7135EB64E1732F75DEA3D48C32C51B15FBC
SHA-512:	8338341AB8D32410FECDB49018D3E3FAD892CD46CD19887FEE390E6610788E3650D7F71551AE2DA4AD71C1D7DD4406B8395972825CA6618AC486B495EEA6D017
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Bill.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16276
Entropy (8bit):	3.3740950819729782
Encrypted:	false
SSDEEP:	96:uDTyWTW8iW3iWn+WDEWnWxWPWgWgWZWGW/WsWV2WCWWYWy7oWnWVW3+f7fT2T2VY:uTC+zl0NgoL250KO
MD5:	998C8DD49546210651C9BB0677FC45FA
SHA1:	24BB4F17404DDE4F3801CDE955D8DE2A7F48FC70
SHA-256:	2F063207A76A744A5427204D32177C3F933B804FA3C63EB9A5CA68A808C952CC
SHA-512:	0F0DA15DC59634CDF7A5105BBB6FB6BF333B6345DDAEA1169B80C635C2D63FFA62B7DE2671748EFEA606ADFED8FD0A64D7528BD8C21CCD3F6AB8892A475D30F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.u.p.p.l.i.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.u.p.p.l.i.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\BillPayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6838
Entropy (8bit):	3.3752646064246767
Encrypted:	false
SSDEEP:	96:uDTaWvW8iW3iWBWn+WeoFWDEWnWoWOG3WDW/W0WbWuDWVWT2VXWhWxhoW6fb:qTf
MD5:	061D00C38600B344CE47882A204D5B86
SHA1:	65374C7318D49CB977B82686138A86B9CEA4857D
SHA-256:	293F97DEE01AE4C799A78829D90A283224064EAB897BCEEE32DED98CF9C01443
SHA-512:	7A90A20C04C467753EE75FFD1C3AA1229BA11806528506F891B43D3854F4DACB6258E77249E317E370DBF5E6B30623EAFB0CA01973D9BA04AE98030E1B037893
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\BuildAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Check.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15204
Entropy (8bit):	3.382036012256892
Encrypted:	false
SSDEEP:	96:uDTozvWXWn+WDEW8iW3iWBWhWkWdWKW/WSWFW52WeWWsWO7oWEWVW3+f7fTGT2VT:xzCTp+zV0NgTL250KA
MD5:	2794A04A222647601A2ED808F2390F20
SHA1:	71827D660BDE3287D6BDC3363E4363AFD09DD54E
SHA-256:	609FAF2FF97316A3A15129093909C5655A6BF76B57042001C6168BF094AE322D
SHA-512:	78E4A0A793F548B558D1230449734B8EFDA85B2A5A1FE4B3EEFF7C7FCF877E5EA8EF40D341C0466753E94FA554FAD79DFFABA8BB3F59D32761A0EF3DB250E955
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.2.>.R.e.f. .N.o. .(.E.x.p.e.n.s.e. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.2.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Class.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	3.370965852197276
Encrypted:	false
SSDEEP:	48:y+6DT/RUW0RUWVsPUW8FPUW3FPUWhnRnFRUW4+RUfb:uDTmWTW3W8iW3iWxhoW6fb
MD5:	1D6F76A597104B9BDB89549161182C43
SHA1:	5B1BF53CE5FF8DA0CA0B615595F211BAC2431091
SHA-256:	E6571C5EC4F6439EC922CE7C2506AB0D9EEECADE5E97B03D338E132B89ED166E
SHA-512:	7C17B3C7BA6C2A41AFE1262056D9C3EF09967BE22FB0128077416507369ADAAEF5FCB81E803F04F006F705D14D2E7DC9061FCF6B8FDB940C53B29B90A05CFA45
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\CreditCardCharge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14050
Entropy (8bit):	3.3856332790702326
Encrypted:	false
SSDEEP:	96:uDTKWXWn+WDEW8iW3iWBWiW3WMWVsWCwEwWaWrCKWpWVW3+f7fTGT2VXW0WUW4Hr:MTREu+zV0NgTL250KQ
MD5:	1C678D96111618D0C26501AE6D40206D
SHA1:	0F4A1AABE9CF3F55DE7878A1A75DB29A6674AEE8
SHA-256:	4683D60AD577FB5FEC59C2BD9E149F0D626ADEB1F90965F1C0116F953CCEEE9D
SHA-512:	42972E25CE111A7B45540A4B4AA94969A737F877A583C916CC792B34DBEED76D6FB51CAE550C5AC9922CA641FC7A3D5ED25D422137DB751A2BB3FDF6C3BE3F3D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.2.>.R.e.f. .N.o. .(.E.x.p.e.n.s.e. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.2.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\CreditCardCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11434
Entropy (8bit):	3.387192525085206
Encrypted:	false
SSDEEP:	96:uDTYUxUPWXWn+WDEW8iW3iWBWHWVW3+f7fu2T2VXWEWsW4PWjFwXW/WyWYW1WoWK:sTo+zG8FwjL250KQ
MD5:	DF2CAA93CA26EA57ADF640B69A69989A
SHA1:	E91A6F8C10229F8A189905802A42C542F11594E9
SHA-256:	E64FB558FFE528CA8C59B56CD5EAC705D849F534C5612A81170969D6EC2A8BD3
SHA-512:	86B47821138F62EAA739B9B54042B9A4D50F61249E60B0B41154877A0120871E8D82DFD71F37C42839418FD8D9B27561570614A9756A6DAB5DA646D053C17A89
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o. .(.C.r.e.d.i.t. .C.a.r.d. .C.r.e.d.i.t. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o. .(.C.r.e.d.i.t. .C.a.r.d. .C.r.e.d.i.t. .N.o.).<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\CreditMemo.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23680
Entropy (8bit):	3.3731705563248626
Encrypted:	false
SSDEEP:	96:uDT6W2VQXW8iW3iWHXRWPWgWoWBWLWIWZWQP5WhawWGFzWLEP5W4XhWVDyDoW8Ef:zVQ5TF+z4s26XqoQAZsu
MD5:	0543F2A7EBF3FF8854782C477637AAD8
SHA1:	55142487E5BA3FD583236B9D4A6D738DD3A3F5F8
SHA-256:	EABA8237AD2EB63F353B92E713E41E36197DE7135873E836F12018B89E034512
SHA-512:	7051627E6BD57FBECF31B27A012801EA18F8208E193E3E3ABE33F03C2F13274E4FCCFC97F73B65483152A6F6918B2CB9720D2B0BE5F0F3B098C20B6C912B21FB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.d.j.u.s.t.m.e.n.t. .N.o.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.d.j.u.s.t.m.e.n.t. .N.o.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Customer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18960
Entropy (8bit):	3.3557377518968856
Encrypted:	false
SSDEEP:	96:uDTmW3WwsXW8iW3iW5W3WlW/qnWpTWgW9W9WRW2tgnWgWfWMrWrWQWrWfWVbobvz:Os5TIqvtgWqgXmT2SfbDo8p
MD5:	982BF0B90F3B69D38474EEBE8D40A06A
SHA1:	D2BDD9E5E427783B90EB86886D6C96AA99B8385D
SHA-256:	542DF251AD28C3DCF1B21C77549D4B4290BC61474F51FC56A58D8CBD3139D03E
SHA-512:	144A6C3E32014E0B71B14A92224C6932D49A0F1D36EA5747E3B8FADE9BC6004656598F8715D6B779FE44F9DBE93BE0D1CAE0FC6B10CE170B0463DF77F7B13DE1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Deposit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6824
Entropy (8bit):	3.3691860583535695
Encrypted:	false
SSDEEP:	96:uDTXNUW8iW3iWxWsclWyW8WOWn+W82FWdmWVWT2VXWYW7WbWLW+AroW+nALW+xC/:bTUw
MD5:	176DC126A1928E489CB6EB5687674384
SHA1:	E56F482269ABEF9A07FA01F004DA5C5D2E355DB1
SHA-256:	76DD99D53105F3F75D8B753E89747814A41EAD1D8E356D54EC1E2D247286FFB1
SHA-512:	47559F1CE35DF13D357319731B3B519BF939106943C74887F24FBF291DA5A80D005D8663BB0239AF75D7551BBC05448E81871E1CF782AD375113696E50812416
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Employee.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13590
Entropy (8bit):	3.3412945079031697
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgW3W8iW3iWMrWfWDWpWrW9W4AaWJW2WsWOEtWZZW5mWSWPWD2c:jqxTggAprHLubT2n
MD5:	0FFF92529C11FC47C77700A6871F984F
SHA1:	5D1266326C606FC5B6B8223F714578EAC994B97F
SHA-256:	91FC15123341F7FB53FD9E6EE8409D7E0C12AA596052E8701381C4E2D505232B
SHA-512:	9652CB73D1EFDC1A5D468CF2E5623D7178A13ECEF2693A1797D8E089978B99F8C0A7EA4467EEF7D4E6525EE504F0684FA602B17474E7E684E2505FE672C3BC18
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Estimate.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19344
Entropy (8bit):	3.370716304274053
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQXW8iW3iWD+iWfWgWoWBWLWxWQP5WhawWGFzWLEP5W4u8WVDyDoW8EF:/LXVQ5TP+/+z4Iz2yZs5
MD5:	BDFF06279B961E1380A598E8F67DE77F
SHA1:	BCF15C78857A61DE2F00565B4DDEB716F79CDF94
SHA-256:	DCED382B253463E1500DC15769880DB2BCCB258AD0E83E4A971B86980A625B07
SHA-512:	8D608EE0E1B34200658C2E46F730EA69A87A0E406B4B603F7BDA6261AD5AEE94E83FEBAA385788B1C5AEBB6046D3D9112347B34EDC31808E06E566E9003247CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\InventorySite.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.3344046683217523
Encrypted:	false
SSDEEP:	96:uDTmW3W8iW3iW2WpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrL4:uTcZwvGcUDTjQpm/0
MD5:	38F7BF511F9302B7E16811738EFA7C5F
SHA1:	3AD17C3DC404A00F89BCA63836E45D388CF0782D
SHA-256:	32ACD47EA14F8297F9B986184A67984F691DF3D2DC5CA5F3DAC7276800069566
SHA-512:	D42366B22A107A816667BDDA7381DFA742B465DFF5A4F9295FDBC7CD1529857957F18B150F8812657E024812AD723A0CDB4736F94DE3BAECAE9F330FE6A78359
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Invoice.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10866
Entropy (8bit):	4.734476536802812
Encrypted:	false
SSDEEP:	192:3bVN8S8jXOWXTZ4I3KDFO9EfuPopKYSNFbHNGXJtgb7N/NTf+Johknq8D8u9Cq8z:3bVqZjXOWXTZ4igFO9EfuPopKYSNFbHt
MD5:	33B1ACBF43AD3B24EEDE54BEDE18D502
SHA1:	4104229CBE7EC9E98734D76F169F6D51D457F093
SHA-256:	D8E9C6AA6E3BC105EC8D4D2D873AEB825BE8C6C0725582B991B54C0BAFFCE5A4
SHA-512:	8CD613F913931A5377F9C0F8DCA3AE05842C000CD699DB5C595C59DC852A5E127B48C653D7E2D056358F92B15DA0B8E17369861F70E35C45500E825D3C9DFE72
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>SalesRep</Key>.. <FileHeader>Sales Rep</FileHeader>.. <Display>Sales Rep</Display>.. </MappingLine>.. <MappingLine>.. <Key>CreatedDate</Key>.. <FileHeader>Created Date</FileHeader>.. <Display>Created Date</Display>.. <HideImport>true</HideImport>.. </MappingLine>.. <MappingLine>.. <Key>ModifiedDate</Key>.. <FileHeader>Modified Date</FileHeader>.. <Display>Modified Date</Display>.. <HideImport>true</HideImport>.. </MappingLine>.. <MappingLine>.. <Key>Currency</Key>.. <FileHeader>Currency Code</FileHeader>.. <Display>Currency Code</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>DueD

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Item.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6888
Entropy (8bit):	3.3830657329856835
Encrypted:	false
SSDEEP:	96:uDTmWwWTW5QZW6W/WSWyHWMWYWIWCKWb8WtWkWEW5W7WoWwMWT7sWxhoW6fb:5Qz
MD5:	F68AC62FD505C258DC552A91754FA53F
SHA1:	3F41D5EA849CB48E998D2191990061FCE0BEC8FA
SHA-256:	B741CA57E6865D1D86B3C81FC0E31A1FA66EE3643A6D0765C1867D51280C5980
SHA-512:	ACE40115B026C9512BA8B5AB114CA23DDE0DBECA29DB011CA94B8A7BF86BC33658FE2B8ED8CFB8CE711C1D77C8FA79BFB9A3B60AC8650E557B80B506E7930B4D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .P.r.o.d.u.c.t./.S.e.r.v.i.c.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .P.r.o.d.u.c.t./.S.e.r.v.i.c.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\ItemReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16214
Entropy (8bit):	3.3738899226403234
Encrypted:	false
SSDEEP:	96:uDTyWTW8iW3iWn+WDEWnWxWPWgWgWZWGW/WsWV2WCWWYWy7oWnWVW3+f7fTGT2VY:uTC+z9kFw4L250KO
MD5:	34D5C389606A683765F2A837DD548449
SHA1:	C346DF69FD8E03A79088715CD16EE4C443552DAF
SHA-256:	A33D395F928E718818E20F9B4141E5AF1BE81D956853506DA9E20D3089F40071
SHA-512:	1172206011B8E43803A035B0D1D7F55F02DB4C01116AABCF598BAB9746BB415B1ED563E6ED66E2FCAA91B4E83E44160BFD382B75D40CE53556BCC9C8A7927D16
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.u.p.p.l.i.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.u.p.p.l.i.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\JournalEntry.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6074
Entropy (8bit):	3.3715186577194176
Encrypted:	false
SSDEEP:	96:uDTgBKUO8iW3iW1Bx7W4WAWzWWn+WT2VXWEW/GWxWoWVWbWW4WnW5WxhoW6fb:ZtTpL
MD5:	4410F2DD5BD3A7711522568DC24E0CA1
SHA1:	3FD5828AA87D39F072EE394154328C0B0EC8D7BB
SHA-256:	8C17BB26A9D99BFF4CF1C0838F817C9FDD273CDD64443DF28F19306DA74A5BDE
SHA-512:	6E3D4C39815425DA710C6EE43B0A90EA342267BDB1DA054F7A51880D5D7228C131871993FB74247AA79DBC5EDF38D3AAD6C11BC339CCB20E5247A421BF97E20E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\PurchaseOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17098
Entropy (8bit):	3.3742686642140094
Encrypted:	false
SSDEEP:	96:uDTSW8iW3iWjWn+WDEWshJWxWgWPWQP5WhawWGFzWLEP5W4u8WVDyDoW8EmUWaW4:DTS+znN2Gm0KYZs7
MD5:	4513FFEEAB8E358BC0A663DFB893DEC1
SHA1:	B8B049EB5F66E2568572522DD57D0B43061116BD
SHA-256:	35D0224931E7C353B7740FDF82F40D8CA52679F1F9E0C8EEE8404CBEFC797536
SHA-512:	2133A893F1C21EF76FE4A909FD31CBBEEED19A205B7D943355F1E6CD46E54A8AC5826376DFDCEC4D62FBD5CB67FC99473AA26FDF835107C73C726CC8D19936DB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.O. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.O. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\ReceivePayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11520
Entropy (8bit):	3.389144927052971
Encrypted:	false
SSDEEP:	96:uDTaW2VQXW8iW3iWneWeoF2BWoWdcDvW/z8QWxBKUW8WDWVWT2VXWTWsZgWDMuWX:TVQ5TFcD4z8b1qoQOrGooq
MD5:	9102C940AB537289E2E55E087BF0EFE4
SHA1:	AD22720A3DD829C47728592CAB21A65D75BC1B1D
SHA-256:	AD628C5DC8EC44CC269CDEED1AFFA08D556F8598DFB1DF2B76A1AAF177E83DFA
SHA-512:	3AC7DE0669A6527A256E1F424815F81855A9141EB0D41145B65817886E4AB8F2751044D790380EF1FD8B1CD1F8417CA907E66D867DB475545213DC23C569435C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\SalesReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23956
Entropy (8bit):	3.3733144637301145
Encrypted:	false
SSDEEP:	96:uDTqW2VQXW8iW3iWhWPWoWdcDvWIWsPiWHYiWQP5WhawWGFzWLEP5W4u8WVDyDo2:DVQ5T1cDd+z4Hz2qqoQIZs5
MD5:	BF248225D709E333B5BB029A84A88D5E
SHA1:	5EBAD513447B2571A0ED350D264AB901B57E4464
SHA-256:	B483687AD25B3AAA505C107D0AE762CAC5A279F7ABFEC10E4D8C410880FD9586
SHA-512:	53945BECE5A6E196B8EFB3790B281F1599349A629DE7111378A140D35091F9B462E03EC6C45585AD6AA46366AE58202C7679BACCC5941798AE68D0BEAF961867
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\TimeTracking.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5228
Entropy (8bit):	3.3312632604164807
Encrypted:	false
SSDEEP:	96:uDT8iW3iWxWbWW2VQXW4W5WxWCWIWcKhMWtW5W3WTWyWxhoW6fb:nT3VQn
MD5:	BC8061D537EB095089CBB963B1657C58
SHA1:	8C679F5E3F2361F0ED9D4ADF842F185EC8BA0537
SHA-256:	8D8BB80D55A74BAA93E943752160BAC0BCD9AEFE9C8C37597E08E2A22FD5576A
SHA-512:	5F443817ECB560DE37B403E875348F934D7A23B590BAFC41A865719DC6A43A3243F210B06D5AF4A9E2CD08E703EF6112423146EF74A01EEAF4BF52EFF4065F6F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Transfer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	3.3644021823593775
Encrypted:	false
SSDEEP:	48:y+6DT8FPUW3FPUWuRUWsRUWhRUWVbqRUWGRUWSRUWhnRnFRUW4+RUfb:uDT8iW3iWxW7W0WVbdW5WVWxhoW6fb
MD5:	80EBC42FB64CE0CB75E2A5E45EAAC4D5
SHA1:	8CEE564F15EEC95E094E73B3EB6122E4945307F0
SHA-256:	B24CD5F18D133265BB08BE5A9912D319013F8B50848DEB82866A55B476E0238F
SHA-512:	F2C370EB01EC00D651DDB40E2394CD959F5D3B97396A7970A1450C63B9EFA6D6C8C3A3E489FF72BF530642FE0A145C6ECF2CEB9D695B5FADE6DB811D05539C1E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\TrialBalance.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2896
Entropy (8bit):	3.368697128468666
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRUGEyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWoGEyFWKWHWUWb1KxfS
MD5:	EFC5F768E3D06E52B694549ABCFD8B87
SHA1:	4622C4188EA88C0188FBB5EB16EC70A1C7359047
SHA-256:	9A4EF4F77EEA239DEC61155ACCD233D778A82A9DA99A07412160A0ED47FDEA70
SHA-512:	F1253652D4F19BBEAF86DD17150D5CAA6103EB75B13D7EBE5A0FEA5DD7DBC961312A86790062E08167965889FEADF715270F3CA216276F5E7AB31F8496DE4F9F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\Vendor.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14516
Entropy (8bit):	3.3512642591933046
Encrypted:	false
SSDEEP:	96:uDTmW3W8iW3iW523WlW/qnWpTWgWNW9WfWMrWrWQWrWfWVbobvbbWaWaTcPciWwK:eTIqDgT2gPAkrh
MD5:	563C2000DE9C73F326A70831999C3F47
SHA1:	B8ED53B84A2BE9AAFADE94C51AD7E6B871FA4AB8
SHA-256:	AB54F2F1796D55E6906C50F7382E23CE8E233778974E4E43EE72A9EC4E14CD1A
SHA-512:	A54BBA81F2FA7403BB0412F253984155BC98FF94560C1D20D3FC892227833F26ED88A8FDEA4B1F82B66F8933361F0132D7FF3D4427FF71A0C70BCE8FAED6B2C8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\57D15647\VendorCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11802
Entropy (8bit):	3.3635322583092297
Encrypted:	false
SSDEEP:	96:uDTUVPWjWn+WDEW8iW3iWBWPWVW3+f7fT2T2VXWEWsW4PWjFwXW/WyWYW1WYWshb:ATg+zN8FwT725eLZ
MD5:	503AA2B56942DB1A0BF393BCB99CD042
SHA1:	7CBBE1224933D74452D43F96BA0DDDF95CD797FA
SHA-256:	70EF94A538BAC4E49F3600740E842802A421B505B9FB80EB09508356FCE9F558
SHA-512:	341741709EEB93E8ED8DECE4C3CED1391EDFA8E63A19AAA5A515F3E199DF98561A04F90996CB2AD0ABF20C8DE4FEBA9B7AF62FB8EBA97C94B2680840760C9FB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o. .(.V.e.n.d.o.r. .C.r.e.d.i.t. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o. .(.V.e.n.d.o.r. .C.r.e.d.i.t. .N.o.).<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Account.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5948
Entropy (8bit):	3.3665643291273986
Encrypted:	false
SSDEEP:	96:uDTmW3WTW8iW3iW829WTWgWpWTW3WfWoWnWn+WFRxyxmWxhoW6eS:DTsREq
MD5:	C8E5FA74F502C698DDB2D799312E9308
SHA1:	8B30703D6E893916799913FADF102BB12B13EE0D
SHA-256:	CBEAC68EED7DFF6E68ABC30259C3EFFE249D1B8115E3059ED35E5D22E47BF7D3
SHA-512:	EF77BBBDA8E0E6B1204B2844FEEE8DFEBF0A25F4887B9F5761DB790529DD0974AD9C13EB7C93B32E8E1A9FB11EB8C5F3CBDE5FF424FEF0225B26B60073999CB9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Bill.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15340
Entropy (8bit):	3.3709446462459436
Encrypted:	false
SSDEEP:	96:uDTyWjW8iW3iWn+WDEWnWxWPWgWgWZWGW/WsWV2WCWWwWy7oWnWVWT2VXW0WUW4x:+TL0NgCL250Kh
MD5:	B43C2A30FE330A6B0BA2EAF378F1A673
SHA1:	4F9D8D2AC44F642355B18F65998811B43E5F77ED
SHA-256:	1072BBBCC74FDC6742BE0CF5859A12729DF6556A98C23407CA885C4CE80D09EF
SHA-512:	13ACC17AD11D1015E2B4E1591FEA11162A92DFE6C0E5CCBB1DFD37610348B2FB7AC3ACA43E72FF7A1B2115856962612FEE2793E188F316237E549B660AB3A3EF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\BillPayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6566
Entropy (8bit):	3.3744363698719724
Encrypted:	false
SSDEEP:	96:uDTaWvW8iW3iWBWn+WeoFWDEWoWO23WDW/W0WbWuDWVWT2VXWhWxhoW6fb:qTu
MD5:	A0F0F9CCCD207884B19626FA44E82A86
SHA1:	C89FD3D2FF571EB5F51AC4C3F3AB94689A686BFB
SHA-256:	9E590599CE0AC7C0D7B07AE37C6830FC81893A696E67D8808A33D0F786ACDDD6
SHA-512:	75F64F1E4D00E2B9B37F8D3EDE7CC7FFFF86538D2D0A84E97D1E01986BA2F416C27A6C0AAAF98E8A794DFD20D2257C2C730759F17D01CDFA9C50758AC1AF5BFA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\BuildAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Check.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13144
Entropy (8bit):	3.3748979246593174
Encrypted:	false
SSDEEP:	96:uDTozvWXWn+WDEW8iW3iWBWhWkWdWKW52WeWWEWO7oWEWVWT2VXW0WUW4HWjNgX8:xzCTW0NgpL250Kr
MD5:	F70F96040CB042120BEE06217A3DB222
SHA1:	316FA86C9EFCD6F00752D9B2DFA96E54586E0803
SHA-256:	E47F5A6253F8F52072509FF3D340564F5E08FB25ABB01822856F246703700AB9
SHA-512:	59B1AF8FC562F38067DACC49513A7367983B63FE4B3A0940617042B88576791B74A3CA86F9A6007C1D0E4739CC48AE3153928FC447B149E17223E6451723CD74
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.2.>.R.e.f. .N.o. .(.E.x.p.e.n.s.e. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.2.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Class.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	3.370965852197276
Encrypted:	false
SSDEEP:	48:y+6DT/RUW0RUWVsPUW8FPUW3FPUWhnRnFRUW4+RUfb:uDTmWTW3W8iW3iWxhoW6fb
MD5:	1D6F76A597104B9BDB89549161182C43
SHA1:	5B1BF53CE5FF8DA0CA0B615595F211BAC2431091
SHA-256:	E6571C5EC4F6439EC922CE7C2506AB0D9EEECADE5E97B03D338E132B89ED166E
SHA-512:	7C17B3C7BA6C2A41AFE1262056D9C3EF09967BE22FB0128077416507369ADAAEF5FCB81E803F04F006F705D14D2E7DC9061FCF6B8FDB940C53B29B90A05CFA45
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\CreditCardCharge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13370
Entropy (8bit):	3.381974245874192
Encrypted:	false
SSDEEP:	96:uDTKWX2n+WDEW8iW3iWBWXWiW3WMWVsWCwEwWaWrCKWpWVWT2VXW0WUW4HWjNgX8:cTOEf0NgpL250Kr
MD5:	59F76EB7257986570FBCB2FA4DDCEF1C
SHA1:	5B70B19BD6780E4DB72EBDF46FE29C5210D74DCC
SHA-256:	DB25161AB1BB8FF2A2AAD5CE6E787DE62E2C9F87A0B80DB12C4C8E17AE2F81B0
SHA-512:	4D740A1D35999F6B88BE56F80B885FECF84B5E9484672ECADE057F75714D2012890817C4AE5785F0DF32C5191F92D6C7F8B31A84A59D15BCB37AAA7B7B2B0CD0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.2.>.R.e.f. .N.o. .(.E.x.p.e.n.s.e. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.2.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\CreditCardCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10444
Entropy (8bit):	3.3839866501304536
Encrypted:	false
SSDEEP:	96:uDTYUxUPWXWn+WDEW8iW3iWBWHWVWT2VXWEWsW4PWjFwXW/WyW1WoWshJWjWDWWq:sTB8FwhL250Kr
MD5:	CD725CF1F4292B93C88432DD5E09B573
SHA1:	152D42A38A301C228643928AB1AE452D6C37C957
SHA-256:	FF70215080EE9983DD4292966A20222325E84ED3C1EB1B5BFEA1A0F1FF73DACC
SHA-512:	C523C4FCB4865580A7B1D6B183D42DE4259949B86C7D4C04D34FC403FF4500B4F30AD3E25B86951C3FEAC32E1F14A321FA30D5753BE61CD9833E0DBD7DECBF57
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o. .(.C.r.e.d.i.t. .C.a.r.d. .C.r.e.d.i.t. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o. .(.C.r.e.d.i.t. .C.a.r.d. .C.r.e.d.i.t. .N.o.).<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\CreditMemo.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23742
Entropy (8bit):	3.3710665625685428
Encrypted:	false
SSDEEP:	96:uDTQQqW2VQXW8iW3iWHXRWPWgWLWoWBWIWZWQP5WhawWGFzWLEP5W4XhWVDyDoWo:jVQ5TTs26XqoQVZsO
MD5:	0C2323EA24ED6D3BDB39AF9057CE9363
SHA1:	9B6045712E8BA6AB99AC8FBF5848AC6CBB728311
SHA-256:	1BB092A97596DA55C0636BF41792129F0624B61CDF773CE0BB511BFB5E3ED425
SHA-512:	CBA8D5F3B942D824DAC20AB057CEE9730063F6675448B635B84AC56CB23C6ABC54E6B18F49D3214310919D236139D75FCC8D38F141F2439A847A456BC380F059
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Customer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19118
Entropy (8bit):	3.3505397352027924
Encrypted:	false
SSDEEP:	96:uDTmW3WwsXW8iW3iW5W3WlW/qnWpTWgW9WwsXWdWRW2tgnWgWfWMrWrWQWrWfWVU:Os5TIqts9tgWKgXmT2SfbDo8p
MD5:	BBFEF6AD9B59F99B7491DA44DE601646
SHA1:	A28352DC4A1B11C41A71DD44B9B65AB13F4953E0
SHA-256:	3053428D0BA298B21F6CB3110971FA1EA26769552127C4D629C545896828263A
SHA-512:	C24C76D0202E35BEABFDDD6DE5BEFEAF39A08825145E908FA2871F4604C517619DC4D75BCC23041CB2B9BA941ED159532203B4F263125A85F236E1AA3A257743
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Deposit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6808
Entropy (8bit):	3.370844466431515
Encrypted:	false
SSDEEP:	96:uDTXNUW8iW3iWxWsclWyW8WOWn+W82FWdmWVWT2VXWYWO8FWbWLW+AroW+HArW+I:bTUw
MD5:	222101515CCF8969C6E42DEC34F51204
SHA1:	9F0D733FDE3ACBD84399D1A03299715C23078CB4
SHA-256:	9C05DF4C60AF916834EAEEAC32F607B00C043C710C2E3CB3D131E53BF90774B0
SHA-512:	9F87DF7751A1616116D1D7B861146D05E4951F9EFB8851A4AAA1B3FE0F3E57525E7B1E790A63841193836189CA3A6E0E79EDB021E35D48E2AFDCCE9EF8FB9268
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Employee.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13800
Entropy (8bit):	3.337124079779447
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgW3W8iW3iWMrWfWDWpWrW9W4AaWJWUW2WsWOEtWZZW5mWSWPWl:jqxTggAX7HLubT2n
MD5:	BC65925321AD453B19E0DA0EDDF5537E
SHA1:	9C04FE56239821C7E3EB2A32BAC73F5678657629
SHA-256:	AABB13247DF4B4462A32FAD4CC80CF0DB9832A9BF18133FC332B9D10C6B83B74
SHA-512:	2A21EECC7454F2E0B2B7FFF7078F7A8BC88A076D028DE99430B18B7D25E91D59B65BA6DFCD74014705075989924550B115499C8E05E2A0FF2207036417546D71
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Estimate.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19474
Entropy (8bit):	3.365735542234896
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQXW8iW3iWD+iWfWgOgWBWLWjW6WQP5WhawWGFzWLEP5W4XhWVDyDoW6:/LXVQ5TP+6WFuz2fZsT
MD5:	407425E490A422D83EF8CE54B5477D5D
SHA1:	33FE94CC6F0EF2D53F58842248B34134A6DC7D7C
SHA-256:	20DCE888ACBF1BF01478E1BF28A58A145E3EE2DB0927334E91ADD140AA496AA8
SHA-512:	87171585F2A81205D994B358D6708ACEA089FD58DAE842A5B8793B0A6FC14C9FEF0497325008F3B1EBE4263F9AAE8539300CA0405A991DC2A374C86A01737ED9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\InventorySite.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.3344046683217523
Encrypted:	false
SSDEEP:	96:uDTmW3W8iW3iW2WpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrL4:uTcZwvGcUDTjQpm/0
MD5:	38F7BF511F9302B7E16811738EFA7C5F
SHA1:	3AD17C3DC404A00F89BCA63836E45D388CF0782D
SHA-256:	32ACD47EA14F8297F9B986184A67984F691DF3D2DC5CA5F3DAC7276800069566
SHA-512:	D42366B22A107A816667BDDA7381DFA742B465DFF5A4F9295FDBC7CD1529857957F18B150F8812657E024812AD723A0CDB4736F94DE3BAECAE9F330FE6A78359
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Invoice.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11223
Entropy (8bit):	4.72693857971157
Encrypted:	false
SSDEEP:	192:3bVN8S8jXOWXTZkZFO9EfuPopKYANFbHNGXJtgb7J/NTx+JohknESD8r4D8+wCq9:3bVqZjXOWXTZkZFO9EfuPopKYANFbHNH
MD5:	EE79782B35552A19B9B85D35969F815F
SHA1:	57A6F42FB46ECF278610DA9CEAF110779A877149
SHA-256:	8D6B5F5E9DEAD967A5C013DF1A2444E6E4721CFE47C30FCC3818C8E89180F392
SHA-512:	AF7B6162D426902BFA0304509E8A989EE5FA491334DE0FAC44B347B2B932F6B89D69F63BF8DD2D31E145DA2851398003864CE176F81DE20BC79CA329C84F8F4D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>SalesRep</Key>.. <FileHeader>Sales Rep</FileHeader>.. <Display>Sales Rep</Display>.. </MappingLine>.. <MappingLine>.. <Key>CreatedDate</Key>.. <FileHeader>Created Date</FileHeader>.. <Display>Created Date</Display>.. <HideImport>true</HideImport>.. </MappingLine>.. <MappingLine>.. <Key>ModifiedDate</Key>.. <FileHeader>Modified Date</FileHeader>.. <Display>Modified Date</Display>.. <HideImport>true</HideImport>.. </MappingLine>.. <MappingLine>.. <Key>Currency</Key>.. <FileHeader>Currency Code</FileHeader>.. <Display>Currency Code</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>DueD

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Item.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6574
Entropy (8bit):	3.3811808795521547
Encrypted:	false
SSDEEP:	96:uDTmWwWTW5QZW6W/WyHWMWYWIWCKWb8WtWkWEW5W7WoWwMWT7sWxhoW6fb:5Q3
MD5:	7B12E6D5E0C83AD56719211AE3010D74
SHA1:	FEA0A3FC1B9F896BC11D1123479B03B4CA71DFCC
SHA-256:	8821B3B6987227D25B1CFA35A0CB9AFF1D0ADCBE53E516B58200F9219ACA7527
SHA-512:	1F36478589E3840E5BB77582D56E630D40C66DB09D0F85F3B03AC3C5C8F229D11E5ACF4E4E303569A0C12F48D2C4D9A11499C238C5B7DEABF5FDAB9634F90989
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .P.r.o.d.u.c.t./.S.e.r.v.i.c.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .P.r.o.d.u.c.t./.S.e.r.v.i.c.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\ItemSites.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3916
Entropy (8bit):	3.374542512973868
Encrypted:	false
SSDEEP:	96:uDTG2hmWXmWrWrDWW0W9WUW8iW3iWxhofS:vD7T9
MD5:	B9392F01A5EA82613C44D5A927D0519E
SHA1:	6092CE8987AA338905065BD93C67755FAC98491B
SHA-256:	BB30D9193473EF4C42B2E04BCDBC53126A93177C575A5D67AA047CF01FAC5CA8
SHA-512:	5C3B97EA9F369BFAF7428EB4ABB8BF7DD274A60716137D515FDC74F4D47F8006E366EFF5DB48C1FA4844E7724AAEF28E395A2828EBC5046841719CA6B36DAE0D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.A.s.s.e.m.b.l.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.D.i.s.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\JournalEntry.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5812
Entropy (8bit):	3.3717861513230543
Encrypted:	false
SSDEEP:	96:uDTgBKUO8iW3iW1Bx7W4WAWzWWn+WT2VXWEW/GWxWoWVWbWW4W5WxhoW6fb:ZtTpC
MD5:	859DDE645AC0E0BB106C6FDE1C6BA93D
SHA1:	BEEC47C1B2D5E05D3DC4352A363DCFCD49C38DC0
SHA-256:	8A357C6760983437D66771EC9796F01EE021C12A3CEC1A0116F456B3995E5413
SHA-512:	823A45407B2C012904C60032B54213800F47EA247310E244DD314B4D82C513F59CFBE32C11D95D6BDE2F68031DC06A3DFBDF6A27F85FC4851338CF4D890EC101
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\PurchaseOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16302
Entropy (8bit):	3.3665138800940686
Encrypted:	false
SSDEEP:	96:uDTSW8iW3iWjWn+WDEW0WxWgWPWQP5WhawWGFzWLEP5W4XhWVDyDoW8EmUWaWgWJ:DTBd2Gm06pZs7
MD5:	76D25250A040F1C083D5C5590916A707
SHA1:	30CC239C720700FEE325FFC6FCF85EDB52117C25
SHA-256:	9CFE2E401D363D4A401558833F4CAE8188C9695DC7DFB875FC6F28B7FFF17E4A
SHA-512:	38F60796C278D1C69E959914FFF1FCDEB9B6EF059F838AF61369A82FF665D15CFB3FF6072521DF7EEC43E4ACC4A47E54624B7AA7099E3AA9A4D3C25BFB0F8EEF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.O. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.O. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\ReceivePayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11520
Entropy (8bit):	3.389144927052971
Encrypted:	false
SSDEEP:	96:uDTaW2VQXW8iW3iWneWeoF2BWoWdcDvW/z8QWxBKUW8WDWVWT2VXWTWsZgWDMuWX:TVQ5TFcD4z8b1qoQOrGooq
MD5:	9102C940AB537289E2E55E087BF0EFE4
SHA1:	AD22720A3DD829C47728592CAB21A65D75BC1B1D
SHA-256:	AD628C5DC8EC44CC269CDEED1AFFA08D556F8598DFB1DF2B76A1AAF177E83DFA
SHA-512:	3AC7DE0669A6527A256E1F424815F81855A9141EB0D41145B65817886E4AB8F2751044D790380EF1FD8B1CD1F8417CA907E66D867DB475545213DC23C569435C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\SalesReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24030
Entropy (8bit):	3.3732184604313367
Encrypted:	false
SSDEEP:	96:uDTqW2VQXW8iW3iWhWPWdeWoWIWsPiWHYiWQP5WhawWGFzWLEP5W4XhWVDyDoW8d:DVQ5THukQdz2SqoQtZs5
MD5:	F63F1C2BADFE3EF960FE7C6C2DD376E3
SHA1:	04A5A11AC88A17249F8BFC086F62ACF400EB0D7E
SHA-256:	DC50B220CA0AD6FB42C6030FB2A7478752917F91E8614F58B8BC23F4825D4965
SHA-512:	3B69031E8012435606B7C07A2560C1BAA8E153D2A2F022621D493AD965AEB2C82482E8799D377B2745BB61923841701239910CC4C9176DCBEBAE6F480337C1FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Transfer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	3.3644021823593775
Encrypted:	false
SSDEEP:	48:y+6DT8FPUW3FPUWuRUWsRUWhRUWVbqRUWGRUWSRUWhnRnFRUW4+RUfb:uDT8iW3iWxW7W0WVbdW5WVWxhoW6fb
MD5:	80EBC42FB64CE0CB75E2A5E45EAAC4D5
SHA1:	8CEE564F15EEC95E094E73B3EB6122E4945307F0
SHA-256:	B24CD5F18D133265BB08BE5A9912D319013F8B50848DEB82866A55B476E0238F
SHA-512:	F2C370EB01EC00D651DDB40E2394CD959F5D3B97396A7970A1450C63B9EFA6D6C8C3A3E489FF72BF530642FE0A145C6ECF2CEB9D695B5FADE6DB811D05539C1E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.o.d.i.f.i.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.M.o.d.i.f.i.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\TrialBalance.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	3.368119197538534
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRU2EyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWo2EyFWKWHWUWb1KxfS
MD5:	99992F30FCF428E325882BEC39FA7727
SHA1:	2CB68A9D3AB9FBA2A44815AF2BAD507316900034
SHA-256:	EF3BF42B4A3642C7B4BF153EEDA3875FD44C1C0F144F45BA91993014A5FA4E32
SHA-512:	6D8B04C92990AC392F523011AE2E3F9372BC2E3919FBE2614F82B7BCFF98E4B006632EEAC0EDF281CA7580B7A009EACF3C692C5A24CEE5972869D8BA8F241587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\Vendor.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14168
Entropy (8bit):	3.348340921298541
Encrypted:	false
SSDEEP:	96:uDTmW3W8iW3iW523WlW/qnWpTWgWNW9WfWMrWrWQWrWfWVbobvbbWaWaTcPciWwD:eTIqDgT2IPAkr0
MD5:	E1E00B29905DC0B5F4E002ACB75A1FAB
SHA1:	72F8870A9F015D270DE0CCD071013199C1A4EF1A
SHA-256:	B1E2C201AA97C68B9079D6BB341D42DD43B50FD90FB44BEF0365821ED757A462
SHA-512:	72DD025B8C341031E25D1D472C0A3A7CC30DEC4A0484A801592AC0EF7D71A752B994121996C3F9E5EFFF00FE914F13B15BC1D3FFC049835A31DEB39B2D6FFF2A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.p.l.a.y. .N.a.m.e. .A.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\6BB9076A\VendorCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10838
Entropy (8bit):	3.360882080826649
Encrypted:	false
SSDEEP:	96:uDTUVPWjWn+WDEW8iW3iWBWPWVWT2VXWEWsW4PWjFwXW/WyW1WYWshJWjWD2WjRs:ATZ8Fwx725eLO
MD5:	6393AC6A3B58AE9064F559C337612A13
SHA1:	26868DCBB2AE1A7B5C2074A72A58C9629C4F5812
SHA-256:	AF050ED9150BE0008DF4F70713160D9DA4844037D3ACCF51ED1A564F51CB2565
SHA-512:	A3DBFB3E0C7895B0AAAB212319506D7B3481F7587A3B70924FE3626135E23D29EFFB27BAD284434837C15C9A85B5B6995CFA99EE805239A8169EBBD62D6812D5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f. .N.o. .(.V.e.n.d.o.r. .C.r.e.d.i.t. .N.o.).<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f. .N.o. .(.V.e.n.d.o.r. .C.r.e.d.i.t. .N.o.).<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y. .C.o.d.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Account.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5696
Entropy (8bit):	3.36440461691417
Encrypted:	false
SSDEEP:	96:uDTmW8W9WgWpWTW3WPWYWn+WfWoWnWFRxyxmW3W8iW3iWxhofS:/REXT9
MD5:	7EBA5CF892154F4C8222C7873DD57995
SHA1:	99E430DD08CD422B9A975C7C52017C3254FC688C
SHA-256:	0EF03F6573B01186EBAF3884F1F2BB3C08CEA16FD22683269BAE4DEFA7F5305F
SHA-512:	AAFC9DE9E748AADEA93A9C1AB156F28845ECF2F16234917DA5C933B51F4B6E12738BA0C55B7C0E5E61F7070758381025F71396035E362D8F2398F94182D195B4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\BankStatement.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4202
Entropy (8bit):	3.362023315280313
Encrypted:	false
SSDEEP:	96:uDT+WXWxWEW0WJWQWpWdch1WYW4HWiWn2WT2VXWxhofb:gchvr
MD5:	F2809696DBE87E6EF86A224E1E0FB224
SHA1:	4404A5547D4EB9CE3D1A2B40781FCAA28C817433
SHA-256:	13B541A6C7A627B15E10E7EC1F1B5619B64893DB6169133D9940CE099D2A3F42
SHA-512:	40348944CFBD0A7F72BE8FE0703023D1A4E29C05BC63D4D93D0A2C1186A5E8B1F84B9D49B965D368330969BFE62748F882FE2E9960E2A29BB80F7AFB7F74AF7E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Bill.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16472
Entropy (8bit):	3.369506101034054
Encrypted:	false
SSDEEP:	96:uDTyWjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WGW526Ts:nkFwOlcJs2ZNEXTw
MD5:	22DD5C191418AE042D685CC551171670
SHA1:	519D05FE41A605BA9D0842E55CE19895D3979850
SHA-256:	E2DC130B0EB63C5DA641143164DFFC6F46646CA3C19150986C659111CECE27F2
SHA-512:	7EDB9106C2E2A186F6DC6CEF9309DE4E356E7E5554B49D312F55A645BADC9911BAC0661096F697CA176B9765BB1DBC78EFDEA9278D486D57796767EF471F214B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.x.p.e.n.s.e. .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\BillPayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXW3WDWxW+WBKgWoW0WbWuDWVWn2WT2VXWnWcG3W/WeoFWDEW8iW3iWxhk:df2Tw
MD5:	9822C955955BB940E0E48E5DF1DCEBA9
SHA1:	C39B2B3CB49F85FA90E22751A28AC98B4578FAB9
SHA-256:	5BA02DF7D3BF6D12899E58D9EBF9C20FF6AF11AF15A5CA5B465D8E157D2AD0CD
SHA-512:	9356CFE1B171E671364E91ECD1C6962760A031E1638D7F836E276E576C551FD55BC791BDFF4F478C2BB5F7F29F5343A7C9A4F7168653C55B9C5F6BDF07FBDB93
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.m.o.u.n.t.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\BillPaymentCheck.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3WeoFWDEW/W8iW3iWxhk:df+Tw
MD5:	119EEA3B83228CF4AF90DB3DA987393D
SHA1:	36E1EE9BFD06B5DB21E8057D6B0A94046805F927
SHA-256:	5BE92994641722A1CAD46DFC600645960E53C3928B2833CA296CDFE865B71118
SHA-512:	367416667D7660D6ADA00DA018FC90DCF6F1035E394B637E75AD26163D9B878902BCA03BBA5FEEC8E2C301A9B3CC60AA10A3F4FDF82593BC418AFFADAC967DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\BillPaymentCreditCard.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3W/WeoFWDEW8iW3iWxhk:dfuTw
MD5:	CCF424242AE506049732FBF1BFFDBC8E
SHA1:	82B5FD23AB9978D8FC24E887C69E126A8597F80E
SHA-256:	40D96F01472756C1C1D6429F629F097C0DE1BEB94AB80CAF1E8F4A4F787327CB
SHA-512:	23A2769384B4A921D921345BF1B02AC7FCDEC923AEBC4C57496C8F0D8674CA3788334DA726CB94D786295C9EE139D0A8D4743C13B39DE2C462858E02F78733CC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\BuildAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Charge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	3.341511882057727
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWxWoWDWWj6yWpWDW0WjW526TMWCwWPWdW5W8iW3iWxhofb:jVQD6y2lfTw
MD5:	4DE6FBB0E4913F56506A55D2F197CD89
SHA1:	0EEC53EDF169E613317FE7FDA43A9D48043D620E
SHA-256:	8DA6DAFE0EE49B9B773956B0A108C3C40BA81A4074470D9936887381D19A0F26
SHA-512:	C76CFD7CFB9E65C902DDD55B4EB6124974B79451AF86A0EB52AB47A2563CDA4413B25716242FE79AC9868DAC86174376C0863FB7712568C8E065350B932DA3CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.e.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.e.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Check.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13386
Entropy (8bit):	3.3689913335499573
Encrypted:	false
SSDEEP:	96:uDToDvW+WXWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWy:xDRkFwOlcJP2ZAE0Tw
MD5:	1C0664D5AA1BB10BC49A85A10CFACB16
SHA1:	A2A461CD1E9317E5A640ADB2DB6CD03EA8EC24A4
SHA-256:	BD547314AE670B52125F0ABA4B051DD2086C49D8B9B8F8DE51AE35FA8D861337
SHA-512:	3407CB83AB03B5D3AFEFDAAEC44C15C131DC42E45BCEC8D24AD6509A733797F6DA189D026D74553A3511873795C3EFD68DFCE7076DF125372AE90A772AECAC44
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Class.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	3.3737628801824364
Encrypted:	false
SSDEEP:	48:y+6DTfRU2VsPUW8FPUW3FPUWhnRnFRUfb:uDTG23W8iW3iWxhofb
MD5:	8394D50FB8C4B1B44E4BFC1E85D8E90E
SHA1:	6FF949F58308BB699CD5AB6C8843F968DB9A135E
SHA-256:	3780ABC3C231B58C09AE37893FEA3AFE44AEE41F07EB503BE4BF9BE90E2204A5
SHA-512:	2C4265418371BC6D88263DB8727982545CEC9214835D8BED5C30EB7D54B51064FFE5674D51D770782899DCAA9AA8A27B6929BA09A902DBDD9837F28C7D43B417
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\CreditCardCharge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13734
Entropy (8bit):	3.3746926532041783
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWH:UkFwOlcJP2ZkEJTw
MD5:	85A3C4FF059214D7032EB18B90D67FC6
SHA1:	BBB3D13CA4CAE06E636C72E07E8C27A08322D1F1
SHA-256:	B06ABF8C753CE58FF4167D569379B0BDBC92F9AA7172F8A1E2234FF1B7D3BEC6
SHA-512:	B96B47E6033823A0D6E7082E2F2E160BD962DF2C838A31DEADE1C070CFA2E52F8BAC19221B8CFB9E32B08A6F56956A23CD0A14BF4AE8B8CA7E8DC926B5EBA682
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\CreditCardCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11192
Entropy (8bit):	3.376232314447034
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjWQ:UkFwOlcJP2ZaTw
MD5:	8799B566ECB2D1BA2FF14D17AA84C271
SHA1:	1170D91A3BEDCBE0B852DFEECED775039F1E77BA
SHA-256:	8327782D98DEB9EC910666CB54E1FDC31F9FA0CC34ADCF731A8D4AC48F3BB9C4
SHA-512:	9DA64E810B494E8B3DA65374136555CC09AB5A8D9BEC90DACDB9E9FC156A26F4DC600C10C20F0F33D2EE803FEDB790C9D45643DDC92E728729ACF5FC664DFE90
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\CreditCardStatement.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	4.696241236318063
Encrypted:	false
SSDEEP:	48:3YV1LJ1mc+J1+c7ZJ1ucuJ1QcwJ1Dcu8J13cRJ1uc0kEfJ1Q3cMuYJ1bchXJ10cN:O19/2v7bGx8yuYGv/mbuuvhhVn5SQIEX
MD5:	B5F0345E4EC6B43B8E374DDCE3DFAEBE
SHA1:	C35A35015F4A9012B076F90F0F20A1ABD2F11726
SHA-256:	955FF27F62B8845D34D0D1EF414BC4371870466CEA6B92D38E20583932313EC5
SHA-512:	F5036B28BB39C68A9377BB6BD0DA99E1799EFCC329FEE433BC92FB0720741FE935E0FC3E205EDFF4C385588C5F2D83BC42C1704FF9CEFA60DE96FF4EBB206046
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Statement No</FileHeader>.. <Display>Statement No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>CardAccount</Key>.. <FileHeader>Credit Card Account</FileHeader>.. <Display>Credit Card Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Payee</Key>.. <FileHeader>Payee</FileHeader>.. <Display>Payee</Display>.. </MappingLine>.. <MappingLine>.. <Key>Account</Key>.. <FileHeader>Account</FileHeader>.. <Display>Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Memo</Key>.. <FileHeader>Statement Memo</FileHeader>.. <Display>Statement Memo</Display>.. </MappingLine>.. <MappingLine>.. <Key>ExpAmount</Key>.. <FileHeader>Amount</FileHeader>.. <Display>Amount</Display>.. </MappingLine>..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\CreditMemo.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23580
Entropy (8bit):	3.3710777732304122
Encrypted:	false
SSDEEP:	96:uDTQQqW2VQXWxWoWBWDWWjRWjW8WhWyObW0WjW526TMW3dUWZVgIW3GWlWcWfWiQ:jVQSu2Z8d/Q/9kQfqoQvZsATw
MD5:	C25945E64B97E72C57BCC9F7379C9EF9
SHA1:	F35B6EB3E6FD0F297232D98727478989941486A6
SHA-256:	0076BABE7A06C173B633073A7B2F653C67213D5A484FAB6CFF818B51EE304979
SHA-512:	C0018D7E32DC4AF7CCCEFA6060FEB147066EC4594D3E962425A99D10A35A67B59BEAFC14C8651BCD3A428111220ACFBAC891CCD5552DE7C424AEEC59ABAB10FA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Customer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18668
Entropy (8bit):	3.352815492415269
Encrypted:	false
SSDEEP:	96:uDTn/uW3WlW/qnWpTWgW9WlWcWfWimWZRoW9GWVWQP5WhawWGFzWLEP5WVDyDoWh:2/lqX0tgrpXmT2NfbDo8tTw
MD5:	75D963B4C35917C19F3A3D8AE3B95FD9
SHA1:	F900D7C232551EF384DA4F294AEA1D0C800F2139
SHA-256:	0D542F1557DFF61EC1EB5886EF3BBE3DF3F7C0F2AB75A9A319A8C013434C5893
SHA-512:	7F07D3204EFF25B8FC0E76DCF260A93BF13FDF3CE81FCD84B2644E0B17F06C938C5D4A84AB6C16607C1CFB8537C04A3F0C6D4F292CE6AF67331C6C3A7F2E4776
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Deposit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	3.3749994451487755
Encrypted:	false
SSDEEP:	96:uDTXNUW4e7WsclWyW8WOWdcDvWoWO8FWG2TW+gHkW+HArW+RC9WVWDWn2WT2VXWa:ucDITw
MD5:	D60B6517E5C856A330029224348ADB67
SHA1:	1112AD001BA5FBC2A23CA993ACE8F2AF4F85C60B
SHA-256:	319C59A778AE176BD9B2C5232F2703DB05F90604D0AA3398F8AB76B8E5117259
SHA-512:	DF59081A0C17AF14F2B4E01CBEE5E606A744A5F81619F1BA5AFE1D12EFF3C1A4E10BE239CF06596A31D6EF84A15AFA4EA249D94CF2F9DBC108FC43AF46488B25
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Employee.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13236
Entropy (8bit):	3.335089551147612
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgGMrWfWDWpWrW9W4AaWJW2WkWOEtWZZW5mWSWPWD2WjooWkUWt:jqsgAB7/LebT2iTw
MD5:	A8F8FD205854B92DF247460D1B68AE61
SHA1:	DF84C1592E4C80910E6D7F79ED70E6DE37343737
SHA-256:	97ECFF8FDB71FA0766E53CB1C600745A4D6FDF1FFE6E19D097BAB425B98BE14C
SHA-512:	1AED2CE7FF57A93429E0EEAAD54A40130B868A07A06FF4FE9B17058A6FE63AED7C45E880520C2086DC7FD88B901E3C86EB3C11F642432E26F7AE984D0805ED81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Estimate.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	3.3649585439931373
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQX2D+iWoWBWDWWjRWj2h2fW0WjW526TMO3GWlWcWfWimWVWZRoW9GW3:/LXVQM+Ao2WMd/Q/ckQLZsATo
MD5:	22CE31AB33A890C6FF4D706C363337AF
SHA1:	6BA1E90F007F927A1B1FD565226CC32B3FFCB296
SHA-256:	43431D770968E99834CDBA44B633D7A151D95F63399068A06B8D86C8644BA5F9
SHA-512:	DB3A2F147A27C626D6370473D8E4C6F000B2A3A15052B244C51A939AFC4DE1F06D3E6F5574D3D99F621C377DC285734B7405DEB288FCC32CD85C13304AF057F4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\InventoryAdjustment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6054
Entropy (8bit):	3.400534507725254
Encrypted:	false
SSDEEP:	96:uDTaW2V4vWBWEWIWHEj5WdpIWDW7W3XKWvlnWvInWZVW+W0WjWVW5hRhRde5Wxhk:zV4mjz
MD5:	305A9C370A61FAE120F187F029B7CD9B
SHA1:	31609A6107445CEAC34CEEA10455257C8DEF72DE
SHA-256:	81D3A7AEA2523FC6FDD7B2FEC8F5143C17573CB126CEA3E789E4E143152A3426
SHA-512:	197C4EE9E01220718AD3CA2972E03583CA55B7C7A99AB6051E0E4D4A74827ED5A1B7B6A8F7CE4FFBDBA10377144FBA88E8643633A0DEE5474BBBF7033C7155F4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r./.J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r./.J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\InventorySite.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8130
Entropy (8bit):	3.328234644697249
Encrypted:	false
SSDEEP:	96:uDTm2mWpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrLqW36WUCW3:5ZwvGcUDTjQpm/FTw
MD5:	0B0DC1FEB1B046A4A54166A0A1DBAA06
SHA1:	25BDA861ECE1DB4ED0B89B0665488BE12A895239
SHA-256:	D2006AC23D0AA1C25C30635019BF59B27077F1612D8E2C795425A1C38870823A
SHA-512:	5A210839D2635668F9F41C85CC1CF45D48F35783461AD42E50F3678811482305AED9CC052B89C3EBE2D154B2A7D6D93F349AD43B0F976784C983B8B8B8E607B1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.S.i.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.n.t.a.c.t.<./.K.e.y.>.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Invoice.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11467
Entropy (8bit):	4.72766178705011
Encrypted:	false
SSDEEP:	192:OmXblKXYCEHoH4VdpedUjulYYANFbHZGBJ1gN7J/NTx+JohknTZWDq8D8r4D8l+M:OmXblKXYCEHoH4VdpedUjulYYANFbHZU
MD5:	BEF17A9A4A799773B7B5CE4A8732B8AA
SHA1:	1F958CF9A80BEC654291238969C157101D9F9ABA
SHA-256:	E89D3E6E2825133B3B2B942E5F428163098B64D38A75A626BE04EB28BE2E5F7D
SHA-512:	2B7701DC1C8DAB9713166746A7278E7CC05B2823D1F9D5E6C448883730B9DAF47E3342ED0495DF92395ACDE0CBDDEAED81462D5BE392B08A3A30694CF71EE034
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Invoice No</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>Product/Service</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>Product/Service Quantity</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeade

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Item.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7666
Entropy (8bit):	3.379894943545433
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWSWyHWcWYWoWCKWb82tWkWUW5W7WoWwMW0W1WtWxWxhoWxfb:SQv
MD5:	BE43F47C14919AFAFA2AF9C33F618BEE
SHA1:	F84F7353E0FA160A091A615D88544BF09A28A153
SHA-256:	3106AC7C52CBA5CF70A69A61A53350CDFB27B164E891D109600B8BFE9D875520
SHA-512:	131E37E0B4755D8086A88633745C5CAB20B9FA4B90BAE336420630B54862BC432C0C469EAAE52417F7031374055DABCFDF962ADDB89CF5644E382FD186E65693
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemDiscount.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	3.369253287042973
Encrypted:	false
SSDEEP:	48:y+6DTnRUWYCORUW/RUW0RUWRRUWbpRUWGRUWsRUWhnRnFRUfb:uDT+WLWmWTWEWbsW5W7Wxhofb
MD5:	25CD8C4E6AF24CAA5FF6EE1B6F903C18
SHA1:	A639747DF534EA47858E4A8D4F36814DA597F533
SHA-256:	20109C74800E1A6DEDBB9D81A8F07D42A5FE12BD399870BD87C5979500188568
SHA-512:	BD4B0D2C92A3829B46021C3FF9D4CEC093D2F0436CF2C585F517C849F8541D5D7A83627A9C3D3328DE5E0AA7F6716C48F0DD5267EB91A95B9506E8810A1082A8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.i.s.c.o.u.n.t.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemFixedAsset.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8138
Entropy (8bit):	3.3590441395434176
Encrypted:	false
SSDEEP:	96:uDTmWOW5WUW5WyWWeWnWxWCLWDWQWPWRvWZaWbWX3KWeW6W6WgxMHxqW1lQQW3W/:92xMHxcbTw
MD5:	22858F010F6BBDEE70F95C304A46F36B
SHA1:	86F75CCF6C690E7FAB0C1CD08361C7D9D220E968
SHA-256:	CA8F453C6429247748AC2CB686A2798EEC84C62ED65E3F37B45F1D9BF7A778DF
SHA-512:	78C14BAA218D0BD2F9AB147E12A3D1661D7061BE18A5E4E825A2D22FD473D71275532561906EC161AE4F6EDE87DFD2F25853B17479707D1AC1AA2664C47CC2F7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.l.a.s.s.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.s.s.e.t.A.c.c.o.u.n.t.<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemGroup.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	3.362693101616319
Encrypted:	false
SSDEEP:	96:uDT2GOWpWeW4WdWDmWk/5WW3W8iW3iWxhofb:X/5xTw
MD5:	124F9AE4C966E010D53679722FFC508A
SHA1:	38C814162C4D3B7E2E6E21A48F52C1DB13B29368
SHA-256:	0D222B200446C0646679201A4CE6B458CEAC61E7365192530780254F98900FB8
SHA-512:	19068388DB1E412B5680AE2A976DEE3FFD54338FAA1A2F11EDA22540CE5A130EE96BA9BDB93624325DB8B010921357D032118519F5E036DEFB557CCE849AF1F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemInventoryAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8870
Entropy (8bit):	3.376494853568335
Encrypted:	false
SSDEEP:	96:uDTmWzW5QZW/W6WyHWcWCaWQWbsWtWUWNWwkW8WFN1IWGQFW+WDuWYW5WrBcuW1q:rQITw
MD5:	95FB5D545CD13670722D8386EA8E7BAA
SHA1:	CCBD082AB859220AB9DABACAD59E8BBF6E45478C
SHA-256:	927BC1A9BF87E7CC2D6126DDFFB7886F0234E218CEF10A431DE69DE0F3DE919B
SHA-512:	379A7C4FFE9AB0B8F65D1922740F7A145D0D14FEE56DEC612B2CD5AEE7D2856C0F2BF5D13CC3BE104D3831414729528FD1DF0125C1CE3EC2069E88D6141D1D7B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.u.r.c.h.a.s.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemNonInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemOtherCharge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	3.3808418806351264
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWyHWcWYWoWCKWbsWtWkWUW5W7WoWwMW0WxWxhofb:SQ4
MD5:	6E56495D5843EBF317452EDA48016548
SHA1:	551CD5D29B84C07CA8B5F78897EA6EC73BFC2FC8
SHA-256:	1835A35348765C761CD41B6B31A8C474EAA722CE3230065903C53C12162247C3
SHA-512:	7F51BECC13CBA14C6B6B2529D3BF538AF0DB90B3B967275F8E6D2D68B0EBFCEC1D08B12B3FB0915A9728EC528B0844C92E44D5D7E9AEA9B6FC3700E0C0492E66
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemPayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3194
Entropy (8bit):	3.363338038961555
Encrypted:	false
SSDEEP:	48:y+6DTnRUWXRUWYCORUWnFRUWscCRUWGRUWVsPUW8FPUW3FPUWhnRnFRUfb:uDT+WOWLWoWsclW5W3W8iW3iWxhofb
MD5:	A6DB6D2135E5EB9517615A4358820761
SHA1:	440BA9F51FA39CD6E402B74E17538AF699956586
SHA-256:	624D43B83672248F4B5137A6CB6671EFDCA38D5A3662D4FB4601CAB8F934355E
SHA-512:	D35FDC067F222BDC6A6E42F6E235373AFF0859199117B77DB7C681D6591DE57C333E1958934D18469F9BD84E767E72CDC95076B82E2C20BE7CF7C1D6870D24ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12122
Entropy (8bit):	3.3777404813750835
Encrypted:	false
SSDEEP:	96:uDTaWjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjW526TH:/kFwOlcJP2Z/Tw
MD5:	AD3343901A04AFAECDFF9116ED7E9E63
SHA1:	22BB309FD9019E36BD907048864A70EC4B3A4ED0
SHA-256:	F88A8A322970A8845900DE777CDA86632FEF892FC396EA7FBC46C9F7CDE7E649
SHA-512:	0AEA7E4D98940950E6C9E7118F1EBB13FADAEAAD3BCB89107A3D66E6748DBFAFF7C601D07CA397028A4716F47DBCA0630C187A572DCC0A99BA1A909A39FE665D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemSalesTax.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	3.3852199742396483
Encrypted:	false
SSDEEP:	48:y+6DTPRUWYCORUWXRUWZ02RUWhnRnFRUfb:uDTWWLWOWcWxhofb
MD5:	811428AC1C5C9D7F349A44FF0ADB98C1
SHA1:	E812DA7171B9BC5551FF11FEB994E15B6A0D5E91
SHA-256:	4FB868BD432D7966E1299570522A2BBE922633790C93606F1A5E7AEAD78FD4BF
SHA-512:	8AAF9052A27F596451C7F89A90C4C2A0E4CF002CB07091DFEE74AEF49AE7A50150EFCC9303FAFE8FE5734EAC37E491B0E7A566C31AC47B6264BFE8CCC3641786
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.a.x. .R.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.a.x. .R.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.V.e.n.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemSalesTaxGroup.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.401575726316516
Encrypted:	false
SSDEEP:	24:QlL+6DTTyEyDARUWXtdtQy2tMRUWMHoyiURUWkAnjyzAnFRUfb:y+6DTGZARUWXPCORUWMBRUWhnRnFRUfb
MD5:	48DC90036A616570B925520A1193A8DC
SHA1:	68387C07D8A2A19E6EF3AE7C90C8A13F811DC58B
SHA-256:	60314415E46AF3A6249F949619D1A4D65270FDDCC0626DA6206DDE168D91B1B2
SHA-512:	D1241237F9E427709FD644EF1AEE2E0D366E8646B17DC30A6FAB44A2FA61F66BE0024D293DDA7912B90EB04220936AC0C5F736C6AD702B49FF7387EFADF9A62A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.S.a.l.e.s.T.a.x.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemService.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ItemSites.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3054
Entropy (8bit):	3.3625349261742494
Encrypted:	false
SSDEEP:	48:y+6DTfRUWsA5VbRUWs25TNRUW4NYmRUWrDPRUWhRUW8FPUW3FPUWhnRnFRUfS:uDTGWhmWXmWrWrDWW0W8iW3iWxhofS
MD5:	F28FDB30C1D4EFEA8C8A2864BFC1E7AE
SHA1:	572F73533F73C877A17A00A675CE2CB54B3FAAC2
SHA-256:	ADC2E8C1C55AC77544252C843C979E95EB6DC24E02B04908958ADEF7DB3D298B
SHA-512:	5D15B79E756DD633B5039A1C0190B88B088D0BBF31BE8D2E691EAEB91C30D08011C70D1CB49756A705FC4C2E71E8137B2A80275DAE879092A8B670B0C99E279C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.A.s.s.e.m.b.l.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.D.i.s.p.l.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\JournalEntry.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5682
Entropy (8bit):	3.3641718817926574
Encrypted:	false
SSDEEP:	96:uDTgBgfg1WbWW1Bx7W4WAWzWWEWDWxWoW4WnWVW5Wn2WT2VXW8iW3iWxhofb:ZKWTw
MD5:	2BD5A49FAA022BC84D5235AEFF84ACA4
SHA1:	D99A02652572731F7AD54F9C5AAD6B427C5D751F
SHA-256:	DE32A8233EF7F37F50A5D87E8F583A4A44BE99CB017CEDCDE1B1D4C6F3CADA1A
SHA-512:	E7C9589DBDED56781ED3EFB27143B6B7F006752DA08F09F13808BF8C781E26F1E1C54F741E959AAA6CD4EB21FE637FDBC52687B87564568BB7B6E5EB4999141C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\OtherName.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	3.337946781523756
Encrypted:	false
SSDEEP:	96:uDTmW9W3WlW/qnWpTWgWUW9W52WxooWeOWcWaZrEWrWVbobvbbWQW1kSEWrW3W8E:JqRTw
MD5:	187288B192B130A10398FBC41051BA8B
SHA1:	7DEB39AD9AD23B32D2FE8658222D1343F9835227
SHA-256:	703DC4C12585B0C955E72F044F07CDE6243F6762C56E9C34BB555C6E700F8EF4
SHA-512:	1F31FEB3E4ED30C74EDF0D169ED8FA2A9D85AE0C27D5490A2DC926F864A99CD45CC0DAF10A02302DFCB25E7746195E4D935E38FCC950A645373706032712972E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Payment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	3.385598702293327
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWdcDvWoW/z8QWDWsclWdW0WbWuDWxhofb:DVQTcDCz8k
MD5:	3043D744FB3967BEFE237A672CFB2471
SHA1:	68BCB0189BA41DF8164EBF390C30265A8B6001A8
SHA-256:	CCAB1ADDC394CDBD187B236DEC59E8D4F3832A3C22FE3E24FD24DAF0F4EA0488
SHA-512:	3594AAE617198B350780295F41C5AB1D63EABF6D97EF130454D6DC5840458E81CE40192BA382EBCCA28A3A3DF70725692C14E1CD26D5CCA06E6E2E3FE88963E6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.h.e.c.k.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\PriceLevel.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4188
Entropy (8bit):	3.3716445400273334
Encrypted:	false
SSDEEP:	96:uDTnGXWn2WxyW4WRWiWikWTvsW3W8iW3iWxhofb:cG2bvXTw
MD5:	E614B301835CD2B26E6C71941FA38064
SHA1:	770636C8C0809AF429E4D91AB26D4771886922FC
SHA-256:	6F0A6C45B22CCAD3FB086FE2F20AA36C743C8A1DE84D441196D575655C2AC4B3
SHA-512:	D72A717563335F24C8AD3F5DFD359F352E8FC535293C3E89AF7220F43F1DEC40AAB04CBEA6F14565E778997EF6156C636BE8381DBA2FB87CDA447F1B28D29F62
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\PurchaseOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18326
Entropy (8bit):	3.362876895276993
Encrypted:	false
SSDEEP:	96:uDTyWjWxWoWhWDWWjBWNW6WsWgXVQXW/WRW0WjW526TMW3GWwW5W2WVmWwWMRoWK:7WVQl2OlNmZsHTw
MD5:	EE58050BDEAD0A0A40BF05786C1A3165
SHA1:	5961C959ED8E0E1C4CA65A84A27BDB96A8D7B8BD
SHA-256:	E4323B9241194F182515FF085AAFAB873F71EF9450E664B0FD23D4C42FD75A3D
SHA-512:	B02D9C0831AED76FD7C8BDDE2E26F4B3D89ED7997F5AE33D9729461FFB2610791CB3EA3A5EC4CBF860F32C10ECE3164EAB9EF8A94B14E2519DD4D749316AD959
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\ReceivePayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11204
Entropy (8bit):	3.387327919099585
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWoWdcDvW/z8QWxBKUW8WDWsclWDMuWBgvXWzWFW0L9WWWTW1WPio3:DVQhcD4z8bNqoQOrGoo3Tw
MD5:	A1696CBFE2413516C0624AA64CD46F90
SHA1:	AE6C8D6AE1E718106648D6AA80007EBF4A01AA24
SHA-256:	FA0AD6866FE892A9DF3027FE52EF7AACA27BC503794CD0E14DD09E8874876FBC
SHA-512:	1478A19296B2AEE18A179C9B1D9D3939BD38A164905F4B1F2DBB75450AEC7AD3930C080ACF3023C1552C2129852434C65DE6EFC599E97F1ACD8D4D564F733A8B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.m.e.n.t.M.e.t.h.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\SalesOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17966
Entropy (8bit):	3.3596296223763984
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWBWPWoWBWDWWjRWjWhWyObW0WjW526TMW3GWlWcWfWimWVWZRoW9GWZ:DVQ1Q2OVd/Q/akQSZsATw
MD5:	8DDAFEB175CD46E5266A3C7D6961A8FD
SHA1:	47D52E3E7BF2153F85D113F6B5AA1C657BEB5A73
SHA-256:	9A358650848A454410DEDFC96A5CD00C6FEC48014F84B8EB6BDD467182012A18
SHA-512:	3EE06E10AE3AB30058A16CC7964A3E516DA25B9767EF5866088F0201938AD0F1CD4C91BE26F2E4032AE2C695B66113FD5F4EE0FCB09B49AA15677367BC07B0ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\SalesReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23970
Entropy (8bit):	3.371707688246353
Encrypted:	false
SSDEEP:	96:uDTqW2VQX2hWoWoWBWDWWjRWjG8WhWfO0WjW526TMW3GWlWcWfWimWVWZRoW9GWx:DVQAe2OGd/Q/1kQ9qoQecDlZsuTw
MD5:	80CE7AA22B92382E8A92DC5497582AB1
SHA1:	9ED81F08DB5D171A4D2C8059ECB4B5796A7694B6
SHA-256:	0370942C2663D59356BAD9306A13BEB8B9E06A57070ED02754F41D0B8EAD0CF2
SHA-512:	096939544811108FCBA59E3D4BAE23CC8EA0F39B3DE17746BBA030AE550ADAFBD736B9AAD6E409C90FCCA76344043F1BC0B82FB9F53AA26FAAD0C3B8F6EA9686
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\SalesRep.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	3.3569081983689473
Encrypted:	false
SSDEEP:	48:y+6DTSS/RUWdGJGSRUWVsPUW8FPUW3FPU2hnRnFRUfS:uDTSSmWd0YW3W8iW3i2xhofS
MD5:	439F52DDFAEBE0B265BD919956ECEED5
SHA1:	8F994D34A6011651B014F0083FE4B1CCA6F1E3D4
SHA-256:	B47081FAE2FEE41F38FFF8DAF5F4DE58396132B445F113E9A488784E1F852D8A
SHA-512:	315D4FDA7304EF0A542C4F2C9939D1ACBB164D01C8987441FAA9013F8DF8252A7DE15819CCD1F89D15597566119736A6F2832AC60D16B7F7093E7E524515A5F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.p. .N.a.m.e. .<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.p. .N.a.m.e. .<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.n.i.t.i.a.l.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.p. .I.n.i.t.i.a.l.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.p. .I.n.i.t.i.a.l.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\TimeTracking.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3924
Entropy (8bit):	3.346158044789658
Encrypted:	false
SSDEEP:	96:uDTbWW2VVAWxW4WxW3WTWaW5W5W8iW3iWxhofb:zVV8Tw
MD5:	D6368DF55D96E8A243DE77C4DE5716FF
SHA1:	258C995AB1B1D637AC8A9738DC92710A12B463EF
SHA-256:	71B468801F6D0401C1D57F415E0E8CA05B5B25D535EEEF2DCE17D756F79CA76F
SHA-512:	E5B5899CE5F24559E25717675C822AC629255A3B88C13B49350F794150EEF26FA436C0F442C0C8AF301AAC90C3366446A955BA90CB6A94D8580E6B3FB59CFDC5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.a.b.l.e.S.t.a.t.u.s.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Transfer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	3.367053488969973
Encrypted:	false
SSDEEP:	48:y+6DTuRUWURUWZRUWVbqRUWSRUWGRUW8FPUW3FPUWhnRnFRUfb:uDTxWzW8WVbdWVW5W8iW3iWxhofb
MD5:	90DDFCD975DABF2BFC155FE574B62409
SHA1:	CC3B584BB4DAA913E22BE5961567E4AFD7274540
SHA-256:	5D3D38448434064F774E032558DEC06585DD61F826A1689AC73767C14D2E1512
SHA-512:	6909865128DFE719AD8106210AB55A1684E0FEA30636B1C93A067AA1300C538457B24B3F30C152C3B8B2FDA7F7C2FBF65E5F9300CD9D09EDC5EE2D7C1DB97D23
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\TransferInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4582
Entropy (8bit):	3.3680537578680694
Encrypted:	false
SSDEEP:	96:uDTaWhWQWmWtWdWGWKWZVW+W3XKWVW8iW3iWxhofb:8Tw
MD5:	E60071D0621D5A15FAD97C168E735A0A
SHA1:	26E62142851B7E8F2ACE2530F48A3997FF5D092D
SHA-256:	012A14B3230223FB17DA860E13E1CB932B2DB2D4B25C06DD463482BE4D49C9AF
SHA-512:	51296D9A2CADF0419C2C3C7C851AE23A4ABC0F74A365F3DE8D205C29A4A86C9975DFEAEE6E96EE903E14887BEBD0E2D79CCA245FFDDD6D8C418F35C587313EB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\TrialBalance.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	3.368119197538534
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRU2EyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWo2EyFWKWHWUWb1KxfS
MD5:	99992F30FCF428E325882BEC39FA7727
SHA1:	2CB68A9D3AB9FBA2A44815AF2BAD507316900034
SHA-256:	EF3BF42B4A3642C7B4BF153EEDA3875FD44C1C0F144F45BA91993014A5FA4E32
SHA-512:	6D8B04C92990AC392F523011AE2E3F9372BC2E3919FBE2614F82B7BCFF98E4B006632EEAC0EDF281CA7580B7A009EACF3C692C5A24CEE5972869D8BA8F241587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Vehicle.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2026
Entropy (8bit):	3.3590278843434818
Encrypted:	false
SSDEEP:	48:y+6DT/RUWyPCORUWVsPUW8FPUW3FPUGhnRnFRUfS:uDTmWpW3W8iW3iGxhofS
MD5:	69DA4404C8BD10DD3054119F5166C3EB
SHA1:	697AAD467353B3114F0C2B45CC869A3D914480C3
SHA-256:	DBE9632DBFE9E07BD0E63E3AD7C7938F18923CB186A4A3BDD8CB6BB7C37F2D06
SHA-512:	010F33D334C406939BDE99F5C447C705F5D24CFD2721D1CDE00550151494DFA6221C150F2377155EE8F2C9C891DA4845EC517ECA92BB240E154B451C27EC3FC0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\VehicleMileage.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4850
Entropy (8bit):	3.353849500727898
Encrypted:	false
SSDEEP:	96:uDTvWJgHHWwYjWBE7zWPWY4F4KW2VNoWIW4W5WaWyWoW8iW3iWxhofb:iYZVNHTw
MD5:	ADBB383E2E3B4626700B09388095DEF4
SHA1:	9FCA832E044CF69F39C15041D8D40D3731911A6F
SHA-256:	248DBA3F7B8AA576F43CBC8A6A709A034701BCDC121641043F9C517AA1FCFC23
SHA-512:	24E551E17871925A02AEC60DE918A8D860D4E7C9E5F7A61CDC9BAAA93962F5E6CDB14748043E216E267C17023070EADF830A5354B8D55562FFA1AE18D186BE7A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.h.i.c.l.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.S.t.a.r.t.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.E.n.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\Vendor.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14326
Entropy (8bit):	3.3493576325255554
Encrypted:	false
SSDEEP:	96:uDTGW3WlW/qnWpTWgW7IPaW9WwW5W2WVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDy4:8qjIPHgT2XrDTw
MD5:	6503E48C78ADFDFBEAECFCE42896D342
SHA1:	B2C96DE6B4BE2BA845A03D2E7712D0D7A6259491
SHA-256:	14ED4835BE5430D2D5F5B806577214CE9FE677F680BC2223E8EAB413BCA81884
SHA-512:	9ECE35593585AF549A1CBBDA408379AF8E8335391179F74F90D459C0C4B910D72372B26E53C6990B94B46D2C7CAB258D4F5BABEE0C5C2D8D72B86F7A3CA3B7F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\76937B30\VendorCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11802
Entropy (8bit):	3.375867252592748
Encrypted:	false
SSDEEP:	96:uDTQL9WjWxWEWkW43WjFwXWPWyWYW1WoWDWWjRWNWBWgXcJXWSWkWvWRW0WjW52a:vkFwOlcJP2ZzTw
MD5:	24397BEEB0A9FA8655FA8B6F69328185
SHA1:	A50F8AE8F03C721B6F6AF13D3DD9806C3ACF7E26
SHA-256:	282683445B62ABD7A42AE3E475DC6498D581BB41E8EFFC58B166E956152F8EFD
SHA-512:	57F23150002340BBDBAEF4151633AFD5BD9FBBE5403E59ED100EC1209BE7B4C2BEE2EA39A06C088A00265A681875319D8FEF4538CAD2A6BCF7BC889EC621B467
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Account.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.385828093280008
Encrypted:	false
SSDEEP:	96:uDTGWyW+WsWMWTW3WPWnlWfWoWnWFRxyxmW3W8iWxhofS:0REX9
MD5:	1683427F2A9E604FC547E2AF1FCC887D
SHA1:	329087DD3E93D911E01F4016BA8CA4B353F01472
SHA-256:	B2EC6DA369E892D257A698E8122976FB18E16A539FC0A40B95B4921C65B3B117
SHA-512:	E7E8B451D83AA6E6D1995E60B8700393179635C4FF81D4319D80508018E4CC905819F91D70B94E583EC04D96D81E7B6F60E24CA046E166270CCF02B8388F9E68
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.T.T.Y.P.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.N.u.m.b.e.r.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Bill.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15344
Entropy (8bit):	3.387950593600828
Encrypted:	false
SSDEEP:	96:uDTsGWJnW7KWJWkW4oWjUXWPWyWYW1WoWDtWjRWBWBWgXcJXWSWkWDWRW0WGW52h:2BULJcJw2ZNEjw
MD5:	095636ACB47CC26ACD619DD62811FB6F
SHA1:	40900F2D4594B5D9FE191A746328B4CD56786291
SHA-256:	E9BFA8A45BE8F09A966EC9FE1BE504017F7517978339D59111214982BE6D653E
SHA-512:	A2D7DA83B518230E9008F646643EC7E83B1A6ECA1C87EB27FD938FE6B8461CFD03DB5E0D64FBFA9A8F49D2494B8AA7471EEE584C4C3C46DD8E7CB666EF052FD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Check.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12946
Entropy (8bit):	3.394060848942431
Encrypted:	false
SSDEEP:	96:uDTs9vWAWW1zW7KWJWzW43WjUXWPWxWYW1WOrWDtWjAWNWBWgXcJXWSWkWvWRW0A:VJkUGucJP2ZiEYw
MD5:	6B27345C734DF6D78E8EBA63B75F9E80
SHA1:	73610EE6AFA7AA8D505733F6EAD59FD041C5FB49
SHA-256:	9671C838047B628731F03E1D0E00C387B8B769711B148C85DB8DFB0BDAA6DF61
SHA-512:	E967133531E17A09898D63CB1AC2332DF6B3A138364A65D7B48597C771366B0D2E5570F6F8991E851D6E265A5F7B19DFB20DB4C082B528BCC27DEDCAB0322267
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Class.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	3.401438369594957
Encrypted:	false
SSDEEP:	24:QlL+6DTL5yoRUWVVyVW1j2UWLgu7yXtW1j2UWkAnjyzAnFRUfb:y+6DTL1RUWVsPUW8FPUWhnRnFRUfb
MD5:	007E9D4F8D2CDB310A2CB00ABC66D554
SHA1:	EC650348913B8C76BB9BF634FBFF0FAB6059F2D9
SHA-256:	CB5A78911D96EC31A5D458C36816591BE8983F2A9DD0E4E315DA5473124992CA
SHA-512:	9F796B251EB560C39F6359B82715EF94D83325A00FBC9ECEACF6A84BEAEC9B767A36021D4C3C1972DDEE8B707A1E904B50170C3414A169A004D7829D1189F506
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\CreditMemo.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23068
Entropy (8bit):	3.397580751364641
Encrypted:	false
SSDEEP:	96:uDTsHqW2+PXW7KWOrWBWDtWjAWPWwWtWyObW0WjW526TMW3dUWZVgIW3GWPaWaqb:64Gh2ZGd/Q/EkQ3qoQiPZsAw
MD5:	0CD8B2D4E3EC5E9C2F79D6910DCA7BBD
SHA1:	811188337FDA66CF1109A0391E59BCC595A6BF44
SHA-256:	2809658D7E0DE5B09CDFA780F2354A25B0E288ADDC1D6D7C5AD1653D26313B84
SHA-512:	9EEAD1170B869BB61504CDFA5E69F797162D6B00F474F8FE46E647A07903BE48F1187D1F33F4C4D197B67FEE74AC54B469D9F8EA396F150FC2278491BB3DC0B6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Customer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17704
Entropy (8bit):	3.3778298617907954
Encrypted:	false
SSDEEP:	96:uDTjuWfWnW/CnWpjWYW9WHWaWNWimWZRoW9GWVWW5WWwW2zWLEP5WVDyDoW8EmUH:CvC/0Fr8YXNT2pr6ww
MD5:	AB72B1394124E9E1118E15E8EF4E511A
SHA1:	5EC1BAC179E30696F1AD70AE3A93AF810020BECD
SHA-256:	B0B47D9BFF22CD109523E2E1E85EFA1D026B57AA2A6D74D27E6000EED52D1C9E
SHA-512:	1855DFE41F1B8D56E2B341EA7D106C9A45E5E933D89AEEF0BB6796CD2220395CE73DA5245E066D6FFD2A2006D7EAB4E8B216122C9A1BBB3F9378B91876DAFCDB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Deposit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6156
Entropy (8bit):	3.4137444628644134
Encrypted:	false
SSDEEP:	96:uDTs4UW7G7WPHlWyW8WBWdcDvWoWqFWwTW+gHkW+HArW+RC9W/qWBSWn2WT2VXWW:ocDYw
MD5:	1803FFF728F97073799C80B67C8FDEE7
SHA1:	0E643BBEFACC62B6661B37C62A66DBAA8658217D
SHA-256:	321392B689C4F31E1C684FB21DB11CFDF832AC047D206EAC28CD28565D3E08C0
SHA-512:	28EDC510A58A87A67B183ABA6953F3242021A517E53FCB06AF98F9615FEF9A878B7055AF15D44519BD174EF528F8BCF09C8FF593151F87B35580F30BDBF7A3FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Employee.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	3.3517687010608053
Encrypted:	false
SSDEEP:	96:uDTnWGW/CnWpjWYGMrWfWDWpWrW9W4AaWJWpWnWOEtWZZW5mWnWyWDUWtoWkUWw+:xCUgAB6x/LebT2iw
MD5:	F3C984C4AE1632BC89840291BEB00358
SHA1:	5DF688B375EE3938472534F937695E49C454ADC5
SHA-256:	3A639B3086EB68D7252C9BEFBDDE1B30B65EB48BBB8B3C42ED3E85F920AE459D
SHA-512:	D4B0D0FAD035E049F68D74EBE21F2CC7A077B0F83D3C1546B4D2758058826868639E8E52936F33EAE0807DBF1D650E63160641AFDBF1561B83F024BDB409E40C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.I.R.S.T.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Estimate.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18398
Entropy (8bit):	3.3839688551388196
Encrypted:	false
SSDEEP:	96:uDTsDJW2+PXW7piWOrWDtWjAWPWtWfW0WjW526TMW3GWPaWaqWlaWimWVWZRoW9T:bX4iE72OVd/Q/UkQLZsAw
MD5:	341CF2CF665673DAF34D8D2F2E5588E3
SHA1:	A81D0913EC0CD932745EBA0E63AF993CC6D58150
SHA-256:	E0A00EA9FF43381DD90AD30F8698A1006055F6307F21EE4679BD8A5D3ACE004F
SHA-512:	7537BF4412647F2A495B1DD194C82E2BD6AF345192C28882C17E728B76887215924590DE9596237F47385EBF777D63606E4192F6264BE7B3F0C6F79B008D6444
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Invoice.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10153
Entropy (8bit):	4.757512621728147
Encrypted:	false
SSDEEP:	192:tWlPvKZ66qEVSLoH4VdrjJlYYANFbHZGBJ1gN7J/NTx+JohknTZl+N9O3ZyxBwaH:tWlPvKZ66qEVSLoH4VdrjJlYYANFbHZ/
MD5:	C67C6FA1BE699190A935B1E7F92607B1
SHA1:	6D8BFE09A3E9F3E419DD5BF9E37C5467F6F8C78E
SHA-256:	9F001FBCB2FF3B2DBF888058104FCAEFF86CE1AE1A2883BEB263D4D8F56F3906
SHA-512:	A41521002C8150D096B6742BDF99A7D8BB1CC1E4841E32A9B1250241ED33534AED0F323781DE792247F55FBA485D76B9C943C0EC5BE6F6DAE564144E7CF735AD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>TRNS: DOCNUM</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>TRNS: NAME</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>TRNS: DATE</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>SPL: INVITEM</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>SPL: QNTY</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeader>SPL: PRICE</Fi

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\ItemReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11698
Entropy (8bit):	3.396173076147388
Encrypted:	false
SSDEEP:	96:uDTs2WJnW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjRWBWBWgXcJXWSWkWDWRW0WjWU:GBFwbJcJj2Zqw
MD5:	A73CDF57131CBFDAB6681AB305AA80F5
SHA1:	F48F228AC5063EACF3ADF97DA6294C0C0758B87C
SHA-256:	A0FE24F35C8B60E21CC3EAC5703436C9D6B48700F10191C083FD6CDEDFAD2A9D
SHA-512:	AEF52B61FC72666A09748CDD5AA8F447AB93DF3D9FF88DDFA70DD9F71005D8821C3506FE8843789A406D9E477F295FA2487C5589FED122B3A3E89065BED1CAEB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\JournalEntry.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5624
Entropy (8bit):	3.401160832913635
Encrypted:	false
SSDEEP:	96:uDTsg1WbWWp7W4WAWzWWpWcWNWxWoW4WnWmWiWn2WT2VXW8iWxhofb:/w
MD5:	DE18D67EC219EE8784CB915380231A69
SHA1:	D7CE005E0E38B03D67293BEEE56AA84B3A92D1E0
SHA-256:	4CEE9DB7E008DC632EEC4AC53C3BB48DF60EEE13289227BEBFBD775EC025D141
SHA-512:	78A52F9E4D0D8854EBA021E4BF3907DFBFCEE3E26D50278993814DE4FCC62669D1161EB97C82931A702BD116D7E563C595B55F14C6EFD2B13AE1870334B24814
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.e.n.t.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\OtherName.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.371180909495819
Encrypted:	false
SSDEEP:	96:uDTGWPWfWnW/CnWpjWYW3WKW52WxooWeOWcWaZrEWAWVbIFbbW3W1kSEWrW3W8ip:JCIUw
MD5:	4724BDA353907F831C9EE02CC56F0589
SHA1:	05F9763BE0CA8893A63541BBD4CC882420DE2900
SHA-256:	5E2931C298FCC22D481DF7F2ADECA18B2C7BAE222C909F02C2E592C0112A38FF
SHA-512:	6094FC542D8A2116A0B51531602C9D98996140BA081C2E06C84FC90620B6469ACE40B7DD5561D0CBF8325A47E9254760A36F221C18638F86F993D302B09A90A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.O.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\PriceLevel.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3780
Entropy (8bit):	3.383914597363917
Encrypted:	false
SSDEEP:	96:uDT7XWn2WcyW4WRWiWikWTvsW3W8iWxhofb:AjbvXw
MD5:	D366551F82B5F038C3D0A4C98AB63141
SHA1:	8F9FE782CA5C2B505410BFBA637D03DB81FFFC7C
SHA-256:	357AC25AA7A8570F6983805C251085879555D3EE0B04EAFA51053CB6125AE1C2
SHA-512:	16DCDBCA2F384C588953235C2CCE601FBA6FD664CF4CD9AB72D6F9BA9F80A67B74C9BF9E0E62A4587B3EC66A968D378A67835573B06B0EF7966D5BF16AD583E9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.A.L.U.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\PurchaseOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16308
Entropy (8bit):	3.39751102690321
Encrypted:	false
SSDEEP:	96:uDTsUWJnW7KWOJWhWDfWjuWzW6WjWgXVQXWxWRW0WjW526TMW3GWeaWTqWIaWVm1:2kVQT2OvaZsHw
MD5:	4A2597CFF83C4C0C42E2ECCE4E29776E
SHA1:	49D3B3FEAEA5AB634B36BBFEEAB4686F0281A76D
SHA-256:	1C037EE6E31DE8A7DC485E67BA2B836F86837D8B55E311DFCA7C980F9D82C8BC
SHA-512:	10430F3309FB9BFD7EB54773E8CF1B6F6BEC58497D2CC02A02270483EC3298788D9AC19DE99A9AD3CDB1E496348B7858E9E8CDE510CBD47704E31A15B7F416F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Transfer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	3.425055648101356
Encrypted:	false
SSDEEP:	48:y+6DTLfDRUWJfcRUW+RUW3qRUWHfjRUWGRUW8FPUWhnRnFRUfb:uDT7KWRLWhW3dW/qW5W8iWxhofb
MD5:	2E942AB54EC0B0FDF9B26C6BF8809DEC
SHA1:	B774A60BA12055E3ED472D19680EA7A76A3B2B03
SHA-256:	E6E1B5547E1FB85BE8A1A8700772C47249804B47E7516FE51DA1130023C6A184
SHA-512:	97E795DDB4DBE5FE815F0D6BE55014637E2A48CF14D738F96CE4F9741483E6D4F8A31F6E23EF2C5650AEACFF501BD51F79E97D8D58E912A7015C31369C52C5B0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\A6E3C0BB\Vendor.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13726
Entropy (8bit):	3.3711405370788805
Encrypted:	false
SSDEEP:	96:uDTiWfWnW/CnWpjWYW7IaW9WQWxWmWVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDyDN:6CbIP8wT2XrTpw
MD5:	1D3FBC50FA064BE05D3CE6BDB3D9742F
SHA1:	41879CCBB18FB42D23E64F12711D20622E46FA9E
SHA-256:	43B97088050C7A5D64FF8B5DB96D3A740BC32721B745D3E6F794964D673A936B
SHA-512:	AFFD9B5FD27F359E9FCB7442B3BAAAF68E9BB9EB0AC6A111A3F52D73C5483B7EB9FC5F9FB116ADA85CCCD1BB7FE357415E43C03553055AAC6B5FFBE239092362
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Account.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.385828093280008
Encrypted:	false
SSDEEP:	96:uDTGWyW+WsWMWTW3WPWnlWfWoWnWFRxyxmW3W8iWxhofS:0REX9
MD5:	1683427F2A9E604FC547E2AF1FCC887D
SHA1:	329087DD3E93D911E01F4016BA8CA4B353F01472
SHA-256:	B2EC6DA369E892D257A698E8122976FB18E16A539FC0A40B95B4921C65B3B117
SHA-512:	E7E8B451D83AA6E6D1995E60B8700393179635C4FF81D4319D80508018E4CC905819F91D70B94E583EC04D96D81E7B6F60E24CA046E166270CCF02B8388F9E68
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.T.T.Y.P.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.C.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.N.u.m.b.e.r.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Bill.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15344
Entropy (8bit):	3.387950593600828
Encrypted:	false
SSDEEP:	96:uDTsGWJnW7KWJWkW4oWjUXWPWyWYW1WoWDtWjRWBWBWgXcJXWSWkWDWRW0WGW52h:2BULJcJw2ZNEjw
MD5:	095636ACB47CC26ACD619DD62811FB6F
SHA1:	40900F2D4594B5D9FE191A746328B4CD56786291
SHA-256:	E9BFA8A45BE8F09A966EC9FE1BE504017F7517978339D59111214982BE6D653E
SHA-512:	A2D7DA83B518230E9008F646643EC7E83B1A6ECA1C87EB27FD938FE6B8461CFD03DB5E0D64FBFA9A8F49D2494B8AA7471EEE584C4C3C46DD8E7CB666EF052FD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Check.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12946
Entropy (8bit):	3.394060848942431
Encrypted:	false
SSDEEP:	96:uDTs9vWAWW1zW7KWJWzW43WjUXWPWxWYW1WOrWDtWjAWNWBWgXcJXWSWkWvWRW0A:VJkUGucJP2ZiEYw
MD5:	6B27345C734DF6D78E8EBA63B75F9E80
SHA1:	73610EE6AFA7AA8D505733F6EAD59FD041C5FB49
SHA-256:	9671C838047B628731F03E1D0E00C387B8B769711B148C85DB8DFB0BDAA6DF61
SHA-512:	E967133531E17A09898D63CB1AC2332DF6B3A138364A65D7B48597C771366B0D2E5570F6F8991E851D6E265A5F7B19DFB20DB4C082B528BCC27DEDCAB0322267
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Class.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	3.401438369594957
Encrypted:	false
SSDEEP:	24:QlL+6DTL5yoRUWVVyVW1j2UWLgu7yXtW1j2UWkAnjyzAnFRUfb:y+6DTL1RUWVsPUW8FPUWhnRnFRUfb
MD5:	007E9D4F8D2CDB310A2CB00ABC66D554
SHA1:	EC650348913B8C76BB9BF634FBFF0FAB6059F2D9
SHA-256:	CB5A78911D96EC31A5D458C36816591BE8983F2A9DD0E4E315DA5473124992CA
SHA-512:	9F796B251EB560C39F6359B82715EF94D83325A00FBC9ECEACF6A84BEAEC9B767A36021D4C3C1972DDEE8B707A1E904B50170C3414A169A004D7829D1189F506
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\CreditCardCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10730
Entropy (8bit):	3.3973078263426566
Encrypted:	false
SSDEEP:	96:uDTs2WNggW1nW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjAWBWBWgXcJXWSWkWDWRWo:PBFwbqcJj2ZFw
MD5:	05489A893E54DDC5FB6CF04CB6E694C6
SHA1:	3127D4D44195A71A0E4747777BC897050C7E8ABC
SHA-256:	69F89A746D7C56D9208A3E78C5A73528DDB1608982EE88890E23A497F8ECAD41
SHA-512:	F8186EF3DB6EF7B04F60E31F20CDD7BCF7DF00934B4F43A5895EEDB37447A335B7E268DC9D7F944E2446178CC036B59567A614ADDD0072DD9B0FBCAC4ED029CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\CreditMemo.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23042
Entropy (8bit):	3.398223768542637
Encrypted:	false
SSDEEP:	96:uDTsHqW2+PXW7KWOrWBWDtWjAWPWwWtWFbW0WjW526TMW3dUWZVgIW3GWPaWaqWC:64Gf2ZGd/Q/EkQ3qoQiPZsAw
MD5:	9D370170D4ACF993A9B35110DCCCF56D
SHA1:	1E83299B41D3191307126BBEBD0ED6B6736752DB
SHA-256:	F95D179C9EABBC684050AE0CB40055F1A3F67FCFEB95FADCFDD792E879E5AAD1
SHA-512:	5EE5F8F08FD556A58FEF02E5BDC0AA1B618B660C853288488E2C4FE62F7070D8B243454D9DFAD912130A022945D3B1CC52B5D55603240F5ABFEED7755143FDCD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Customer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17704
Entropy (8bit):	3.3778298617907954
Encrypted:	false
SSDEEP:	96:uDTjuWfWnW/CnWpjWYW9WHWaWNWimWZRoW9GWVWW5WWwW2zWLEP5WVDyDoW8EmUH:CvC/0Fr8YXNT2pr6ww
MD5:	AB72B1394124E9E1118E15E8EF4E511A
SHA1:	5EC1BAC179E30696F1AD70AE3A93AF810020BECD
SHA-256:	B0B47D9BFF22CD109523E2E1E85EFA1D026B57AA2A6D74D27E6000EED52D1C9E
SHA-512:	1855DFE41F1B8D56E2B341EA7D106C9A45E5E933D89AEEF0BB6796CD2220395CE73DA5245E066D6FFD2A2006D7EAB4E8B216122C9A1BBB3F9378B91876DAFCDB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Deposit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6156
Entropy (8bit):	3.4137444628644134
Encrypted:	false
SSDEEP:	96:uDTs4UW7G7WPHlWyW8WBWdcDvWoWqFWwTW+gHkW+HArW+RC9W/qWBSWn2WT2VXWW:ocDYw
MD5:	1803FFF728F97073799C80B67C8FDEE7
SHA1:	0E643BBEFACC62B6661B37C62A66DBAA8658217D
SHA-256:	321392B689C4F31E1C684FB21DB11CFDF832AC047D206EAC28CD28565D3E08C0
SHA-512:	28EDC510A58A87A67B183ABA6953F3242021A517E53FCB06AF98F9615FEF9A878B7055AF15D44519BD174EF528F8BCF09C8FF593151F87B35580F30BDBF7A3FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Employee.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	3.3517687010608053
Encrypted:	false
SSDEEP:	96:uDTnWGW/CnWpjWYGMrWfWDWpWrW9W4AaWJWpWnWOEtWZZW5mWnWyWDUWtoWkUWw+:xCUgAB6x/LebT2iw
MD5:	F3C984C4AE1632BC89840291BEB00358
SHA1:	5DF688B375EE3938472534F937695E49C454ADC5
SHA-256:	3A639B3086EB68D7252C9BEFBDDE1B30B65EB48BBB8B3C42ED3E85F920AE459D
SHA-512:	D4B0D0FAD035E049F68D74EBE21F2CC7A077B0F83D3C1546B4D2758058826868639E8E52936F33EAE0807DBF1D650E63160641AFDBF1561B83F024BDB409E40C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.I.R.S.T.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Estimate.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18352
Entropy (8bit):	3.384551124984066
Encrypted:	false
SSDEEP:	96:uDTsDJW2+PXW7piWOrWDtWjAWPWtWFbW0WjW526TMW3GWPaWaqWlaWimWVWZRoWx:bX4iE92OVd/Q/UkQLZsAw
MD5:	62AE25FBDDDC98DB1A4B1CEDD59F708E
SHA1:	34F4D1D40DD74D089F812AC82696D767F074C33F
SHA-256:	6DFE8B6D0E73BB9B92556B43F0A1926F658E8D3C3B56733331B865B948B96ECD
SHA-512:	8BC81FFD54DCF4E659EA0DCCD27A78460EB4E67546F597789883B4D71539E694B8F774EB03BA5E25E6BFF0591A1DF94DAC8AF9146CBDF2A48618059860716874
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Invoice.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10140
Entropy (8bit):	4.758739425022912
Encrypted:	false
SSDEEP:	192:tWlPvKZ66qEVSLY9H4VdrjJlYYANFbHZGBJ1gN7J/NTx+JohknTZl+N9O3ZyxBwE:tWlPvKZ66qEVSLY9H4VdrjJlYYANFbHh
MD5:	52AFA928FD6D0FD9268EB16B131E519A
SHA1:	F41C216F86A999BBE40E24F05D7B9A69F3C089C7
SHA-256:	2386EF38E0ED0D2CFD93B21B5E38B8236D25FBE0D48B8542D714BF3FB9B9B98E
SHA-512:	0D0537C7B425DF0E5F7EE6B8BE9A28B121DA8A399FC3295BF0957A346736B369C9BEB7725F5B5ABBF2D5C59872D6EC0C111A40E312C9F56D3DA5ABE9CDC65BD1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>TRNS: DOCNUM</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>TRNS: NAME</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>TRNS: DATE</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>SPL: INVITEM</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>SPL: QNTY</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeader>SPL: PRICE</Fi

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\ItemReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11698
Entropy (8bit):	3.396173076147388
Encrypted:	false
SSDEEP:	96:uDTs2WJnW7KWJWkW4oWjFwXWPWyWYW1WOrWDtWjRWBWBWgXcJXWSWkWDWRW0WjWU:GBFwbJcJj2Zqw
MD5:	A73CDF57131CBFDAB6681AB305AA80F5
SHA1:	F48F228AC5063EACF3ADF97DA6294C0C0758B87C
SHA-256:	A0FE24F35C8B60E21CC3EAC5703436C9D6B48700F10191C083FD6CDEDFAD2A9D
SHA-512:	AEF52B61FC72666A09748CDD5AA8F447AB93DF3D9FF88DDFA70DD9F71005D8821C3506FE8843789A406D9E477F295FA2487C5589FED122B3A3E89065BED1CAEB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\JournalEntry.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5634
Entropy (8bit):	3.4039784593921643
Encrypted:	false
SSDEEP:	96:uDTsg1WbNWp7W4WAWzWWpWcWNWxWoW4WnWmWiWn2WT2VXW8iWxhofb:Iw
MD5:	4AA435BFA1FA43EB61347CBA9D610796
SHA1:	C84B868C5C3B9C9DB67968B4DB925C9A6B9B68CC
SHA-256:	7C492BA1526A8E88CBD927A28BD1BD5974864F0DEB8C604C26E7C57AC77A7878
SHA-512:	B102C9C696A5642EFC270A5450F638EFEF2147610CBDAFA57081C72B6CF46C3899BB34E8C8C6AE681E56BA0F4B0BAFC7B61772D0FE556A985EBF1088431B3427
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.e.n.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\OtherName.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.371180909495819
Encrypted:	false
SSDEEP:	96:uDTGWPWfWnW/CnWpjWYW3WKW52WxooWeOWcWaZrEWAWVbIFbbW3W1kSEWrW3W8ip:JCIUw
MD5:	4724BDA353907F831C9EE02CC56F0589
SHA1:	05F9763BE0CA8893A63541BBD4CC882420DE2900
SHA-256:	5E2931C298FCC22D481DF7F2ADECA18B2C7BAE222C909F02C2E592C0112A38FF
SHA-512:	6094FC542D8A2116A0B51531602C9D98996140BA081C2E06C84FC90620B6469ACE40B7DD5561D0CBF8325A47E9254760A36F221C18638F86F993D302B09A90A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.O.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\PriceLevel.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3780
Entropy (8bit):	3.383914597363917
Encrypted:	false
SSDEEP:	96:uDT7XWn2WcyW4WRWiWikWTvsW3W8iWxhofb:AjbvXw
MD5:	D366551F82B5F038C3D0A4C98AB63141
SHA1:	8F9FE782CA5C2B505410BFBA637D03DB81FFFC7C
SHA-256:	357AC25AA7A8570F6983805C251085879555D3EE0B04EAFA51053CB6125AE1C2
SHA-512:	16DCDBCA2F384C588953235C2CCE601FBA6FD664CF4CD9AB72D6F9BA9F80A67B74C9BF9E0E62A4587B3EC66A968D378A67835573B06B0EF7966D5BF16AD583E9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.F.i.x.e.d.P.e.r.c.e.n.t.a.g.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.A.L.U.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.x.e.d. .P.e.r.c.e.n.t.a.g.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\PurchaseOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16308
Entropy (8bit):	3.39751102690321
Encrypted:	false
SSDEEP:	96:uDTsUWJnW7KWOJWhWDfWjuWzW6WjWgXVQXWxWRW0WjW526TMW3GWeaWTqWIaWVm1:2kVQT2OvaZsHw
MD5:	4A2597CFF83C4C0C42E2ECCE4E29776E
SHA1:	49D3B3FEAEA5AB634B36BBFEEAB4686F0281A76D
SHA-256:	1C037EE6E31DE8A7DC485E67BA2B836F86837D8B55E311DFCA7C980F9D82C8BC
SHA-512:	10430F3309FB9BFD7EB54773E8CF1B6F6BEC58497D2CC02A02270483EC3298788D9AC19DE99A9AD3CDB1E496348B7858E9E8CDE510CBD47704E31A15B7F416F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\SalesReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23006
Entropy (8bit):	3.3910042780355365
Encrypted:	false
SSDEEP:	96:uDTs/W2+PXW7eWoWOrWDtWjAWPWwWtWFbW0WjW526TMW3GWPaWaqWlaWimWVWZRD:J4pf2Ofd/Q/FkQaqoQ+cDSZsOw
MD5:	9A8BE944D08BEBB64947BD99658E3F94
SHA1:	AC50E83F4FF5E2901B94ADCDBA7DE79B2C1ADF7B
SHA-256:	8D036545AE9FDDD19A67EF6CCF8E305C6A93C2089577166DEAB49C3B10DC0038
SHA-512:	4FCFD63CAADDD73AFA7679BA7E713F8A145E70662890184FE41A0195870E1480DDA4FD2449923A9C2A9F78941ECF9CE4958299D24B73EF2815B01735888BBB21
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.O.C.N.U.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Transfer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	3.425055648101356
Encrypted:	false
SSDEEP:	48:y+6DTLfDRUWJfcRUW+RUW3qRUWHfjRUWGRUW8FPUWhnRnFRUfb:uDT7KWRLWhW3dW/qW5W8iWxhofb
MD5:	2E942AB54EC0B0FDF9B26C6BF8809DEC
SHA1:	B774A60BA12055E3ED472D19680EA7A76A3B2B03
SHA-256:	E6E1B5547E1FB85BE8A1A8700772C47249804B47E7516FE51DA1130023C6A184
SHA-512:	97E795DDB4DBE5FE815F0D6BE55014637E2A48CF14D738F96CE4F9741483E6D4F8A31F6E23EF2C5650AEACFF501BD51F79E97D8D58E912A7015C31369C52C5B0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.P.L.:. .A.C.C.N.T.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\Vendor.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13726
Entropy (8bit):	3.3711405370788805
Encrypted:	false
SSDEEP:	96:uDTiWfWnW/CnWpjWYW7IaW9WQWxWmWVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDyDN:6CbIP8wT2XrTpw
MD5:	1D3FBC50FA064BE05D3CE6BDB3D9742F
SHA1:	41879CCBB18FB42D23E64F12711D20622E46FA9E
SHA-256:	43B97088050C7A5D64FF8B5DB96D3A740BC32721B745D3E6F794964D673A936B
SHA-512:	AFFD9B5FD27F359E9FCB7442B3BAAAF68E9BB9EB0AC6A111A3F52D73C5483B7EB9FC5F9FB116ADA85CCCD1BB7FE357415E43C03553055AAC6B5FFBE239092362
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.O.M.P.A.N.Y.N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.A.L.U.T.A.T.I.O.N.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\C2A3C96C\VendorCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	3.3886826903517617
Encrypted:	false
SSDEEP:	96:uDTQL9WJnW7KWJWkW43WjFwXWPWyWYW1WoWDtWjAWBWBWgXcJXWSWkWDWRW0WjWb:LkFwLqcJj2ZZw
MD5:	B04B6EDB6B582A743361788847CF0BCD
SHA1:	3F3815AFA4A67477747C74EF0488A1DC2015C323
SHA-256:	A215A41010A602B5B702EA8AC6604F847C32A83A4B5D2878297075F21C3314FB
SHA-512:	45E2F77CB6EC77129E8602E21C350E03A1C46A6B4DEA9CC3E5313A779D4DDA9A0BFC84A6DAAF732CF0D88D118270A44FF775163951BE19E705BA1AC3FB6975AD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .N.A.M.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.R.N.S.:. .D.A.T.E.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\F335F1B9\BuildAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\F335F1B9\TrialBalance.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	3.368119197538534
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRU2EyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWo2EyFWKWHWUWb1KxfS
MD5:	99992F30FCF428E325882BEC39FA7727
SHA1:	2CB68A9D3AB9FBA2A44815AF2BAD507316900034
SHA-256:	EF3BF42B4A3642C7B4BF153EEDA3875FD44C1C0F144F45BA91993014A5FA4E32
SHA-512:	6D8B04C92990AC392F523011AE2E3F9372BC2E3919FBE2614F82B7BCFF98E4B006632EEAC0EDF281CA7580B7A009EACF3C692C5A24CEE5972869D8BA8F241587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Account.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5438
Entropy (8bit):	3.363475259267064
Encrypted:	false
SSDEEP:	96:uDTmv8W9WgWpWYWTW3Wn+WfWoWnmFRxyxmW3W8iW3iWxhofS:PREXT9
MD5:	360D0BC74F8F50129FADB1E1535877D3
SHA1:	BE3BB98EB180147CE128D1B3E9CC3849AC237CE6
SHA-256:	C643F8DF342C5901CA8D074461439953B390E079AE70492D67C18F090BFAE6CE
SHA-512:	06FD685A205B0813CCF53A10B6674BA97B629E82AACB9EE73184946FD4238017AA90AB3D4F100CAEBD85AF874C55280077C897DCA3D8FA73E0590D927D80EAE2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\BankStatement.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3892
Entropy (8bit):	3.3594933314149307
Encrypted:	false
SSDEEP:	96:uDT+WXWxWEW0WJWQWpWdch1WiW4HWn2WT2VXWxhofb:gchJv
MD5:	84679772B48C7AB9511AD37BC6FBDC18
SHA1:	21B7B86AEDD405145C0B4D68F425A3D8CF53C277
SHA-256:	F5181ED1DE18D1854DC6AD871DAA62B2731F55C68FCC83D10833FE45130666B2
SHA-512:	C2929284FF525B2DE07D54A0012067CB4403530074290A25B543D86F7AEBAA1E3C32B724BD986C573F48CB076132BB16285142360326902BE52D746474ED1D38
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Bill.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	15188
Entropy (8bit):	3.3670458887140775
Encrypted:	false
SSDEEP:	96:uDTyWjWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WGW526TMW3dJ:nkFwMlcJN2bEiTw
MD5:	7663C4182FA8F67F5503865682360BEB
SHA1:	5EADA9C202AF7A75DB7252561BD2938E74B9C656
SHA-256:	56B5DBB56FC951C4D7D51FA822844C5367504279144AB8494357B36B92CC472A
SHA-512:	CB6C13E6FEDF65C0B0432F34A257237CEB008AFDE4FABA3A540C61D32915AA9476BB466072DB2D7AB6E7E8333D1A60BB360E5F4BE8C0C549F19063176B1ACB4B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.x.p.e.n.s.e. .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\BillPayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXW3WDWxW+WBKgWoW0WbWuDWVWn2WT2VXWnWcG3WeoFWDEW/W8iW3iWxhk:dfmTw
MD5:	A316197A5B8C458F08911F47C3963B51
SHA1:	CEA20BE2D1FFA05399B86ADF4EBC4AFDDA839921
SHA-256:	390D6876397DFACB98BE0AF57488A41FEEA115595E84DB956E628A541D6F0C12
SHA-512:	9682C85F5E3972D713D87423F67C5D4ED7AC3D8F34F786E598CF65FCE2F18167AFD9A81FE387388B99D6CC31608BEB012E118B66CCBC41BC69FCE219AF54E066
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.i.l.l. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.i.l.l. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.m.o.u.n.t.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\BillPaymentCheck.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3WeoFWDEW/W8iW3iWxhk:df+Tw
MD5:	119EEA3B83228CF4AF90DB3DA987393D
SHA1:	36E1EE9BFD06B5DB21E8057D6B0A94046805F927
SHA-256:	5BE92994641722A1CAD46DFC600645960E53C3928B2833CA296CDFE865B71118
SHA-512:	367416667D7660D6ADA00DA018FC90DCF6F1035E394B637E75AD26163D9B878902BCA03BBA5FEEC8E2C301A9B3CC60AA10A3F4FDF82593BC418AFFADAC967DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.P.A.c.c.o.u.n.t.<./.K.e.y.>..... .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\BillPaymentCreditCard.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.370086356748662
Encrypted:	false
SSDEEP:	96:uDTcfvWXW8iW3iWxWnWoW+WBKgW3WDW0WbWuDWVWn2WT2VXWcG3WeoFWDEW/Wxhk:df8T6
MD5:	B0BD54E925B232D10BABC76E4DB3E76E
SHA1:	8BD9BE3FEF0D8482F970C88B992B5AA3CC1D6204
SHA-256:	F6EAA273E21AD44EF18EDCD6D720D9CDDEC05E20A37DE2CC6C1F7B22834B95FD
SHA-512:	5A2059498E0AC05A5A4BD5520FCF6418C143029C29B36E230200CC5AE7DBC119CBA19D7A4CF0564AA3F7A99A126422898DAF82B54B92991020A8A6EE681B65CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o./.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\BuildAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.714780910689675
Encrypted:	false
SSDEEP:	96:OYO2vVMydL8ULIDd6e4lJWjM+eUReG5EJ8w3qB8cd8yk8TiFAgmP847I841z8C8Y:aKVZdHOdpeqzekeIM8Cu88818T6g8N8m
MD5:	4CAB16ECC9D264E67FB5BF7A8B261BF1
SHA1:	C3A0A0AAF19FD8B42D090EBDABCDEA30B988DD20
SHA-256:	ABCE847730645F4D7DA2BAC10A8F66FCDF013A1B578C7F3FA3AD241A11B8B93A
SHA-512:	E478972D63593D44409BD78EA4C92B62A9FEE1A7963E9C373F3F0869D2D7AAE16BBA21BDB031100A9FCB5435293869A3AC9600658A3F659342445481982924EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Build Assembly No</FileHeader>.. <Display>Build Assembly No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>ItemInventoryAssembly</Key>.. <FileHeader>Inventory Assembly Item</FileHeader>.. <Display>Inventory Assembly Item</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySite</Key>.. <FileHeader>Inventory Site</FileHeader>.. <Display>Inventory Site</Display>.. </MappingLine>.. <MappingLine>.. <Key>InventorySiteLocation</Key>.. <FileHeader>Inventory Site Location</FileHeader>.. <Display>Inventory Site Location</Display>.. </MappingLine>.. <MappingLine>.. <Key>SerialNumber</Key>.. <FileHeader>Serial No</FileHeader>.. <Display>Serial No</Display>.. </MappingLine>.. <MappingLine>.. <Key>LotNum

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Charge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	3.341511882057727
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWxWoWDWWj6yWpWDW0WjW526TMWCwWPWdW5W8iW3iWxhofb:jVQD6y2lfTw
MD5:	4DE6FBB0E4913F56506A55D2F197CD89
SHA1:	0EEC53EDF169E613317FE7FDA43A9D48043D620E
SHA-256:	8DA6DAFE0EE49B9B773956B0A108C3C40BA81A4074470D9936887381D19A0F26
SHA-512:	C76CFD7CFB9E65C902DDD55B4EB6124974B79451AF86A0EB52AB47A2563CDA4413B25716242FE79AC9868DAC86174376C0863FB7712568C8E065350B932DA3CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.e.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.e.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Check.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12102
Entropy (8bit):	3.36502616526145
Encrypted:	false
SSDEEP:	96:uDToDvW+WXWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526TZ:xDRkFwMlcJm22E1Tw
MD5:	3C11F4A8197ABCA19BF95E30D358CB99
SHA1:	1448716D5F22BE1B190E23241BE31D74E00B098F
SHA-256:	E898106D8823696FA67F6E5EA530A7863A79E93649C6753D5CF9ABA856DF3009
SHA-512:	29608B3C9004864851954938E5DB8A872F776BA89DA3D5657681A63E38A0FF595B80A3E54A722D563945417929089F2D9644122158CA3C4CE607C69A5994505C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.h.e.c.k. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.h.e.c.k. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.n.k.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.n.k. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.n.k. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.e.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.e.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Class.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	3.3737628801824364
Encrypted:	false
SSDEEP:	48:y+6DTfRU2VsPUW8FPUW3FPUWhnRnFRUfb:uDTG23W8iW3iWxhofb
MD5:	8394D50FB8C4B1B44E4BFC1E85D8E90E
SHA1:	6FF949F58308BB699CD5AB6C8843F968DB9A135E
SHA-256:	3780ABC3C231B58C09AE37893FEA3AFE44AEE41F07EB503BE4BF9BE90E2204A5
SHA-512:	2C4265418371BC6D88263DB8727982545CEC9214835D8BED5C30EB7D54B51064FFE5674D51D770782899DCAA9AA8A27B6929BA09A902DBDD9837F28C7D43B417
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.c.t.i.v.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.t.a.t.u.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.t.a.t.u.s.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.p.o.r.t.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.a.t.e.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.a.t.e.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.a.t.e.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\CreditCardCharge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	12450
Entropy (8bit):	3.3722979297344806
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526TQ:UkFwMlcJm2yEQTw
MD5:	0B93967EEF020B5DEC9700DF4075F070
SHA1:	54B0D91792A9FF53A8B7BA418FFEFDDF0B3164EC
SHA-256:	0374107985E2BBC957535BA89FA373C7F84C2CF3FE0FD37F5E7DCE7CDFE616B0
SHA-512:	6B266F7113580060A6935982CBDE9E6CA3D08D275ADA70C94918821313DB0347DF9E210479115A8BAE90B1DB2B69E0921BE0435B48CB8E45AC5063FB1A03F185
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\CreditCardCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9908
Entropy (8bit):	3.3731464485228266
Encrypted:	false
SSDEEP:	96:uDTaWBKgWvWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526T3:UkFwMlcJm2RTw
MD5:	74884BEF4C0176341524937C5AEC586B
SHA1:	AD0CCA9DC8E994AA5AE99CC8A7E3C665A48E4B65
SHA-256:	1CD0CEC3CF4EE52380E0DEA49DA70EB4DCEFF980A96A7148A5C155A5A15A8117
SHA-512:	3401652C33265E156641C0C6C8F3EFBD0F6D389B939808BAD330B818473F1A21864D87CDF529FD46628F61C98B8A37F76EC1F94C99181607A49037D47F81A06E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.i.t.C.a.r.d.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .C.a.r.d. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.e.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\CreditCardStatement.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	4.692990702071966
Encrypted:	false
SSDEEP:	48:3YV1LJ1mc+J1+c7ZJ1ucuJ1QcwJ1Dcu8J13cRJ1uc0kEfJ1Q3cMuYJ1bchXJ10cF:O19/2v7bGx8yuYGv/mbuuvhn5SQIE86t
MD5:	C273CEEDC243730052117AFD713A67F5
SHA1:	03FFBD551BBD539F74EFFD7376F9940241CD49FA
SHA-256:	29EA33F57ADD9BE1C7B3C130FA09D7D8340E81B6BA4309028265A05C092257CE
SHA-512:	79CDA28A495DAA6BC3900A451EA16AE678A6490B698C6A20EA18D987F90962D8B3B4C806A576043DC84F7C19752D51BF2CFC1DDA9285DCC0B9BE636DB6DE42A4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Statement No</FileHeader>.. <Display>Statement No</Display>.. </MappingLine>.. <MappingLine>.. <Key>TxnDate</Key>.. <FileHeader>Date</FileHeader>.. <Display>Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>CardAccount</Key>.. <FileHeader>Credit Card Account</FileHeader>.. <Display>Credit Card Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Payee</Key>.. <FileHeader>Payee</FileHeader>.. <Display>Payee</Display>.. </MappingLine>.. <MappingLine>.. <Key>Account</Key>.. <FileHeader>Account</FileHeader>.. <Display>Account</Display>.. </MappingLine>.. <MappingLine>.. <Key>Memo</Key>.. <FileHeader>Statement Memo</FileHeader>.. <Display>Statement Memo</Display>.. </MappingLine>.. <MappingLine>.. <Key>ExpAmount</Key>.. <FileHeader>Amount</FileHeader>.. <Display>Amount</Display>.. </MappingLine>..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\CreditMemo.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23284
Entropy (8bit):	3.3705748386357155
Encrypted:	false
SSDEEP:	96:uDTQQqW2VQXWxWoWBWDWWjRWjW8WhWyObW0WjW526TMW3dUWZVgIWlWcWfWimWVm:jVQSu2rd/Q/ckQPqoQvZsATw
MD5:	2DCEE8AD7C0910CB469E7318729DFC7B
SHA1:	9E9D1800A03118513759869B1568AD81AA9516C1
SHA-256:	588587D7C8AA1EA1FF11163271A88F21D61DDB058A8AFDBFE7C6D663FE1542D2
SHA-512:	C3B42574296CF7739D6CDD9B7CC1ECC22D5DCCBF4DB950C03516E624227DC81AD481860B80D2CC5ED168185FF3AB1C15A674FFF0A1EAFF1CE8DEFD520CF0B732
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .M.e.m.o. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Customer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	19376
Entropy (8bit):	3.363329995765941
Encrypted:	false
SSDEEP:	96:uDTn/uW3WlW/qnWpTWgW9WlWcWfWimWZRoW9GWVWQP5WhawWGFzWLEP5WVDyDoW1:2/lqX0tgrtXmT2NfbDo8tTw
MD5:	A331DF847E4BEBDE703ACD132B40738B
SHA1:	EBCB542C7E9D7FB6917B6CDFEA5287989FB20E7D
SHA-256:	7AC73B1C2F82C60F6621B23EC14C0E0E6575A31E0E2F9A9622E6841B39EAAEE4
SHA-512:	3B2249BB6075894DE63FEE132D8B5B88C927BF824698FAADD14B54A30EA8B07EE4232A3784A476D49B54503E86C6498E4F5AB4CD7AABFE9E409DC7B7F387D2DE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Deposit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	3.3749994451487755
Encrypted:	false
SSDEEP:	96:uDTXNUW4e7WsclWyW8WOWdcDvWoWO8FWG2TW+gHkW+HArW+RC9WVWn2WT2VXWDWa:ucD4Tw
MD5:	9BE4C113361BB5E59939FB96658DE1B3
SHA1:	BDBA415164E76920BF6D65361D2578064085E355
SHA-256:	1FA789C19C30E4F4305CC49E183B68233E68BFF1A76DA769A9337360FD2E17DF
SHA-512:	AA6843DF3DF4ED507727D1AEA08ACB85ED000B4793CDDAE7717A84A6CD4089DC8821DC835D2CA218BC106A8AA0975541D37D67BA7DA347C1B91D2558A1BFC3A3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.p.o.s.i.t.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.p.o.s.i.t. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Employee.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	13234
Entropy (8bit):	3.3352156476733796
Encrypted:	false
SSDEEP:	96:uDTlWmW/qnWpTWgWMrWfWDWpWrW9W4AaWJW2WkWOEtWZZW5mWSWPWD2WjooWkUWt:jqkgAB7/LebT2iTw
MD5:	3609E9EBA12E03F83E63D788610AF002
SHA1:	C0DA85E709A9F29DF8CE7175F4AB82EDE5F95650
SHA-256:	68F7E3023204FDD790E888EBF4C8542AEE40882F2BCA351C400E8C69788429B5
SHA-512:	71EAEE71C913B7837E8475FDE7C26E0409E988D104FFAEF333178D38A9D1AEB0BD3BE63FA50A59CA34035B3DEDDB2A08CFC0993B3A294C6E195FB0CF10F9D715
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.F.i.r.s.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.F.i.r.s.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.i.d.d.l.e.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Estimate.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	3.3650391858722557
Encrypted:	false
SSDEEP:	96:uDTmLJW2VQXWD+iWoOBWDWWjRWjWh2fW0WjW526TMWlWcWfWimWVWZRoW9GWQP5C:/LXVQs+A42Fd/Q/ckQLZsATw
MD5:	C51D66E1C0EB70409BFBED228E9C7469
SHA1:	A56C5BB5D6AF638DC77B66721B2F0FBE9C3BC557
SHA-256:	AFC34C9ECBAAE107ADAA0AD2F90A22989A8BED3FE01DD854893A9B778E7C5209
SHA-512:	72F5F761353DC14869B6CB5665A8678E5964D8D73DC061BAE3DE3B5A34CA514A0E57FF916298E360B74F004E94BA36C3391CD8E246F58ED4170E9BE8BA7FCB61
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.E.s.t.i.m.a.t.e. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\InventoryAdjustment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6054
Entropy (8bit):	3.400534507725254
Encrypted:	false
SSDEEP:	96:uDTaW2V4vWBWEWIWHEj5WdpIWDW7W3XKWvlnWvInWZVW+W0WjWVW5hRhRde5Wxhk:zV4mjz
MD5:	305A9C370A61FAE120F187F029B7CD9B
SHA1:	31609A6107445CEAC34CEEA10455257C8DEF72DE
SHA-256:	81D3A7AEA2523FC6FDD7B2FEC8F5143C17573CB126CEA3E789E4E143152A3426
SHA-512:	197C4EE9E01220718AD3CA2972E03583CA55B7C7A99AB6051E0E4D4A74827ED5A1B7B6A8F7CE4FFBDBA10377144FBA88E8643633A0DEE5474BBBF7033C7155F4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r./.J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r./.J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.d.j.u.s.t.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\InventorySite.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8128
Entropy (8bit):	3.3284430324122924
Encrypted:	false
SSDEEP:	96:uDTmGmWpWaZKxWrWVbobvbbWrWmSWFKWECWj6WiyWELaWQiWPhXoWrLqW36WUCW3:5ZwvGcUDTjQpm/FTw
MD5:	FC250F86D187EBE604DBC5E6BBC05017
SHA1:	4B6588C7F9ADA8496E71F85D677AA88969E1B6CD
SHA-256:	2AB50FC9448CF90A8892BBC6F7FC839EE38C9DDC9FDC9A7A57AC88CDB2F0BAC8
SHA-512:	A572BF48826B3781B352319DAA1C979DF45027C8E2E765DABC44D479A02A1C3E1E53734DBADFC162B7283690CA2470A07EC7FD838ADF5A8B411D13D6C498056D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.S.i.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.n.t.a.c.t.<./.K.e.y.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Invoice.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11318
Entropy (8bit):	4.726707667993704
Encrypted:	false
SSDEEP:	192:OmXblKXYCEHoH4VdpeUjulYYANFbHZGBJ1gN7J/NTx+JohknTZWDq8D8r4D8l+NO:OmXblKXYCEHoH4VdpeUjulYYANFbHZGF
MD5:	AAF3F0BCFBF3EA768D0EA858569B5BC6
SHA1:	A83F30C71E979D53630A5C8FCD38CA1BBE9EB355
SHA-256:	B4E90F61B465CFCE6681DDD684BFEE6665854C32273A59AB7677372ADF4323EB
SHA-512:	434B1510AC667ED2DB3DA479EB43BF2788C7508EE5B03FFDA550A026664B34D6E45613A4CEF6F344118B6F1AA0CF05B48B63783AEB7EA800A346BB34B13C6A29
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<MappingLines>.. <MappingLine>.. <Key>Number</Key>.. <FileHeader>Invoice No</FileHeader>.. <Display>Invoice No</Display>.. </MappingLine>.. <MappingLine>.. <Key>Customer</Key>.. <FileHeader>Customer</FileHeader>.. <Display>Customer</Display>.. </MappingLine>.. <MappingLine>.. <Key>InvoiceDate</Key>.. <FileHeader>Invoice Date</FileHeader>.. <Display>Invoice Date</Display>.. </MappingLine>.. <MappingLine>.. <Key>Item</Key>.. <FileHeader>Product/Service</FileHeader>.. <Display>Product/Service</Display>.. </MappingLine>.. <MappingLine>.. <Key>Description</Key>.. <FileHeader>Product/Service Description</FileHeader>.. <Display>Product/Service Description</Display>.. </MappingLine>.. <MappingLine>.. <Key>Quantity</Key>.. <FileHeader>Product/Service Quantity</FileHeader>.. <Display>Product/Service Quantity</Display>.. </MappingLine>.. <MappingLine>.. <Key>Rate</Key>.. <FileHeade

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Item.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7354
Entropy (8bit):	3.378740152849802
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWyHWcWYWoWCKWb8WtWkWUW5W7WoWwMW0W1WtWxOxWxhofb:SQD
MD5:	48796B0AC6BFD66270E01F5CE3E798E8
SHA1:	A9A99317F47F7F9BC33EFA4A66F6E8BA26F2427E
SHA-256:	94DFD7AD248AAF5182BD277E2BDD173D611F89EB15F8EBB06A69F267A29183C5
SHA-512:	77C49633AB14446324DF08B5FFE82E3C674B4FBE6A5EDF30B0CAF26AB7D12B4CCFCA33E9DD85ABB19DBBA24508987B30AE766E0806DCB48D9449B31A2161DCAD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemDiscount.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	3.369253287042973
Encrypted:	false
SSDEEP:	48:y+6DTnRUWYCORUW/RUW0RUWRRUWbpRUWGRUWsRUWhnRnFRUfb:uDT+WLWmWTWEWbsW5W7Wxhofb
MD5:	25CD8C4E6AF24CAA5FF6EE1B6F903C18
SHA1:	A639747DF534EA47858E4A8D4F36814DA597F533
SHA-256:	20109C74800E1A6DEDBB9D81A8F07D42A5FE12BD399870BD87C5979500188568
SHA-512:	BD4B0D2C92A3829B46021C3FF9D4CEC093D2F0436CF2C585F517C849F8541D5D7A83627A9C3D3328DE5E0AA7F6716C48F0DD5267EB91A95B9506E8810A1082A8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.i.s.c.o.u.n.t.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.i.s.c.o.u.n.t. .A.m.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemFixedAsset.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8138
Entropy (8bit):	3.3590441395434176
Encrypted:	false
SSDEEP:	96:uDTmWOW5WUW5WyWWeWnWxWCLWDWQWPWRvWZaWbWX3KWeW6W6WgxMHxqW1lQQW3W/:92xMHxcbTw
MD5:	22858F010F6BBDEE70F95C304A46F36B
SHA1:	86F75CCF6C690E7FAB0C1CD08361C7D9D220E968
SHA-256:	CA8F453C6429247748AC2CB686A2798EEC84C62ED65E3F37B45F1D9BF7A778DF
SHA-512:	78C14BAA218D0BD2F9AB147E12A3D1661D7061BE18A5E4E825A2D22FD473D71275532561906EC161AE4F6EDE87DFD2F25853B17479707D1AC1AA2664C47CC2F7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.l.a.s.s.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.l.a.s.s.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.l.a.s.s.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.s.s.e.t.A.c.c.o.u.n.t.<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemGroup.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3948
Entropy (8bit):	3.3622550575612524
Encrypted:	false
SSDEEP:	96:uDT2GOWpWeW4WdWDmWk/5WO3W8iW3iWxhofb:X/5hTw
MD5:	2D1265D24BECA138512E8D259D0364E9
SHA1:	7411E484582BCB9C94F325BAD2FCA86268848AA6
SHA-256:	685285A5D308E2504D5D3626F9287A949492C828E12BD761960C4AC73AF9B5F0
SHA-512:	2E116FA1DB2EC78D3458A1903BAF79969A1A90CAF693B639C888F725272FD2990B0E565513E08D29AE345CF453E340BB626B5B975DAF3D93966404E484172DF8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemInventoryAssembly.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8730
Entropy (8bit):	3.3724020804281607
Encrypted:	false
SSDEEP:	96:uDTmWzW5QZW/W6WyHWcWCaWQWbsWtWUWNWwkW8WFN16WGQ7W+WDuWYW5WrBcuW1q:rQgTw
MD5:	6C7D529C5BA9D7AFA50B9980AB97A8CF
SHA1:	7C45D104E9E0DDF6C54E6E377250FD5AF32872F5
SHA-256:	E6805BEEFE63690DC347DA45468D51411005D5523DC85D96DACDC72FB6C9775F
SHA-512:	BA1B858EAAE2919E5EA131D542B36019474ECB868DB0494D83382C64F496C8B54ACBE135DC30207270F118928148ECB7497BFF0C3EA827DE9FA89D83748CACAB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.s.s.e.m.b.l.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r.C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.u.r.c.h.a.s.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemNonInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5998
Entropy (8bit):	3.3820808987438795
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0OxWxhofb:RQW
MD5:	85B03A2C3830B3054BE00240F52E90F9
SHA1:	C983274DDE55CC804EA3394DE08C1D6C73221899
SHA-256:	F741CB945A027469B7BC6FDAC1B72451BC06944CC1E4F14D351776864665A873
SHA-512:	300D6D2F3A1E573717ED7E3E1B338C95EB024BD9F1D6187D0B2D8604BBCBCB8EB144FB46F0CEB7523951F433A7810826F41756CABBE2E4483F6BD5CB4935E2B3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemOtherCharge.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	3.3808418806351264
Encrypted:	false
SSDEEP:	96:uDT+WQW5QZW6WnWyHWcWYWoWCKWbsWtWkWUW5W7WoWwMW0WxWxhofb:SQ4
MD5:	6E56495D5843EBF317452EDA48016548
SHA1:	551CD5D29B84C07CA8B5F78897EA6EC73BFC2FC8
SHA-256:	1835A35348765C761CD41B6B31A8C474EAA722CE3230065903C53C12162247C3
SHA-512:	7F51BECC13CBA14C6B6B2529D3BF538AF0DB90B3B967275F8E6D2D68B0EBFCEC1D08B12B3FB0915A9728EC528B0844C92E44D5D7E9AEA9B6FC3700E0C0492E66
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.U./.M.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.U./.M.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.M.a.n.u.f.a.c.t.u.r.e.r.P.a.r.t.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemPayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3200
Entropy (8bit):	3.361749650440019
Encrypted:	false
SSDEEP:	48:y+6DTnRU2XRUGYCORUWnFRUWscCRUWGRUWVsPUW8FPUW3FPUWhnRnFRUfb:uDT+2OGLWoWsclW5W3W8iW3iWxhofb
MD5:	C0BBF1F8E3DB611C74BBD4E532256CA4
SHA1:	C619ACE9E5DEC1C1DA202048DD85EA920EA91326
SHA-256:	50B7ABC03DC410C299885ED35BA733184C2D5B904257CF8EE329C24D1044D803
SHA-512:	C1B3CBC91D9DBD9832D85B2788B79EC41E9F53B7964E847379DA0BDECBDD490D787EC3DEBE340697ACFE3850836A59DE56850A3147445917F87ADF0815D32CA2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.a.r.C.o.d.e.V.a.l.u.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.B.a.r. .C.o.d.e. .V.a.l.u.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10838
Entropy (8bit):	3.3747161497689007
Encrypted:	false
SSDEEP:	96:uDTaWjWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526TMW3dO:/kFwMlcJm2ITw
MD5:	CD736FD3BEFF518DAF71E58937565680
SHA1:	92D2E5FF02106E4C7690CAB4EA7D9CB578A00A47
SHA-256:	8A2DFF2C32C4BA891ECB5C249B9D4F05F026215A380DA3AFFA14858B390ED8A7
SHA-512:	8D84466EEFBF21C7624389309D6310C7762F2B295D5DDDC1EA8557E50E45F7CC22EA4EDA5DFFD3D85768A4CADC2E73E8FFAB072F0DC89BD1E4EAA3938C12E039
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemSalesTax.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	3.3852199742396483
Encrypted:	false
SSDEEP:	48:y+6DTPRUWYCORUWXRUWZ02RUWhnRnFRUfb:uDTWWLWOWcWxhofb
MD5:	811428AC1C5C9D7F349A44FF0ADB98C1
SHA1:	E812DA7171B9BC5551FF11FEB994E15B6A0D5E91
SHA-256:	4FB868BD432D7966E1299570522A2BBE922633790C93606F1A5E7AEAD78FD4BF
SHA-512:	8AAF9052A27F596451C7F89A90C4C2A0E4CF002CB07091DFEE74AEF49AE7A50150EFCC9303FAFE8FE5734EAC37E491B0E7A566C31AC47B6264BFE8CCC3641786
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.R.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.a.x. .R.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.a.x. .R.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.a.x.V.e.n.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemSalesTaxGroup.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.401575726316516
Encrypted:	false
SSDEEP:	24:QlL+6DTTyEyDARUWXtdtQy2tMRUWMHoyiURUWkAnjyzAnFRUfb:y+6DTGZARUWXPCORUWMBRUWhnRnFRUfb
MD5:	48DC90036A616570B925520A1193A8DC
SHA1:	68387C07D8A2A19E6EF3AE7C90C8A13F811DC58B
SHA-256:	60314415E46AF3A6249F949619D1A4D65270FDDCC0626DA6206DDE168D91B1B2
SHA-512:	D1241237F9E427709FD644EF1AEE2E0D366E8646B17DC30A6FAB44A2FA61F66BE0024D293DDA7912B90EB04220936AC0C5F736C6AD702B49FF7387EFADF9A62A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .T.a.x. .G.r.o.u.p. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.D.e.s.c.r.i.p.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.s.c.r.i.p.t.i.o.n.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.s.c.r.i.p.t.i.o.n.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.S.a.l.e.s.T.a.x.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.L.i.n.e. .T.a.x. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemService.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.382370954730198
Encrypted:	false
SSDEEP:	96:uDT+WQWjW5QZW6WnWyHWcWYWoWCKWbsWtWkWUWoWwMW0WxWxhofb:RQ+
MD5:	1C369BECBC62DC76776E7388D01DCC68
SHA1:	3BA6C860F0E37E3090BFBE40A268226ABEC9A79D
SHA-256:	03BF4520FECF37DA5AAEC6387742499763247AE3760EA3E37960D193A8A57F9E
SHA-512:	A514FBC522E23660AF3900C408AD21C9BB13ED0FE3185986B8A6998E49C4814C52DDB562A79DA33C0B653A79C3E2926671C1C96ABE10C7E910351F2E4D5744C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.r.e.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.r.e.n.t. .I.t.e.m.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.r.e.n.t. .I.t.e.m.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.U.n.i.t.O.f.M.e.a.s.u.r.e.S.e.t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ItemSites.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3916
Entropy (8bit):	3.374542512973868
Encrypted:	false
SSDEEP:	96:uDTG2hmWXmWrWrDWW0W9WUW8iW3iWxhofS:vD7T9
MD5:	B9392F01A5EA82613C44D5A927D0519E
SHA1:	6092CE8987AA338905065BD93C67755FAC98491B
SHA-256:	BB30D9193473EF4C42B2E04BCDBC53126A93177C575A5D67AA047CF01FAC5CA8
SHA-512:	5C3B97EA9F369BFAF7428EB4ABB8BF7DD274A60716137D515FDC74F4D47F8006E366EFF5DB48C1FA4844E7724AAEF28E395A2828EBC5046841719CA6B36DAE0D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.n.v.e.n.t.o.r.y. .S.i.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.A.s.s.e.m.b.l.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y. .A.s.s.e.m.b.l.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.I.n.v.e.n.t.o.r.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.I.t.e.m. .I.n.v.e.n.t.o.r.y.<./.D.i.s.p.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\JournalEntry.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5420
Entropy (8bit):	3.364352414587203
Encrypted:	false
SSDEEP:	96:uDTgBgfg1WbWW1Bx7W4WAWzWWEWDWxWoW4WVW5Wn2WT2VXW8iW3iWxhofb:ZKPTw
MD5:	76B94DCAFAA0C08CC6DAE7EC743BC43E
SHA1:	6F65CFEA1474BB60437F233D23D584B8B875FFD2
SHA-256:	3DF9906CC6458C4BEB291D99B445E23B79A34A77FEE7388614B8DC4A79C74DB5
SHA-512:	1E7260094109C872AB8605BB06ACA55704086CC6B9C570157006A4C6188D2C61EF5BF2C3DB7082790D6CE3852C9AD666925DCD71E5946A7DC6720B515CB1ED22
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .E.n.t.r.y. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.J.o.u.r.n.a.l. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.J.o.u.r.n.a.l. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.s.A.d.j.u.s.t.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\OtherName.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7030
Entropy (8bit):	3.3347023981721735
Encrypted:	false
SSDEEP:	96:uDTm29W3WlW/qnWpTWgWUW9W52WaWxooWeOWcWaZrEWrWVbobvbbWQW1kSEWrW3m:Jq1Tw
MD5:	8289DAE7CBB584CCC672DF7839C0D128
SHA1:	CC623DE9D01D2F1DAFD0B75899D10046779A06DC
SHA-256:	D6B36813DA86613BA7470F920687F87035B680AF03EFD03885FD555DBEC3A93C
SHA-512:	37C94940C4E44CCCFD04D613E1BA35A789A12B8C9CEB624B36D1143741D7D4DC67393B60F6377E80696A323D1934B9B740C46848EB593876A89A0140406FC679
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Payment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	3.385598702293327
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWdcDvWoW/z8QWDWsclWdW0WbWuDWxhofb:DVQTcDCz8k
MD5:	3043D744FB3967BEFE237A672CFB2471
SHA1:	68BCB0189BA41DF8164EBF390C30265A8B6001A8
SHA-256:	CCAB1ADDC394CDBD187B236DEC59E8D4F3832A3C22FE3E24FD24DAF0F4EA0488
SHA-512:	3594AAE617198B350780295F41C5AB1D63EABF6D97EF130454D6DC5840458E81CE40192BA382EBCCA28A3A3DF70725692C14E1CD26D5CCA06E6E2E3FE88963E6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.h.e.c.k.N.u.m.b.e.r.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\PriceLevel.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4192
Entropy (8bit):	3.370826082625971
Encrypted:	false
SSDEEP:	96:uDTnGX2n2WTvsWxyW4WRWiWikW3W8iW3iWxhofb:cG6vfxTw
MD5:	791A3385374BE38F469942E62728DB5D
SHA1:	4BA2E15ECA6A6513A55958215C42596C7D390F9F
SHA-256:	0BDFA67132C8A6FCF860F5EF62855D10433659C0142BA3E80D76839CA288B4A2
SHA-512:	6321417BA5475F9EC8C431ABE92B3247B2B2FFC808E4447434730EE3FBF1D34891DD789C8149067656DBD579304DF92F5B3C185CEBB17B9CC1F8C77FFC06AF62
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>. . ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.r.r.e.n.c.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.r.r.e.n.c.y.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.r.r.e.n.c.y.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.r.i.c.e.L.e.v.e.l.T.y.p.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.i.c.e. .L.e.v.e.l. .T.y.p.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.i.c.e. .L.e.v.e.l. .T.y.p.e.<./.D.i.s.p.l.a.y.>..... . . . .<.H.i.d.e.I.m.p.o.r.t.>.t.r.u.e.<./.H.i.d.e.I.m.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\PurchaseOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17352
Entropy (8bit):	3.3597407626699654
Encrypted:	false
SSDEEP:	96:uDTyWjWxWoWhWDWWjBWNW6WsWgXVQXW/W0WjW526TMWwW5W2WVmWwWMRoWCGWQPP:7WVQc2nNGZsHTw
MD5:	8710FE941FF7003FCC7F232134E24DF1
SHA1:	2D663F025D324BC50492F3610368F6D52E8A0707
SHA-256:	4819F581063321780B645598BA2D75A209A37E879935E989FB38981B8DD049F7
SHA-512:	A2E4BD89FF47CA35DB0B92F2CE172D65BB099CC516473038564A8A07BCEF863FB37B12042BEF2A83210CA290ACF6FCA614775BA22E0D6CCEF6F442A412BED059
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.u.r.c.h.a.s.e. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\ReceivePayment.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	11204
Entropy (8bit):	3.387327919099585
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWBWoWdcDvW/z8QWxBKUW8WDWsclWDMuWBgvXWzWFW0L9WWWTW1WPioX:DVQhcD4z8bNqoQOrGoo3Tw
MD5:	D956414E108CFA2B7A0473F7C4E86667
SHA1:	37147FA6F4527E348B2ECCF955B88FD2BE8CAD0D
SHA-256:	5699DDD81E7885EEBA1394CBC92FC4FBBB5BC4DE88534391A808F0404BFEE6BE
SHA-512:	8787F7288D612D698C216DB936C7FF30FDEDB4D9AA7AE23632776669450E4AC7FEF990F1D25A5BAC4BE8FCC22130F2A04780DD80B93B013BA7BA15398794709D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.a.y.m.e.n.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.a.y.m.e.n.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.P.a.y.m.e.n.t.M.e.t.h.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\SalesOrder.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	17672
Entropy (8bit):	3.3588217943261576
Encrypted:	false
SSDEEP:	96:uDTKW2VQXWBWPWoWBWDWWjRWjWhWyObW0WjW526TMWlWcWfWimWVWZRoW9GWQP54:DVQ1Q2td/Q/LkQSZsATw
MD5:	C4CD2E361EDC956B313DBEE01CACC03E
SHA1:	D6AAE22665F7A38F1F56DD39F3F1C3593081345D
SHA-256:	ACAC3608ED3DB0E53046AE6D51986296991A2590FE7C6676CC86CB66CEEB568C
SHA-512:	32DF82ED055286B455FE629EF6BC9466EEF1730968019E5EBCE60FBA3D7902678D28ACDF9F1E69D7B8DE06B88B1B0BA9EE33EDDEE60E21C05BC7BCDD97484B24
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .O.r.d.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\SalesReceipt.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	23646
Entropy (8bit):	3.372245064442722
Encrypted:	false
SSDEEP:	96:uDTqW2VQXWhWoWoWBWDWWjRWjW8WhWfW0WjW526TMWlWcWfWimWVWZRoW9GWQP5A:DVQgW2Od/Q/ckQ9qoQ+cDNZsOTw
MD5:	BD02F89803F9C531C85A24D5D58186EF
SHA1:	B273D4345066F8721A1ED18767A511488AF2768D
SHA-256:	C94A930651FB9C73BECEC8221C37D34749CEA2CD4CE4416513B1A16B8731017C
SHA-512:	125DF7E1D70F1631D0BB082C11D13EF22D1438A77F090CE3FAF6BC7A37789C8D907429477041A9ACA0DE53F5B0E2A285AD6E382FAA840FA20DF693E4E2C5A007
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.S.a.l.e.s. .R.e.c.e.i.p.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\TimeTracking.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3924
Entropy (8bit):	3.346158044789658
Encrypted:	false
SSDEEP:	96:uDTbWW2VVAWxW4WxW3WTWaW5W5W8iW3iWxhofb:zVV8Tw
MD5:	D6368DF55D96E8A243DE77C4DE5716FF
SHA1:	258C995AB1B1D637AC8A9738DC92710A12B463EF
SHA-256:	71B468801F6D0401C1D57F415E0E8CA05B5B25D535EEEF2DCE17D756F79CA76F
SHA-512:	E5B5899CE5F24559E25717675C822AC629255A3B88C13B49350F794150EEF26FA436C0F442C0C8AF301AAC90C3366446A955BA90CB6A94D8580E6B3FB59CFDC5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.E.n.t.i.t.y.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.u.s.t.o.m.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.u.s.t.o.m.e.r.:. .J.o.b.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.B.i.l.l.a.b.l.e.S.t.a.t.u.s.<./.K.e.y.>..... . . . .<.F.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Transfer.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	3.3658738196336557
Encrypted:	false
SSDEEP:	48:y+6DLuRUWURUWZRUWVbqRUWSRUWGRUG8FPUW3FPUWhnRnFRUfb:uDLxWzW8WVbdWVW5G8iW3iWxhofb
MD5:	AD10EED0BE58469F4211BD0B49BD739E
SHA1:	95C1BBFBDB5BA1BC2908546BBD89E6C8CEA64990
SHA-256:	5EBF59F236F72AB34E981557C269014F10CC2C305CF881B402DB24D465343FCF
SHA-512:	FCDEF0A646D5D51876E0F137DB3B760AF78C9FBD61F6787890842CF5D8E8764DED519EF58151B099FDE5685020F7DEF5F7E8FC987231E519AF426EC6A325964C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>. ..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.F.r.o.m.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .F.r.o.m. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.a.n.s.f.e.r.T.o.A.c.c.o.u.n.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .T.o. .A.c.c.o.u.n.t.<./.D.i.s.p.l.a.y.>..... . .<./.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\TransferInventory.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4582
Entropy (8bit):	3.3680537578680694
Encrypted:	false
SSDEEP:	96:uDTaWhWQWmWtWdWGWKWZVW+W3XKWVW8iW3iWxhofb:8Tw
MD5:	E60071D0621D5A15FAD97C168E735A0A
SHA1:	26E62142851B7E8F2ACE2530F48A3997FF5D092D
SHA-256:	012A14B3230223FB17DA860E13E1CB932B2DB2D4B25C06DD463482BE4D49C9AF
SHA-512:	51296D9A2CADF0419C2C3C7C851AE23A4ABC0F74A365F3DE8D205C29A4A86C9975DFEAEE6E96EE903E14887BEBD0E2D79CCA245FFDDD6D8C418F35C587313EB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .I.n.v.e.n.t.o.r.y. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.a.n.s.f.e.r. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.I.t.e.m.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.P.r.o.d.u.c.t./. .S.e.r.v.i.c.e. .N.a.m.e.<.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\TrialBalance.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	3.368119197538534
Encrypted:	false
SSDEEP:	48:y+6DT9ZfRUWmRUWuRUWFRU2EyiRUWDRUW+PUW/PUWb1KuRUfS:uDT9ZGWZWxWo2EyFWKWHWUWb1KxfS
MD5:	99992F30FCF428E325882BEC39FA7727
SHA1:	2CB68A9D3AB9FBA2A44815AF2BAD507316900034
SHA-256:	EF3BF42B4A3642C7B4BF153EEDA3875FD44C1C0F144F45BA91993014A5FA4E32
SHA-512:	6D8B04C92990AC392F523011AE2E3F9372BC2E3919FBE2614F82B7BCFF98E4B006632EEAC0EDF281CA7580B7A009EACF3C692C5A24CEE5972869D8BA8F241587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.a.l. .B.a.l.a.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.A.c.c.o.u.n.t. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.A.c.c.o.u.n.t. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.D.e.b.i.t.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.e.b.i.t.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.e.b.i.t.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.r.e.d.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\VehicleMileage.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4850
Entropy (8bit):	3.353849500727898
Encrypted:	false
SSDEEP:	96:uDTvWJgHHWwYjWBE7zWPWY4F4KW2VNoWIW4W5WaWyWoW8iW3iWxhofb:iYZVNHTw
MD5:	ADBB383E2E3B4626700B09388095DEF4
SHA1:	9FCA832E044CF69F39C15041D8D40D3731911A6F
SHA-256:	248DBA3F7B8AA576F43CBC8A6A709A034701BCDC121641043F9C517AA1FCFC23
SHA-512:	24E551E17871925A02AEC60DE918A8D860D4E7C9E5F7A61CDC9BAAA93962F5E6CDB14748043E216E267C17023070EADF830A5354B8D55562FFA1AE18D186BE7A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.h.i.c.l.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.h.i.c.l.e. .N.a.m.e./. .N.u.m.b.e.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.S.t.a.r.t.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .S.t.a.r.t. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.r.i.p.E.n.d.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.r.i.p. .E.n.d. .D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\Vendor.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14054
Entropy (8bit):	3.349445787282344
Encrypted:	false
SSDEEP:	96:uDTGW3WlW/qnWpTWgW7IPaW9WwW5W2WVmWMRoWCGWwWQP5WhawWGFzWLEP5WVDyl:8qjIPHgT2Xr6Tw
MD5:	351EFE8EAADEFB657A369883B8008058
SHA1:	39005DE89C3B07C6647BAED718992F31183C2901
SHA-256:	BD1EA761F40A5B237157895EC7B968FAF316BAA18F29CFD56331AA5A055D896F
SHA-512:	1313E70F7D267CCD80754FB657A26006F46808573C5C8E62DCF22E26BE58D1B0A931A6D93D509A1798F13C45BA10154AD4E5E0F07AFFA57A4969C11D941C0E79
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.C.o.m.p.a.n.y.N.a.m.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.o.m.p.a.n.y. .N.a.m.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.o.m.p.a.n.y. .N.a.m.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.S.a.l.u.t.a.t.i.o.n.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.T.i.t.l.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.T.i.t.l.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.F.i.r.s.t.N.a.m.e.<./.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\61541D54\FA1DA2E6\VendorCredit.xml

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10518
Entropy (8bit):	3.372758990102341
Encrypted:	false
SSDEEP:	96:uDTQL9WjWxWEWkW43WjFwXWPWyW1WoWDWWjRWNWBWgXcJXWSWkWvW0WjW526TMWU:vkFwMlcJm2UTw
MD5:	A3583B6ADFFC7EC05ED71DB9E9953C53
SHA1:	5424661D0367CB8747D64FD69DCCEF9FCFDFE181
SHA-256:	1CD0A38773CEA9C4035D3A57966847E68D2D30137B4545C1C0376EF266F8E896
SHA-512:	F238724627B46A8708BE16A05E04C9EC3F701E5E2228AD78F00B3435B87ABD38F21E777C07017927718BC35E67150BE199968CE42F8EE27AE6F769D965D2F560
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.a.p.p.i.n.g.L.i.n.e.s.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.N.u.m.b.e.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.C.r.e.d.i.t. .R.e.f.e.r.e.n.c.e. .N.o.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.V.e.n.d.o.r.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.V.e.n.d.o.r.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.V.e.n.d.o.r.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.T.x.n.D.a.t.e.<./.K.e.y.>..... . . . .<.F.i.l.e.H.e.a.d.e.r.>.D.a.t.e.<./.F.i.l.e.H.e.a.d.e.r.>..... . . . .<.D.i.s.p.l.a.y.>.D.a.t.e.<./.D.i.s.p.l.a.y.>..... . .<./.M.a.p.p.i.n.g.L.i.n.e.>..... . .<.M.a.p.p.i.n.g.L.i.n.e.>..... . . . .<.K.e.y.>.A.c.c.o.u.n.t.<./.K.e.y.>.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\63ADD426\F3574DDF\GalaSoft.MvvmLight.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	5.6173719329363045
Encrypted:	false
SSDEEP:	768:cO12uMd438J2Bd+5onSYEBHyOR+DmHKPrzX7uFL3xLA1n1s6j:b0uM63jv+2nCBFs8FFLA1r
MD5:	B349A5C9165CBB8663F82C31F9402D35
SHA1:	E8B38649C05408DA796E2DC21E699CA8352A059F
SHA-256:	60FFBD8A891ACBE1ADBE79D320806A32AE826575F5218A51379FFC83F03F62A7
SHA-512:	377C0C88F0FEBF3DBB4786CE823AA2CF2B85F55A654D9F3D10A44480A9F9B726A08BB2C03B190473F4F461824ECDCF0FEB9AF098D4840952A2ACCBC197E89E6E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W.........." ..0..f............... ........... ...............................1....@.................................@...O.................................................................................... ............... ..H............text....e... ...f.................. ..`.rsrc................h..............@..@.reloc...............n..............@..B................t.......H.......d:..$I...........................................................0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...{........0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...{........0..p.......s.......}....(......{...(....-N..{...o.....(....,:.u......,..o....(...+.......s....(...+,.r...p.{...s....z.0...........{......,....s ...o!...*.0......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\661E908A\F3574DDF\System.Windows.Interactivity.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.593512133791687
Encrypted:	false
SSDEEP:	768:6MazwAgR8/XJ665bKZdxuB8DCuL5enM7JxKjuMlZCZN+R0E7E:63wBccZdxuB8mQen6JxKjrlMZgR0Eo
MD5:	3AB57A33A6E3A1476695D5A6E856C06A
SHA1:	DABB4ECFFD0C422A8EEBFF5D4EC8116A6E90D7E7
SHA-256:	4AACE8C8A330AE8429CD8CC1B6804076D3A9FFD633470F91FD36BDD25BB57876
SHA-512:	58DBFCF9199D72D370E2D98B8EF2713D74207A597C9494B0ECF5E4C7BF7CF60C5E85F4A92B2A1896DFF63D9D5107F0D81D7DDDBC7203E9E559AB7219ECA0DF92
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ....................................@.................................\...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{.......0..&........(..............s....o.....s....}.......0..K........(.....{....o........,3..+&..( .........{.....o!..............X...(....2...0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d

C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2212856
Entropy (8bit):	7.984882716563244
Encrypted:	false
SSDEEP:	49152:xkQTAfvy2l5gF8yChTk90rxraCvj2yzo96yvDii8wma/tMrUzXlpeAPjsm3rG:xafvpjgFQTZxjgiilKrmHeQso
MD5:	D4D3CC4AE87C1D4CC794AD864B211E3B
SHA1:	0FDD5672DBF1533C537F76844B2756DAA1BA9FAE
SHA-256:	A02B86F93D6CF2277723C1B78FDA5F119D40D156CA672CB272A1E9C3F6B573AF
SHA-512:	C3D064B98CE3F375755A3B54ED2062CD445B0E6DB37E6A22F99ECA86B1AF7FA5270A4230616F8863149DC0813CCC4BE1676D138E9DBDECE8B2E8F215983D0DA8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\ProgramData\miaB83E.tmp\data\OFFLINE\67A3EB0F\A9118E7B\SaasAntTransactionsConsole.exe, Author: ditekSHen
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~..................ue....PE..L...t..P..........#................./.............@...........................!.......!.........................................P....`...q............!..1..............................................@............................................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@....rsrc....q...`...r... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A02C8CD\F3574DDF\Telerik.Windows.Controls.GridView.Export.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.72238088528774
Encrypted:	false
SSDEEP:	768:P0VHoHwY+TFmju+BslvfqjDaukRlvMt2Wz:sC25m8vfqjDarl42Wz
MD5:	EBDE9AF6A57353D42F254DC64F5F38CC
SHA1:	8DC3CC190E9D64E2E34924F8B29E4C4D528BFEF4
SHA-256:	A93BD7830CA4D4F541BD2CA80C6938EC55B9DCDB72AB3B2AAD481DAC556B72A2
SHA-512:	7D7A68554721A74F6648E24EC7385235F1D11D4C6DD795F34E81175AF4BF2A80CFB64C9B2F2F63ACBABC1B5548021A0D3B51EA8E54D73DB29031CC26ECADD85D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!.....v..........^.... ........... ..............................J.....@.....................................S................................................................................... ............... ..H............text...dt... ...v.................. ..`.rsrc................x..............@..@.reloc...............~..............@..B................@.......H........@...R..................P .......................................W...e.1..I.N.u]....bX..ZY...Q...z.\|.B...".V2R.......\|.....\-s.$D.#........R.f.........4.Sh.}.~s.C....Vo."1.4...@.x.E<.....r..(......{....Z.{.....(....,...}......{....F.{.........}......{....Z.{.....(....,...}......{.....0..;........{.........(....l..(....l3...(......(.........+..,...}......{....Z.{.....(....,...}......{....Z.{.....(....,...}......{....F.{.........}......{....*..0..9...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A38D2E8\F3574DDF\Telerik.Windows.Documents.Spreadsheet.FormatProviders.Pdf.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	5.738522033850893
Encrypted:	false
SSDEEP:	384:GmCDymrAz38UOjVca1v9XI9Yvm9rK25gXYasXkLrgUCrqFGzU26ioOQZRuuNt:dkDs4UocWv7vQrvgXYQeQZRd
MD5:	B7FDAD850F9ABB6372E86DDC771B1B1D
SHA1:	DA6ABB6A20D168DADCAFCB0DB474A84992F12D52
SHA-256:	013E37F9406055BF49405DB001DC703A19CF20227479220E0192BCEFC796CFD1
SHA-512:	9DD4029DE12815C6DEFE7EA8CD3EDB49D8A88C5CECF3395D327F5D5547FC9CBBC5AE46EB5283B5A09CE7CAC0E03BDCBBF6399B3BF3449DA0FCC770E012FA0B92
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.([...........!.....r............... ........... ..............................."....@.....................................S.................................................................................... ............... ..H............text....q... ...r.................. ..`.rsrc................t..............@..@.reloc...............z..............@..B.......................H........<...R..................P ......................................... B..9r..u......6)E..y....E.!...d..+j.....y....O....r~E..R....5.r....../....h..(..e..M.i.,....2......w..].xz.p...?....8:.(......(......{...."..}........0...........(....-..o....,e.o....o.....o.......(....Z..o....o.....o.......(....Z..#........#..........s....({......o.....o....&...o......(.....s;...}......{.....s....}.....r...pf.{.....o"....{.....o .....(.....sA...}.....s....}......{...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\6A99F5AE\F3574DDF\NLog.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	694272
Entropy (8bit):	5.991317826120999
Encrypted:	false
SSDEEP:	12288:0nq3M3ufU3inL3HzT1hUfYyHrZlrnYW3Y9AxspqZ+NUsQ:0nq3M3ufU3inL36ZDY0sxNUsQ
MD5:	9BD9998FADA60EB7E157148A5D681633
SHA1:	0715F534B854AC2E3660DD073610E2C6426EF274
SHA-256:	5413095E2E536356A2F8FACFCF0818F711BC512AAD8A0034F646CBD4E9F979DF
SHA-512:	D6507DED543D5F2AD1889698067B58D05DFCBEC3613BFAE92D655F5E032A03D7AF4E79D2A2994366D14319F2611C719C61A5C50DA489907608FD906E6C265864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$............" ..0.................. ........... ..............................."....@.................................3...O...................................d...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................g.......H........0..Pl..........4.............................................."..(......(...."..(......(......(......(.....(........0..).......~..........(C...~......oD......,..(E........................0..).......~..........(C...~......oD......,..(E......................."..(....6.(.....(......0..1.......~..........(C...~.......oF...-........,..(E.................%.......0..).......~..........(C...~....oG.......,..(E.........................0.........~..........(C...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\7703EBBF\F3574DDF\Common.Logging.Core.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.515668005518576
Encrypted:	false
SSDEEP:	192:Iw2SGGh3mQQQQQbzsESNa0G+xEMMPoLXrYshSkvW:fXXh3JJSNH2PUJSkvW
MD5:	1830CD72D0EA37BAB9AF9FDF81FC96DE
SHA1:	3480C6662A0E1C0F579DDC0B30D3FF79278FC915
SHA-256:	43D21A6EF97B8B9E02994BE1EAEE2D73EAAD10F2DC1FA100FD57636FFAFF446C
SHA-512:	1A5D96B92876C796EE6FA1A77F46E202913FFD89939347784F783F664CC11DE880D4627A9D0A4D14AB335ACF29EE8C691EBF06D59B78E7E386F799C53BDEAF1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~GV...........!.................<... ...@....... ............................... ....@.................................D<..W....@.......................`.......;............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H........ ......................P .........................................S.....d........ei'...!..P.tpO#.g.Z).._wnST..N.Q.......h...[8./B.~Z9...$sv.H...t..d.P.f%.W.U..O0K0...2.3Q....a...P..:.(......(......{...."..}....BSJB............v4.0.30319......l.......#~..P.......#Strings............#US.........#GUID...........#Blob...........W.........%3........!...........]...............D.........................................................w.........................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\79EC1EC4\F3574DDF\SaasAntTransactions.exe.config

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4556
Entropy (8bit):	5.132782894119603
Encrypted:	false
SSDEEP:	96:Zr7197KmWo618WhMrNGCKWKJQK5jK/KJsFK5s0KF7:Zr7z7tG18uMrhrBcstFR0C7
MD5:	8840204B9602335E03C6261C20731EBC
SHA1:	DCC6116077630315733A887CEB3D101AED5EC665
SHA-256:	53BB189A6F1696BF1ED9DFB1E7EE4FA2F6ADAF5FF3B8A67EA160A89E55072C7E
SHA-512:	30A01DABBD9BF2ACA7721B74A29BD80C6CFECC7C092D3533BEF1037E34D10B92EF69635085DCEADEDDFCFC495746C2677DE01FBBFC8129B4DAE20DB594231D08
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <configSections>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler,Log4net" />.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="SaasAntTransactions.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.... <log4net>.. <appender name="Console" type="log4net.Appender.ConsoleAppender">.. <layout type="log4net.Layout.PatternLayout">.. <conversionPattern value="%date %level [%thread] %type.%method - %message%n" />.. </layout>.. </appender>.. <appender name="FileAppender" type="log4net.Appender.RollingFileAppender">.. <file value="$

C:\ProgramData\miaB83E.tmp\data\OFFLINE\79EF4496\F3574DDF\GalaSoft.MvvmLight.Extras.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.460171271073151
Encrypted:	false
SSDEEP:	384:x1ovgfOI8VYPh6+A8V34kAS8e9UnXQUkz+rybx0gWgRJTKkZAlphPyWA1isrH:x1o0pPg+KFS8e9UX5O+raVWgRJTKOShS
MD5:	43312122AF66A3E99CF2F9C597012C22
SHA1:	634D4C39A874EDDD4A733C4548C37FFB0D2F467B
SHA-256:	8E248E95E6DC65317AF9CAAF6A43091D5CB75FD1302BAE0A49DEA821FA21DC8E
SHA-512:	2A73B9DF94F219A2B8DDF54A7D1B176BB79FBAE346AC8B30E3DF82CB8C604C681960FD8208D68D30CA66CE4DE9F9963B789D3105402D899FD930A4831BEE2EE3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W.........." ..0..L...........j... ........... ...............................S....@.................................Hj..O....................................i............................................... ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................\|j......H.......l4..$4...................h........................................{......{....V.(......}......}.......0..;........u......,/(.....{.....{....o....,.(.....{.....{....o...... ..O' )UU.Z(.....{....o....X )UU.Z(.....{....o....X.0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(....F.~....( ...t....6.~.....(!...2.~....( ...6.~.....(!...F.{....%-.&.(....:..}.....( ...*F.~.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\7AA45FEF\F3574DDF\Common.Logging.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	5.5636356942236285
Encrypted:	false
SSDEEP:	768:47Fuak/yRoDPqJjW8SDSsR7TuPXj0Hiz4mZ2b8eqrxa:47poD1Gz+pmZ2b9qr4
MD5:	7C4C80A7A8B46A7100937018DFF0540E
SHA1:	37B979C2A79031AEDF8729ECF46AE1AB9E2B513A
SHA-256:	7D4435779924F739DD0ABD0117B380FA4CF63BBA552BC6EB9E0D29E24B85E6D1
SHA-512:	28850810683AE532FE7448D43D64B7FCF319374DF889565FD8920B090CD4FDDA4478C7E5D7BE29426DBBCC0B66E49544BDEDB719E144F549CA3274D1B19B6B5D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~GV...........!..................... ........... ....................... ............@.................................L...O.......x............................................................................ ............... ..H............text........ ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B........................H........M...t..................P ......................................_.P....\|.x.v..4t....Z.C.W.:q...+.xj.....1...r..........K...h...........2....DK]r..l.=.f.....h..&b.%...n.....g,.PJC).5..9....%>..( .....("..."..(#...&...($...&...(%.......0..........s&...........'...s(...(...+...)...s...(...+...+...s,...(...+...-...s....(...+.../...s0...(...+...1...s2...(...+...3...s4...(...+Z~.........(5....o6...&...(....*..0..J........,C.o7...o8....+...(9.......(:...-...o).....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\80CC9BA\88DA6A7B\SaasAntTransactions.exe

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3788792
Entropy (8bit):	6.803425488647004
Encrypted:	false
SSDEEP:	49152:5qV7UDbo9c/twWrrnWz0Sbpx2w+NTTGbmSecg7n:5qV7UDbTS/2HTS
MD5:	0F6452633C2790B06B482D15C47B5D0A
SHA1:	31AC756ADC5E16FBFD658E3980E0F0B5BD8BB996
SHA-256:	EEE533B378B832847AE0A60D7E16064E9CEB97E1DC71BD40D4C51888FEBB7066
SHA-512:	2261DD8A0DF69FAEB90094267FBE483FFDFBB9C10E51A59118122F3D9CD541472A8915977D3D3F4C93B050151A4182D9EEC100D61E8C62E0402A8647E6E258FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ue.................09..j.......N9.. ...`9...@.. ....................... :.....7.9...@..................................M9.K.....9..d............9..1....:.....tM9.............................................. ............... ..H............text.....9.. ...09................. ..`.sdata.......`9......49.............@....rsrc....d....9..f...69.............@..@.reloc........:.......9.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\85CA11D2\F3574DDF\System.Runtime.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22176
Entropy (8bit):	6.896165715914101
Encrypted:	false
SSDEEP:	384:r+4185WiR/B0GftpBj4T+ILKHRN7YSlVQP/:sLgiWmYws
MD5:	8E4E0EA396B5452BED54E6888CB07CA1
SHA1:	1A7AFCDD7F118B3EF8F1D9761FA71FAEEE16FD2C
SHA-256:	DFEAB83E6A9555A6C18070C611D868E117FA2FEF6F815DA26E622FEB2E610254
SHA-512:	E160570F598D5FDD637725A70595A7DDC247C20AED66C031FF9816142231C8EA58C69FEF7F5EB8E10120E5E5AD68ECECB1B584054832464046209C9E04CC1AAE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.T...........!..................... ...@....... ....................................`.................................D...W....@...................>...`.......-............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H.......$!......................P .......................................@.......m.1.!I%i`..>hg..w...F.2.9...o.Q.G..8d.;/.......~.H.........s.v].%....>m.I.E.`.M.C2{s.s.w..........V.^.v3.[...Oi:.(......(......{...."..}...."..(......(......(......(...."..(......(....*..BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.8.......#GUID...H.......#Blob...........W.........%3....................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\8D59114E\B12429E5\NLog.config

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.092787469309081
Encrypted:	false
SSDEEP:	3:JLWMNHU8LdgCzMvWCFqDmJS49ZpjR+XveHIXViJS4RKbuviyiovB0z+T7R/bTl8z:JiMVBdTMqmc4fJRRYVic4subioG6SP
MD5:	B2704E1CEF8ECD1C60B5F2E19A40046C
SHA1:	B14F64D57DFABF9CBFBCF640BAE7917A6E7B4BFD
SHA-256:	B987E814F9F2382E97C2B6BDA997E8F90F5AF942D33A45C7CC900E26D2183D3A
SHA-512:	66C665EC4E771CA940AAE5ADF028D1917385F5F84E3FE50D3E36AD40DF8BF68A2912D4C29B3058C25BDAB3F6ED4A213E72643FF380911149048DCC72CCF37162
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. autoReload="false".. throwExceptions="false">..</nlog>

C:\ProgramData\miaB83E.tmp\data\OFFLINE\901C7C89\F3574DDF\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	525824
Entropy (8bit):	5.856165679472465
Encrypted:	false
SSDEEP:	12288:3MRKBWOcZJToYL7fxWpJd7YxQ+kBadQd:cRmU7xq7Yx0BadQd
MD5:	07E04FD870CEE6F9994921B5AF243B7F
SHA1:	0EA4611EEEE3736963CB718132099624BFEBF460
SHA-256:	52CC6DDF77990FBAAAE4DB593F655610652133CEEADB32262C122D8C9EEA1BAD
SHA-512:	4639A7F77F7A9CAFA38C632332DD5085355623F3D84475374241A64BD110569F504086B479B519E90DDBD471D4A5034239418EBC03277424212E0E6698E64418
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HP..........." ..0.................. ... ....... .......................`......-e....@.................................:...O.... ..d....................@......l...8............................................ ............... ..H............text...L.... ...................... ..`.rsrc...d.... ......................@..@.reloc.......@......................@..B................n.......H........Q..l.............................................................{...."..}......($...:.($.....}...."..(%.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(....0...........{)......(....-....(....*6..s..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\905D6215\F3574DDF\Telerik.Windows.Controls.Navigation.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1154560
Entropy (8bit):	5.959246694674978
Encrypted:	false
SSDEEP:	12288:qiMTOruZw5kE6bfxDftXn7Q11iOjcG/ZhzsEr3p7ErxyZoI5QklS+rpwNs76xb1V:3kbYXsErZ7ErxyZrFpJIb1uJXKDT
MD5:	D805210EA6F050817E643A049CFD7969
SHA1:	D018696C6046DF3B4938DA435D8D72F8F195C381
SHA-256:	A97A6ED736FC26FD590127DC3779D8DD07448D79E9786F8D2E4D4950E111B8BA
SHA-512:	F51A90C536BA3EC614F193131728462828C80F1F27CD9DACA295DCD38A6DADA54B3A059A79EA027215DA269E77B8942689D58B9B2EFAF5232CCCDA186A241D5B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!..................... ........... .............................. .....@.....................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......8...H...................P ......................................V.<..h........3.Y.;z.......5d{....A...HB^v..'[..U/a+5...b........e...:.R0-.Ti;t.8..C.".m.......%...>..P.F...Jk1~.O..3y...0..@........(............sJ....(K...........sL....(M...........sJ....(N............sJ...(O...........sL...(P...........sJ...(Q..."..oR.....%{.....oS...#......$@[Y}......oR...*..0...........{....#......$@[(T.....(,...,).#........7...(,...(O...+N..(,...e(O...+?.#.......@4..#...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\905D63D6\F3574DDF\Telerik.Windows.Documents.Spreadsheet.FormatProviders.OpenXml.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	340480
Entropy (8bit):	5.887372930731597
Encrypted:	false
SSDEEP:	6144:JouAnmKqXWOYTI4y/6Q/Okj01X4UIS0Q9/oRZovxm:JoVmFHIoyfHh
MD5:	6ED1104F558CC167944131DDCFD89AF9
SHA1:	5F3F3DB27D06C5FED511177725DD9EC8DFBC22F6
SHA-256:	E1B5360B7A471161F9BFF35B9128B1E04EE99CC2AE37591625FB336B948E3DAC
SHA-512:	94DFBFCA8C83256834AF2CD355CC46C636645F600B03E5B8C885845EDE77E9768C336A99273E2171FCF54747EED9CF6D922504801C6288D81B40E087D38841DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.([...........!.....&..........NE... ...`....... ....................................@..................................D..O....`.. ............................C............................................... ............... ..H............text...T%... ...&.................. ..`.rsrc... ....`.......(..............@..@.reloc...............0..............@..B................0E......H.......x...Lm..................P ........................................+....G..Q.."....Q..5.{.{K _.w.k%#Y..u?.3..sF..-@Z+.>,Y..[8(?f[.....O.....(a..h$.y...s....~.8....c.3_g..._..u..)...&}....{...."..}......{...."..}......(....J.(.....s....}....2.{....o....6.{.....o....J.{..........o......0..%........{.....o....u......,..u#...,.~.........0..2........{.....o....u............(....,...(.......(.....V.(......(......(......{...."..}......{...."..}......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\92A72B5F\F3574DDF\Telerik.Windows.Data.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	466944
Entropy (8bit):	6.001750454195401
Encrypted:	false
SSDEEP:	12288:jawJHGqcW1UGzJiJmh1a8IxFLma8PzHbuhAGvaSAv8rYn2sPz2Wp+k7V23I1JaT/:jawJH0W1UU48UxFSa8Prbu
MD5:	3AD5CEB7C975776A54FB2E37F8104B16
SHA1:	D380F4259EFD38C85716D23F64DA1ACE90F88770
SHA-256:	E188050802404CC88A07FF88852AAA763F6DCF7650CC95604A8520AAFCD7D638
SHA-512:	AB81F0819A96AEEA3CCDB3D3A0030A2C7B0B530155B7DBF8659C686C7535564F3988991223A67CA33ABDF91B6E3BA0BEFA5EF6A8164B7903E8D9568CFFC052F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!................n5... ...@....... ..............................m}....@..................................5..S....@.......................`.......3............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P5......H........v..L............q......P ...........................................P)....OYm1....J....[v..\jc........-...p.p..(.z..X_.}./...S,.{@...>.i..{.T....^...<VL.: _%4..Y........rV.a:.,.\P.+....~............~...........>.,.(....(....^........................{...."..}......{...."..}......{...."..}....6.(..........6.(..........J.(.....(...........(@....-.r...psA...z..(......(......(....:.(C.....(D...:.(C.....(D.....(C.....(D....-.r%..psA...z..(E...>..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\A04D6C1D\F3574DDF\log4net.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.778490068583466
Encrypted:	false
SSDEEP:	3072:++EIoS8U9BGRl9bmXPbH79EfZHpMtTOnJDI3lk3ze3XjCVnm7sNzQn7G7k+Yr4zx:bx8CBGRlhmKHpyTmUVkDe3Xjknm7kCU
MD5:	7EA1429E71D83A1CCAA0942C4D7F1C41
SHA1:	4CE6ACF4D735354B98F416B3D94D89AF0611E563
SHA-256:	EDEC54DA1901E649588E8CB52B001AB2AEC76ED0430824457A904FCC0ABD4299
SHA-512:	91C90845A12A377B617140B67639CFA71A0648300336D5EDD422AFC362E65C6CCD3A4FF4936D4262B0EAF7BAE2B9624BCD3C7EEC79F7E7CA18ABE1EC62C4C869
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.X...........!.....,..........~K... ...`....... ..............................H.....@.................................$K..W....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................`K......H...........<x...............-..P .......................................i.)V.#c....e../.`...V....j>....?.LbrzKV.x.}...........[.f)..dD`..66.61[.z....W^....>F..r...#. ..g...T...P....Ss)ii.a.v.(0.....(1...o2...s....}.......0..7........{....-%~....r...p.{....r9..p(3...(.....(.......(4.............//........{...."..}......{........0..4..........%...(5....-.~....r?..p(....+...}.......,..(6............')........{......{...."..}.......{...."..}....*.0..........

C:\ProgramData\miaB83E.tmp\data\OFFLINE\AA301B57\F3574DDF\Telerik.Windows.Controls.VirtualGrid.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	323072
Entropy (8bit):	5.908700483089774
Encrypted:	false
SSDEEP:	6144:nTTS49+iEHX1EjLxT3GiX56IchwLEZ2E4tNbdGivJeUl9s7qlI2:nt9+iE3FiX5/cGLEmt+uzI2
MD5:	755690DC817D23AE7432331837542A87
SHA1:	AF3F9CF46C5D3A46DC09F80325F126A12EFDAA7C
SHA-256:	C63925EE541ACDCB8344B3493FE41C768888D2154379F4CC2250DD885B41F6C9
SHA-512:	7C2B7E8488FD29F1C064C5DEFC584514E703ED899134EE843731A3F6C3F12434E961ACF95622104955986EC58BEBECF310717C571C1E334217FD4EDBE0755321
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!..................... ... ....... .......................`.......7....@.................................D...W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........t...................P .......................................+M...$.q..f.A..B..h...<....wMH....f{=4.#.#.R.....46....o.Y.;...U#2[...:)..&.........K..{..A.!.6.........R$1....\|.1."..(....2.(....tu.....(.....r...p.. F.(....o ...o!.....0...........(".....(#...-..r...p..0..........($....@.....(....9....r#..p..........(....o\........o%.......(....o^........o%.......(....o`........o%.......(....oT......(&.....('....rM..p..(....((...()...~....(+...>

C:\ProgramData\miaB83E.tmp\data\OFFLINE\AA35C740\F3574DDF\System.Net.Http.WebRequest.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27352
Entropy (8bit):	6.737660517891196
Encrypted:	false
SSDEEP:	384:b4BInjVaiyLjrxxjQa2k1lWpYm1sIVZdWE4frOhEZ0GftpBjF+ILKHRN7/a6wlCn:0CJaiy/rxxt+pVhZlobKiXm/FAcF
MD5:	1925E1654510EE0914FF3360C6C94765
SHA1:	A032C1456DC199189310EF4DF533BCEEB6C41A92
SHA-256:	6E599D81A2B8D803CA794C25111FEA54C34356C4ED853B926C9AB42A4B0D6454
SHA-512:	1995A5F16AAA62D23D69022B613362B7CF952059CC9C4FBDDFCBE0905B94B02599DD4B5A784344A2B541457EC255B8F38BACCB7919F04F323D35B59B2E10D0D1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..T...........!....."..........^A... ...`....... ...............................B....`..................................A..K....`..0............,...>...........?............................................... ............... ..H............text...d!... ...".................. ..`.rsrc...0....`.......$..............@..@.reloc.............................@..B................@A......H.......T%...............#......P ......................................x.....+r,..t.{.:h...D.Vp.h/.R6.y:+...-%.y.i..s.........+e.k.ny&..VW.Oo.=o.i3.<..z..d...`.DD..}LR..dc..&x ..0".....3M\......{....:.(......}......{....:.(......}......{....:.(......}......{....b.(....~....o......}......{....v..0.r...ps....z.(......}......{....v..0.r...ps....z.(......}......{....:.(......}....*.s....z.s....z..0..O........(....,-(....(.............r...p...r?..p..(....s....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\AAB28644\F3574DDF\Telerik.Windows.Controls.Data.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	5.830168207129661
Encrypted:	false
SSDEEP:	6144:IAD3wLHEF9uZ3GSnmUxV9Lkg6q7UCvunRJIvySpqm:+pBIm
MD5:	02B71A017F2F3528EEEA9AA08AD028D2
SHA1:	BE129392440CB2F5B95F0FA6208B064A8BD3EB2C
SHA-256:	61B599FDCA95D6B6E6BB027FF8A538BC5717F65F975BB886592A8C21CB4480B0
SHA-512:	DB279404A5DE462B743ED07241ECED9A01021CEAF491834E69D251FAE5FFC33F64BBFBC6E1B3EC33CFBD89B20FC86139293EFA74CD5AC759A17F1D606F388F9A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!.....F...........d... ........... ...................................@..................................c..K....................................b............................................... ............... ..H............text...$D... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B.................d......H.......H...PF..............@...P ........................................!....K....}j..K......q....B..!3Y!.`.W.mb..vb...^._o..Qh.V-.8.'..(.....y..l.....B....HD.52.$c..m.w...<)...R.......aQ.%"..("...2.(#...u.......B.....($...o%.....(....B.....($...o%....0..........(&....@.....(....9....s'.....r...p.(....oC......((...()...o...&.r...p.(....o?......((...()...o...&.r...p.(....oA......((...()...o...&.r...p.(....o3.......((...()...o*...&.r...p.(....o7.......((...(

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B35D72DF\F3574DDF\Telerik.Windows.Controls.Input.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	610816
Entropy (8bit):	5.941819837876689
Encrypted:	false
SSDEEP:	12288:BeKxungHlf7219LzXKqwgJ97lFXDDGC+gNRBPS7VGkxvwnZ1:txungHlf723PKqwgJ97lxGCXNRBPS
MD5:	9615A817742CD3F4498E018DDA560B15
SHA1:	33014F658F8031A81B660BF84B46F85097BD62C8
SHA-256:	23C1E7F8D4D5582F2835DD5566CBCDEE3C04491AEB35079407A68FE7A139B3E2
SHA-512:	5772D8F9DDFA9DABF969F66E879D1212C94DE504DA93F95B59A30C5EBD5310ECD1DF161370D4F6F77157074C8B92F27CE542E2C41C74D9D3E43C8C25DFD16973
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!.....H...........g... ........... ...............................-....@.................................Lg..O....................................f............................................... ............... ..H............text....G... ...H.................. ..`.rsrc................J..............@..@.reloc...............P..............@..B.................g......H.......D....F..................P ........................................Ry/.xs1Kj.E..T'L.F?HQ.u$..7c.....aw.'..,N....&...v.hE3.8g...!.K.E.O..,4....Z.7b....?.....O+3T..._@.V.....`......jw.T.'...(5....0............o.......(6........................0..)........{.........(7...t7.....\|......(...+...3.....0..)........{.........(9...t7.....\|......(...+...3.F.~....(:...t....6.~.....(;...F.~....(:........J.~..........(;...2.~....(:...6.~.....(;.......0..&........{&.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\01-ETI_Desktop_Sample_Basic_Templates_All.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	61066
Entropy (8bit):	7.725568502316254
Encrypted:	false
SSDEEP:	768:9r2XBXUGW43srZBSaFs/GAshl5McPsX9AHQmvEk/cw5/NezZltbgviTn:Uxo48tX4Ke9XmQmvb/cwIvtU6Tn
MD5:	FD72AE69A9CD138E657F177EB71E50AF
SHA1:	46DB4037F55DA40FE0F25EEC28A705E24E6A4C5E
SHA-256:	70E546E140E465E2AD083FBFB3394E16446F85AD712A9D4379246A5579703D9F
SHA-512:	2F18A42854E661A4A70083B53B11926BA02CAC54AA226592B8AC95C3D9E0BC29B9ADB8E5A07F2C338F9AFD1305212FE2F52D2400F2F8124352FD78A1D1832E20
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Bank Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9184
Entropy (8bit):	6.799097466445164
Encrypted:	false
SSDEEP:	192:wc8mVYTEF1b3UGUg3whaFUlbVvevUqzGmKQp:wc3GIFl3vw6UlM9zGtG
MD5:	CE5F7CCB47AF31F73CE769337EED8E90
SHA1:	F8A7EF192050ABA6024C4A373DF1CC95F18B0764
SHA-256:	05AEEB77B1A830D1E7015790BD0DD166D8C9621C900C04F6EAB9028D077E75B3
SHA-512:	71FA9A4658542E58EBBCE74BD2FB4CDAEED6A5BAF078BAB4B8B7F0CDB5092BD2777B8258B30C0C8B56D12E5512D9698BBB85DCB840DCE50AAAE0996A48CD856E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Bill Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9135
Entropy (8bit):	6.791930714923156
Encrypted:	false
SSDEEP:	192:wc8mV4Ecrob3UGgLaFUlbVvevUqzFRETysPnDzGLsgo:wc3ig3OYUlM9zF2TLPnDzSlo
MD5:	192B8F44FA177EA0FFDB8460630830A3
SHA1:	145DA91DDBC60B81180B0A3A88096A0FC518AF73
SHA-256:	BE9421EAC4C17095B25D5BA803BE784F6E92E43409A2C1236D011BD0563716EF
SHA-512:	C1E2A6630207173A813ED1A12DB43E5EEBABCBD5EF02011C286E109F0E593FE7BF6AC716B71365E003777758C699E742B3C8E4204D6D04098021FB40D4E80495
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Bill.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10213
Entropy (8bit):	6.890529533133892
Encrypted:	false
SSDEEP:	192:KIQ/jYtbb3UtJlaFUlbVvevUqzhNlQbDj30yMqDbzz:KljA33vUlM9zhSDKqDD
MD5:	BDF397CAFB2FF47591D2C49A7C5FF230
SHA1:	423BC617BC0F02B155359AB2D2332CEDC47057E5
SHA-256:	57C5C629B2B5A78A176F2CCB1389BCA55EC2601CDE9D1177B8DE0F621211042E
SHA-512:	40E536B524724F6DF41EEDA8D07E3CE12DD8E1806B0407356DD680F6C33689EF64B4394E565CADDABDE863FA66FDA3E7FB35EBABEF88DD56BBE47627B629779C
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Build Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Chart of Accounts.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9369
Entropy (8bit):	6.820004824747073
Encrypted:	false
SSDEEP:	192:wc8mV8Rb3UrnX2rta1ngRaFUlbVvevUqzaNm+JbA5d:wc3K3GXgtaVgqUlM9zIm+NA5d
MD5:	40E861F530FA90654EDEAEC57EB78259
SHA1:	A357577AF40310250D1D327C9C0B0471AFC75CD1
SHA-256:	2BE05E08A5A64348B9075D2CD6806A81281D9552E091E142851CF777DFE328B0
SHA-512:	D32A0F4B4E28EDCE14B6FC5BE2FF1F63B0C93B435A36BAC53CC4C65C07FCB9F56397026B89C7315B13352715DA77428A51E23A29FF8987D54E3D6D8BD8C2BAEE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Check.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9194
Entropy (8bit):	6.794556375149265
Encrypted:	false
SSDEEP:	192:wc8mVKMFXb3UqxZ+naFUlbVvevUqznr3xDKG9:wc3Nr3rj+8UlM9znr3xD39
MD5:	8406148C8D072ACD5181A28EF422536D
SHA1:	DE995904787D00B6CC9D0ED4341CEF9B79C30178
SHA-256:	374767BC567F75A914D105A8F1F24F2026AA833393EA1939CC18DE8538827ED8
SHA-512:	57271BDEC904EF903851F8742B50C2E2B46F9F6AD4AA549D85385B534910ACA4BAB0E64B351C5CE7C8428460D066E4B9334B49A2B1658F1F9291637EAFDC30B8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Class.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8836
Entropy (8bit):	6.731437216389898
Encrypted:	false
SSDEEP:	192:wc8mVLTIyb3ULY93aFUlbVvevUqzwz4tzPPnhwRc2xTQD:wc3R0W3aY9MUlM9zwz4hhwuY8
MD5:	468174A45289B92A9539A43E04E41432
SHA1:	47EF75923A676C238994ED796A66B5A5A2CFC998
SHA-256:	42B269D5FF693E25E33B5E9E80CF937CC5FFEE51B0070B5B717F7C4DCBB83F11
SHA-512:	4992E2A092D2CD3F893CD579B84E89BF5A95C47749DE84CEA172BD6F725EE272261322A5446D78F5ECB81E6E4571C978490FD6882D07D23CACE172BC5645A0B1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Credit Card Charge.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9353
Entropy (8bit):	6.8266239151092805
Encrypted:	false
SSDEEP:	192:wc8mVl3FbQIAb3UDUbMwWRoaFUlbVvevUqznr3xljbOsCXY:wc373FbQP3hbSUlM9znr3xlX4XY
MD5:	7C492D1132BDCF34AE0F0BCE636AA633
SHA1:	E92182622DC46E6E941D449C782CE83EB2464A55
SHA-256:	D6B222686B69187951120576193388845C9D8484C1CAA7BC2C20B2477636900F
SHA-512:	BDCA77E241B675C66F25498FF64E605DA18B5DF03BB2691677354431547DFC69F19CEE4F52B616F29184C689153CFC1692FD103BB81187CDDA9E50406683F180
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Credit Card Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9203
Entropy (8bit):	6.796497021864688
Encrypted:	false
SSDEEP:	192:wc8mVrQj6GIEQb3UnfJIWFAmaFUlbVvevUqzI/4a:wc3NQj9S3bWkUlM9zI/4a
MD5:	4B4F3EF66E93972E8F99245A758CA0E9
SHA1:	11EBD0F894EAA4037D47EC6F562861DC74E6D4CA
SHA-256:	D9C8AD247AB7B050FF991FEC49AE5A41B57ACF09BD5942E5DAA0DE8C2B6AA2EB
SHA-512:	B20237EF9C8FBE82D1E420D9D895BB0AEEA1131EAE78E1B446D9E4A4619E08F48AB13A896E30DA9279639A3FF39AC561EDC9360C9F1CAC65F1942D0D07674D94
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Credit Card Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10043
Entropy (8bit):	6.855789206815509
Encrypted:	false
SSDEEP:	192:KLmT2b3UUBkCaFUlbVvevUqzDVN+WHp+c8bzP:KiTi3AUlM9zDL+4pWbT
MD5:	600277C1E0C0ED5B89158D021471D218
SHA1:	6C8A1D7A395BE12514604A1434BDEEC3FE619DA4
SHA-256:	356397D0EBB8BB1520D2F7D32C2275D955DA9C5CBFAD99CC051506DA480FF91F
SHA-512:	3A4CD3916660A44F6DF37F452E746B3CD9E81B0D009F7BFD375B9AE0A01B9269D349448E7ACBEED072ACFA8417A6DB3B27122EBF9F0E3852F6374F0B9D6A6538
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\CreditMemo.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	6.804033887715217
Encrypted:	false
SSDEEP:	192:wc8mV0OtFb3UESMC4CaFUlbVvevUqzmpPhEYot1isr:wc3CWV32CUlM9zE5+lr
MD5:	D8A27A9E4CCCAEA9A920B1DC6C1A119B
SHA1:	E065CAF0AAA56F5331423E66340A0F5A38184B1B
SHA-256:	36AB013D0F3E1AC207A7BDF5D57F3F202857E1711EFF16B69B19321A61D55225
SHA-512:	6B255A8057616A9B9A8D27F60DE1649F376A801CC99814A4D69B88DD9613109290E288A5CB6C68F5DD715E6584AE6EA2426E98A45374982A69A6453225809250
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Customer Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9107
Entropy (8bit):	6.778806112720085
Encrypted:	false
SSDEEP:	192:wc8mVESHTTteb3Ulxj+I7aFUlbVvevUqzQ/3S7+Zkh:wc3fvtK3Cxj+XUlM9zQ/S73h
MD5:	BC59FA63BF1FE00967005768578BF425
SHA1:	FBCFA4ED201CD174E007E758AB5B8474AC7833C7
SHA-256:	FDF9CC7D78AA342DC8558ED7C9ED12E6C64771156366AF085833E2DA35C5BF03
SHA-512:	20F2C9A6506B6D105F0A31D2A8C912822EA4776FB31766691A193ABBDB3B0A8398339484FB1F9FF0A65319A861A5B8C7DC87DC1072A2F306DE6B4DD85C51D4F3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Customer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9813
Entropy (8bit):	6.860671425936742
Encrypted:	false
SSDEEP:	192:wc8mVnJeb3UyKopmaFUlbVvevUqzZJtVMNSXnGLY41LLg:wc363/KavUlM9zZJtTXnSr1ng
MD5:	24FD891870D191BCED85E80CACD647B9
SHA1:	FE21A94DAC5899CEDC9D661065D0B9A7F3136CD6
SHA-256:	18ABEEFF3359B16923C25BAED92C4BA4313CBBA7589F7C832C468F9AAF0A9499
SHA-512:	1BBCE47C787FF0F6C299D1D4ACF947E82BA7B49946EBF877E6C60D124F5E438544CA67682D7BE6367F501D1F60720A4E1C14E697B39E86D1ACBA9A6B8A5D2616
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Deposit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9165
Entropy (8bit):	6.788062247325982
Encrypted:	false
SSDEEP:	192:wc8mV+C9Pnb3UfbMPsW5aFUlbVvevUqzQ/3S+GL2+nT:wc30CN3MkpSUlM9zQ/S+S2+T
MD5:	2D312CB10F08B78BE0820C7F3874B266
SHA1:	02DCAEB6B4D79E039D64FC4A18007D1FBBA0FA29
SHA-256:	D7FC270A3FA93E714C8C39DD8A176709708EE6B7C73A7F64C981998BEDAA434A
SHA-512:	CC700D1A2239783BF61B1D38D90E724E83B39E6376EB283A1BDB0B1830927E4E118BE82DF147F5584BB0E2DCF29DAEF11B7E442911F56766AB53F46BD8CAC061
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Employee.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10671
Entropy (8bit):	6.986459582747118
Encrypted:	false
SSDEEP:	192:wc8mV9pfCb3UgK9AKRAaFUlbVvevUqzfneKjYVQWhGLvDj:wc3U3HK9Aw9UlM9zP3jYVHSvDj
MD5:	8CE6E3E912C77074A303D7C2E9B54B3D
SHA1:	188B639451C2CEB4F3E9CF192000FDC1AB007974
SHA-256:	FBAE185C3B14C3A7D7DC0A4983AF801475791009535D4EF7C4A57C3B6EF2584B
SHA-512:	8698E31160710223DDFCC5E094F01EC898ADD4E9D71DB3911696486AC59C3D587B17BB68C10F35DABA4814C8B0B8B73C3B13F9B9FE163F840A70DDB501819864
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Estimate.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10166
Entropy (8bit):	6.878077026613522
Encrypted:	false
SSDEEP:	192:K+EB7kb3UDo7SvfpaFUlbVvevUqzMWHn9SFjtlgNSWL:KDq3R7TUlM9zMWH9SFvg/
MD5:	92A188443B48D573523158EBF1C335F2
SHA1:	558046F03685225C6AA76B1303A3190937EACE4A
SHA-256:	BB1F898699D5A2D3B63E85833BF4C30CE254E141CA6E5B9B1B0257EA7EE2B75B
SHA-512:	EE79B41DDBC58086B395BCB7265E743946ECD3CB9BC7396E11C84DA7EE6CF47517379A818C2B92787F3D0092AA81F21B49F68E9AA7D31327C191D588E39C415F
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Inventory Adustment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9198
Entropy (8bit):	6.796468832739139
Encrypted:	false
SSDEEP:	192:wc8mV2+uub3UhbbObGiNaFUlbVvevUqzQ/3SjmFunTH:wc3ll3wKxeUlM9zQ/SpTH
MD5:	33F6770ECFBA78F163373ADFABA060CF
SHA1:	B0139602B76831B5FC08C51DFA21F5453361B320
SHA-256:	6EBF787D74B085FD9502EBF246A71CCFB09271D26E509A779C2FA721DE16C0AA
SHA-512:	9169BAA6EC288EBEE795620CD3E9C7D2D2AE61721F8B4D46508332BBDA8A6D462CC7C68136A38FC0ABD879155A06BE1D618E8E76FC4B3EAEB60AF456399180BB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Invoice.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10308
Entropy (8bit):	6.903411153340173
Encrypted:	false
SSDEEP:	192:KrTEC9b3Uhe4aaFUlbVvevUqz/sKHPTII+W1Um:KrTECN3DCUlM9z/sKHL7+tm
MD5:	632A50F9622433E866CABCE5C4AF5BCF
SHA1:	93FE7731008623651573D66E95CE91195D6B7C1F
SHA-256:	20AF6E2667E931B6F8CDF2493CC503D1C3F978EFFEACBCD275271D3C6BD2F714
SHA-512:	C2D17C4CCDB80384C177AEB94FE91BF4453444515DD02B0F29A329FF1064DE1478B14277AC762DD201939426B895EB724B402472BFA97DEB9294679A566DD4B6
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Item Discount.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10553
Entropy (8bit):	6.906479889381009
Encrypted:	false
SSDEEP:	192:D7XYYYb3UBazsaFUlbVvevUqz2RIMpQcqjz4B/D:D0Y43xUlM9z2OMpQHmL
MD5:	9EAF0A9C1A73EECD7A04C5BA04E8B602
SHA1:	339C3D6332368B2E5C243A48ABCFFBFC00FBB9F9
SHA-256:	33FF9A0444BD7966BC8229FE2810CABCBDCD79F9A7500C169F03CF5CC9B6F0E8
SHA-512:	4F51A78C4973B4B3A6FAA5D0AB85DC2A90297F1E4C14AE6A3DC7865124727A73EB2E2DD6993CB9B14B4DBFFB2E54438BCF37987FE4E8DD174962D80F3F967A8E
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Item Fixed Asset.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10339
Entropy (8bit):	6.901061806810003
Encrypted:	false
SSDEEP:	192:Kb4ZZyb3UqzYbkeaFUlbVvevUqzQ/3SjeFFtr6qeKjU:KUW370wnUlM9zQ/SjevteKjU
MD5:	570B66738D1554DF311D890B916E0F8B
SHA1:	5FDD69E2F3BFD5E27863F4CC4E029C091A2D7E70
SHA-256:	AA4670232A2FAE2262B4E4A454EE316B35631A76EFBF393F949A65219389B26A
SHA-512:	7A615E63CD1A4B4BE31D26BE92A36B4B291A4417D67ED5643A6CDA41A7EA9656E74D802EBA60CB5DB174E05A62D64B605BD957E17EDDFBE924B6F8C1FC041AE7
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Item Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8936
Entropy (8bit):	6.748673130020193
Encrypted:	false
SSDEEP:	192:wc8mVQshM0/Jb3UshT3OaFUlbVvevUqzxk1xQML5nsOoF:wc3OsvB3ptXUlM9zTMNsOoF
MD5:	1FE268B151BC885E9865CE977D3D6FCB
SHA1:	B45D680644FFED507926E5B056AA59FCDEE0C65E
SHA-256:	16C703F60D9C41095BCD620CEB14B479BC2B0FF1587B8FC92CEDFDF56B5B147D
SHA-512:	47440B28903C641744963FB15D937E9FCCA594B1CB3DB881D26D5B2C31DF0D8C62C0A7CD9206F0E554F2652647A779329B25A1B9F78C8C5AF36B785DAE0A001A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Item Inventory Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9326
Entropy (8bit):	6.820089794231195
Encrypted:	false
SSDEEP:	192:wc8mVe6g/b3UUYlHaFUlbVvevUqzxk1xJORs08+stb9:wc3g36cUlM9zZqx
MD5:	6FB508B17C40EAFF871080C6569DFA2A
SHA1:	250C8CF05B83A5E82D11FF59F309F756242069EE
SHA-256:	64C511BC90F6B590AB837CD629861785FA3A3BD5645F722152592113C66AB99E
SHA-512:	4335B4F309C42E07022A8FF71C40AA27D6B0AA03832B8976706B6BBD86E18B562DD96CAD08AC6146D8D91738D49978513E8FCA6D0D195DCF07079105E62E2A5C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Item Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8893
Entropy (8bit):	6.741464399644638
Encrypted:	false
SSDEEP:	192:wc8mVkn993b3UW0IAaFUlbVvevUqzxk1xz9:wc3kL3Rp9UlM9zG9
MD5:	86B7BDFD63EAEAD23F4FA9160C8F847D
SHA1:	BAAC7671A49437204841AC5CC60D8CAC9EEA7AC2
SHA-256:	FC95ADE85D4E81830994761FC2E5DBCAD2E4F256A38F92219FE9EF7951984559
SHA-512:	6866D18630B10C5F83CE11554987B0FF0C7CF8B6A336D37D3CE9C0E54587EE85E19AD0420F53C30E2D097B999D8BC60672DAAA3EFD9A044943715E0CBE8130BC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Item Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9153
Entropy (8bit):	6.790640553486682
Encrypted:	false
SSDEEP:	192:wc8mV5Hnpwpb3UvWYnaFUlbVvevUqzMWHn9SmnOBu:wc3Lyh3zUlM9zMWH9S3u
MD5:	9666585613B610BA36F6E339C5A99C18
SHA1:	6252C24CFBC55771972B2DB9BC350C390371C21A
SHA-256:	BEF12CFD50FC027278B710C9A8AD3F6724702BFB6090352685E42997D18E3193
SHA-512:	8496C978C515EF12954DA362ED68887F0EF87BDACFDC63066F04373B44A255E543C5711D67ECE9A3361D379ED368D5BD65038ED329B1350FD6FB8CB70EB7A4D1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Item.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9287
Entropy (8bit):	6.808545659750705
Encrypted:	false
SSDEEP:	192:wc8mV3+vIh2b3UVPV6eIXvaFUlbVvevUqzxk1x2D+kseytD7HX/:wc3Ygc3NeIXkUlM9zrseYD7P
MD5:	D57BCC7552FD94814BABD06C3A5A728C
SHA1:	437A50990D69E36D59C30D1281C2245DEFA26293
SHA-256:	F7448BB9D137B93957C1DCF4E77EC168141CBC8A2DE9D722E4E6B6B27C57E67D
SHA-512:	3ACDFF5E40087190D6B33B6682CB6A9873973DB8F1984E6551EEF9E3D165ECCB00A84FFE27C96645298364E00C76D5DCD0795385EA3E84613A16F1234D691D6D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Journal Entry.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9088
Entropy (8bit):	6.774778798840462
Encrypted:	false
SSDEEP:	192:wc8mV5B0JgszMPb3U2WcaFUlbVvevUqz32fFqn80C:wc3fB0HzQ3vCUlM9z36o87
MD5:	7A5F633598A8638830E46565968205CD
SHA1:	2D87350D7B9988437CB975851A15FFB0A7B66645
SHA-256:	B7FDCF7A7625909ED588C89ED2B760216DCC64BA886F3066BEDFF524D0176EE9
SHA-512:	5BF05B03FB8504E523BD2CFEC5A7CB8FFDF22068A2026278E4A54EE9FC8904D9C97079E92F2ABB58C088C0D4FB48FE66F025B93A0CA29F28A649DC6ABEDBB1B3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Other Name.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9973
Entropy (8bit):	6.882467303186888
Encrypted:	false
SSDEEP:	192:wc8mVpv6Kb3U0VjjRnaFUlbVvevUqzvMJbjBWNkMfYkeoK0t3:wc3x33J8UlM9z4UNFAkeoK23
MD5:	B9A5FB817878602B1E0BC1AC1E573070
SHA1:	FEF3038BA16B96C4F3241E48FFF3D882F0FA8EF4
SHA-256:	A308567D4DBBBDA556812C559297567785CBE082CEDAD70103FBCFD02A970377
SHA-512:	A85271658C2E0945AE07414C2E8F93C979FF5DC6486630AFF817F54C5C70001714392B5A3D935FED624C528D6AE5F40697136CE5522F869C4E6F589864E42DD4
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Price Level.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9138
Entropy (8bit):	6.777464816597789
Encrypted:	false
SSDEEP:	192:wc8mVXZBXyoRb3UWrKJgPpaFUlbVvevUqzxk1xKhnJ1qlY:wc3dF35KuKUlM9z3d0Y
MD5:	477128674AA8AAA769DC9B043B0C9734
SHA1:	8FB69498EA8BCFCC6A2AAEB004982D1520453D6F
SHA-256:	1F378230DDA0EE5D3006F39B1A501280DC907443861CC5192B97759CD1BCF5D5
SHA-512:	7F65836D0357FCD6E246A1593ACF22E221EFB0B34DBFB4B55247EA61F50FB16C5A66DA784802FCBD222FE536AD4BA11A8A2EA371912226AB9DFF5A1DBA88136D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Purchase Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9228
Entropy (8bit):	6.804200759490604
Encrypted:	false
SSDEEP:	192:wc8mVn2ROb3UGEGaFUlbVvevUqzYDx8SHWV:wc3YM398UlM9zYDP2V
MD5:	5EE240E36B72BB16061AE308B09CDD5A
SHA1:	D1BC3F912DF6D7917D9E120D9004A4C45891AEE7
SHA-256:	2C6D807AD0885410665968F89A30E54AD0D41F94EB716A3B098AF8859A736545
SHA-512:	B10084E887E79CC0D9F65320C3315F44219BFEC638B9C8B548CD659D6541356D23AEE7F976C92438C4399391C26FDCB62AD75CC70BE83E617BE3D81AE052A488
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Sales Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9304
Entropy (8bit):	6.815093622466568
Encrypted:	false
SSDEEP:	192:wc8mV/ndJYu88b3Uyi54/hB+TaFUlbVvevUqzYDxcgEfXr:wc3ZdJDv3i4/hB+AUlM9zYDTEfr
MD5:	512B87331D781AA63E85D0C0B92A948E
SHA1:	32335A46CFC1D88D3C2CD355C4959666901FF485
SHA-256:	CEDBD8EDF4A5A8453008884EECC4253EE5ADC13101CC0E354A687168AFB66888
SHA-512:	D6A19550A2CD06769D552E0E28461A68DF60384186C16224C937C81CAF7EE64B59CBB157D16131CB0F9EEDD772DA73BD3C47A856289035915DD25FA541EBB291
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Sales Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10013
Entropy (8bit):	6.921629504110839
Encrypted:	false
SSDEEP:	192:wc8mVuRb3UpcH/TboR8aFUlbVvevUqzYDxIIEp/:wc3Qp3K0/TsRxUlM9zYDGhp/
MD5:	4375B91B6DCC6FF545218DDFEE04578D
SHA1:	D24ECF5EF5A04BB0DD2D1C22C54E9DAA3D7A8D2A
SHA-256:	D70BB2691ACF04825C19AD4F76972B25B569A497275AC3C9FA81C1C1E5076DF9
SHA-512:	8C0A1085957BD7BFD848C86933578EBA46306BE63FF0ABE0B5547B4618E0A682CA0B3E2B5370EEF0DAE6F01B7E9697B30F2127A1A6FE58F7711DC2985DBF05EA
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Sales Tax Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8903
Entropy (8bit):	6.746413783682726
Encrypted:	false
SSDEEP:	192:wc8mVNh2wguyb3U47YcfzN+aFUlbVvevUqzxk1xcLjasbBh:wc3txguW3bYMHUlM9z/LbNh
MD5:	7C341F07B87A03BE583AE0EC9BD5B253
SHA1:	3E21C8E0A511AB97E24483ACD224076BF8554DCB
SHA-256:	191C5EE6BDC23F69DB2C26FEEC52E8602AD653311CCC06DD77400C338A1501F3
SHA-512:	890B2A446BC44A5597C36FF4718C60123C574528391CB5E872A2C91DFCE35004A2160D9C4271069559DD729E90876B26DEBAC12325D6ABDE3DB0AD36B1E6586C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Sales Tax.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8905
Entropy (8bit):	6.741727027305183
Encrypted:	false
SSDEEP:	192:wc8mVjib3UmVaFUlbVvevUqzxk1xpZklpB:wc3lm3uUlM9zgZkjB
MD5:	45687B6D0775709CFBE39553290627F6
SHA1:	35F6266975EFBFA5579502A40EDE5F15A65D433B
SHA-256:	8A1090CFE648F4C711A04F426BF0DC97FA9A16AFB2BFA86D40D35504512C3215
SHA-512:	72F6CAA73E8B958E4D9DAF17BC2C7EB42BBC6A7AE593249A57F476436065F72076503D74263853E050B62FE30CA4F16309EE9CCA42C850A5F032726F1AF7B5CF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Statement Charges.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9098
Entropy (8bit):	6.7833505794763465
Encrypted:	false
SSDEEP:	192:wc8mVY82zxD7Wb3UO+QAfaFUlbVvevUqzQ/3S2g7K:wc3N21D7C3ZFJUlM9zQ/S2g2
MD5:	C5412A4DD8F8823B24F08EF28220C713
SHA1:	9383048EAEAB0E738264330CCE9E796583C68DEC
SHA-256:	A66883BF9677E9485B7A63D51263E1B361F49BDD6987B1DB2B1F83DF9312A50A
SHA-512:	D3E520F378DBEC3AEA23BB52953C7A734C3301E57A0A9E5A9E42892ED917EE418FF0907EB4F9A814B6C6B52D9B9374BDCD4FB8C64CEE5A0F2AA3087A86EC07D9
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Time Tracking.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9028
Entropy (8bit):	6.763438882772652
Encrypted:	false
SSDEEP:	192:wc8mVpmD7uUI6BaSb3UXv/HoaFUlbVvevUqzoDmh1veKGnoyi:wc3ru7xI6B33qlUlM9zleDoyi
MD5:	A5FDDB650DD24C69AD6187A7CF29458B
SHA1:	541CF099BADFDF2567127E440253D8AEABD2EE4C
SHA-256:	21B55055CABA9FD52F0BEB73FF48EE254726E05359641C28AC6F72EFFBE34B1D
SHA-512:	93A699A2DA66870E8FCA3A11DCE75BA767A8EF62E6EB49F07011539F4EB901DB7F4C7CEE69421ABFEB8A5F97F6233208CAD469AF8542A8045A7DA9193DC2D0B6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Transfer Inventory.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9073
Entropy (8bit):	6.775095439636831
Encrypted:	false
SSDEEP:	192:wc8mVc1b3UsVoaFUlbVvevUqzQ/3SuyFJ8lhg:wc3s3bVlUlM9zQ/SuyUlhg
MD5:	3A0598F31A965B06BDC721A44897C61B
SHA1:	7F9BD01454B18E409200619FEC6910BFF15ACCAD
SHA-256:	4C0797371EFA059D0BB53E4038F06B8C880069E5897B9F0872BE1B39E269E4E8
SHA-512:	160D66FBA3260E04024557EBC8A0B6458A56847D5A9D15DDCF5731EE7F17A36221AAC6640DA1246AE7CF8610D145AD65AABEEE281702CFF53E0D76C375BC3F88
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Transfer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8939
Entropy (8bit):	6.748242510526029
Encrypted:	false
SSDEEP:	192:wc8mV9Trb3Ut4WaFUlbVvevUqzoDmhWzn:wc37n384fUlM9zyzn
MD5:	96E1F7C4743E814EC91A66F0111C26E6
SHA1:	35477FA996BE87866EAF805948BB186EDA2C1C42
SHA-256:	F57D33B7A220FBD5BDA83B5B3CE2C28F54916B6B20E7F80B8657114744A4041C
SHA-512:	82941DA34BA0DCD6C56732AAC1AD03AF980A9A5490448CE6EDE65526219832614DDE27F7777851F0F02872D3923261163A00316AAD366884874AB2E530150A26
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Trial Balance.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Vehicle Milege.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9059
Entropy (8bit):	6.771509929735666
Encrypted:	false
SSDEEP:	192:wc8mVRNs7bb3UHwxQGugaFUlbVvevUqzQ/3S2PiAL:wc3zNs7333xQ1UlM9zQ/S262
MD5:	91C493B99593764501FF33B0BED060D8
SHA1:	2073076A51EEEC12D953344CE8955FADE29F0FAD
SHA-256:	7F8D3452FAB6BED5A92CD897826CB9610AEBEEC1135761FCC5B12C589B9B35E5
SHA-512:	B8F6ADF0ECCF11AA459E6346F1973488E09245156D56CD8EB86A69F1A67FEA75F191FD690267D6EECA05B97B760FD088F34E746123B6C6D0D616D1B5344D5917
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Vendor Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9219
Entropy (8bit):	6.797160453567968
Encrypted:	false
SSDEEP:	192:wc8mVoFZRb3UPp7xjaFUlbVvevUqzMWHn9SLvciX:wc3m13CxQUlM9zMWH9SLUiX
MD5:	6A2282B8C611DB702E3FED15CAED45F8
SHA1:	5A19AA35F3019EB70464C1E73565936DC7F4CE81
SHA-256:	B6B330DCBB9D8815732BB629D4E6DD1BD5A7252058F36BC962DB59A2622B803C
SHA-512:	9EFF4495F1B4B7D80E4EA906D66D148BCBF47936405FD539346F940B98FF2C8938AC7683F1B36556B10323F942EB9AC4174246E335A5C26C08108EFFD877A206
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\11FBC130\Vendor.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10549
Entropy (8bit):	6.968572308131826
Encrypted:	false
SSDEEP:	192:wc8mVGeb3Uo2tdKx2HEWoZZMoaFUlbVvevUqz0aO5GDSKk8Y43V:wc3cK3ueIkWQEUlM9zjTVk8Y43V
MD5:	B00DED87D8A3865084BEA4456D59E6EF
SHA1:	018D8B3EBDDF0AF2F1E5E1413DDB5C3E964F11A9
SHA-256:	9FB6D2CA7D4B1F39F89B118359CCD34166F82754FB3B1550DECED94711559C0F
SHA-512:	1FC86ECA0AC55CFAED5034256D9CCDC9785E8506CD10E5CC68C62A66345C64C9C9B8DB629D13877250D74AADE01A959111EEBFD9A17C81730511A916F0496166
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\01-ETI_Desktop_Sample_Advanced_Templates_All.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	71821
Entropy (8bit):	7.792072809135735
Encrypted:	false
SSDEEP:	1536:3oX00e6wwXNAfYvaeTQPyMhAZ/mJsGvb/WfB4E0I2OWL69Mi:3Jp6fPvBOyMm4JssiB4s2DL69X
MD5:	C9CFBA3A65069FFFED935763D4A7A74C
SHA1:	676053CAC74074248341EAF9A0E16F7ECD58CAFB
SHA-256:	6B339110EC06E73580B01EFDF0B677C9C8FD0509CE16163FFA1E5CB0B825212B
SHA-512:	E6F601F03E9A8F0AB7D8DB886C7FD7E79FFC3AF841F6FDD051C6B0469DD2315EB86140F41054F03D5318D91C31355B38B2FAEF64062F23B5AF95BF218BCD5F7E
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Bank Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9409
Entropy (8bit):	6.835146893058168
Encrypted:	false
SSDEEP:	192:wc8mVxieIb3Uk7paFUlbVvevUqzGBNG7Km:wc3m13xmUlM9zG1m
MD5:	7786245F307AA5E9F53FC02D1D743AF4
SHA1:	EC55E64029FCBB70AB744C291BC2EAF05B9E045D
SHA-256:	AD495770FF19ABB285FF25A0787E53C6472E5629F0058F7369B1DE3E9977B77B
SHA-512:	69134FD79019EF64D84E7E98D3759177C0F4EC34EF03D4FD7F7D5E06E4943C9049CFF668712239F38FA465E8A54D9FC1518EA3724C8957BAE2E1E546D5129DBE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Bill Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9263
Entropy (8bit):	6.811174803774489
Encrypted:	false
SSDEEP:	192:wc8mVXEib3UnoBi5epwbaFUlbVvevUqzFRETys8FqAKY/Qgd:wc3NL3iepwoUlM9zF2TL8EAKkhd
MD5:	F4EE9D1C72D66C00502095D92B51D075
SHA1:	679329C9242F85260591330C280CC36AEC56EE0E
SHA-256:	980E3A62E7255829C7A8FD9DFED72BACA46250EDB551D149592F985E366C3CD2
SHA-512:	79810A162530880E10754A49861A9600EA26EC89ADD1FF22CE2B81B124457EA2E4BDA6CE7B4FEAA24FCF018378135BEE4CCDDA52E9EAAB12796F271C0CF6318C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Bill.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11078
Entropy (8bit):	7.002037492689051
Encrypted:	false
SSDEEP:	192:KNAHvb3UBHJmnYaFUlbVvevUqzhNlQbDj38KeOB5G1Dbzt:KNyj39UlM9zhSDwKnBSDd
MD5:	CC45E37D94AB802C4E60269C255DCAE4
SHA1:	11AC2A6900DC370CD92AF3A556FC6E9E2BE2CD83
SHA-256:	DB3CD0023FF1B155D3114970F51F9C5BB0A368C12D06D7F3E2437E0AE471D135
SHA-512:	7CFFE9E81B0E3336D87FD79430752E181EDFB36C805093FA33C33A717BF3BF4D4555639B924F7797F58CB77DD14F9AFE6411B0669C78F898E3A514863E4D3D9F
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Build Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Chart of Accounts.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9428
Entropy (8bit):	6.8346550146854295
Encrypted:	false
SSDEEP:	192:wc8mV1CMBKb3Ugo+EXSsVp9aaFUlbVvevUqzuap28N/WA5M:wc33CMo34+GPUlM9zuaptlWA5M
MD5:	E46D702786A28A22EBF3E08FFB8E7800
SHA1:	15FC3234E1F7B247A10926E1EC3C79D0B9E1326C
SHA-256:	04E46E45709212C1549A80DC1BC5C371DD5BEF1FFC6AE183392012C6D171811D
SHA-512:	246A846EBFD06BFA70B4A8563F8962511611FEC874B316D4ADA78C99B6988F1B9F187A8F8F0C36F5E4DEF3FAE2EE6E9B63B624905E8977F1EAE8F91C99702413
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Check.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10142
Entropy (8bit):	6.9469252609143055
Encrypted:	false
SSDEEP:	192:wc8mVf5U1/Ab3UGwoN8SGZaFUlbVvevUqznr3xIcuf+:wc395m/g3lwZzyUlM9znr3x3uf+
MD5:	31221D18750154962C6D16D487F6671C
SHA1:	2D4C0DAF65B97FFE8B474016EC89D041F79B6AA9
SHA-256:	337AF1B959DE3B4985C2A12F53E783D0A9A828B800CF33EA86EBEA7E8FDE1091
SHA-512:	82E0206B00F1405DA1392D6699F0604556434806B3F6C0DA7D93117DC300BAE67E717796FADB4E0C64BE089176C50863EE6DBD28E0AD7D621B9600E8B780D042
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Class.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8798
Entropy (8bit):	6.720255988540497
Encrypted:	false
SSDEEP:	192:wc8mVW08Sb3UqRo3/aFUlbVvevUqzrTJNoPnhZZjTy7:wc34y3E30UlM9zrdUhnm
MD5:	1C2DD44337B6FBDECEB7AC25CB944E0A
SHA1:	D8656BF1849FD6667D96D94353FC04278031092F
SHA-256:	A6687AB16520919EBE6AA8065C428E3C06C46B07CDE4DEEF86A53BDC75A9DB81
SHA-512:	2AFD8CCDAC7042B735E8D113F3C05F9498FFAA9F31B7A952977B2113099A1972FD33B7CE77BB957AA803F5F99165A7A58C24E466040421D10326DE09F27FA53A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Credit Card Charge.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10198
Entropy (8bit):	6.9604922120108474
Encrypted:	false
SSDEEP:	192:wc8mVE3Fb3UszomioppCaFUlbVvevUqznr3xazG9OtZdbOsCn:wc3EV3ddpTUlM9znr3xazGYh4n
MD5:	C15464404820B961E00F3A97FF282592
SHA1:	B578DB215DD25CB3A8974A1F47F788F3A36194D7
SHA-256:	0347E93B8C0FB4023B90556828937782C831E62396588355386BF61DA6788B5C
SHA-512:	BE02A4B0188CED7CEECCB678535E2B7B3189F204E33131EB9977238624D391467D4FED08A0B68FFE7783474E0406452479E7C3CBC8A2DCECB66DD72F961D25F3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Credit Card Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	6.906727391175815
Encrypted:	false
SSDEEP:	192:wc8mVFvujyb3UlS8wvqZaFUlbVvevUqzIv5Fyrdt6EuFUNZ:wc3XuS3RSyUlM9zIv5Fy5UjiNZ
MD5:	8A2EEFC6A0436D32E3EB3E5B8155A7AF
SHA1:	CDD2713936FD91DD9F1DBF3B9E61140FC9BD1A84
SHA-256:	56A6DBAF402C0418558E38F2090C0F8E2A18393DD7E2F589DDBAF416F15A1AE8
SHA-512:	59C3D8F203EA614097B39D5A33A6ABCA4E75B5FCC04022423B53136BDD428458F2A60AC1C367A585B06F84C5F070AE58AEE35A515D00EF901B3EC0107CAC8199
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Credit Card Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10209
Entropy (8bit):	6.886777504200445
Encrypted:	false
SSDEEP:	192:KhjHtZb3U3V4DvaFUlbVvevUqzDT+Y+WFdt6Elzoh:KJNx3VkUlM9zDL+mUEe
MD5:	2E35BFFA12C6E81688934CAB032D017B
SHA1:	09B5D4C370B1E28984E22F0F340AC9D8E31D65F8
SHA-256:	33167B04345362F45E2B6DEFE84C4279F776BA4ADEFE04447134ECD76A3D8CC5
SHA-512:	9C834E1D40493D5D98F893E6127DFFB0A68837EB6E54B2F4388247AA4B8A468821BE17C3B897390E5ECB9D9C5DD10209F405F90F8A6504BC4C94E9C8C231242A
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\CreditMemo.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10585
Entropy (8bit):	6.999634894317925
Encrypted:	false
SSDEEP:	192:wc8mVHY0hb3UtdCziWaFUlbVvevUqzGm81q3yjKimQmpzsw:wc3lXZ363fUlM9zGmoq3yjVmpYw
MD5:	3F22FDAEC17F3243E01D91FE93B37AD9
SHA1:	BC4D3968A68304F4CF0EA0236BED2380040461E7
SHA-256:	E0412675ABA85C69A55C8DDEAEFC537FBB723D21269283BE9650959D74E68D71
SHA-512:	CED0EB56D93D77D5C2A792FAB64291DADD657899F003C8BE9049E664FBAE0183584B05DEF6B4524DEACBAE91B59591CD8466A5DA2A2DB602899EA01E0FE4EE9D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Customer Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	6.804106873918999
Encrypted:	false
SSDEEP:	192:wc8mVurLTb3UemlF66WOMaFUlbVvevUqzQ/3Si0K:wc3Kr3QlFfWqUlM9zQ/ShK
MD5:	5A3ABC826FEDD4DDC40F28F91FF2C49A
SHA1:	5B206F8A97E70E3B36A0A16C802E7D7FF1E672D2
SHA-256:	073829AB46F6926D5D88F3356351C92F9B96BECBE647B6961D9C69EB8C068893
SHA-512:	DF6B0F193AF2ABE4AC7B127183F72880EF41869A9AD0D3D7FD29957C414FAF8CB9A5CFF88D315F484BF14F711137FD70B420665FC2733FC683967A4832C472B1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Customer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10806
Entropy (8bit):	7.00455927670836
Encrypted:	false
SSDEEP:	192:wc8mVBBjvt3kGb3UO05NfkgKBZA5aFUlbVvevUqzZJtVMuErD8hzXvp141an:wc3/Br+S39AkL3/UlM9zZJtRs8hzXvpx
MD5:	6A647229C586F23E7FD222CD8B917983
SHA1:	27B732103ABB99938B4EB6B67097491F6245E9B9
SHA-256:	CB761B527FB136E74568EC5F2D2ECCC95AF923BCC7F02EF775AC3A1E0AF1E42F
SHA-512:	58673708D6F85CEB82FB9AB704ADB0A0D69A74EB43CBF38D0CAA0EDBBEF2C2A865D35F1DECC2EE6968EE32F8AD4D7512349D33A4548FBD0102648CF1A834EAA5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Deposit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9334
Entropy (8bit):	6.8245118687473925
Encrypted:	false
SSDEEP:	192:wc8mVxA/9b3UmBFJnT7PaFUlbVvevUqzQ/3SN8W:wc3jAF3H9T7EUlM9zQ/SN8W
MD5:	6701A6B0B167EAFD0375E78A4A2658A6
SHA1:	C2999565414E306DACE2233E94B52A947C66FEA5
SHA-256:	E4E0253ED8B4635ABF5716343C743FBD628447D3942697EEED65685CFFB36A1A
SHA-512:	65FB16429AB0B71C63E7E93DA677A9D897F72F4772EBB8CF4AF6EB2D75A30B6224916BD06C8458697C113A05FA99B3C0DD918E3366C82D1DAB6649BF2B90A368
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Employee.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.021013113154668
Encrypted:	false
SSDEEP:	192:wc8mVBeKnoY8++b3UtVuXgw1gEQ4aGAoaFUlbVvevUqzjBYSHskTMQWbZc5X:wc3XLz8F3xHwG+UlM9z4kTMtZc5X
MD5:	9558B568CD1DEEC125BF9881EADC96E2
SHA1:	438BB1F4CE19852ABF5957A7A9FEEBB820FF9F74
SHA-256:	B6A39B7FDC8CDA82A9B70689F3F1F61354C3C2C0B7BEA8FAB49A85B577CA2AFD
SHA-512:	A85B4060013DB56740BD11F43918BFC12FB018D40F9A8BB680ABEC2720B499751148AFB536BAE6EB8BC3A3D896185934DE0F66DD930FB7B6DB82A3D2B125065D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Estimate.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11408
Entropy (8bit):	7.040857250327687
Encrypted:	false
SSDEEP:	192:KllCb3U+aoT/BrkgfMnaFUlbVvevUqzMWHn9SloDjLOZdjW:K7G3/T/BrkglUlM9zMWH9SkHOZ4
MD5:	EB6F2173E89241455666BC81605A3744
SHA1:	AB4399313AC083E0DFF06419982C7F64C5F0DDC7
SHA-256:	0A9DAC5514807986E50D3BFD5755B11BDC233EB334B851262A1FCB94DDB7E99D
SHA-512:	9BB78F77DDD2AC0A7EA0FF57EFCE8F6A09FBF5990C0C63C12938300171B24DBBE1A3898434B5BAF01E639684D346AFF476092A5BA2F6570DC43A708B75A653C3
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Inventory Adustment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9310
Entropy (8bit):	6.8189561680744255
Encrypted:	false
SSDEEP:	192:wc8mVXQMQgub3UkOqujnLaFUlbVvevUqzQ/3S2Zn6:wc3Xx63XujnYUlM9zQ/S2V6
MD5:	B97EEF588202369F8B876F1423663195
SHA1:	6BADAF761D637C9EB332E9119594EF3576986A27
SHA-256:	9D60D238304CD104A2FC7C17CEFB87CBE802AD0F08D43C955E9D6B0A605F02A6
SHA-512:	3523A17765CD859E046F5B6DDF9E38EE916B0935EB88A7E8510194448C75B7542E1A11C8BE3FDA35CF27EE50B9C92F377D719C3E9379C2DFA8954FFC691C1CAF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Invoice.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11340
Entropy (8bit):	7.034558168346158
Encrypted:	false
SSDEEP:	192:K8L+Yhb3UF8Ds6WFLoaFUlbVvevUqz0zH5eK6z+WlE5a:K8+43iBLlUlM9z65eV+/w
MD5:	D74C95A1AD48C9964B1B27682B3E4E17
SHA1:	47C3DA361C430B40028CBCA998EEB65AFF882D85
SHA-256:	FDDD98280EFA3941D16DEAFE85BB1FB87800D181249478E18BC8110B60300A5C
SHA-512:	3BC69B80D9CF29E2C7E9AAE137AEDFDB552180C6E050A6472E31854ACF7822DECDD08AA293944BF4D0C9B862C2115DACAD918B73B5B093BA3DC71B6D6FF1034E
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Item Discount.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10751
Entropy (8bit):	6.934760300038226
Encrypted:	false
SSDEEP:	192:D0+b3UPnosMuaFUlbVvevUqz2WPpnRxFGMUf0/:D0q3HsgUlM9z2AnfFhUM
MD5:	A19B8A630EDB8370A3B709FB4598A590
SHA1:	FC168E56503A9EFE0E60FDB605A93EB7CA3EEAAC
SHA-256:	79A459642999B71E377F01A021FADA955870EDD4A63B92449A8024FA36A2C2D9
SHA-512:	22F87F18BFE2AFAEB06ED4F90F505598AEEF0D8CFBC62E0CD5422CFB619FCCDCB82A46B9AEEE4AA8DD4CCC0DB6167B3EA623551C2C79FC6CA91A19FD2D8A546D
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Item Fixed Asset.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9636
Entropy (8bit):	6.874857397593093
Encrypted:	false
SSDEEP:	192:wc8mVbS1F4b3URlQzyPertXcaFUlbVvevUqzQ/3SjReK5tr:wc3l6Y3+QzyPktXRUlM9zQ/SjYK5tr
MD5:	6C97C50570FDEAE69D921048FF063ABD
SHA1:	925E4EDCE6D10E67330D04100251829F53C13CA5
SHA-256:	E7B3B3269A7137D9A4784E60B87E72AB94397F822609457D4BAF32778C61EC36
SHA-512:	B2122793F0838B98C87C131A40617FC7B340445FC7B251D50CE6CA134FB388FF867B7964142ED7F7C7FD8901D3A328143C0C3B711C4E767F4BD190D405EAEEA8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Item Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9008
Entropy (8bit):	6.758581176481423
Encrypted:	false
SSDEEP:	192:wc8mVCFDb3UnzaFUlbVvevUqzxk1xQPkM5nsOoD:wc3kf3kgUlM9zLcusOoD
MD5:	6E37867EEE64D3892AEA74BB73483925
SHA1:	CCFCEB314F72660035B3E7C274D40C28D9F08464
SHA-256:	A0EAEF42ABE9CD0BFA595CA90230A22C2B0B0D5B39F6D084DD1882F715D459F0
SHA-512:	C8075365204D8A1B7C8129D2D06D55DCC1F60434259F9E2E9C61A99EC1C2AD7DFAE2941867DB69E98DE9B83EEE0C7BBFCAA7666D4EEE5E3314C5C847A36D04D8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Item Inventory Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9535
Entropy (8bit):	6.8571626406180215
Encrypted:	false
SSDEEP:	192:wc8mV+jfUb3UT5BvhYCsiiaFUlbVvevUqzQ/3SJE/BUSaS:wc3N3IzsWUlM9zQ/S0BLaS
MD5:	79B005C4A9081B3FC61EC5298A62600D
SHA1:	5683FD5645D84EE3181639BB3D404D6661825DA2
SHA-256:	72FDBAC8A845D8FFD09E90050F88F2663783439EB86BEAF04E15044B891BAC7A
SHA-512:	A61DF7D4028DD005B04A6B77175EF337DF07177FD6B4B292552387354F13BFE6A07240766132B7CFF49ABA2FC8EF3108CDC16B1411E6A665E0980E7C4F5CF89A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Item Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8902
Entropy (8bit):	6.741515570203868
Encrypted:	false
SSDEEP:	192:wc8mVdCwiTFb3UL6p3aFUlbVvevUqzxk1xEtN9s:wc3ST3XpMUlM9z9tbs
MD5:	0897DD514B3B8F24F6B54ED967D819F1
SHA1:	B16A9940546B96913E1EA4035C0AEBBF0F9B378E
SHA-256:	019EB7073ADE81163CD299BCFF07F452DA9EE09CD492B699713277D113A8BA36
SHA-512:	B91FFE144D0446A726EE7CEF428E40EF69AC414842B70C896396476D9EBD6332E36723C7115D35721D598B671938E52DEF6024ED9DAB50007BF47CD867D98726
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Item Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	6.898973088547867
Encrypted:	false
SSDEEP:	192:wc8mVK9c/9kV/4jb3UAayghAa9aFUlbVvevUqzMWHn9SR8vFhDTBDq:wc3Aen/3wygOPUlM9zMWH9SR8vFNFDq
MD5:	AD2D0719A7082ADD252ED93DF29DBEA3
SHA1:	9B0ABDFAD5AEC4558A69819BAA4BD4E2C49C4F7A
SHA-256:	CB7F87885506C4C12431257FDDF5456967E5A573927A44CC48278F41D9E138E7
SHA-512:	99962543896C322D06064B92AC3C8865202D1D7DBE192BD1FE5BD8347F1A3B1BF83EF15DF2F3CA2C2E6C4BB538984946ACDDEE0F4E09004FF6772150A0DFDD85
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Item.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9572
Entropy (8bit):	6.8591410772456065
Encrypted:	false
SSDEEP:	192:wc8mVePgw4db3U3cNgSYmIaFUlbVvevUqzxk1x1uydHctD7ecx:wc3UYw4t3qFmFUlM9zfPD7ecx
MD5:	E1CCA320B79E4FE363C2510493B6099C
SHA1:	97AA9F4D525025A73A9E798B98017095EE1E1053
SHA-256:	054E620A0930293871A2789AE706FDC3245E36887625FA5B7DF6E020A164E833
SHA-512:	D0CE5D966C4D0C2A4476C5C2E2727404920561046C3AB2E8F5D608C94C6531C2BDC30FB462A185D1BB18666ACA288B514F90BA5F7966C522A9B725323C1ED245
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Journal Entry.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9165
Entropy (8bit):	6.790829628817651
Encrypted:	false
SSDEEP:	192:wc8mVUUKb3UGRsjMaFUlbVvevUqz32f7J8D76:wc36UO3lsBUlM9z367iD76
MD5:	5BA3282AA143B09BB4C749AC9F59A778
SHA1:	1CD45042BF16ECF82F10B2F1E26217B16A40017B
SHA-256:	D0CC6D919667209BBDEA1CB6E14CFD90720D89849D9BA33A82E2D05E905C4BC1
SHA-512:	265B9130CE8E03D6A48B08F8024B0EDA82180AEBF7A42FE10D3DF53EC1B7CCA0A89C9E9CD04071D2A2B0342CE95B5B0A789E8B5FF4B763443B2162B1AC900342
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Other Name.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9942
Entropy (8bit):	6.880574321203129
Encrypted:	false
SSDEEP:	192:wc8mVIVP5gb3UiE3/+ycaFUlbVvevUqzvMJbjBWNkMf/2oKVGD:wc32G3qRUlM9z4UNFX2oKMD
MD5:	1EFD320BB319BEC7314C291AB4844DC3
SHA1:	D07899C98E925FF095F777E13B260311CE1EA1CB
SHA-256:	6F6DC81D587C005625D282223BDFE046BF377F6C810713325F10FC7F7EE9AB92
SHA-512:	DA13B789D2F95D7AD0D81BC75209DBE08394CBDC89873247442D7E997999B4EEA351C55E4E52F49D105182E815CFA70F70C1B9F225BC073ECD0B80B87E406088
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Price Level.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9107
Entropy (8bit):	6.779691843621978
Encrypted:	false
SSDEEP:	192:wc8mVc8zb3USVx5p1joaFUlbVvevUqzxk1xfTd7P:wc328v3XxvxlUlM9zC7P
MD5:	DDB1A777F2BFE417F8D0D1DE53662C05
SHA1:	04A40137A4D32E177E302AE4DF988DF8E1A996F1
SHA-256:	9CB1C01D2C72B8A36A0749BF12AC7ED7E2C60EEFD32090B5874A0D7520CABFB9
SHA-512:	754126DCB416564CEAAE0194852966999148DC733E6D71FDE84CDA16A75A322A59A500AAC05494AB8BB53F3C59AF7757B61DCBC42495FCF926A973F9E9E4FADC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Purchase Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10212
Entropy (8bit):	6.9585940246465805
Encrypted:	false
SSDEEP:	192:wc8mVIBTanb3Uxj5kmaCU+aFUlbVvevUqzYDxeGZL:wc3mBTab3WjlaC8UlM9zYDAGZL
MD5:	CB19033D56B615821E7A14DA7FA94A24
SHA1:	D19DEE1C92DA51BD909D06C7755484A88C4F0822
SHA-256:	D07DD5808CF886316EC12DF0DFDA21611C1296C0758B0310618F0711A3276B22
SHA-512:	1A58418DF5EAD2D67B46E9220B4853278C1628554F47E65D008569EDA3DA593162B88D803DC9B879D37D3952475ADA7F0EA28153B8D66A0F10331B45248681B2
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Sales Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	6.993302047378494
Encrypted:	false
SSDEEP:	192:wc8mVKaagb3UopdpwaFUlbVvevUqzYDxZWP6cvnzNFfXAW:wc3ga3PpdLUlM9zYD3WP6szzfAW
MD5:	A51DEBCCE7CCE3AEDCB4BBC96DBBA8EF
SHA1:	CA9C083F72AC92059785B7356919DB38C424ACD9
SHA-256:	787C092492F3293CE06B875976E3B25C6B57FC5786FD070958BBC5B059713798
SHA-512:	EB649DE96C0F0843005103D5D8984D2C53F69D4902B5FC410F097BDB9CA7CAFD81164EFE7B1EA81B49849EA2AB459817D7080DAD68B5DA24E075277EEF4719ED
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Sales Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10563
Entropy (8bit):	7.000994706243713
Encrypted:	false
SSDEEP:	192:wc8mVPS29jRb3U0Ma/cj4ing8ooaFUlbVvevUqzYDx5TSTm3IEX:wc3U2j3PMOZFUlM9zYDD53hX
MD5:	A6AF62DC0A1B0D64B62B92F2A394A903
SHA1:	368BDAF6D16882018C5C058F36AD7EAD98C5E569
SHA-256:	C320E36C1C63F0111F87A610252BBD77C651E15208D33A7C4208BDF5144D7375
SHA-512:	EB383F99ED44CE5AD1AB5719A0047388BE9FBF9A4FD8BFA99F0BE1FD0E3C54AE6CF823E56F4FC6698976F83A224A030D645488252568F341BA8A4430B24B23B6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Sales Tax Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8878
Entropy (8bit):	6.738910117567037
Encrypted:	false
SSDEEP:	192:wc8mVK4qNU6g5b3UXnhhzsaFUlbVvevUqzxk1xcoasbBKE:wc38tgR30nZUlM9z/ENKE
MD5:	57A1600221F6BAF16D271409A90E6961
SHA1:	5AE582F5D78661B93FC13B5CFDCB3A243A41EB66
SHA-256:	45A1D852E6D465C9FDA030C8B621B74075EBF9B4FA45EBDCAB53A7ABE7C65075
SHA-512:	48E01EF950EC6B3AB4523A46DF961BBD6F177EB1D7F65F1843AE21C371BE94A73B1E3B802CEB881EB687340323818882801E7E4BF3466341094C7BC2A7320F7E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Sales Tax.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8877
Entropy (8bit):	6.731786945467423
Encrypted:	false
SSDEEP:	192:wc8mVEtuXjzrb3U08xkyamaFUlbVvevUqzxk1xpwpppdn:wc3wmzn3AFavUlM9zgwpndn
MD5:	2E40D56C244D5BC0BD2E33345167DE2D
SHA1:	6759D0A8E6A710417BB5396278323989B7050EF8
SHA-256:	5F07DDEB0383EDD7140C065C1619CC257A99CB10AACFA6F53615575F971BA188
SHA-512:	8D7E18C7952A0A8CA8E888531D2A92C9AF1A497179B83D0E796569BB6BD2697CB4F2B3DF596EEE422B7819F40411401F5FB31C2FDDF8B2AE9112D7B58DBEB1BD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Statement Charges.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9195
Entropy (8bit):	6.80403615435195
Encrypted:	false
SSDEEP:	192:wc8mVcmuIub3U6DbISLaFUlbVvevUqzQ/3SsLlZk1/:wc32I63FbuUlM9zQ/SSZk5
MD5:	D59FDFD946BEDA6FEF78DBB5573BDFBC
SHA1:	E05EC9E34694CB6CAC2033643774B438CF1DE3D1
SHA-256:	A844F3925A61BD5689D3FFC577F2FEC536E968B42930DD1C648DC8C95C53E8E5
SHA-512:	DCD44F952C450A235E9EA64F978D93068990BF6326017E54A2D3E9F15ECFFA8BCAB94AA195AC63BEB15ECC4CAE9D672B686A1D9D3A7E275BFEE6BE3F7AE112B5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Time Tracking.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9030
Entropy (8bit):	6.765434751177057
Encrypted:	false
SSDEEP:	192:wc8mVsib3U6jjcycyoaFUlbVvevUqzoDmhoCnoyQ:wc32m3BjHUlM9z8CoyQ
MD5:	A99CC77D26C2F03CA5AA587DF34A9501
SHA1:	949F9E0697F5CAAAEEF5E1D42488DC046FD4B50D
SHA-256:	17BFBEF2D1546F59C7BD072D3DF13FC619FBC68745963D98B332EAC6F3A2038B
SHA-512:	D32FFA9A66EAFD3A3F2A52152B58CAF9C8CBEB9EE8F6CEE0FEF16AAAB60E9259C15DB8922A2CEB653C069B50003583B3B0D1F4184A391E2B94CA75569B1DC997
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Transfer Inventory.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9079
Entropy (8bit):	6.780184862313751
Encrypted:	false
SSDEEP:	192:wc8mVyQl5b3UCsHvJFcpaFUlbVvevUqzQ/3SDnlhY:wc3kQf3UICUlM9zQ/SDnlhY
MD5:	5176457989D44739BD45A5AFFE8C76BA
SHA1:	5D260894372376DD3B98D935743EEF67AA68121C
SHA-256:	DE1711A1DAEA88F2F7778B2F7BA7BFBC12E207D03A6B3D88C462003E9D1E1640
SHA-512:	35B1A24EA2A2BFB11C6FB7168D1C4F96A3D31C3B4CD563D65F07EC44529951B433E74B603C7EC9C746C54515A64C461FAD2F316156C1A15C942DECFDF95A371C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Transfer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8927
Entropy (8bit):	6.7447222021488455
Encrypted:	false
SSDEEP:	192:wc8mV5b3UpCehQWaFUlbVvevUqzoDmhecRWxsBo:wc3P3yhuUlM9z6cR24o
MD5:	D931EF04D1779CDD007C3C0BA5201DD0
SHA1:	801A29AABEF972C41A9186D256B058FDF942F26E
SHA-256:	D01BDBC91EAB65E485DCA7C91FE6C47620BEDFF99B6E3B5F7B9060FAF072E929
SHA-512:	21506B3B2376068133A1C5CA061FD3BCB8B4A72CFCCB882FAD9B7BACCF4A82240933ED6F6A7B06D13238CB5DA0D31FB3921B883E7428E6DF22CD56988842CEE1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Trial Balance.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Vehicle Milege.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9141
Entropy (8bit):	6.782145844796253
Encrypted:	false
SSDEEP:	192:wc8mVadAb3UxeFFaFUlbVvevUqzQ/3SBBBosPiu1:wc3AS3n2UlM9zQ/SBjos6u1
MD5:	A0403054E8EC020532ADB27CD91E1604
SHA1:	49FE13F6CB42F28579FEDF768F1F10312407B00A
SHA-256:	EAAB2188E3128256846E56C6D42BF921E3286A06E05DAF993197F0829CE8A155
SHA-512:	3649310E6023FBD26FBC2548F1BBDCB3EFCF4837B8B5D90372E7A4DA2FA588FCE876558478ECA83C504A27094A4B6EF8DFEC33BC629897E517594E1B6EA3B24A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Vendor Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9788
Entropy (8bit):	6.890099926914943
Encrypted:	false
SSDEEP:	192:wc8mVakT+SYb3U5bA7EafaFUlbVvevUqzMWHn9SDGtNjci11:wc3kI+S43SEqUlM9zMWH9SytOi11
MD5:	AF3C6C8E2D69E51B391806619BD49937
SHA1:	FCC8AE968EB274339923B88686EF229E278DB991
SHA-256:	1842387ECDDB1432025D6BB501A901F0F8D4F2D23C00CC303CB2F36E56E42395
SHA-512:	F7D8EA3A96096735FF849B0257EA7914D54176D22D1CC5BBF87F2B159B767A0B4FEB37E531DD4F8876E0F5E7E8BCFEC3AF4A5E6DC7A2E2B234EBEC05835E2743
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\3DF7D4C1\Vendor.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10521
Entropy (8bit):	6.960581353008388
Encrypted:	false
SSDEEP:	192:wc8mV5BMPb3UFfcYipGSyaFUlbVvevUqz0aO5GDSoloZY45Mth:wc3Ji3Zn8SDUlM9zjTBl2Y4Gth
MD5:	93F43677DAF2D9348053DA5512A6A667
SHA1:	05CA5E521C9DD38FA63AA644EFE1595564F3FC68
SHA-256:	C074167D13B825ECCE798A1C861665E9494561B64895096F26F0B3C43A4476E5
SHA-512:	3E315E75DE816E8D7DFF055352E2B3D5B0559640EDBE7230096D4D3DA3B3B5237727AA030E6BD0E795983C61B2361817172E6D654C5A4AEC49F44F92A86FF9D5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\4858F4D4\LookupSample.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	6.819620975894779
Encrypted:	false
SSDEEP:	192:iRhjwAvOb8XpS0iaFUlbVvevUqzDCiMzg65AtgfFvof:iRhHOypbUlM9zWiMtWOfGf
MD5:	F36B43F28EF0C3ED040587F011567BFB
SHA1:	4D6535CE089E6CA11571C84A28B38BBDF82733C1
SHA-256:	EB1172F0C1BF6D6D5ECD22FB08B48D148F8C20D07CD9039B4DE8C3516E3459E0
SHA-512:	0374F75FB3DDCF2BEC7DFC6A00C059FB823F55A48641FDD021E81DD71D5D54D472C51B42ADECB3D4020E5F2E3F21F001359B90F8A9A8C4563020DD4F3B21F0A9
Malicious:	false
Preview:	PK..........!.....d...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.....U.S..0M.....7.....C#.$......`....@.Q...~qc....f+.h.+E...\.q.R.O..;.!)....J.......p....g;,EM....Fa..8...(..8.AU.5.9..ne.....Z.1.>.L--eOk..%.`Qd......kEL*WN.r.w..g...M.........`....FC6Q.^T..rm......a..J?.......W...Ai....EZ.F...>...Q...a..\|I.D..?q..;..y~)...#m,....=.\...."w...~j....;.> wr...o.6;.,...\|7k..v.)pv..3.t..Lsm........PK..........!..U0#....L......._rels/.rels ...(.............................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\01-ETI_Desktop_Sample_Advanced_Templates_All.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	69537
Entropy (8bit):	7.781602475716056
Encrypted:	false
SSDEEP:	1536:liFPa3mMXjxKTeKatratJDmJGvb/OCrWL67p/:rtNKiKoZJs7iL67F
MD5:	6B5BECB26F3F77D4C8C596EAA999BB54
SHA1:	C33155760AB71588E3E6B1E94D1D23C7D7F197F2
SHA-256:	46FD6F5B94C8A2A3E688BE21B3237BFF20169D5BE895C4DA76E5B2F369190650
SHA-512:	3C2617B009F2857D2A0DDA10C4718FFA472ED2D08F4334BBDAE84FE3416E8A0B41AF1C81443B26BE610D0A98EB599FA6BE5AE3CD5CF7C40A45135818D365035A
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Bank Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9406
Entropy (8bit):	6.835780316286597
Encrypted:	false
SSDEEP:	192:wc8mVAlJXb3UQ5nBuJaFUlbVvevUqzGUupHg/PKo:wc3ulJr3H5nBXUlM9zGUKA/yo
MD5:	F89D82AF5DB2FD07BF4D2FBBC979643D
SHA1:	B86FB7F6D1C1B73987B3CBF1DE8A267FA036650E
SHA-256:	49E1272D5A05AA0F6B19ED0BCE6A7C82C634C4A944799C06F841C12CDA1B8F8C
SHA-512:	6E9BE4336CFFA9898EAA3F5B723E30C7538A7E43BCF02C3C535FE38CF2BEE2E2F4856C7AAD8DDF5BABE9CA2E4367B9DE777659520046D72A362F46DC8443422B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Bill Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9290
Entropy (8bit):	6.814926896364427
Encrypted:	false
SSDEEP:	192:wc8mVyQOubGcb3UoLTaFUlbVvevUqzFRETys8FqAK5wgm:wc3ouaE3EUlM9zF2TL8EAKTm
MD5:	D56F7A9C9BC3B8C204F7DC2297C65DCE
SHA1:	0077B73C1A33C5944A199F029D29F8993D879DC4
SHA-256:	E7EFA41AF7EDD1FA44C663D180B287F094FBB142A75D8D931750F2BF58D54776
SHA-512:	EB548C913526D92B974459D1FA70DD354308ED9CF1BC8999F27CE747C1DF741AA40CDD96DF20DE3302A8A23158A84399E5621D67A366AE1AD8BC8BAB846CEB45
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Bill.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10857
Entropy (8bit):	6.973657813330878
Encrypted:	false
SSDEEP:	192:KEFAgP9b3UosimrWOaplloiaFUlbVvevUqzhNlQbDj37NKfF/eDbzWt:KEF/F3FxQWOapHEUlM9zhSDNKfkDGt
MD5:	C9D0005ACDCF0D73BD09B173223A99E8
SHA1:	D2949B46FF22E20DDFB5E3A43B1D52A269DF380A
SHA-256:	67F6A5D73465B7D3E888A79B5A82C6797E4F663D0D612D7770FC501616C5B131
SHA-512:	42CE90427EBB67C0669F26C0A645D4754314D970DE88195534A37A9860F08C5D95073F06470138D0C39E5E934F9AF3C39786A3FB248C8A9A9C43BD201F6C079A
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Build Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Chart of Accounts.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9462
Entropy (8bit):	6.840751247149905
Encrypted:	false
SSDEEP:	192:wc8mVU5r6swQFbpb3UCbm51lsHaFUlbVvevUqzaNm+c28KXA5NK:wc3S5rzrlh3jmRUlM9zIm+ctKXA5NK
MD5:	3C5E111EC948398BC5DAC4AD68158BB8
SHA1:	ABF5FB865B5ABDB0FC40FEB58C297424B0ABD559
SHA-256:	AB6F2E768A0B8D808256FFCE2A0BBC6B776251E7C018B9C2E93FCB689F1D4E34
SHA-512:	CBCD360854A7BDF345ADE1DBAD3C0FC7A519A777CA23FE3920EA9207F535264D26A86D7883E316FB0E098796A069123E5837D2269A260F7898330E3D98ACA348
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Check.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9931
Entropy (8bit):	6.913313930370472
Encrypted:	false
SSDEEP:	192:wc8mVPy1Ecb3U18eBeoCaFUlbVvevUqznr3xyL2BFKpu:wc39y1EE3QUlM9znr3xJBkw
MD5:	1C58F837BD86500667B709CB79FDCBA5
SHA1:	791824B21143B865A1FB20C1B7186586434D7E9E
SHA-256:	6CB37FF29BDA609F1AAC32DF400272306C3F7F8014FB83DBB0701D52F39C5F08
SHA-512:	116CB8D8EC17B03B128295F5492C2287EF4EC1F2A2B42CE110891A4BEE4DC8EECDC654F6CCDE89FDA92342BF48F66C9F2FC62E1CC71DFA72C602BD077FFB8D01
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Class.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8836
Entropy (8bit):	6.729179804296002
Encrypted:	false
SSDEEP:	192:wc8mV/n6acb3U7iH4cW7aFUlbVvevUqzwz4tzPPnhjqTndG:wc3M3MA4zIUlM9zwz4hhjAs
MD5:	5AAA25682A20C68C2B6437F276317C6B
SHA1:	90112FD520FC5A11A96DA3EC6912B8855C6B9E23
SHA-256:	9BAB10472D6A373C42D87D3BD26B58A3A547A82036EBE389FA87C2FFA7F85F4A
SHA-512:	B6C69545F1DC11F697FF447B082E8BF09530C1EB16CA78E96625D3777992110A44C04012E30087BAD2CD0E1BC4C2EA2015B5D1819DC18DCEBF74321EE667C676
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Credit Card Charge.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10000
Entropy (8bit):	6.932539520886787
Encrypted:	false
SSDEEP:	192:wc8mVFUDqb3UAVMfbVXJaFUlbVvevUqznr3xP7j85bOsCyp:wc3d3nkb4UlM9znr3xn8R4M
MD5:	B723B413692FA07BB233B5377D67C3DD
SHA1:	E3D1CF3B1D16BEA1793DF084FAFCD079D2339845
SHA-256:	2800F9C0D1617067FA4FD1325D20ACCAC14C9B1F64C23676C3B6C77C956CFDA1
SHA-512:	DDE455F7F259DB33F3ABCA7A8A29F8A3BCDB2034AFE3065B46FD95BF8E2BA85AE73088C68C5A3E09BCA331E5B3916EB6ACFFB26C230476FF5A4E2D3AF2318B1E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Credit Card Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9641
Entropy (8bit):	6.871247825299292
Encrypted:	false
SSDEEP:	192:wc8mV2nb3USdEn3yUaFUlbVvevUqzIm1ktoOGZoaFS:wc34b3XiAUlM9zIrtoOGZoaFS
MD5:	7268F44A5F76D10E16AD3CDA2016418B
SHA1:	C93B9DCB35B62FAA7083D8A272A5CD0C3E1F306D
SHA-256:	AD8093BC81F3579D5CFBD503C4795EAC180EED3ACD2870DC7D957BB76E4DFC5B
SHA-512:	242DEEA9FF63DBFF0B6604F9FB7CBA56A8B25EBC10A6EC95D5F13749D2682D20A4190A6CFC8BBBC2DD31567296233EBCFB4E6EE48E5E605BD836CFBE446EC488
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Credit Card Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10212
Entropy (8bit):	6.883765631338095
Encrypted:	false
SSDEEP:	192:K5Gqg7LDb3UNyHLbaFUlbVvevUqzDzf9+WbezP:KUff3/HLoUlM9zDzf9+Uej
MD5:	EA8B994DF804D0548ED5977306A69B29
SHA1:	45945B4E5CD9F935C1672F54C938E11975245F84
SHA-256:	43C6C13AED397390AC165C072FD351E0C8CF6B455764DEEA169F45EA0688C1DD
SHA-512:	42B18FFEFD7E75A947246B159F0E74EFFB47BDC431C80EF51D49E9261E7D14583CAB55A8DAC170215BD0F725B6C94A7999122BAC5E8A4DE846DD4837E76083AE
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\CreditMemo.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10450
Entropy (8bit):	6.98431100151026
Encrypted:	false
SSDEEP:	192:wc8mVblb+b3U31Jox4EaFUlbVvevUqzGm8cS+3G+QlsO:wc3Tbq3aJfUlM9zGm95GJiO
MD5:	DB0630FBC51EA7D46870288E6A0DEA3E
SHA1:	4ED906C86930F3CCD2FF5C0BD687D793250C1200
SHA-256:	B2D05E3DAB88C12C664D2429565EC7F90C484609138F5C7928996F4542722A84
SHA-512:	CDB047D9748358C16E5A0A8B07A8A37206CB4C8735B3B99CE401BA50A738604721B0B0CEBE38DCDCDCDB82C0266FE7A78E9EB79365978276598F2B1B3EFF809B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Customer Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9273
Entropy (8bit):	6.809555086031053
Encrypted:	false
SSDEEP:	192:wc8mVG/Fab3Ula/QkvxwRaFUlbVvevUqzQ/3Si/StO:wc3k/F+3GQUlM9zQ/SKGO
MD5:	928E331D3F0871812817101A9C3271A7
SHA1:	7EBB3051FD13F778D68C9235B14472645099A651
SHA-256:	DEA7F88C233505387756D31DC1EF50ED2DC5C0002DEE1F19A2ADE43B2779D6F1
SHA-512:	50F64160411D255B97FAF6B6E796F802111D7EBCF06CACFE97B72DF8A4175F5D7500DED10489E8EB21D401DD0A819E00C9ED12A3E181FDE04912664D91844E9B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Customer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10836
Entropy (8bit):	6.999274692126049
Encrypted:	false
SSDEEP:	192:wc8mVTQb3Uhy3MvEajfaFUlbVvevUqzZJtVMuErD8hzXJT9S241QB:wc3pQ3A8SUUlM9zZJtRs8hzXJxu1QB
MD5:	D3937D1A626F0A965D1CC42C0A0980DA
SHA1:	46FD746B76D6BBA7AF6206CE741E5B803775692A
SHA-256:	40A6F9FCAE2FF1DFAB6F2D6AAF613DD64262240EC3E120F34501C345C137BB17
SHA-512:	932055B365A9EF339428CCE3F70B8754385AA152D9DBA480FE67C1EC2BB29B91BD1B7981BC87FA293A482839E223AECDE970876FE714BDE330700D131DC47844
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Deposit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9362
Entropy (8bit):	6.826945412783724
Encrypted:	false
SSDEEP:	192:wc8mVlMBb3UTJ1Jx1faFUlbVvevUqzQ/3SNDp+c8A4:wc3O3WiUlM9zQ/SNDpWA4
MD5:	ADEF4B3F15F611034D66243AF19A1FFD
SHA1:	437196B1F7304AA9410A7330E16742D21531CE18
SHA-256:	38CA1CEBF500EE80B84E3C880D7F0A5B17D5450DEEEAEE5C4AAAD1C8AB98624F
SHA-512:	7BE70A6A71617D63F0134D07CCEDC245D9417CD18F153FE45968B3FA513FF85B471C1E4460C6F29405B39C1CAC9FA8EBF38431210FFCB553E22C09619265811E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Employee.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11009
Entropy (8bit):	7.01736060620506
Encrypted:	false
SSDEEP:	192:wc8mVV9wNvlb3UyDCjKJdA54psaFUlbVvevUqzfneGskTMQWEqQZVH:wc3rc93LC8A5cUlM9zP8kTMqqQZVH
MD5:	84E455CA030846364B2724BED1419F53
SHA1:	9CE8F5EE2BABF46BC47C9E475E5A1C818C789603
SHA-256:	1C270A2AB4084D1201BB9D3B596E7B00B592D1BE03B46A31044345F876794F5A
SHA-512:	06F17713D08EB334EEEAF50BF92CCB12A20BFDFAD30837FCDFA691C8904D27EECE02850226696D3836BC443EF9D9E07B068243613861DDE113E9E56A706D29B3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Estimate.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.023651414159856
Encrypted:	false
SSDEEP:	192:Kv3Lk9b3UE/9gVcEJaFUlbVvevUqzMWHn9SX7ucpX:KPQN3T/9tUlM9zMWH9SXa4
MD5:	7D5524C94B4883203FA99661E64FA5BC
SHA1:	6283ED1416344804D77DA5C76EA36850F24157FB
SHA-256:	4AB3C2FFFC6574151A557248E4195C3F8600AE7F60FE19A57110E6AB65C07372
SHA-512:	D8342CE797326200554187FEB9D962CB7F5A92479A1934AEBC227A546F76E1150DB85542E42CBAAC68DC092119088B8DB3C794E1A7BF715E407534895A296FE7
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Inventory Adustment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9339
Entropy (8bit):	6.822004521163334
Encrypted:	false
SSDEEP:	192:wc8mVBfsDb3UJ/aFUlbVvevUqzQ/3S2OUtaInz:wc3HC33UlM9zQ/S2OUQsz
MD5:	325BC35550BAB21E167E3D866CB95914
SHA1:	350AD1DEFD9775A77FA2883E113B6A264002107E
SHA-256:	BB080D63D368851409F24A6015F7D7A60C3741E9AD3F1A57A2FADDB6493E717F
SHA-512:	35EA3002C38FBC398DA4D5D153133A75BFE82BEE58CBE4217CB516ADD850B08AFBC6F7CE7DBD28388E1C480E7E67EAD44EEBA60835D799E740AA36F22EFB0037
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Invoice.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11221
Entropy (8bit):	7.017877426256738
Encrypted:	false
SSDEEP:	192:KokIJb3UaTAfyZSrmJaFUlbVvevUqz/sKHPTIBTjCG+WOccEX3z:K7IB3/A6YhUlM9z/sKHLbG+1Ez
MD5:	99647F86C82486B700D005E89442F8E1
SHA1:	EFFA198001F467453CE5002AECE9C153576EC9F7
SHA-256:	97E37AEEA44807D049FBB62BE73BFE9B9D8E8E942443926735828CA0CEDC363B
SHA-512:	FC1326034829BF3FA20D8D8733602C3252578BD94C27D7C5D9AFE899A0AE3AB47C5D9B0C024360291DB176C2F8BC0E797479DB4B1EB6F638951B24FFC593A63A
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Item Discount.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10779
Entropy (8bit):	6.9418222152063835
Encrypted:	false
SSDEEP:	192:DpRYUkb3U24qH6+xaFUlbVvevUqz2WPsZyIm/Yf/Hg/r:Dzs3iqHSUlM9z2Nv/AT
MD5:	3F30397DA5968557AD9F0DE0B65C9910
SHA1:	318E5E4163320D854D4D303B17255CCEFE82B5BC
SHA-256:	344BF0B3BFEEFBD8BF4BA1DA7E0547696D9404E0886CF0B810C9D3378929297F
SHA-512:	E1DA955F5F252C9BB9C39FBAF8DC2C672051E63FC8D0F38B82FB6DB053FFD637B9A015079E3338F6433B636A61483B2605628FDCB0A8E77D63E13A9A09B4635A
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Item Fixed Asset.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	6.876856042487015
Encrypted:	false
SSDEEP:	192:wc8mVZbaAOAb3U5uesSoaFUlbVvevUqzQ/3STW/TeK5tG:wc3rbv33auzSlUlM9zQ/STdK5tG
MD5:	D3C913F017E8D277C0444E44F20F1E02
SHA1:	9DD03B6E3A8135C14B8C6B4839F2DC846B52BDF7
SHA-256:	6B0AD1417661B8670F7E384B7D3006531A1B823ED5CB6B7297BE8799B95A13F5
SHA-512:	5996199DDEF897332CA14757184D56C9D9A4151D491444AB6A53D560471C3AEFB9E8F60AC6FF99BCC043EF73F103A52B35C290D2B5F3D8F4562F9EDCCA6F9579
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Item Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9032
Entropy (8bit):	6.767608632033993
Encrypted:	false
SSDEEP:	192:wc8mVHvTYVb3UR6UeOJySaFUlbVvevUqzxk1xQPw1+Qq5nsOo4a:wc35vI3s6bUlM9zLo1JwsOoH
MD5:	B505ED5DC1D5905A7CADBE7617068B47
SHA1:	D287258EB1AE1A5A65FDBDB12C05E5B69EFB89A0
SHA-256:	503E9C8D39F69700260E3283C9BB2EB5C37B9521146B96E1ED81D1C91CA8C492
SHA-512:	0B5221AC4FC49B615384EC815264F991C04F748D47A22329CF1DA1938E38D9C794E2F32FDD76000CB9FD06A1E9FE4B130B8DD98AF5399545E68D88F99B9D3909
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Item Inventory Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9535
Entropy (8bit):	6.861523063048331
Encrypted:	false
SSDEEP:	192:wc8mVDtuTJmzBTzub3UlaFUlbVvevUqzQ/3SJESiQDW:wc39tCUBS3FUlM9zQ/SFDW
MD5:	56A91BC00571ADDE20E3BBC3616DEB55
SHA1:	72696B180F91707F3BBE6C96B45FD66B18D46DD7
SHA-256:	646D1B194C31B96167A9E1C5B2783DA9E5575712A42EFFA48C9D94D7BACB5A77
SHA-512:	9DA710D6A05943492A18F6895F8CB6F1138700CCBF8E25E142E6CACF85CC772847C0755122B978B7CCBC1A038FC83594B13CE3B5639FA331E00C06806D858E88
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Item Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8925
Entropy (8bit):	6.744063773910199
Encrypted:	false
SSDEEP:	192:wc8mVaoDDb3U2zZmaFUlbVvevUqzxk1xYaQaT:wc35Df3dxUlM9zjaQaT
MD5:	D704B54740776163E2B818AF48057A36
SHA1:	7A32C73EBB38BB0C25B916865AD2D1174FDDA9D6
SHA-256:	54C1FBF6DA1CCAC0F709D0A0278E686BD11A6861914320D23534532F05295832
SHA-512:	4462E73623BB5F9BBDD87B10152F7563DE66A851CE50C434F03BE4A971F050DECAAE03B3FC3AF39A45BCBC263A3731513DAC99B2E1FAB456B4CB1E6098D7284B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Item Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9629
Entropy (8bit):	6.871624988147625
Encrypted:	false
SSDEEP:	192:wc8mVoKEYb3URte7jsWLsUaFUlbVvevUqzMWHn9SIZEV0cBjW:wc3x3CtEAUlM9zMWH9SPTjW
MD5:	B4FE893271AE9945D88266425B57DC79
SHA1:	EACC02E665FC484E7B04723D2902B11D52C06020
SHA-256:	85CDBD7FC55F251AD04D1752B1BF67076326B56E10DC0B8CB13BF23AFD2C3948
SHA-512:	CA6879822D78127CA07E412C9F35D875058101C1C6264388536CBFDD97719E4D42779A2DFBC916FCE8EAA21DAA82CEE9BF1BF92466B08DA9626D6007F4D64C61
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Item.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9597
Entropy (8bit):	6.859256483337967
Encrypted:	false
SSDEEP:	192:wc8mV+J1BUb3UAUk7keaFUlbVvevUqzxk1xrEBn7wHgmtD73o:wc3gjO3bDMUlM9zOEZwA8D73o
MD5:	4EC22FBC3BB0115FE5DB88B1CA929B03
SHA1:	8F4F37013E3E6EC5B716E9E8F1F08610F6B7123A
SHA-256:	8B779B79536FCF700259299BE2CBD7521D3D67605594C793875D0C4B79D9B8B3
SHA-512:	2CC9CD6F8189F27582BAD6FD88990BCED8AC4330EE5A3E6DD4BA7DFC8A2CB05B01C4BA264CDCCBC2EF0FC8F7F3C57BD4E3ACD606F93DBD21CBED0DF9FDC0639C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Journal Entry.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9160
Entropy (8bit):	6.7900209701185945
Encrypted:	false
SSDEEP:	192:wc8mVvTn5cHb3UnXP8CaFUlbVvevUqz32fXoEtax81w:wc3J5u3CXgUlM9z36XoEQK1w
MD5:	7AF9E358CF778FA63006A21CA40F1E22
SHA1:	D35D66C6F69236F7A724D11BBD79DC4D7A7977D8
SHA-256:	F8B39FFA5AC39BF5E9F90343A40E995E94596C485913E52432D52864F35D9815
SHA-512:	DF6F4CB70547FCDD5BD980173902E4FF8A0ACB7C137E425B0A3B273B200932759342ABDDE57F6E37FC2B1E571F5461FC7A3426F5E0374835F58C546F044C11F5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Other Name.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9968
Entropy (8bit):	6.880867618821103
Encrypted:	false
SSDEEP:	192:wc8mVe5ZQIb3UQC2aFUlbVvevUqzvMJbjBWNkMfjiLoK63G:wc3tI3iUlM9z4UNFbAoKqG
MD5:	6ACBEF4FD24CFF80F6322CA881F4A2C6
SHA1:	5A1B79443C117E16C6B2EA41E9D28F192E444E5D
SHA-256:	CA09A44C36559A08E1298B2786C68A69F54516394BED1EB949D168BBC723663C
SHA-512:	41C4A1D1D1D7BEA260536C36653B0030854C20A737F56DC78F6E8C1F5FAB049E3C3FBCCB1D2255F68C9FF4EC0DB23207EA57CEA8322F9B69E4A2D495C52F6B7D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Price Level.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9140
Entropy (8bit):	6.781150851973323
Encrypted:	false
SSDEEP:	192:wc8mVYDp8Qb3UXrBKKMaFUlbVvevUqzxk1xfT5f:wc3e+Q3CBUlM9zMf
MD5:	89601CF9F60AA7E68DD4381BBAE7AADF
SHA1:	B161B14BF6D60ED1ECFA94B0ECD005C55400EE1F
SHA-256:	91C850E21A3587ED9AFB10D26EBA0683D53B543B3BF0C45108A0078809A0096E
SHA-512:	1DB27677DD450245F8AAAB2730C49B3C297E5294FE3805CC8B549483B93773166C18EF6D3190817F14DC129F0757F80F6E99F60AA3072B4A434039550B104235
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Purchase Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10037
Entropy (8bit):	6.929733981691885
Encrypted:	false
SSDEEP:	192:wc8mVRlaHjjb3UqojALwaFUlbVvevUqzYDx9KA:wc3TlaHj/3xLtUlM9zYDfKA
MD5:	FA9A4541F27427CBA61D64FB697C8929
SHA1:	EAAD44B40CB2A67CDFAA7ACD24B1E02A30B463EB
SHA-256:	9F8AE5F217D7019560EB32EE8F5391EEC920DAA85246FBCA1E56B82184D41C15
SHA-512:	AD59D548920774F69F726873EA0FD754559ED608E6AC8158227277F544EBAF8F3636D64DE571A1B1945DA27309E361D27F088CE1772DEDC0CFAEF613AC944314
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Sales Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10401
Entropy (8bit):	6.980672917702035
Encrypted:	false
SSDEEP:	192:wc8mV2KYEb3UjQPlA92fKOaFUlbVvevUqzYDxqcw1pEP3fX1:wc3X/3aQPi95UlM9zYD+G3f1
MD5:	199D8E109ACE39A00ABBE5BE7F9D99B4
SHA1:	F1F267D00E6441D3512436255951DF3D27003434
SHA-256:	DD6DE0C75058A184C927D4425D6E15D98C72DE5B5C66241575C7C495200CFC8A
SHA-512:	D0C1B5601DBD77FF311A7007DE3FD4179C990EC8CBF1EB2969689DBB73B21FDAFB7EA2970EA388759832D85844B2CE6A16D81B5B3DEB90DC1B8A8B7E1A3780FC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Sales Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10432
Entropy (8bit):	6.980892950521402
Encrypted:	false
SSDEEP:	192:wc8mV/Oxeb3UZPW/kT8v3HWaJAaFUlbVvevUqzYDxqvT44W5DIEa:wc3IxK3sPWi8frJ9UlM9zYDf4Cha
MD5:	82FFA7B163050D4383BF1ACA4BB4E7DA
SHA1:	D1B6DA0C3EF0D7665CC41367F966A47BE058DCAD
SHA-256:	0B5AD6E76C48ABBC1754FA80993E0FBDF9790A78F9162DC177EF70097FE03226
SHA-512:	81EC91768B824F7B6C1AA1A8C5EE5F974AD7CDDAAA144A3DF4BC5C4A1C873FF4299A3588FBFD412C2578A038419BC7D9FBF89FA9DEB22C8B82F41AB2CFF87F15
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Sales Tax Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8901
Entropy (8bit):	6.743101482786187
Encrypted:	false
SSDEEP:	192:wc8mVWbYalMb3UbdPzaFUlbVvevUqzxk1xcfLasbBT:wc3oNU3wgUlM9z/LNT
MD5:	BF50AAB66AFC90B24ECC25614C9DC93A
SHA1:	F3C1EEB360C1C749F4099921576D98F6B2DB4A99
SHA-256:	8CF123DA00F60A3FB3EB125FA8183374FA13AAA402D4EC24206EFDBD2BB53B59
SHA-512:	6CA2B94F10B8E5A537960370102CCDDCA5E939B73E1A6CCB99DF78F3BAC8F931F85036DFACB3FBA4CE958C61CE5BEAF2F6421F3775729747A4CC695BCC2B5DE1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Sales Tax.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8905
Entropy (8bit):	6.7404901435281905
Encrypted:	false
SSDEEP:	192:wc8mV9boSDn6xpb3UrcHaFUlbVvevUqzxk1xpDk5pT:wc37bPU35cUlM9zgDk3T
MD5:	F78BF8DA44261C881965FCF15DD224BF
SHA1:	CF170B195F04A92B84299EA5625FCA8BF62D4EE4
SHA-256:	B9160091F043FFD3D12FF4E5CE1E257E34D7ED76978EB5523EFB3D93E69BCD16
SHA-512:	DD31CFBE802FE572AC426A287A3F876E7635406284A61C4CE44B7538D6C613C5610F87C38B1C688A836617B934C0139C8D0F0966E23C0381A353B4737939F826
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Statement Charges.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9224
Entropy (8bit):	6.799542843318275
Encrypted:	false
SSDEEP:	192:wc8mVJoNpb3UixBqbosaFUlbVvevUqzQ/3SsLakqO:wc3q398EUlM9zQ/SnkqO
MD5:	EC69EDD7F173B26A11EA8CEE46B4D382
SHA1:	7493B0D9D201E1AC4F86A76A4EE72A91F0B2FAD7
SHA-256:	7A2658BC20BD82BF53682211F4DDEE91BCA2DBE44263FC6BBFAA06C2EE02D008
SHA-512:	177F870279216E16D503D0D44668DA0DF2B9EFC3A94F1A988A7B2A3C9DC434033062F95D6C3717742E8642231E744F2617C7789918E4AFDD86D29DA2742E43FA
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Time Tracking.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9056
Entropy (8bit):	6.7690723733388065
Encrypted:	false
SSDEEP:	192:wc8mVduesZb3UIECXiB2oaFUlbVvevUqzoDmhoInoy2:wc3OZx34Cy2UlM9z8Ioy2
MD5:	3B89E70C4E18AD6369C0CB4E899C6D79
SHA1:	7B6E9EA66AA9700F376B9210DAAF6936AAA23944
SHA-256:	63F7327783B3DBEA7D69AD028580609FE3577B9E43200702D4FE8C067ADCDF49
SHA-512:	78C3C73FE98A37693F4D5153DC319FFEEE374AD436EB652214CF29D36C0F99C431EEA6826D07AA8D879235C5A5584F1C506628A1D65803F3099A6569EC4DD460
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Transfer Inventory.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9106
Entropy (8bit):	6.784389292421563
Encrypted:	false
SSDEEP:	192:wc8mVklSHl+b3UyGXLjKaFUlbVvevUqzQ/3Srlhkn:wc3ilSFq3Q7UlM9zQ/Srlhkn
MD5:	80037AA7AE2CF8709C2F24782E7B92AF
SHA1:	BD74EFFD2A639724FFF81177DEB9BB65D3ADE063
SHA-256:	827007B90EE09729AAA6D6BB4A1DD46290AB65F2BD07D03AB99CE62D9FCA70BF
SHA-512:	E71DD40867257A6056092D43E09521FC939F9B72AD441B137B8E8043C03FFC3CF38F5A92D2ABC365C60A542D2861B98363DBE2C20DB2C960E98FF6C3AA7C3029
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Transfer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8950
Entropy (8bit):	6.751180788127307
Encrypted:	false
SSDEEP:	192:wc8mVJ2cTyWb3UXyblaFUlbVvevUqzoDmhecRWx9yCsh:wc35TyC3QUlM9z6cR27u
MD5:	AB36C0F9542013A11BB6CBA2B9E93931
SHA1:	75B89BD6AEBFD438AAC322357666E8EA0EFC7D0E
SHA-256:	2F93A834E787A9457511C384E80FD45E05606ADD0B290C5E9D1068E2795C0B29
SHA-512:	9CA3D1B2E22E4D883BC7732445F31219761D8D3839B1E3DDA7F7F6410CE8AE184DA0C1816E041212CBC36281087E351526A11C7C07B3010956AFF9D1692153B9
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Trial Balance.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Vehicle Milege.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9166
Entropy (8bit):	6.7896252842101115
Encrypted:	false
SSDEEP:	192:wc8mVHZcHTb3UM4K9aNqvaFUlbVvevUqzQ/3SBBVPiJh:wc33cv3H9a3UlM9zQ/SBT6Jh
MD5:	537591EA3150CFA2C1A60EC7094F8BE0
SHA1:	C099CF61376038D4E682D7FB3CD73CF495604388
SHA-256:	339C67145A35E04E0FFE7F0501B15856A49292AA5BD63B55A8016A807ECD8F52
SHA-512:	2AABBCDAE0419F76471A1E7458898ECD6B5203A101AFF5DEFA4112D6CAD29789B3B3B039C87E013B6BD4723CDD1E4402828D96B6FE7C7323BCEBA3A099298F73
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Vendor Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9581
Entropy (8bit):	6.861554982818282
Encrypted:	false
SSDEEP:	192:wc8mV7n/TxR6b3U0BQ343aFUlbVvevUqzMWHn9SzcipUK:wc311Re3ZBlMUlM9zMWH9Sgipb
MD5:	D7207B7C8FBB90760C7280131102B620
SHA1:	556365446DF478F00674DE2559B272528A55090B
SHA-256:	728A7F334F540137F5D7F99CF8246073E802B3A013FD6F6D9F9902258542F00F
SHA-512:	D814EFBCF6A650004D0FE2609B193208B51D528EA96D81E1B2F74D5AB6E4542EEA92CF38BCD1E3BDBB0863BC29775B203B41032B5AD4D57A7DD11BAC405AB345
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\62DF54EE\Vendor.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10546
Entropy (8bit):	6.966579022301526
Encrypted:	false
SSDEEP:	192:wc8mVUDr3lApGpb3UPTimNqbgaFUlbVvevUqz0aO5GDSItWY4Ua:wc32lApGh3oim8ZUlM9zjTAY4Ua
MD5:	C202DFADA9AA9B1849F72158ADFD0F85
SHA1:	DBA13C1B98038DB530F189FDA58D428F97F6BA5B
SHA-256:	7A183F7D689FE81D5E6091CA3FBFE44DF477693176E9A046AB6A5714E24DF4AF
SHA-512:	88C1F6E4DC42D06CA831D6BD905605E3418AD718939AE21A5A7393F9F6D92F3B799F5E9B8A551AAA6652609B0A5567E7DD2BAC90E1CDF6395E68595ABC01FEDD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\6EB9D5AA\LookupSample.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	6.819620975894779
Encrypted:	false
SSDEEP:	192:iRhjwAvOb8XpS0iaFUlbVvevUqzDCiMzg65AtgfFvof:iRhHOypbUlM9zWiMtWOfGf
MD5:	F36B43F28EF0C3ED040587F011567BFB
SHA1:	4D6535CE089E6CA11571C84A28B38BBDF82733C1
SHA-256:	EB1172F0C1BF6D6D5ECD22FB08B48D148F8C20D07CD9039B4DE8C3516E3459E0
SHA-512:	0374F75FB3DDCF2BEC7DFC6A00C059FB823F55A48641FDD021E81DD71D5D54D472C51B42ADECB3D4020E5F2E3F21F001359B90F8A9A8C4563020DD4F3B21F0A9
Malicious:	false
Preview:	PK..........!.....d...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.....U.S..0M.....7.....C#.$......`....@.Q...~qc....f+.h.+E...\.q.R.O..;.!)....J.......p....g;,EM....Fa..8...(..8.AU.5.9..ne.....Z.1.>.L--eOk..%.`Qd......kEL*WN.r.w..g...M.........`....FC6Q.^T..rm......a..J?.......W...Ai....EZ.F...>...Q...a..\|I.D..?q..;..y~)...#m,....=.\...."w...~j....;.> wr...o.6;.,...\|7k..v.)pv..3.t..Lsm........PK..........!..U0#....L......._rels/.rels ...(.............................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\01-ETI_Desktop_Sample_Basic_Templates_All.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	60608
Entropy (8bit):	7.72158777055586
Encrypted:	false
SSDEEP:	1536:xEjn/qO0hC6y2mwU4NKf/QWHcIfRij037fXKkvb/UjDUj6T7:xEjaC6hdU4G4WHnE0rvHiUj6T7
MD5:	2FC2034D6E43283CBDAEE5625C29388A
SHA1:	51431CCB4B3645690F32B90FB89767BF21CEF86E
SHA-256:	ED8C776FAF95DB425BF2FD1EE4DA5521FC40FBD051A345B5FF2FB7727A3BF219
SHA-512:	A6A30231DAE53D79B1D38C7B0EFB33D724CABA83C2F83DE2A9B2F8F4203935CD2EBE74624C3D9386572EE432204992CFE9CA366A841B87D4346FF88237B10E77
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Bank Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9179
Entropy (8bit):	6.794915179830353
Encrypted:	false
SSDEEP:	192:wc8mV8pOvxKwRkib3Ue6gS2KkxaFUlbVvevUqzGuPK8I:wc36gp530/2BKUlM9zGx8I
MD5:	A9F59D704F0046C9DDF4BC78AFE0602E
SHA1:	642BFAA1A38C106BD33200BFF3156A20731BC922
SHA-256:	07C8A96AC8204EB1067781D38AD07A2ACA03AD892A01D1C10CE2DAFC33A2D7A0
SHA-512:	248328CE90C2F316BCBD26C200031001D13F08768C23A8CC56D918D14CC2FAC82A11439379A2929F8D13C85B4E49B19D251AD302F5C535FC48B19AD72B7A6AFD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Bill Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9137
Entropy (8bit):	6.792737999962153
Encrypted:	false
SSDEEP:	192:wc8mVsTu3zb3UOc8aFUlbVvevUqzFRETysPnDr6gEZ:wc3yTu3v3yxUlM9zF2TLPnDXi
MD5:	12DC3AEB3063E4CD6D2EEE73254AA628
SHA1:	3B8B1C277D40112E34E0D22FBDF5CA7DF325D00B
SHA-256:	7E7B631CD1A09AB185EFC2D6DBC2B195830A29659EB99E8E9C06C3AE336FFE6F
SHA-512:	5C1A6AC09F388E49FEBF5FF28D26D15F627E53E7DBE7AB4AE51B723440CE88BC95CE316F0D777CD8ED61DE4F49482D9EBB357178C6EA455FFFC083CE54C19D4B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Bill.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10310
Entropy (8bit):	6.902085495948442
Encrypted:	false
SSDEEP:	192:KD1+gb3UAP7lAaFUlbVvevUqzhNlQbDj3qZnRDbzi:KZ+A3HP7l9UlM9zhSD+ZRDS
MD5:	C7AE2C022CA8C673A89C837DE7E9141D
SHA1:	43D508EDCA6A9809E7691240F6314396A66997BF
SHA-256:	1B5F8058535D5454D6C4A81258784D6CB874AD2506EE4F15CF8AFEE33940879F
SHA-512:	9AF3203737D2A79041B356CA93C4F70C733FAF8462F6D6D80B3901046C6F9D2A74EDE85CA8EBE0F708CA67FEBD1F5E9C02284066AB8E1FBBAD177D02290052E5
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Build Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Chart of Accounts.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9364
Entropy (8bit):	6.821970615427216
Encrypted:	false
SSDEEP:	192:wc8mVHw0B6db3UMY1ZFo7T4aFUlbVvevUqzuaToA5HaE:wc35w0E3gHoVUlM9zuakA5HJ
MD5:	09E8A762CE42B56F03B800563478CD10
SHA1:	80FF7AEEA1DA861732DB3F0D1D17F3144F3D979A
SHA-256:	DFBB8620DECC816F2085D2FEC636C3CDB928CD0EB25CB3492B200DEC39ACE84B
SHA-512:	09A0A3A5EE8962E023DE27DB5C99B1F2276078524E2CB1352528BDE1EE2F2F8A6CF60C71B5CEE3639B09CBADD2C9D1637E9B2886C439C35C0E3D361F90A820FB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Check.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9279
Entropy (8bit):	6.811763392150569
Encrypted:	false
SSDEEP:	192:wc8mVSFrLeGMmb3UlbVPgh/aFUlbVvevUqznr3xae/xL6nz:wc34rrN3ydgh0UlM9znr3xae/x6z
MD5:	54A0DB0C902D4940B94C3BC1A06523E1
SHA1:	0C875F23CD656DB873FCCC1D80095144F0AB310C
SHA-256:	37D5A0526FBED14A7D290975C3FF57DC1F55404091C3F3FA0FAA63E1D5AAA1A6
SHA-512:	A8CB79E0B7B6CB40999A698FF26CF3B8CAA6E8B888F78D46BB010B3BBB6F5590C4713B45466CB8391C7A54CCB38A9ADA44D20490E79731B1A06E6ACF2D0451ED
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Class.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8830
Entropy (8bit):	6.729273799907828
Encrypted:	false
SSDEEP:	192:wc8mVnT42Xb3Ub3C0aFUlbVvevUqzrTJNoPnhhTqJ:wc3G2r3bUlM9zrdUhxo
MD5:	6F0F3638E5D2A4D9FDBADB93A620AE5E
SHA1:	52ECC7CD6C4F98712D414909EF8F86F893958DF3
SHA-256:	7413628012ED627A283149A01B7273BD900330CF917B524319F73DD34D7E71D7
SHA-512:	D4B6526D8FCA703196834775AD24A22B53E093BA93B0379B970839568E1F67FCA68C0B682214052994971CA558DB5290662B82496A1DDA9BAD5A7665B29CD1DF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Credit Card Charge.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9423
Entropy (8bit):	6.839785295716797
Encrypted:	false
SSDEEP:	192:wc8mVJ4HUIkGCb3UOGW95ZlnaaFUlbVvevUqznr3xSFbOsCK9:wc3ge3FZlnLUlM9znr3xY4U
MD5:	AF5B372522E9D8654675DEFA4F408156
SHA1:	513AB2B83145F3AB267C16906CB234962A473A21
SHA-256:	76FFC405EE86CA3314BBB6EF1108A8ABDEFD4D5C718A1FD63A69AF736808D3DB
SHA-512:	312719ED149D193044396BF9234F069F3F3C01185DC2139DB9C6FD0B1820C373576F7FEE94148701F9A1B20B5CD3788AC3FE4E45B07815EEDFCD14605EFCBA08
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Credit Card Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9300
Entropy (8bit):	6.813928011985626
Encrypted:	false
SSDEEP:	192:wc8mV7hC9d3Cb3UorVFraFUlbVvevUqzI41y/LxI:wc3Zc73G3HAUlM9zI2cxI
MD5:	2ACEB40AEC0AEEBA1C0AEAC2029D846F
SHA1:	F64308248680B91371053134B6A1BD5A745D45EB
SHA-256:	5CEB84B7E74F7C17B43B9605E6BCC9A54C43213E9DD01D930521CC05933C98B2
SHA-512:	22150751FF4B387F0CB7BA401220260E4C6C97E7881661F9F52273311B92A06957591DA87FE09EED06D2F08008EA3CB17C86485CBB9A1396633DBC470EF3EC63
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Credit Card Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10042
Entropy (8bit):	6.860852476669272
Encrypted:	false
SSDEEP:	192:K93SOA1Lwcb3UxpkiaFUlbVvevUqzDVN+Wvy/MzX0:K93y1UE3NzUlM9zDL+sfj0
MD5:	D5C2BB7A2A6AAFA67A5CEC0851F1279C
SHA1:	4ED0A99525B8617B34A34F3E8CE3963248E9188A
SHA-256:	FBA508F6B2733B9D9CF2DE93A09B0E6EA7F75AF08AE11A323E4F17E662FC5371
SHA-512:	81C8DE579826ACED62EF053ABE18083E7720FC9B9ADEF61A6F6B463257CD18BD99920AF78EEABF228756D30E4ABA176911D9063446082E177EA396AC15F9D771
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\CreditMemo.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9271
Entropy (8bit):	6.811643027566105
Encrypted:	false
SSDEEP:	192:wc8mVf2U35b3UAZTaFUlbVvevUqzmpPhEYoxR9ss9:wc3Z2ER3jZAUlM9zE5m9H9
MD5:	CCFE8245FF49E0FE0D036E51BF7D3F63
SHA1:	55CE309D4FEC86D442EB345CF0B81FCD149EEBA3
SHA-256:	9A43623D564057B84AB29AFBA4288EEC96CE2FA18106DA572C67CC0844F11AEC
SHA-512:	5C4391D145FDAA8B568B0E6F06C3B5D385E6EF351C7ABE83422CA5549FC1B86A9396445EE919D0EC0DEA5BDFF8ACEAA5CDF17AB41BE4899AA0741BC67A1E0333
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Customer Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9105
Entropy (8bit):	6.781014209396833
Encrypted:	false
SSDEEP:	192:wc8mVvURb3Umzlp+aFUlbVvevUqzQ/3S7O/xLUy:wc3Y39lVUlM9zQ/S7O/xUy
MD5:	1B0657CB32BEBB1FD5DD1C2FB1B749C3
SHA1:	7BAEAA0FB0885C0F004CDE7443E8183D828DFE28
SHA-256:	37D8820AE95851BC491E32275B57B2D8BE84DBBA016A4358C5D7F50C377B0B9B
SHA-512:	5CDE34D9A602E4F9942250A434844DFAF95E9C7C6C9E23C3AC3780837A0F7A770C765B13856271C75431465F07999051B794AEE56A9737CA219779F8FD3702FB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Customer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	6.865386475865739
Encrypted:	false
SSDEEP:	192:wc8mVt+6DKPv9+b3UiKpaFUlbVvevUqzZJtVMNSX5I41663:wc3Piv83zfUlM9zZJtTX571663
MD5:	08057568E24A84432911C7480B9BA2F8
SHA1:	D35A457F40D2116417108295718214C67DBFC56C
SHA-256:	653929EB88C5F7526D51CE15C5E95D0005EB071509E5185CDB4A04C7E31D6C3B
SHA-512:	1BA361B34327CC831B5F4F1F2FC6429E81C8F28A1B158790D4798027BC9EF19F69CBBA48B2C4F043C1E92AD970FCBB3EDAFD2ACE9F68D344EE680817848CEE78
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Deposit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9174
Entropy (8bit):	6.7924481974634565
Encrypted:	false
SSDEEP:	192:wc8mVi3b3UMTFaFUlbVvevUqzQ/3SFsw5:wc3UL3B2UlM9zQ/SCw5
MD5:	6A72B5C256385E38490AB05902A2A3B0
SHA1:	EE772D71C3596FBDDAD106051A5D101B794F55B2
SHA-256:	DDB241E0E9064DA7443D8876B27A9A69D06CA6669D4FA5E281EA1A9C5CD56684
SHA-512:	546B143348EB1A45D9A620C663F96DF90C0056DE2593ED7C7909B3913DBE0BDCF05FD549ABCB1DDC1D9AF7A65A46880F17A0A03A6FC0C26392514F9AB9878F60
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Employee.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10662
Entropy (8bit):	6.978039342816095
Encrypted:	false
SSDEEP:	192:wc8mV76EzJb3Uz2Q/m6aFUlbVvevUqzjBYSHjYVQWmHgrxG:wc3sE93WyUlM9zrjYVoArxG
MD5:	B14A9C7D27DD7712A0B8788A45B7BDD1
SHA1:	17C3203A89ADE5D0D6A2666F2F96355002A5D158
SHA-256:	3C0B72549EA06721309266918917A8827703CB25FB0E9B13998BE25ACE9BD820
SHA-512:	E502E0B643CF69DF67D27FC7735B17FF5FC089AF5BB1A5321DD654604FF121929C234919564AE4ABBA9656C62367534DFFE3607DFA3A13427584BE290C9C8668
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Estimate.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10179
Entropy (8bit):	6.878884512140004
Encrypted:	false
SSDEEP:	192:K+v3LU/Mrb3UHL8aFUlbVvevUqzMWHn9SyWv+xLVS:K+v3L+Mn3YLxUlM9zMWH9SyWv+xQ
MD5:	111DC57DAE120885E74B1A2E22FC42CF
SHA1:	916CF01E9CAD15CF072F0121B3B75571C4FAC98A
SHA-256:	01E72D36A12BB15310D91DBBBA126A8BF292E24DF5511907752A4BEA27CEE4F3
SHA-512:	92A28A0D08DC161B35C3A6C19BC3B141CDAB69380A089517AF4B1F251FA193B53A0AD9E0140C07ECA414CCFB2C8B8B85AE197BBE93075FFD173C91DA2C2886DF
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Inventory Adustment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9205
Entropy (8bit):	6.800891004632689
Encrypted:	false
SSDEEP:	192:wc8mViLvVab3U5Knw7m0YaFUlbVvevUqzQ/3Sjmvun1:wc3sE35w62UlM9zQ/S91
MD5:	989A01BD9C8C7239F25814AAC66E462D
SHA1:	54E62D002F5DABAAA38849F40323DC7A3876491B
SHA-256:	2C1DAA59560CB8248D9D8DD4F1B526AFDAD8F0B7F044F78D7091B1DDB42E5779
SHA-512:	B5981FAB999D5C67D11EB1CD1098530E18C0181D982F00CC01303E0B11D53EE4207F2A0E1BBE4491775355E35D57F99C7A035ABCFB65F5A9C732178CDC3D6CDC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Invoice.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10311
Entropy (8bit):	6.902523632816974
Encrypted:	false
SSDEEP:	192:KlQnZsb3UFdNmiaFUlbVvevUqz0zP7+WX6Y9+:KYZ03CeUlM9zE7+M19+
MD5:	E0E05A34B4EED3129E3DFFC054D1F070
SHA1:	1593B64E4185A1FEBF3FD6CD5DD3152ECB260B76
SHA-256:	E163E2DEBB21D40EFFF3196F1427923CBD8DEBC92D4A10B6E645D27B92D5E68F
SHA-512:	798AC0AAD0A4571E58606FA476F28D596D5B753365C00807BD09578985C647F2E2B53108483982D5B66386A707B5FE6423C12F2B7C75BC8A35E71391E2B8B619
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Item Discount.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	6.910242705829882
Encrypted:	false
SSDEEP:	192:DK7Y3k6b3U+FBN4BaFUlbVvevUqz2RIMpQc6Omow7:DKk3J3vV4aUlM9z2OMpQ7f
MD5:	32B22473DEFDD10651778BFE40BA7F38
SHA1:	2238007231F2DCF3AE7765F62872936DE662508D
SHA-256:	DB5C17DCCB68E77BE29FD9F237918BB72661D88D76629889663B7935F492DC8F
SHA-512:	CA1E16A6816031BB980DAA92CD252494B726E3875151E386AE747CA56B6C524AD1EB0BA543FC729B7E8781E3A3702349C4E0502E624B01446BA93279260A0057
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Item Fixed Asset.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10342
Entropy (8bit):	6.908061401318368
Encrypted:	false
SSDEEP:	192:Krsb3UFi7jscVaFUlbVvevUqzQ/3SjeFFtQTeKfz:Kr03iinsTUlM9zQ/SjevNKfz
MD5:	274DC88AA87B2FFB6A900B9569F25AC3
SHA1:	356AF0CBB48026F0989F71E6A443601FE4106E72
SHA-256:	A0821C5ADAC4CA9B0F95B470B9DA09F22695B0C1B645C437C6729DC919C2FC58
SHA-512:	493A40314200F831EB11E010C15AA2470373D02E17918D79208E341EA568EDF0E244A10EE2DBD991A2F679E9B68A7BA260FEF28C43447BD01BACAD9DE2A671AE
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Item Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8939
Entropy (8bit):	6.751801640397702
Encrypted:	false
SSDEEP:	192:wc8mVhHmW+yM41b3US32wraFUlbVvevUqzxk1xQMH5nsOoEJn:wc3+t8l3X32w4UlM9zTMZsOo2n
MD5:	5F268BD22DF45BA9C0D41CDBAC0F10AC
SHA1:	AC4C7E080F58E4F4B22EA6C1217C54009F6D90FC
SHA-256:	A3710B7AC9F8FBF6A2D59477A7CE708E52215C1DBCC5A1164FDB19799D7A4BCF
SHA-512:	7E77DFA1D17378EFC7514EB152C0CFE4B06A7CCA1732E63617E84B67A69BD75503F5AE49F75199D75CC42278EAC07992FC960D76DE46C41F1216D9162C786749
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Item Inventory Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9302
Entropy (8bit):	6.818788409862115
Encrypted:	false
SSDEEP:	192:wc8mV8LNAb3UXMZZDoaFUlbVvevUqzxk1xJOWrh:wc3ig36MvDlUlM9zih
MD5:	652CD5C190512D8D08D81C561EEE2103
SHA1:	89575FF7865DC5B0AC26DB9F100C53AEA8A0E51D
SHA-256:	A0F2C4AE896841461B8BD886BD1698613263AD8131B678ACA1EF375ECB160B35
SHA-512:	504788FEE9E6E752779E1FE252104B3FEBDA4C6AA85B3BA4CFC875A5B2957CBB50905E05030A4C517975618CB32F0D6519D34FFCC3A79D3F213339FB44C80514
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Item Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8904
Entropy (8bit):	6.741967696983345
Encrypted:	false
SSDEEP:	192:wc8mV6aK2bb3UZ5lE0aFUlbVvevUqzxk1xh0PC:wc3Uc33EoUlM9zLPC
MD5:	511021BBC919910B7BFE88EDD692FE9F
SHA1:	A3F5F0276F944D2F110C4B5B67B1E5379649DC13
SHA-256:	CF048FB4F41EAFFA959CB6CFA378981D84C5BB0998B49686303573DCAFBA591E
SHA-512:	CB27226285CFC60CCC5C0ED9323D3E154F9D3A214AC5D08CED4215622098CEE30C3A12D46E370DF30F361AAD752DC973BB4EAD0A1466F04A6A69B2514EAB4768
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Item Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9159
Entropy (8bit):	6.790575326802142
Encrypted:	false
SSDEEP:	192:wc8mVd0llCnb3UOFn4u6aFUlbVvevUqzMWHn9SmngBPI:wc3f0f23P54aUlM9zMWH9SnA
MD5:	F988A3154CFC4A0A24B40D4DADD6B165
SHA1:	1FA4289E808748C3A65A4CB7A5F4FA93D6F76163
SHA-256:	9388FBEBDA3CAC8B4B44C4AD4B90376F3A678BEB8182C5EBB5EB2E6713A89909
SHA-512:	458E108052968AFA9C4944133D6DEF95D82773BD39EE0F75923F71828822E12EAE89811B0063E945B281ED8A6F0683ED3D2E56CBE5E8210335948BA76CC26334
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Item.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9293
Entropy (8bit):	6.8141719578289255
Encrypted:	false
SSDEEP:	192:wc8mVDC9NMb3UkNFC+/SNMaFUlbVvevUqzxk1x2D+HtD7CP:wc3FC9S3fB/0BUlM9zrmD7m
MD5:	2FC32E74CF43FD1CC9F15B4D6FAD6F23
SHA1:	5B6018F0660F03A0AEC7CD79CDF06B5724AEEC87
SHA-256:	31D1F2BCDF03328C577F42F412557018C75A44F113AFAA230B1B8D43E3DD2AD5
SHA-512:	73FF985EF939D89A1CECE9A582744B92C400B1742CEF5440846AD88881CF36D0A2E7B619BF85A34EC04126EEE1A08A2FBF0FC0E493432A09D746DD5C3CD6B81F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Journal Entry.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9093
Entropy (8bit):	6.77631031314201
Encrypted:	false
SSDEEP:	192:wc8mVcKEXb3UB7n2tyaFUlbVvevUqz32fNPR7b8fU:wc3a33GnWDUlM9z36NJcs
MD5:	43FD14A8C807C600DA56C934B028AC62
SHA1:	104B533622E0706C09C3E8DC54710B1F82D2A21C
SHA-256:	91D6391C2DD44B951DDFD136AA7ACEC0EFB298796C19557EF1E7AD587D312C19
SHA-512:	0004BAD639F2A45E4AF3EF08DB8D635829AEE60072C80E5CB12E037AA5529BE2D3FA10541C907DA40D032808DA45E1A58808578E4C0D4BC77AB5819FBE339089
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Other Name.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9977
Entropy (8bit):	6.881824897442895
Encrypted:	false
SSDEEP:	192:wc8mVgF6skEmb3U8rpU4yaFUlbVvevUqzvMJbjBWNkMfBR7VoK2ej:wc3C6sE3du4DUlM9z4UNFHhoKfj
MD5:	350480A984ACB80CF21F542D4CDE9823
SHA1:	00091FA7BED5E8BC6D4D32AC9F5BCB6FA06B07F6
SHA-256:	311A12234259B32BACD59FA164CE5BE2023786DE3BDBDE1FF1DBD6F31ACB11F8
SHA-512:	1C54C073A5D4212699BA136A1D9B91A8E725BE6E8541F23823FCDBC7805A197791D3FD839AC8FA58C077C1B877F1F3ABF528D25EE04DFA31DAA03508994F7D9F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Price Level.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9142
Entropy (8bit):	6.782431923212374
Encrypted:	false
SSDEEP:	192:wc8mViNEB6Qb3Uyim/9fetaFUlbVvevUqzxk1xKhnJ1q8f6VY:wc3jBF345+UlM9z3d7SVY
MD5:	2506630D2BEEA9C1868E7741DEE13D2B
SHA1:	0C2FFE451D4C10AA5A08B415CA8E88D03B03C55F
SHA-256:	6A667EB4303F007954E8E51A2D8D06729C4D18982EBDC53DB81D571D2A99A887
SHA-512:	90C7E14D51657AC8385DC023F4101398E7F6392ECEB0D76A058ED1D2E809C50BF057B0F09BA7986EC19F6391B5C507405EE3F4B5F0B3B4FE33B10C825955E50F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Purchase Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9250
Entropy (8bit):	6.808163260128793
Encrypted:	false
SSDEEP:	192:wc8mV0+NRb3UbKsIQaFUlbVvevUqzYDxX++fqa2:wc3FNp35UlM9zYD3ya2
MD5:	7A3007D4C7D6A735AADAD4272E05BA64
SHA1:	1571CBD2207B346AD1E3540CF31C6B27094988FA
SHA-256:	D1418C308F1D895E88BC9F7293E72D03D05AF01368E37E9E3032BD7A14F0C17B
SHA-512:	5F8F33A6292A6C03E45D4BBB38BD60DCB9AF32E9C23705F78AD2070074AF6344CD64404BFD97E215DAA247284B5A67DE2C5B3E0793C68BEF17E83B2BEBC34099
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Sales Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9262
Entropy (8bit):	6.806043299070465
Encrypted:	false
SSDEEP:	192:wc8mVXZb3Uw86AAkaFUlbVvevUqzYDxcgSQfXBa:wc3Bx3xRAuUlM9zYDTLfBa
MD5:	DFABD8959A1CF9284CBC958557A6BC11
SHA1:	D2701208198885731EF8FE25D9D2BADD6C422E23
SHA-256:	FF80F6BFD07318A31225C0BFBBBE9D92A40A2F9A474FF228105EAE2C302DB1F9
SHA-512:	572744C2AA9FFE5DB9935D60B668D3DF917569A4B78EE1C3269E3426297F926DEB53F30AE508688094438F393D8A216B9D701E347D9B9897F58217F3F79D73C6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Sales Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9212
Entropy (8bit):	6.79823789885158
Encrypted:	false
SSDEEP:	192:wc8mVeuWugPb3Ulhj1OhaFUlbVvevUqzMWHn9SBpRKhOIEIS:wc3EFx3ghO6UlM9zMWH9SPRKhOhf
MD5:	17357BDF06F4DB40706B6FE701830D4D
SHA1:	80105281255CB887BBD56DD1CAB9BACC9CB0F8F4
SHA-256:	2080703D1094096953772CEAC224A8C5CBA1470E8CA0B214AEF0910C61E59B32
SHA-512:	9AE1A8085F92F1BCB444239AB6FF9B1EACFE60197F6054C15FAEB2015D0B84D73CA5D3DA266F91BB3D3EFF7F146C0A20C3AC982E6187B4804B5700EFDB465717
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Sales Tax Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8903
Entropy (8bit):	6.746206691996274
Encrypted:	false
SSDEEP:	192:wc8mVVRZC3+b3U/1xMaFUlbVvevUqzxk1xccOasbB2:wc3nR43q3s/UlM9z/hN2
MD5:	F4E307557F1304745D2221BE28BDAC8F
SHA1:	E37F9CA0B0DC157C2ED14021536594A834543E84
SHA-256:	87177848091C9392F8681B54CE82FD8897ED1A50A03CAB6FB493C13422E1A62E
SHA-512:	9677FECC6EF16172BEDDD661342F7A62ACFD8D67BF7783878CCF0BC3772AF3B418811C9F6EFE0ECFE95172273FEFA99579C66BAAB3595AACA71960A7EF795874
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Sales Tax.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8905
Entropy (8bit):	6.745897938150198
Encrypted:	false
SSDEEP:	192:wc8mVCg6xRcb3UQn0XaFUlbVvevUqzxk1xpGpb:wc3Q5DE3znhUlM9zgqb
MD5:	EB8F39AB8EE40E48CDD5191AAE8ED020
SHA1:	23EB3219094EC7DB1607EF900B7C4E6D53153680
SHA-256:	E67EAC32A26A25FD2EA2FE4601F4D42CEB5031494A47A383BC272071F5C3005A
SHA-512:	D8B3CF08CAA5AC3E92BAFDEEBD04B604A6AEB9E56A7062427A8A404B93C39B4C2AED107EC650A89CC27F9ACCAC75BF767FC622EB08925EC37BC20C6C88484324
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Statement Charges.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9102
Entropy (8bit):	6.7850184234097215
Encrypted:	false
SSDEEP:	192:wc8mV5UtZ2Ub3UxPseGxvTaFUlbVvevUqzQ/3SIJ5i:wc3f2M83ctc4UlM9zQ/SY5i
MD5:	DAF53A1E6A82439CBAB24CBC7356365D
SHA1:	A84BC61A1CD6ADDF6FC3E146CBB51173E24D5BAE
SHA-256:	2110753916F77DDFC14B1379F0BB2B010E8AC828EDDEB3AB111B0E9A44F5B9AD
SHA-512:	39999E226CB4FD2E9CE0E1AEAEA8D6AEB7CCC735DFFA26F25F0F152EB0FF37C702B890FAD7F06FBF7F1668D949CB34EB77447789A009EE05CD1636113A1BA0F9
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Time Tracking.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9034
Entropy (8bit):	6.769753878312157
Encrypted:	false
SSDEEP:	192:wc8mV/cGYDrWb3U1oEipaFUlbVvevUqzoDmh1veK5noy5R:wc3hcGWW3SiCUlM9zleQoyv
MD5:	67B314265F3E444E28B6AE3B8215BEF6
SHA1:	844568E31FDA53C40B7A47B9CCA7B07BFA51EE84
SHA-256:	4ECCB5D5F240EC7FA276B8962E8E0F16EB9E4F3DA7E702DD67DDA9724F6A718C
SHA-512:	1EC806B8A9FC894C0AA7B64574983D79FFE6793B7379BE220B0155C51E2BB63CF8EC41AC9EC6FD89DC1536C30A02BE326CDEDF397379685F25BD34253A88B1AB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Transfer Inventory.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9081
Entropy (8bit):	6.779563405224094
Encrypted:	false
SSDEEP:	192:wc8mVTYJBJb3UmiaIdaFUlbVvevUqzQ/3SuyylhS8:wc3O13HdUlM9zQ/Suyylhv
MD5:	C2DB2CBD357B3AF84F47456F4210E3AF
SHA1:	595E4FF7467CDF793C70BF82C02BAD5C840A4E6B
SHA-256:	C18ED83E70DF157700C1A608E612325FC79622F7A3728B045C9CA5BFF6BB0ACC
SHA-512:	116C655938D358B5B5A644C7975F38BB2355AEEE6AF3056F94331BA88C575F4501334D2B60EEE036F14DF3C4D04267F41119A518522A378EC9209100D3461663
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Transfer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8933
Entropy (8bit):	6.7475711333237465
Encrypted:	false
SSDEEP:	192:wc8mV4yybeeuUb3Ufkx3R3NaFUlbVvevUqzoDmh64:wc3+eeu83HMUlM9zm4
MD5:	FEE9D3BDED7551DAE9FFD5A560BEB49B
SHA1:	F3D16C4AE99AE1A5EFE9956A7E763072E3C8049A
SHA-256:	E61C23FE64FE8A7A2FF9AF1C9C930444F499F2000154DDED356ADE81685E2BC6
SHA-512:	3004A79F8242260FBAFE0051928906C0CC7061E735852485A975672E9E9C1590B5B02B76017C5BAEF04B060F34196867DBB3493474CF637F22A3B8D3260974D2
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Trial Balance.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Vehicle Milege.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9069
Entropy (8bit):	6.775976988880308
Encrypted:	false
SSDEEP:	192:wc8mVSgx68b3Un4T92bqi/aFUlbVvevUqzQ/3SzYPi8q:wc3Ugx6k3vTfUlM9zQ/S868q
MD5:	46CBF18F2A34DEC0D2A552F7D29B172D
SHA1:	E2277962AD39FA3E2258C48CB0260DE3AAEF3311
SHA-256:	B942929F61942CC36C5D1BACA8D432E9798A639BAB630FEB10501ED31F18CD02
SHA-512:	594BA58DA7F2E97344CBC2132BE6845EEAD70F966EC9D3A83448C0DF8200ED62919FAA2E8FA424A6285A2D478EC03D8B8A096DDE81E9F19E3EAAC1C21B9959AE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Vendor Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	6.79917826988387
Encrypted:	false
SSDEEP:	192:wc8mV2s/ypEb3UauTu/b7yaFUlbVvevUqzMWHn9SL0ciT:wc3s6F3huTyb7DUlM9zMWH9SLbiT
MD5:	A2537669E02FD8E38CEE1FB144B2B5D5
SHA1:	841E29BA7C6B41BA94E4BFCF913290F356DAB431
SHA-256:	6D8C3D2EC8BE937FFB7EF0EEF5AF207893C15CA41147BCE2EBC9ADF9447C8CDE
SHA-512:	D2844FB50CF9B639113325F9AADF118B1E688D50E28D8EB37DBD96B215F57845B88E9B91BD0622D3E9B36C8EA5377BDD3F12F71587605605A1CEB601A8934E9E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\85302A46\Vendor.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10550
Entropy (8bit):	6.970001374614585
Encrypted:	false
SSDEEP:	192:wc8mVQzfnb3UbkxdBxTi7KaFUlbVvevUqz0aO5GDSvY4OiW:wc3SzD3jovUlM9zjTgY4OiW
MD5:	41F22C302B54096D0FF445534616A9BF
SHA1:	7256BD503A3906AE16B0990DD5CDA48FF52EDF1A
SHA-256:	F6B059ADBF7F18CA8795E1C8CC730BF6D11A228871EF20D4DF1DADB90787BB72
SHA-512:	CAF25BD0FD91B665633BF87808A31EEB6406A501A62936A1B9041D008AF7D7F7E15A534FED9C5708768E3F595F1727C7AC5A99605CF0B3544BA1A7E228DFCD2D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\A5BDB59E\LookupSample.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	6.819620975894779
Encrypted:	false
SSDEEP:	192:iRhjwAvOb8XpS0iaFUlbVvevUqzDCiMzg65AtgfFvof:iRhHOypbUlM9zWiMtWOfGf
MD5:	F36B43F28EF0C3ED040587F011567BFB
SHA1:	4D6535CE089E6CA11571C84A28B38BBDF82733C1
SHA-256:	EB1172F0C1BF6D6D5ECD22FB08B48D148F8C20D07CD9039B4DE8C3516E3459E0
SHA-512:	0374F75FB3DDCF2BEC7DFC6A00C059FB823F55A48641FDD021E81DD71D5D54D472C51B42ADECB3D4020E5F2E3F21F001359B90F8A9A8C4563020DD4F3B21F0A9
Malicious:	false
Preview:	PK..........!.....d...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.....U.S..0M.....7.....C#.$......`....@.Q...~qc....f+.h.+E...\.q.R.O..;.!)....J.......p....g;,EM....Fa..8...(..8.AU.5.9..ne.....Z.1.>.L--eOk..%.`Qd......kEL*WN.r.w..g...M.........`....FC6Q.^T..rm......a..J?.......W...Ai....EZ.F...>...Q...a..\|I.D..?q..;..y~)...#m,....=.\...."w...~j....;.> wr...o.6;.,...\|7k..v.)pv..3.t..Lsm........PK..........!..U0#....L......._rels/.rels ...(.............................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\01-ETI_Desktop_Sample_Advanced_Templates_All.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	71782
Entropy (8bit):	7.791937463737708
Encrypted:	false
SSDEEP:	1536:z/X00e6wwXNAfYvaeTQPyMhAZ/mJB/Gvb/WfB4E0jWL6B5:wp6fPvBOyMm4JB/siB4WL6B5
MD5:	F9C39F66AB7282AF2B0FF81B6DC740EE
SHA1:	23C0995F93DF582935C68989353B1BE57544093F
SHA-256:	7B09E43366AD6847BE39788FCD9A8E825B19279A86F48EB492E96AE5689EFC43
SHA-512:	FEB8DF39A0AFBB197C261F3EF6994FE74A98851D53FE3C3AD517A60CF3F8CA02FF31DA383C15DFB3FFFF51106198B935F62EA8EA1CEA567B97413D3DBA4CA2B4
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Bank Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9409
Entropy (8bit):	6.835146893058168
Encrypted:	false
SSDEEP:	192:wc8mVxieIb3Uk7paFUlbVvevUqzGBNG7Km:wc3m13xmUlM9zG1m
MD5:	7786245F307AA5E9F53FC02D1D743AF4
SHA1:	EC55E64029FCBB70AB744C291BC2EAF05B9E045D
SHA-256:	AD495770FF19ABB285FF25A0787E53C6472E5629F0058F7369B1DE3E9977B77B
SHA-512:	69134FD79019EF64D84E7E98D3759177C0F4EC34EF03D4FD7F7D5E06E4943C9049CFF668712239F38FA465E8A54D9FC1518EA3724C8957BAE2E1E546D5129DBE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Bill Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9263
Entropy (8bit):	6.811174803774489
Encrypted:	false
SSDEEP:	192:wc8mVXEib3UnoBi5epwbaFUlbVvevUqzFRETys8FqAKY/Qgd:wc3NL3iepwoUlM9zF2TL8EAKkhd
MD5:	F4EE9D1C72D66C00502095D92B51D075
SHA1:	679329C9242F85260591330C280CC36AEC56EE0E
SHA-256:	980E3A62E7255829C7A8FD9DFED72BACA46250EDB551D149592F985E366C3CD2
SHA-512:	79810A162530880E10754A49861A9600EA26EC89ADD1FF22CE2B81B124457EA2E4BDA6CE7B4FEAA24FCF018378135BEE4CCDDA52E9EAAB12796F271C0CF6318C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Bill.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11078
Entropy (8bit):	7.002037492689051
Encrypted:	false
SSDEEP:	192:KNAHvb3UBHJmnYaFUlbVvevUqzhNlQbDj38KeOB5G1Dbzt:KNyj39UlM9zhSDwKnBSDd
MD5:	CC45E37D94AB802C4E60269C255DCAE4
SHA1:	11AC2A6900DC370CD92AF3A556FC6E9E2BE2CD83
SHA-256:	DB3CD0023FF1B155D3114970F51F9C5BB0A368C12D06D7F3E2437E0AE471D135
SHA-512:	7CFFE9E81B0E3336D87FD79430752E181EDFB36C805093FA33C33A717BF3BF4D4555639B924F7797F58CB77DD14F9AFE6411B0669C78F898E3A514863E4D3D9F
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Build Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Chart of Accounts.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9428
Entropy (8bit):	6.8346550146854295
Encrypted:	false
SSDEEP:	192:wc8mV1CMBKb3Ugo+EXSsVp9aaFUlbVvevUqzuap28N/WA5M:wc33CMo34+GPUlM9zuaptlWA5M
MD5:	E46D702786A28A22EBF3E08FFB8E7800
SHA1:	15FC3234E1F7B247A10926E1EC3C79D0B9E1326C
SHA-256:	04E46E45709212C1549A80DC1BC5C371DD5BEF1FFC6AE183392012C6D171811D
SHA-512:	246A846EBFD06BFA70B4A8563F8962511611FEC874B316D4ADA78C99B6988F1B9F187A8F8F0C36F5E4DEF3FAE2EE6E9B63B624905E8977F1EAE8F91C99702413
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Check.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10142
Entropy (8bit):	6.9469252609143055
Encrypted:	false
SSDEEP:	192:wc8mVf5U1/Ab3UGwoN8SGZaFUlbVvevUqznr3xIcuf+:wc395m/g3lwZzyUlM9znr3x3uf+
MD5:	31221D18750154962C6D16D487F6671C
SHA1:	2D4C0DAF65B97FFE8B474016EC89D041F79B6AA9
SHA-256:	337AF1B959DE3B4985C2A12F53E783D0A9A828B800CF33EA86EBEA7E8FDE1091
SHA-512:	82E0206B00F1405DA1392D6699F0604556434806B3F6C0DA7D93117DC300BAE67E717796FADB4E0C64BE089176C50863EE6DBD28E0AD7D621B9600E8B780D042
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Class.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8798
Entropy (8bit):	6.720255988540497
Encrypted:	false
SSDEEP:	192:wc8mVW08Sb3UqRo3/aFUlbVvevUqzrTJNoPnhZZjTy7:wc34y3E30UlM9zrdUhnm
MD5:	1C2DD44337B6FBDECEB7AC25CB944E0A
SHA1:	D8656BF1849FD6667D96D94353FC04278031092F
SHA-256:	A6687AB16520919EBE6AA8065C428E3C06C46B07CDE4DEEF86A53BDC75A9DB81
SHA-512:	2AFD8CCDAC7042B735E8D113F3C05F9498FFAA9F31B7A952977B2113099A1972FD33B7CE77BB957AA803F5F99165A7A58C24E466040421D10326DE09F27FA53A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Credit Card Charge.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10198
Entropy (8bit):	6.9604922120108474
Encrypted:	false
SSDEEP:	192:wc8mVE3Fb3UszomioppCaFUlbVvevUqznr3xazG9OtZdbOsCn:wc3EV3ddpTUlM9znr3xazGYh4n
MD5:	C15464404820B961E00F3A97FF282592
SHA1:	B578DB215DD25CB3A8974A1F47F788F3A36194D7
SHA-256:	0347E93B8C0FB4023B90556828937782C831E62396588355386BF61DA6788B5C
SHA-512:	BE02A4B0188CED7CEECCB678535E2B7B3189F204E33131EB9977238624D391467D4FED08A0B68FFE7783474E0406452479E7C3CBC8A2DCECB66DD72F961D25F3
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Credit Card Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	6.906727391175815
Encrypted:	false
SSDEEP:	192:wc8mVFvujyb3UlS8wvqZaFUlbVvevUqzIv5Fyrdt6EuFUNZ:wc3XuS3RSyUlM9zIv5Fy5UjiNZ
MD5:	8A2EEFC6A0436D32E3EB3E5B8155A7AF
SHA1:	CDD2713936FD91DD9F1DBF3B9E61140FC9BD1A84
SHA-256:	56A6DBAF402C0418558E38F2090C0F8E2A18393DD7E2F589DDBAF416F15A1AE8
SHA-512:	59C3D8F203EA614097B39D5A33A6ABCA4E75B5FCC04022423B53136BDD428458F2A60AC1C367A585B06F84C5F070AE58AEE35A515D00EF901B3EC0107CAC8199
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Credit Card Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10209
Entropy (8bit):	6.886777504200445
Encrypted:	false
SSDEEP:	192:KhjHtZb3U3V4DvaFUlbVvevUqzDT+Y+WFdt6Elzoh:KJNx3VkUlM9zDL+mUEe
MD5:	2E35BFFA12C6E81688934CAB032D017B
SHA1:	09B5D4C370B1E28984E22F0F340AC9D8E31D65F8
SHA-256:	33167B04345362F45E2B6DEFE84C4279F776BA4ADEFE04447134ECD76A3D8CC5
SHA-512:	9C834E1D40493D5D98F893E6127DFFB0A68837EB6E54B2F4388247AA4B8A468821BE17C3B897390E5ECB9D9C5DD10209F405F90F8A6504BC4C94E9C8C231242A
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\CreditMemo.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10585
Entropy (8bit):	6.999634894317925
Encrypted:	false
SSDEEP:	192:wc8mVHY0hb3UtdCziWaFUlbVvevUqzGm81q3yjKimQmpzsw:wc3lXZ363fUlM9zGmoq3yjVmpYw
MD5:	3F22FDAEC17F3243E01D91FE93B37AD9
SHA1:	BC4D3968A68304F4CF0EA0236BED2380040461E7
SHA-256:	E0412675ABA85C69A55C8DDEAEFC537FBB723D21269283BE9650959D74E68D71
SHA-512:	CED0EB56D93D77D5C2A792FAB64291DADD657899F003C8BE9049E664FBAE0183584B05DEF6B4524DEACBAE91B59591CD8466A5DA2A2DB602899EA01E0FE4EE9D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Customer Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	6.804106873918999
Encrypted:	false
SSDEEP:	192:wc8mVurLTb3UemlF66WOMaFUlbVvevUqzQ/3Si0K:wc3Kr3QlFfWqUlM9zQ/ShK
MD5:	5A3ABC826FEDD4DDC40F28F91FF2C49A
SHA1:	5B206F8A97E70E3B36A0A16C802E7D7FF1E672D2
SHA-256:	073829AB46F6926D5D88F3356351C92F9B96BECBE647B6961D9C69EB8C068893
SHA-512:	DF6B0F193AF2ABE4AC7B127183F72880EF41869A9AD0D3D7FD29957C414FAF8CB9A5CFF88D315F484BF14F711137FD70B420665FC2733FC683967A4832C472B1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Customer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10806
Entropy (8bit):	7.00455927670836
Encrypted:	false
SSDEEP:	192:wc8mVBBjvt3kGb3UO05NfkgKBZA5aFUlbVvevUqzZJtVMuErD8hzXvp141an:wc3/Br+S39AkL3/UlM9zZJtRs8hzXvpx
MD5:	6A647229C586F23E7FD222CD8B917983
SHA1:	27B732103ABB99938B4EB6B67097491F6245E9B9
SHA-256:	CB761B527FB136E74568EC5F2D2ECCC95AF923BCC7F02EF775AC3A1E0AF1E42F
SHA-512:	58673708D6F85CEB82FB9AB704ADB0A0D69A74EB43CBF38D0CAA0EDBBEF2C2A865D35F1DECC2EE6968EE32F8AD4D7512349D33A4548FBD0102648CF1A834EAA5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Deposit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9334
Entropy (8bit):	6.8245118687473925
Encrypted:	false
SSDEEP:	192:wc8mVxA/9b3UmBFJnT7PaFUlbVvevUqzQ/3SN8W:wc3jAF3H9T7EUlM9zQ/SN8W
MD5:	6701A6B0B167EAFD0375E78A4A2658A6
SHA1:	C2999565414E306DACE2233E94B52A947C66FEA5
SHA-256:	E4E0253ED8B4635ABF5716343C743FBD628447D3942697EEED65685CFFB36A1A
SHA-512:	65FB16429AB0B71C63E7E93DA677A9D897F72F4772EBB8CF4AF6EB2D75A30B6224916BD06C8458697C113A05FA99B3C0DD918E3366C82D1DAB6649BF2B90A368
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Employee.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.021013113154668
Encrypted:	false
SSDEEP:	192:wc8mVBeKnoY8++b3UtVuXgw1gEQ4aGAoaFUlbVvevUqzjBYSHskTMQWbZc5X:wc3XLz8F3xHwG+UlM9z4kTMtZc5X
MD5:	9558B568CD1DEEC125BF9881EADC96E2
SHA1:	438BB1F4CE19852ABF5957A7A9FEEBB820FF9F74
SHA-256:	B6A39B7FDC8CDA82A9B70689F3F1F61354C3C2C0B7BEA8FAB49A85B577CA2AFD
SHA-512:	A85B4060013DB56740BD11F43918BFC12FB018D40F9A8BB680ABEC2720B499751148AFB536BAE6EB8BC3A3D896185934DE0F66DD930FB7B6DB82A3D2B125065D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Estimate.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11408
Entropy (8bit):	7.040857250327687
Encrypted:	false
SSDEEP:	192:KllCb3U+aoT/BrkgfMnaFUlbVvevUqzMWHn9SloDjLOZdjW:K7G3/T/BrkglUlM9zMWH9SkHOZ4
MD5:	EB6F2173E89241455666BC81605A3744
SHA1:	AB4399313AC083E0DFF06419982C7F64C5F0DDC7
SHA-256:	0A9DAC5514807986E50D3BFD5755B11BDC233EB334B851262A1FCB94DDB7E99D
SHA-512:	9BB78F77DDD2AC0A7EA0FF57EFCE8F6A09FBF5990C0C63C12938300171B24DBBE1A3898434B5BAF01E639684D346AFF476092A5BA2F6570DC43A708B75A653C3
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Inventory Adustment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9310
Entropy (8bit):	6.8189561680744255
Encrypted:	false
SSDEEP:	192:wc8mVXQMQgub3UkOqujnLaFUlbVvevUqzQ/3S2Zn6:wc3Xx63XujnYUlM9zQ/S2V6
MD5:	B97EEF588202369F8B876F1423663195
SHA1:	6BADAF761D637C9EB332E9119594EF3576986A27
SHA-256:	9D60D238304CD104A2FC7C17CEFB87CBE802AD0F08D43C955E9D6B0A605F02A6
SHA-512:	3523A17765CD859E046F5B6DDF9E38EE916B0935EB88A7E8510194448C75B7542E1A11C8BE3FDA35CF27EE50B9C92F377D719C3E9379C2DFA8954FFC691C1CAF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Invoice.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	11340
Entropy (8bit):	7.034558168346158
Encrypted:	false
SSDEEP:	192:K8L+Yhb3UF8Ds6WFLoaFUlbVvevUqz0zH5eK6z+WlE5a:K8+43iBLlUlM9z65eV+/w
MD5:	D74C95A1AD48C9964B1B27682B3E4E17
SHA1:	47C3DA361C430B40028CBCA998EEB65AFF882D85
SHA-256:	FDDD98280EFA3941D16DEAFE85BB1FB87800D181249478E18BC8110B60300A5C
SHA-512:	3BC69B80D9CF29E2C7E9AAE137AEDFDB552180C6E050A6472E31854ACF7822DECDD08AA293944BF4D0C9B862C2115DACAD918B73B5B093BA3DC71B6D6FF1034E
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Item Discount.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10751
Entropy (8bit):	6.934760300038226
Encrypted:	false
SSDEEP:	192:D0+b3UPnosMuaFUlbVvevUqz2WPpnRxFGMUf0/:D0q3HsgUlM9z2AnfFhUM
MD5:	A19B8A630EDB8370A3B709FB4598A590
SHA1:	FC168E56503A9EFE0E60FDB605A93EB7CA3EEAAC
SHA-256:	79A459642999B71E377F01A021FADA955870EDD4A63B92449A8024FA36A2C2D9
SHA-512:	22F87F18BFE2AFAEB06ED4F90F505598AEEF0D8CFBC62E0CD5422CFB619FCCDCB82A46B9AEEE4AA8DD4CCC0DB6167B3EA623551C2C79FC6CA91A19FD2D8A546D
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Item Fixed Asset.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9636
Entropy (8bit):	6.874857397593093
Encrypted:	false
SSDEEP:	192:wc8mVbS1F4b3URlQzyPertXcaFUlbVvevUqzQ/3SjReK5tr:wc3l6Y3+QzyPktXRUlM9zQ/SjYK5tr
MD5:	6C97C50570FDEAE69D921048FF063ABD
SHA1:	925E4EDCE6D10E67330D04100251829F53C13CA5
SHA-256:	E7B3B3269A7137D9A4784E60B87E72AB94397F822609457D4BAF32778C61EC36
SHA-512:	B2122793F0838B98C87C131A40617FC7B340445FC7B251D50CE6CA134FB388FF867B7964142ED7F7C7FD8901D3A328143C0C3B711C4E767F4BD190D405EAEEA8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Item Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9008
Entropy (8bit):	6.758581176481423
Encrypted:	false
SSDEEP:	192:wc8mVCFDb3UnzaFUlbVvevUqzxk1xQPkM5nsOoD:wc3kf3kgUlM9zLcusOoD
MD5:	6E37867EEE64D3892AEA74BB73483925
SHA1:	CCFCEB314F72660035B3E7C274D40C28D9F08464
SHA-256:	A0EAEF42ABE9CD0BFA595CA90230A22C2B0B0D5B39F6D084DD1882F715D459F0
SHA-512:	C8075365204D8A1B7C8129D2D06D55DCC1F60434259F9E2E9C61A99EC1C2AD7DFAE2941867DB69E98DE9B83EEE0C7BBFCAA7666D4EEE5E3314C5C847A36D04D8
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Item Inventory Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9535
Entropy (8bit):	6.856166349790785
Encrypted:	false
SSDEEP:	192:wc8mVAAHb3UT5BvhYCsiiaFUlbVvevUqzQ/3SJEnpW:wc3qA73IzsWUlM9zQ/SYpW
MD5:	2C3695A087699206B586BEAB488BBFE8
SHA1:	9B2C4C4E40F1B73F759817B9816E4206FC10381C
SHA-256:	26DE8AA89E3BD37E9416348713241EDC1434D0E520F22687316924B7792A1C22
SHA-512:	87F10CC5FEFBC50C95BBFF6596A88B416002A5266D7B534C968D7CA05707F5041F1D4BB24DD7993F48E3377D4B409163BAACB33A000B9B927B46D1BA86768E84
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Item Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8902
Entropy (8bit):	6.741515570203868
Encrypted:	false
SSDEEP:	192:wc8mVdCwiTFb3UL6p3aFUlbVvevUqzxk1xEtN9s:wc3ST3XpMUlM9z9tbs
MD5:	0897DD514B3B8F24F6B54ED967D819F1
SHA1:	B16A9940546B96913E1EA4035C0AEBBF0F9B378E
SHA-256:	019EB7073ADE81163CD299BCFF07F452DA9EE09CD492B699713277D113A8BA36
SHA-512:	B91FFE144D0446A726EE7CEF428E40EF69AC414842B70C896396476D9EBD6332E36723C7115D35721D598B671938E52DEF6024ED9DAB50007BF47CD867D98726
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Item Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	6.898973088547867
Encrypted:	false
SSDEEP:	192:wc8mVK9c/9kV/4jb3UAayghAa9aFUlbVvevUqzMWHn9SR8vFhDTBDq:wc3Aen/3wygOPUlM9zMWH9SR8vFNFDq
MD5:	AD2D0719A7082ADD252ED93DF29DBEA3
SHA1:	9B0ABDFAD5AEC4558A69819BAA4BD4E2C49C4F7A
SHA-256:	CB7F87885506C4C12431257FDDF5456967E5A573927A44CC48278F41D9E138E7
SHA-512:	99962543896C322D06064B92AC3C8865202D1D7DBE192BD1FE5BD8347F1A3B1BF83EF15DF2F3CA2C2E6C4BB538984946ACDDEE0F4E09004FF6772150A0DFDD85
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Item.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9572
Entropy (8bit):	6.8591410772456065
Encrypted:	false
SSDEEP:	192:wc8mVePgw4db3U3cNgSYmIaFUlbVvevUqzxk1x1uydHctD7ecx:wc3UYw4t3qFmFUlM9zfPD7ecx
MD5:	E1CCA320B79E4FE363C2510493B6099C
SHA1:	97AA9F4D525025A73A9E798B98017095EE1E1053
SHA-256:	054E620A0930293871A2789AE706FDC3245E36887625FA5B7DF6E020A164E833
SHA-512:	D0CE5D966C4D0C2A4476C5C2E2727404920561046C3AB2E8F5D608C94C6531C2BDC30FB462A185D1BB18666ACA288B514F90BA5F7966C522A9B725323C1ED245
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Journal Entry.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9165
Entropy (8bit):	6.790829628817651
Encrypted:	false
SSDEEP:	192:wc8mVUUKb3UGRsjMaFUlbVvevUqz32f7J8D76:wc36UO3lsBUlM9z367iD76
MD5:	5BA3282AA143B09BB4C749AC9F59A778
SHA1:	1CD45042BF16ECF82F10B2F1E26217B16A40017B
SHA-256:	D0CC6D919667209BBDEA1CB6E14CFD90720D89849D9BA33A82E2D05E905C4BC1
SHA-512:	265B9130CE8E03D6A48B08F8024B0EDA82180AEBF7A42FE10D3DF53EC1B7CCA0A89C9E9CD04071D2A2B0342CE95B5B0A789E8B5FF4B763443B2162B1AC900342
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Other Name.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9942
Entropy (8bit):	6.880574321203129
Encrypted:	false
SSDEEP:	192:wc8mVIVP5gb3UiE3/+ycaFUlbVvevUqzvMJbjBWNkMf/2oKVGD:wc32G3qRUlM9z4UNFX2oKMD
MD5:	1EFD320BB319BEC7314C291AB4844DC3
SHA1:	D07899C98E925FF095F777E13B260311CE1EA1CB
SHA-256:	6F6DC81D587C005625D282223BDFE046BF377F6C810713325F10FC7F7EE9AB92
SHA-512:	DA13B789D2F95D7AD0D81BC75209DBE08394CBDC89873247442D7E997999B4EEA351C55E4E52F49D105182E815CFA70F70C1B9F225BC073ECD0B80B87E406088
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Price Level.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9107
Entropy (8bit):	6.779691843621978
Encrypted:	false
SSDEEP:	192:wc8mVc8zb3USVx5p1joaFUlbVvevUqzxk1xfTd7P:wc328v3XxvxlUlM9zC7P
MD5:	DDB1A777F2BFE417F8D0D1DE53662C05
SHA1:	04A40137A4D32E177E302AE4DF988DF8E1A996F1
SHA-256:	9CB1C01D2C72B8A36A0749BF12AC7ED7E2C60EEFD32090B5874A0D7520CABFB9
SHA-512:	754126DCB416564CEAAE0194852966999148DC733E6D71FDE84CDA16A75A322A59A500AAC05494AB8BB53F3C59AF7757B61DCBC42495FCF926A973F9E9E4FADC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Purchase Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10212
Entropy (8bit):	6.9585940246465805
Encrypted:	false
SSDEEP:	192:wc8mVIBTanb3Uxj5kmaCU+aFUlbVvevUqzYDxeGZL:wc3mBTab3WjlaC8UlM9zYDAGZL
MD5:	CB19033D56B615821E7A14DA7FA94A24
SHA1:	D19DEE1C92DA51BD909D06C7755484A88C4F0822
SHA-256:	D07DD5808CF886316EC12DF0DFDA21611C1296C0758B0310618F0711A3276B22
SHA-512:	1A58418DF5EAD2D67B46E9220B4853278C1628554F47E65D008569EDA3DA593162B88D803DC9B879D37D3952475ADA7F0EA28153B8D66A0F10331B45248681B2
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Sales Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	6.993302047378494
Encrypted:	false
SSDEEP:	192:wc8mVKaagb3UopdpwaFUlbVvevUqzYDxZWP6cvnzNFfXAW:wc3ga3PpdLUlM9zYD3WP6szzfAW
MD5:	A51DEBCCE7CCE3AEDCB4BBC96DBBA8EF
SHA1:	CA9C083F72AC92059785B7356919DB38C424ACD9
SHA-256:	787C092492F3293CE06B875976E3B25C6B57FC5786FD070958BBC5B059713798
SHA-512:	EB649DE96C0F0843005103D5D8984D2C53F69D4902B5FC410F097BDB9CA7CAFD81164EFE7B1EA81B49849EA2AB459817D7080DAD68B5DA24E075277EEF4719ED
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Sales Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10563
Entropy (8bit):	7.000994706243713
Encrypted:	false
SSDEEP:	192:wc8mVPS29jRb3U0Ma/cj4ing8ooaFUlbVvevUqzYDx5TSTm3IEX:wc3U2j3PMOZFUlM9zYDD53hX
MD5:	A6AF62DC0A1B0D64B62B92F2A394A903
SHA1:	368BDAF6D16882018C5C058F36AD7EAD98C5E569
SHA-256:	C320E36C1C63F0111F87A610252BBD77C651E15208D33A7C4208BDF5144D7375
SHA-512:	EB383F99ED44CE5AD1AB5719A0047388BE9FBF9A4FD8BFA99F0BE1FD0E3C54AE6CF823E56F4FC6698976F83A224A030D645488252568F341BA8A4430B24B23B6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Sales Tax Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8878
Entropy (8bit):	6.738910117567037
Encrypted:	false
SSDEEP:	192:wc8mVK4qNU6g5b3UXnhhzsaFUlbVvevUqzxk1xcoasbBKE:wc38tgR30nZUlM9z/ENKE
MD5:	57A1600221F6BAF16D271409A90E6961
SHA1:	5AE582F5D78661B93FC13B5CFDCB3A243A41EB66
SHA-256:	45A1D852E6D465C9FDA030C8B621B74075EBF9B4FA45EBDCAB53A7ABE7C65075
SHA-512:	48E01EF950EC6B3AB4523A46DF961BBD6F177EB1D7F65F1843AE21C371BE94A73B1E3B802CEB881EB687340323818882801E7E4BF3466341094C7BC2A7320F7E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Sales Tax.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8877
Entropy (8bit):	6.731786945467423
Encrypted:	false
SSDEEP:	192:wc8mVEtuXjzrb3U08xkyamaFUlbVvevUqzxk1xpwpppdn:wc3wmzn3AFavUlM9zgwpndn
MD5:	2E40D56C244D5BC0BD2E33345167DE2D
SHA1:	6759D0A8E6A710417BB5396278323989B7050EF8
SHA-256:	5F07DDEB0383EDD7140C065C1619CC257A99CB10AACFA6F53615575F971BA188
SHA-512:	8D7E18C7952A0A8CA8E888531D2A92C9AF1A497179B83D0E796569BB6BD2697CB4F2B3DF596EEE422B7819F40411401F5FB31C2FDDF8B2AE9112D7B58DBEB1BD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Statement Charges.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9195
Entropy (8bit):	6.80403615435195
Encrypted:	false
SSDEEP:	192:wc8mVcmuIub3U6DbISLaFUlbVvevUqzQ/3SsLlZk1/:wc32I63FbuUlM9zQ/SSZk5
MD5:	D59FDFD946BEDA6FEF78DBB5573BDFBC
SHA1:	E05EC9E34694CB6CAC2033643774B438CF1DE3D1
SHA-256:	A844F3925A61BD5689D3FFC577F2FEC536E968B42930DD1C648DC8C95C53E8E5
SHA-512:	DCD44F952C450A235E9EA64F978D93068990BF6326017E54A2D3E9F15ECFFA8BCAB94AA195AC63BEB15ECC4CAE9D672B686A1D9D3A7E275BFEE6BE3F7AE112B5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Time Tracking.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9030
Entropy (8bit):	6.765434751177057
Encrypted:	false
SSDEEP:	192:wc8mVsib3U6jjcycyoaFUlbVvevUqzoDmhoCnoyQ:wc32m3BjHUlM9z8CoyQ
MD5:	A99CC77D26C2F03CA5AA587DF34A9501
SHA1:	949F9E0697F5CAAAEEF5E1D42488DC046FD4B50D
SHA-256:	17BFBEF2D1546F59C7BD072D3DF13FC619FBC68745963D98B332EAC6F3A2038B
SHA-512:	D32FFA9A66EAFD3A3F2A52152B58CAF9C8CBEB9EE8F6CEE0FEF16AAAB60E9259C15DB8922A2CEB653C069B50003583B3B0D1F4184A391E2B94CA75569B1DC997
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Transfer Inventory.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9079
Entropy (8bit):	6.780184862313751
Encrypted:	false
SSDEEP:	192:wc8mVyQl5b3UCsHvJFcpaFUlbVvevUqzQ/3SDnlhY:wc3kQf3UICUlM9zQ/SDnlhY
MD5:	5176457989D44739BD45A5AFFE8C76BA
SHA1:	5D260894372376DD3B98D935743EEF67AA68121C
SHA-256:	DE1711A1DAEA88F2F7778B2F7BA7BFBC12E207D03A6B3D88C462003E9D1E1640
SHA-512:	35B1A24EA2A2BFB11C6FB7168D1C4F96A3D31C3B4CD563D65F07EC44529951B433E74B603C7EC9C746C54515A64C461FAD2F316156C1A15C942DECFDF95A371C
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Transfer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8927
Entropy (8bit):	6.7447222021488455
Encrypted:	false
SSDEEP:	192:wc8mV5b3UpCehQWaFUlbVvevUqzoDmhecRWxsBo:wc3P3yhuUlM9z6cR24o
MD5:	D931EF04D1779CDD007C3C0BA5201DD0
SHA1:	801A29AABEF972C41A9186D256B058FDF942F26E
SHA-256:	D01BDBC91EAB65E485DCA7C91FE6C47620BEDFF99B6E3B5F7B9060FAF072E929
SHA-512:	21506B3B2376068133A1C5CA061FD3BCB8B4A72CFCCB882FAD9B7BACCF4A82240933ED6F6A7B06D13238CB5DA0D31FB3921B883E7428E6DF22CD56988842CEE1
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Trial Balance.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Vehicle Milege.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9141
Entropy (8bit):	6.782145844796253
Encrypted:	false
SSDEEP:	192:wc8mVadAb3UxeFFaFUlbVvevUqzQ/3SBBBosPiu1:wc3AS3n2UlM9zQ/SBjos6u1
MD5:	A0403054E8EC020532ADB27CD91E1604
SHA1:	49FE13F6CB42F28579FEDF768F1F10312407B00A
SHA-256:	EAAB2188E3128256846E56C6D42BF921E3286A06E05DAF993197F0829CE8A155
SHA-512:	3649310E6023FBD26FBC2548F1BBDCB3EFCF4837B8B5D90372E7A4DA2FA588FCE876558478ECA83C504A27094A4B6EF8DFEC33BC629897E517594E1B6EA3B24A
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Vendor Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9788
Entropy (8bit):	6.890099926914943
Encrypted:	false
SSDEEP:	192:wc8mVakT+SYb3U5bA7EafaFUlbVvevUqzMWHn9SDGtNjci11:wc3kI+S43SEqUlM9zMWH9SytOi11
MD5:	AF3C6C8E2D69E51B391806619BD49937
SHA1:	FCC8AE968EB274339923B88686EF229E278DB991
SHA-256:	1842387ECDDB1432025D6BB501A901F0F8D4F2D23C00CC303CB2F36E56E42395
SHA-512:	F7D8EA3A96096735FF849B0257EA7914D54176D22D1CC5BBF87F2B159B767A0B4FEB37E531DD4F8876E0F5E7E8BCFEC3AF4A5E6DC7A2E2B234EBEC05835E2743
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\B6078100\Vendor.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10521
Entropy (8bit):	6.960581353008388
Encrypted:	false
SSDEEP:	192:wc8mV5BMPb3UFfcYipGSyaFUlbVvevUqz0aO5GDSoloZY45Mth:wc3Ji3Zn8SDUlM9zjTBl2Y4Gth
MD5:	93F43677DAF2D9348053DA5512A6A667
SHA1:	05CA5E521C9DD38FA63AA644EFE1595564F3FC68
SHA-256:	C074167D13B825ECCE798A1C861665E9494561B64895096F26F0B3C43A4476E5
SHA-512:	3E315E75DE816E8D7DFF055352E2B3D5B0559640EDBE7230096D4D3DA3B3B5237727AA030E6BD0E795983C61B2361817172E6D654C5A4AEC49F44F92A86FF9D5
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\01-ETI_Desktop_Sample_Basic_Templates_All.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	60608
Entropy (8bit):	7.72158777055586
Encrypted:	false
SSDEEP:	1536:xEjn/qO0hC6y2mwU4NKf/QWHcIfRij037fXKkvb/UjDUj6T7:xEjaC6hdU4G4WHnE0rvHiUj6T7
MD5:	2FC2034D6E43283CBDAEE5625C29388A
SHA1:	51431CCB4B3645690F32B90FB89767BF21CEF86E
SHA-256:	ED8C776FAF95DB425BF2FD1EE4DA5521FC40FBD051A345B5FF2FB7727A3BF219
SHA-512:	A6A30231DAE53D79B1D38C7B0EFB33D724CABA83C2F83DE2A9B2F8F4203935CD2EBE74624C3D9386572EE432204992CFE9CA366A841B87D4346FF88237B10E77
Malicious:	false
Preview:	PK..........!...T0....2.......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0....}....+....qz.n.[.....I,bKBR...{.6e..!$.s......H.s8gr...b.1Y.&.1+...X7....kV....wP.5$v3..4y\.H..v.bM..;.n........._..]/......x.]..G..`.....s...+..-.u..}{.........../...d.g3[...s..e...I.@..2D....r....[=#..8...J\9.K...3...a.wN....E..5.0.w..........^..Kw..\|.....O./.."...p.e...l.......8s...A....H.E$.%.._.."..+...Dr\|#.C....BTA....S....T.T..pUP...BVI.....Ud.T...UR!..BVI....Y%..*dUT.....UQ!..BVE....Y.....E

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Bank Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9179
Entropy (8bit):	6.794915179830353
Encrypted:	false
SSDEEP:	192:wc8mV8pOvxKwRkib3Ue6gS2KkxaFUlbVvevUqzGuPK8I:wc36gp530/2BKUlM9zGx8I
MD5:	A9F59D704F0046C9DDF4BC78AFE0602E
SHA1:	642BFAA1A38C106BD33200BFF3156A20731BC922
SHA-256:	07C8A96AC8204EB1067781D38AD07A2ACA03AD892A01D1C10CE2DAFC33A2D7A0
SHA-512:	248328CE90C2F316BCBD26C200031001D13F08768C23A8CC56D918D14CC2FAC82A11439379A2929F8D13C85B4E49B19D251AD302F5C535FC48B19AD72B7A6AFD
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Bill Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9137
Entropy (8bit):	6.792737999962153
Encrypted:	false
SSDEEP:	192:wc8mVsTu3zb3UOc8aFUlbVvevUqzFRETysPnDr6gEZ:wc3yTu3v3yxUlM9zF2TLPnDXi
MD5:	12DC3AEB3063E4CD6D2EEE73254AA628
SHA1:	3B8B1C277D40112E34E0D22FBDF5CA7DF325D00B
SHA-256:	7E7B631CD1A09AB185EFC2D6DBC2B195830A29659EB99E8E9C06C3AE336FFE6F
SHA-512:	5C1A6AC09F388E49FEBF5FF28D26D15F627E53E7DBE7AB4AE51B723440CE88BC95CE316F0D777CD8ED61DE4F49482D9EBB357178C6EA455FFFC083CE54C19D4B
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Bill.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10310
Entropy (8bit):	6.902085495948442
Encrypted:	false
SSDEEP:	192:KD1+gb3UAP7lAaFUlbVvevUqzhNlQbDj3qZnRDbzi:KZ+A3HP7l9UlM9zhSD+ZRDS
MD5:	C7AE2C022CA8C673A89C837DE7E9141D
SHA1:	43D508EDCA6A9809E7691240F6314396A66997BF
SHA-256:	1B5F8058535D5454D6C4A81258784D6CB874AD2506EE4F15CF8AFEE33940879F
SHA-512:	9AF3203737D2A79041B356CA93C4F70C733FAF8462F6D6D80B3901046C6F9D2A74EDE85CA8EBE0F708CA67FEBD1F5E9C02284066AB8E1FBBAD177D02290052E5
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Build Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	6.954206889073703
Encrypted:	false
SSDEEP:	192:wc8mVPhoP6b3U5D9aFUlbVvevUqzxwBLf5YoXip4PbfdE:wc3RhYe3RUlM9zxwBLRLSp4Pba
MD5:	DC602F39E84C9FF56C4406FC6B080AD4
SHA1:	79A55A1BCD7DC5FF2C0D1D944CA7946E4E1DC6CD
SHA-256:	620D884B84C2F6BB3AF0DF8A4F48A0FF9DFDBB8FBBCD802D2D4DFD2071EEF6DE
SHA-512:	7160CCF9CA8BFB09F76BABB7EC9EF12694D1C8AF0C06F80E1F90F6029D51FACAC95AA81294E1C695F005544265A7D7D2AE50B1A1186A7B46CEA12B1DC6F9D731
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Chart of Accounts.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9364
Entropy (8bit):	6.821970615427216
Encrypted:	false
SSDEEP:	192:wc8mVHw0B6db3UMY1ZFo7T4aFUlbVvevUqzuaToA5HaE:wc35w0E3gHoVUlM9zuakA5HJ
MD5:	09E8A762CE42B56F03B800563478CD10
SHA1:	80FF7AEEA1DA861732DB3F0D1D17F3144F3D979A
SHA-256:	DFBB8620DECC816F2085D2FEC636C3CDB928CD0EB25CB3492B200DEC39ACE84B
SHA-512:	09A0A3A5EE8962E023DE27DB5C99B1F2276078524E2CB1352528BDE1EE2F2F8A6CF60C71B5CEE3639B09CBADD2C9D1637E9B2886C439C35C0E3D361F90A820FB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Check.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9279
Entropy (8bit):	6.811763392150569
Encrypted:	false
SSDEEP:	192:wc8mVSFrLeGMmb3UlbVPgh/aFUlbVvevUqznr3xae/xL6nz:wc34rrN3ydgh0UlM9znr3xae/x6z
MD5:	54A0DB0C902D4940B94C3BC1A06523E1
SHA1:	0C875F23CD656DB873FCCC1D80095144F0AB310C
SHA-256:	37D5A0526FBED14A7D290975C3FF57DC1F55404091C3F3FA0FAA63E1D5AAA1A6
SHA-512:	A8CB79E0B7B6CB40999A698FF26CF3B8CAA6E8B888F78D46BB010B3BBB6F5590C4713B45466CB8391C7A54CCB38A9ADA44D20490E79731B1A06E6ACF2D0451ED
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Class.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8830
Entropy (8bit):	6.729273799907828
Encrypted:	false
SSDEEP:	192:wc8mVnT42Xb3Ub3C0aFUlbVvevUqzrTJNoPnhhTqJ:wc3G2r3bUlM9zrdUhxo
MD5:	6F0F3638E5D2A4D9FDBADB93A620AE5E
SHA1:	52ECC7CD6C4F98712D414909EF8F86F893958DF3
SHA-256:	7413628012ED627A283149A01B7273BD900330CF917B524319F73DD34D7E71D7
SHA-512:	D4B6526D8FCA703196834775AD24A22B53E093BA93B0379B970839568E1F67FCA68C0B682214052994971CA558DB5290662B82496A1DDA9BAD5A7665B29CD1DF
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Credit Card Charge.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9423
Entropy (8bit):	6.839785295716797
Encrypted:	false
SSDEEP:	192:wc8mVJ4HUIkGCb3UOGW95ZlnaaFUlbVvevUqznr3xSFbOsCK9:wc3ge3FZlnLUlM9znr3xY4U
MD5:	AF5B372522E9D8654675DEFA4F408156
SHA1:	513AB2B83145F3AB267C16906CB234962A473A21
SHA-256:	76FFC405EE86CA3314BBB6EF1108A8ABDEFD4D5C718A1FD63A69AF736808D3DB
SHA-512:	312719ED149D193044396BF9234F069F3F3C01185DC2139DB9C6FD0B1820C373576F7FEE94148701F9A1B20B5CD3788AC3FE4E45B07815EEDFCD14605EFCBA08
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Credit Card Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9300
Entropy (8bit):	6.813928011985626
Encrypted:	false
SSDEEP:	192:wc8mV7hC9d3Cb3UorVFraFUlbVvevUqzI41y/LxI:wc3Zc73G3HAUlM9zI2cxI
MD5:	2ACEB40AEC0AEEBA1C0AEAC2029D846F
SHA1:	F64308248680B91371053134B6A1BD5A745D45EB
SHA-256:	5CEB84B7E74F7C17B43B9605E6BCC9A54C43213E9DD01D930521CC05933C98B2
SHA-512:	22150751FF4B387F0CB7BA401220260E4C6C97E7881661F9F52273311B92A06957591DA87FE09EED06D2F08008EA3CB17C86485CBB9A1396633DBC470EF3EC63
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Credit Card Statement.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10042
Entropy (8bit):	6.860852476669272
Encrypted:	false
SSDEEP:	192:K93SOA1Lwcb3UxpkiaFUlbVvevUqzDVN+Wvy/MzX0:K93y1UE3NzUlM9zDL+sfj0
MD5:	D5C2BB7A2A6AAFA67A5CEC0851F1279C
SHA1:	4ED0A99525B8617B34A34F3E8CE3963248E9188A
SHA-256:	FBA508F6B2733B9D9CF2DE93A09B0E6EA7F75AF08AE11A323E4F17E662FC5371
SHA-512:	81C8DE579826ACED62EF053ABE18083E7720FC9B9ADEF61A6F6B463257CD18BD99920AF78EEABF228756D30E4ABA176911D9063446082E177EA396AC15F9D771
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\CreditMemo.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9271
Entropy (8bit):	6.811643027566105
Encrypted:	false
SSDEEP:	192:wc8mVf2U35b3UAZTaFUlbVvevUqzmpPhEYoxR9ss9:wc3Z2ER3jZAUlM9zE5m9H9
MD5:	CCFE8245FF49E0FE0D036E51BF7D3F63
SHA1:	55CE309D4FEC86D442EB345CF0B81FCD149EEBA3
SHA-256:	9A43623D564057B84AB29AFBA4288EEC96CE2FA18106DA572C67CC0844F11AEC
SHA-512:	5C4391D145FDAA8B568B0E6F06C3B5D385E6EF351C7ABE83422CA5549FC1B86A9396445EE919D0EC0DEA5BDFF8ACEAA5CDF17AB41BE4899AA0741BC67A1E0333
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Customer Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9105
Entropy (8bit):	6.781014209396833
Encrypted:	false
SSDEEP:	192:wc8mVvURb3Umzlp+aFUlbVvevUqzQ/3S7O/xLUy:wc3Y39lVUlM9zQ/S7O/xUy
MD5:	1B0657CB32BEBB1FD5DD1C2FB1B749C3
SHA1:	7BAEAA0FB0885C0F004CDE7443E8183D828DFE28
SHA-256:	37D8820AE95851BC491E32275B57B2D8BE84DBBA016A4358C5D7F50C377B0B9B
SHA-512:	5CDE34D9A602E4F9942250A434844DFAF95E9C7C6C9E23C3AC3780837A0F7A770C765B13856271C75431465F07999051B794AEE56A9737CA219779F8FD3702FB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Customer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	6.865386475865739
Encrypted:	false
SSDEEP:	192:wc8mVt+6DKPv9+b3UiKpaFUlbVvevUqzZJtVMNSX5I41663:wc3Piv83zfUlM9zZJtTX571663
MD5:	08057568E24A84432911C7480B9BA2F8
SHA1:	D35A457F40D2116417108295718214C67DBFC56C
SHA-256:	653929EB88C5F7526D51CE15C5E95D0005EB071509E5185CDB4A04C7E31D6C3B
SHA-512:	1BA361B34327CC831B5F4F1F2FC6429E81C8F28A1B158790D4798027BC9EF19F69CBBA48B2C4F043C1E92AD970FCBB3EDAFD2ACE9F68D344EE680817848CEE78
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Deposit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9174
Entropy (8bit):	6.7924481974634565
Encrypted:	false
SSDEEP:	192:wc8mVi3b3UMTFaFUlbVvevUqzQ/3SFsw5:wc3UL3B2UlM9zQ/SCw5
MD5:	6A72B5C256385E38490AB05902A2A3B0
SHA1:	EE772D71C3596FBDDAD106051A5D101B794F55B2
SHA-256:	DDB241E0E9064DA7443D8876B27A9A69D06CA6669D4FA5E281EA1A9C5CD56684
SHA-512:	546B143348EB1A45D9A620C663F96DF90C0056DE2593ED7C7909B3913DBE0BDCF05FD549ABCB1DDC1D9AF7A65A46880F17A0A03A6FC0C26392514F9AB9878F60
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Employee.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10662
Entropy (8bit):	6.978039342816095
Encrypted:	false
SSDEEP:	192:wc8mV76EzJb3Uz2Q/m6aFUlbVvevUqzjBYSHjYVQWmHgrxG:wc3sE93WyUlM9zrjYVoArxG
MD5:	B14A9C7D27DD7712A0B8788A45B7BDD1
SHA1:	17C3203A89ADE5D0D6A2666F2F96355002A5D158
SHA-256:	3C0B72549EA06721309266918917A8827703CB25FB0E9B13998BE25ACE9BD820
SHA-512:	E502E0B643CF69DF67D27FC7735B17FF5FC089AF5BB1A5321DD654604FF121929C234919564AE4ABBA9656C62367534DFFE3607DFA3A13427584BE290C9C8668
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Estimate.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10179
Entropy (8bit):	6.878884512140004
Encrypted:	false
SSDEEP:	192:K+v3LU/Mrb3UHL8aFUlbVvevUqzMWHn9SyWv+xLVS:K+v3L+Mn3YLxUlM9zMWH9SyWv+xQ
MD5:	111DC57DAE120885E74B1A2E22FC42CF
SHA1:	916CF01E9CAD15CF072F0121B3B75571C4FAC98A
SHA-256:	01E72D36A12BB15310D91DBBBA126A8BF292E24DF5511907752A4BEA27CEE4F3
SHA-512:	92A28A0D08DC161B35C3A6C19BC3B141CDAB69380A089517AF4B1F251FA193B53A0AD9E0140C07ECA414CCFB2C8B8B85AE197BBE93075FFD173C91DA2C2886DF
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Inventory Adustment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9205
Entropy (8bit):	6.800891004632689
Encrypted:	false
SSDEEP:	192:wc8mViLvVab3U5Knw7m0YaFUlbVvevUqzQ/3Sjmvun1:wc3sE35w62UlM9zQ/S91
MD5:	989A01BD9C8C7239F25814AAC66E462D
SHA1:	54E62D002F5DABAAA38849F40323DC7A3876491B
SHA-256:	2C1DAA59560CB8248D9D8DD4F1B526AFDAD8F0B7F044F78D7091B1DDB42E5779
SHA-512:	B5981FAB999D5C67D11EB1CD1098530E18C0181D982F00CC01303E0B11D53EE4207F2A0E1BBE4491775355E35D57F99C7A035ABCFB65F5A9C732178CDC3D6CDC
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Invoice.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10311
Entropy (8bit):	6.902523632816974
Encrypted:	false
SSDEEP:	192:KlQnZsb3UFdNmiaFUlbVvevUqz0zP7+WX6Y9+:KYZ03CeUlM9zE7+M19+
MD5:	E0E05A34B4EED3129E3DFFC054D1F070
SHA1:	1593B64E4185A1FEBF3FD6CD5DD3152ECB260B76
SHA-256:	E163E2DEBB21D40EFFF3196F1427923CBD8DEBC92D4A10B6E645D27B92D5E68F
SHA-512:	798AC0AAD0A4571E58606FA476F28D596D5B753365C00807BD09578985C647F2E2B53108483982D5B66386A707B5FE6423C12F2B7C75BC8A35E71391E2B8B619
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Item Discount.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	6.910242705829882
Encrypted:	false
SSDEEP:	192:DK7Y3k6b3U+FBN4BaFUlbVvevUqz2RIMpQc6Omow7:DKk3J3vV4aUlM9z2OMpQ7f
MD5:	32B22473DEFDD10651778BFE40BA7F38
SHA1:	2238007231F2DCF3AE7765F62872936DE662508D
SHA-256:	DB5C17DCCB68E77BE29FD9F237918BB72661D88D76629889663B7935F492DC8F
SHA-512:	CA1E16A6816031BB980DAA92CD252494B726E3875151E386AE747CA56B6C524AD1EB0BA543FC729B7E8781E3A3702349C4E0502E624B01446BA93279260A0057
Malicious:	false
Preview:	PK..........!...1.z...p.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>..&j...}.=..!T.FU...x...dF....5x....0......2..}...g.`.F.......M..w....&.m0ge..s.%h..u`h..^.@.~...K...8.<qiM....h..h..X.!y.....5..u..r&..+).9.k..(.Qf...r.@6.o%.i..-.J..r..\|F.S/6T.........'..W.....Ch:'..\|c....evY...g..y..K...,....9...?.#..g#...p..@..<>o..e:..v5`.e..].RxP_.SG.n.v..iu......u/...y.&.../.8......P.i.....H...[.f~)P-l...........PK..........!..U0#....L......._rels/.rels ...(.......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Item Fixed Asset.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10342
Entropy (8bit):	6.908061401318368
Encrypted:	false
SSDEEP:	192:Krsb3UFi7jscVaFUlbVvevUqzQ/3SjeFFtQTeKfz:Kr03iinsTUlM9zQ/SjevNKfz
MD5:	274DC88AA87B2FFB6A900B9569F25AC3
SHA1:	356AF0CBB48026F0989F71E6A443601FE4106E72
SHA-256:	A0821C5ADAC4CA9B0F95B470B9DA09F22695B0C1B645C437C6729DC919C2FC58
SHA-512:	493A40314200F831EB11E010C15AA2470373D02E17918D79208E341EA568EDF0E244A10EE2DBD991A2F679E9B68A7BA260FEF28C43447BD01BACAD9DE2A671AE
Malicious:	false
Preview:	PK..........!.A7..n...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.n.0..W.?D.V.........[$...x.X$...(.}'fQU...%Ql.[&.<...&YB@.l..YO$`....r.=.H.E...V....5........L..b.j"."%.5..3...N.B..?C%.*.....=..Y.K)u.b8x.R-.J.W..Q23V$..s.U....)..P....I.....].h.:C.@i...m2..3....1.. g../#..2...x\|`.G....u_.;...U.O.w.j...s..4...-.Ze.N...x.e\|.o,...... .1..y...s..i.......s......V7........88.....wa...:......Crh..........A..............PK..........!..U0#....L......._rels/.rels ...(...................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Item Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8939
Entropy (8bit):	6.751801640397702
Encrypted:	false
SSDEEP:	192:wc8mVhHmW+yM41b3US32wraFUlbVvevUqzxk1xQMH5nsOoEJn:wc3+t8l3X32w4UlM9zTMZsOo2n
MD5:	5F268BD22DF45BA9C0D41CDBAC0F10AC
SHA1:	AC4C7E080F58E4F4B22EA6C1217C54009F6D90FC
SHA-256:	A3710B7AC9F8FBF6A2D59477A7CE708E52215C1DBCC5A1164FDB19799D7A4BCF
SHA-512:	7E77DFA1D17378EFC7514EB152C0CFE4B06A7CCA1732E63617E84B67A69BD75503F5AE49F75199D75CC42278EAC07992FC960D76DE46C41F1216D9162C786749
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Item Inventory Assembly.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9301
Entropy (8bit):	6.8182471050909585
Encrypted:	false
SSDEEP:	192:wc8mVxj7v8b3UXMZZDoaFUlbVvevUqzxk1xJOF1wA:wc3H3k36MvDlUlM9zlaA
MD5:	220029E3F585B178E6FD911D95CC8161
SHA1:	B6F0373EC85C3C59ED954D198E0DAE49905B8B98
SHA-256:	95D82427661DCD43BE1139A010524E2572CDD65005CD3BA3BC30E71E891761E5
SHA-512:	DA67C32A8F12CA26C2DFD8E03FB77743A980E61D9FD7B82CD4B1C9032A9A85F463496B65A14AD96DBCB47B2107E963BA450354EEDA938A74A84DB70F55BE0A62
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Item Payment.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8904
Entropy (8bit):	6.741967696983345
Encrypted:	false
SSDEEP:	192:wc8mV6aK2bb3UZ5lE0aFUlbVvevUqzxk1xh0PC:wc3Uc33EoUlM9zLPC
MD5:	511021BBC919910B7BFE88EDD692FE9F
SHA1:	A3F5F0276F944D2F110C4B5B67B1E5379649DC13
SHA-256:	CF048FB4F41EAFFA959CB6CFA378981D84C5BB0998B49686303573DCAFBA591E
SHA-512:	CB27226285CFC60CCC5C0ED9323D3E154F9D3A214AC5D08CED4215622098CEE30C3A12D46E370DF30F361AAD752DC973BB4EAD0A1466F04A6A69B2514EAB4768
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Item Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9159
Entropy (8bit):	6.790575326802142
Encrypted:	false
SSDEEP:	192:wc8mVd0llCnb3UOFn4u6aFUlbVvevUqzMWHn9SmngBPI:wc3f0f23P54aUlM9zMWH9SnA
MD5:	F988A3154CFC4A0A24B40D4DADD6B165
SHA1:	1FA4289E808748C3A65A4CB7A5F4FA93D6F76163
SHA-256:	9388FBEBDA3CAC8B4B44C4AD4B90376F3A678BEB8182C5EBB5EB2E6713A89909
SHA-512:	458E108052968AFA9C4944133D6DEF95D82773BD39EE0F75923F71828822E12EAE89811B0063E945B281ED8A6F0683ED3D2E56CBE5E8210335948BA76CC26334
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Item.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9293
Entropy (8bit):	6.8141719578289255
Encrypted:	false
SSDEEP:	192:wc8mVDC9NMb3UkNFC+/SNMaFUlbVvevUqzxk1x2D+HtD7CP:wc3FC9S3fB/0BUlM9zrmD7m
MD5:	2FC32E74CF43FD1CC9F15B4D6FAD6F23
SHA1:	5B6018F0660F03A0AEC7CD79CDF06B5724AEEC87
SHA-256:	31D1F2BCDF03328C577F42F412557018C75A44F113AFAA230B1B8D43E3DD2AD5
SHA-512:	73FF985EF939D89A1CECE9A582744B92C400B1742CEF5440846AD88881CF36D0A2E7B619BF85A34EC04126EEE1A08A2FBF0FC0E493432A09D746DD5C3CD6B81F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Journal Entry.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9093
Entropy (8bit):	6.77631031314201
Encrypted:	false
SSDEEP:	192:wc8mVcKEXb3UB7n2tyaFUlbVvevUqz32fNPR7b8fU:wc3a33GnWDUlM9z36NJcs
MD5:	43FD14A8C807C600DA56C934B028AC62
SHA1:	104B533622E0706C09C3E8DC54710B1F82D2A21C
SHA-256:	91D6391C2DD44B951DDFD136AA7ACEC0EFB298796C19557EF1E7AD587D312C19
SHA-512:	0004BAD639F2A45E4AF3EF08DB8D635829AEE60072C80E5CB12E037AA5529BE2D3FA10541C907DA40D032808DA45E1A58808578E4C0D4BC77AB5819FBE339089
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Other Name.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9977
Entropy (8bit):	6.881824897442895
Encrypted:	false
SSDEEP:	192:wc8mVgF6skEmb3U8rpU4yaFUlbVvevUqzvMJbjBWNkMfBR7VoK2ej:wc3C6sE3du4DUlM9z4UNFHhoKfj
MD5:	350480A984ACB80CF21F542D4CDE9823
SHA1:	00091FA7BED5E8BC6D4D32AC9F5BCB6FA06B07F6
SHA-256:	311A12234259B32BACD59FA164CE5BE2023786DE3BDBDE1FF1DBD6F31ACB11F8
SHA-512:	1C54C073A5D4212699BA136A1D9B91A8E725BE6E8541F23823FCDBC7805A197791D3FD839AC8FA58C077C1B877F1F3ABF528D25EE04DFA31DAA03508994F7D9F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Price Level.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9142
Entropy (8bit):	6.782431923212374
Encrypted:	false
SSDEEP:	192:wc8mViNEB6Qb3Uyim/9fetaFUlbVvevUqzxk1xKhnJ1q8f6VY:wc3jBF345+UlM9z3d7SVY
MD5:	2506630D2BEEA9C1868E7741DEE13D2B
SHA1:	0C2FFE451D4C10AA5A08B415CA8E88D03B03C55F
SHA-256:	6A667EB4303F007954E8E51A2D8D06729C4D18982EBDC53DB81D571D2A99A887
SHA-512:	90C7E14D51657AC8385DC023F4101398E7F6392ECEB0D76A058ED1D2E809C50BF057B0F09BA7986EC19F6391B5C507405EE3F4B5F0B3B4FE33B10C825955E50F
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Purchase Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9250
Entropy (8bit):	6.808163260128793
Encrypted:	false
SSDEEP:	192:wc8mV0+NRb3UbKsIQaFUlbVvevUqzYDxX++fqa2:wc3FNp35UlM9zYD3ya2
MD5:	7A3007D4C7D6A735AADAD4272E05BA64
SHA1:	1571CBD2207B346AD1E3540CF31C6B27094988FA
SHA-256:	D1418C308F1D895E88BC9F7293E72D03D05AF01368E37E9E3032BD7A14F0C17B
SHA-512:	5F8F33A6292A6C03E45D4BBB38BD60DCB9AF32E9C23705F78AD2070074AF6344CD64404BFD97E215DAA247284B5A67DE2C5B3E0793C68BEF17E83B2BEBC34099
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Sales Order.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9262
Entropy (8bit):	6.806043299070465
Encrypted:	false
SSDEEP:	192:wc8mVXZb3Uw86AAkaFUlbVvevUqzYDxcgSQfXBa:wc3Bx3xRAuUlM9zYDTLfBa
MD5:	DFABD8959A1CF9284CBC958557A6BC11
SHA1:	D2701208198885731EF8FE25D9D2BADD6C422E23
SHA-256:	FF80F6BFD07318A31225C0BFBBBE9D92A40A2F9A474FF228105EAE2C302DB1F9
SHA-512:	572744C2AA9FFE5DB9935D60B668D3DF917569A4B78EE1C3269E3426297F926DEB53F30AE508688094438F393D8A216B9D701E347D9B9897F58217F3F79D73C6
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Sales Receipt.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9212
Entropy (8bit):	6.79823789885158
Encrypted:	false
SSDEEP:	192:wc8mVeuWugPb3Ulhj1OhaFUlbVvevUqzMWHn9SBpRKhOIEIS:wc3EFx3ghO6UlM9zMWH9SPRKhOhf
MD5:	17357BDF06F4DB40706B6FE701830D4D
SHA1:	80105281255CB887BBD56DD1CAB9BACC9CB0F8F4
SHA-256:	2080703D1094096953772CEAC224A8C5CBA1470E8CA0B214AEF0910C61E59B32
SHA-512:	9AE1A8085F92F1BCB444239AB6FF9B1EACFE60197F6054C15FAEB2015D0B84D73CA5D3DA266F91BB3D3EFF7F146C0A20C3AC982E6187B4804B5700EFDB465717
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Sales Tax Group.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8903
Entropy (8bit):	6.746206691996274
Encrypted:	false
SSDEEP:	192:wc8mVVRZC3+b3U/1xMaFUlbVvevUqzxk1xccOasbB2:wc3nR43q3s/UlM9z/hN2
MD5:	F4E307557F1304745D2221BE28BDAC8F
SHA1:	E37F9CA0B0DC157C2ED14021536594A834543E84
SHA-256:	87177848091C9392F8681B54CE82FD8897ED1A50A03CAB6FB493C13422E1A62E
SHA-512:	9677FECC6EF16172BEDDD661342F7A62ACFD8D67BF7783878CCF0BC3772AF3B418811C9F6EFE0ECFE95172273FEFA99579C66BAAB3595AACA71960A7EF795874
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Sales Tax.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8905
Entropy (8bit):	6.745897938150198
Encrypted:	false
SSDEEP:	192:wc8mVCg6xRcb3UQn0XaFUlbVvevUqzxk1xpGpb:wc3Q5DE3znhUlM9zgqb
MD5:	EB8F39AB8EE40E48CDD5191AAE8ED020
SHA1:	23EB3219094EC7DB1607EF900B7C4E6D53153680
SHA-256:	E67EAC32A26A25FD2EA2FE4601F4D42CEB5031494A47A383BC272071F5C3005A
SHA-512:	D8B3CF08CAA5AC3E92BAFDEEBD04B604A6AEB9E56A7062427A8A404B93C39B4C2AED107EC650A89CC27F9ACCAC75BF767FC622EB08925EC37BC20C6C88484324
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Statement Charges.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9102
Entropy (8bit):	6.7850184234097215
Encrypted:	false
SSDEEP:	192:wc8mV5UtZ2Ub3UxPseGxvTaFUlbVvevUqzQ/3SIJ5i:wc3f2M83ctc4UlM9zQ/SY5i
MD5:	DAF53A1E6A82439CBAB24CBC7356365D
SHA1:	A84BC61A1CD6ADDF6FC3E146CBB51173E24D5BAE
SHA-256:	2110753916F77DDFC14B1379F0BB2B010E8AC828EDDEB3AB111B0E9A44F5B9AD
SHA-512:	39999E226CB4FD2E9CE0E1AEAEA8D6AEB7CCC735DFFA26F25F0F152EB0FF37C702B890FAD7F06FBF7F1668D949CB34EB77447789A009EE05CD1636113A1BA0F9
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Time Tracking.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9034
Entropy (8bit):	6.769753878312157
Encrypted:	false
SSDEEP:	192:wc8mV/cGYDrWb3U1oEipaFUlbVvevUqzoDmh1veK5noy5R:wc3hcGWW3SiCUlM9zleQoyv
MD5:	67B314265F3E444E28B6AE3B8215BEF6
SHA1:	844568E31FDA53C40B7A47B9CCA7B07BFA51EE84
SHA-256:	4ECCB5D5F240EC7FA276B8962E8E0F16EB9E4F3DA7E702DD67DDA9724F6A718C
SHA-512:	1EC806B8A9FC894C0AA7B64574983D79FFE6793B7379BE220B0155C51E2BB63CF8EC41AC9EC6FD89DC1536C30A02BE326CDEDF397379685F25BD34253A88B1AB
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Transfer Inventory.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9081
Entropy (8bit):	6.779563405224094
Encrypted:	false
SSDEEP:	192:wc8mVTYJBJb3UmiaIdaFUlbVvevUqzQ/3SuyylhS8:wc3O13HdUlM9zQ/Suyylhv
MD5:	C2DB2CBD357B3AF84F47456F4210E3AF
SHA1:	595E4FF7467CDF793C70BF82C02BAD5C840A4E6B
SHA-256:	C18ED83E70DF157700C1A608E612325FC79622F7A3728B045C9CA5BFF6BB0ACC
SHA-512:	116C655938D358B5B5A644C7975F38BB2355AEEE6AF3056F94331BA88C575F4501334D2B60EEE036F14DF3C4D04267F41119A518522A378EC9209100D3461663
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Transfer.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8933
Entropy (8bit):	6.7475711333237465
Encrypted:	false
SSDEEP:	192:wc8mV4yybeeuUb3Ufkx3R3NaFUlbVvevUqzoDmh64:wc3+eeu83HMUlM9zm4
MD5:	FEE9D3BDED7551DAE9FFD5A560BEB49B
SHA1:	F3D16C4AE99AE1A5EFE9956A7E763072E3C8049A
SHA-256:	E61C23FE64FE8A7A2FF9AF1C9C930444F499F2000154DDED356ADE81685E2BC6
SHA-512:	3004A79F8242260FBAFE0051928906C0CC7061E735852485A975672E9E9C1590B5B02B76017C5BAEF04B060F34196867DBB3493474CF637F22A3B8D3260974D2
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Trial Balance.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	6.608229772525394
Encrypted:	false
SSDEEP:	192:wc8mVAPAwb3U9FwuOWSTKeZNoZjs9xI7VS:wc32PAw3buOW2ZSjbZS
MD5:	E23449A3E6D8B91ECF939E2154130C26
SHA1:	28AFD5F5B50A3E6EBC9BD681B4CA17B19EFE34EB
SHA-256:	FCCD05F35D01EBA7E0566ECA777151416CEAB636914EAFF2B1C6B63F85796D7E
SHA-512:	C068AE0603E7F16E7D65A2CE5BDB6C17322CD7095BBA3F232ED9E5A7235B278374D53ECCA6DCF9F46A334EC2F1612512BEAA7C6D59A80852496B3985B7EBB54D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Vehicle Milege.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9069
Entropy (8bit):	6.775976988880308
Encrypted:	false
SSDEEP:	192:wc8mVSgx68b3Un4T92bqi/aFUlbVvevUqzQ/3SzYPi8q:wc3Ugx6k3vTfUlM9zQ/S868q
MD5:	46CBF18F2A34DEC0D2A552F7D29B172D
SHA1:	E2277962AD39FA3E2258C48CB0260DE3AAEF3311
SHA-256:	B942929F61942CC36C5D1BACA8D432E9798A639BAB630FEB10501ED31F18CD02
SHA-512:	594BA58DA7F2E97344CBC2132BE6845EEAD70F966EC9D3A83448C0DF8200ED62919FAA2E8FA424A6285A2D478EC03D8B8A096DDE81E9F19E3EAAC1C21B9959AE
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Vendor Credit.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	6.79917826988387
Encrypted:	false
SSDEEP:	192:wc8mV2s/ypEb3UauTu/b7yaFUlbVvevUqzMWHn9SL0ciT:wc3s6F3huTyb7DUlM9zMWH9SLbiT
MD5:	A2537669E02FD8E38CEE1FB144B2B5D5
SHA1:	841E29BA7C6B41BA94E4BFCF913290F356DAB431
SHA-256:	6D8C3D2EC8BE937FFB7EF0EEF5AF207893C15CA41147BCE2EBC9ADF9447C8CDE
SHA-512:	D2844FB50CF9B639113325F9AADF118B1E688D50E28D8EB37DBD96B215F57845B88E9B91BD0622D3E9B36C8EA5377BDD3F12F71587605605A1CEB601A8934E9E
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B62AF75C\D96A3CE1\Vendor.xlsx

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	10550
Entropy (8bit):	6.970001374614585
Encrypted:	false
SSDEEP:	192:wc8mVQzfnb3UbkxdBxTi7KaFUlbVvevUqz0aO5GDSvY4OiW:wc3SzD3jovUlM9zjTgY4OiW
MD5:	41F22C302B54096D0FF445534616A9BF
SHA1:	7256BD503A3906AE16B0990DD5CDA48FF52EDF1A
SHA-256:	F6B059ADBF7F18CA8795E1C8CC730BF6D11A228871EF20D4DF1DADB90787BB72
SHA-512:	CAF25BD0FD91B665633BF87808A31EEB6406A501A62936A1B9041D008AF7D7F7E15A534FED9C5708768E3F595F1727C7AC5A99605CF0B3544BA1A7E228DFCD2D
Malicious:	false
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\B788C7C3\F3574DDF\ExcelDataReader.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141312
Entropy (8bit):	6.0071023665423615
Encrypted:	false
SSDEEP:	3072:876KBUlsTcVxZz1cvk056vRy+8CkZukXiLin78Shl2l:aBHgcvZ6vF8CkIkXiWn7ni
MD5:	EB58E362D86798A547D05CFF1501B112
SHA1:	F34944D80168FA40F2B6D9F536CFE28DC1F8B433
SHA-256:	319CB6C476BD3E3DFE19089B9B0A66450AB2BA2365A975E08D9EE7463DB74011
SHA-512:	A1EE7826540D16CC12CF733FAAC658AFEA9F1D47D60A8594D094B8F25001D785E4172EDAA8F51584169FCC107EC698233D997C3ECB7428A2B48463940C88D41E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5............." ..0..............;... ...@....... ...............................)....@.................................J;..O....@..<....................`.......:..8............................................ ............... ..H............text........ ...................... ..`.rsrc...<....@....... ..............@..@.reloc.......`.......&..............@..B................~;......H.......h...._..................$:.........................................(#......($...o?....($...o=...sb...(%....(&.....('....((...oc...%-.&+.().....(%.....(....-.sA......sA...%.o=...o>...%.o?...o@...}+.....0............(,......(.........................0..C........{-...%-.&.o.....................-.q.............-.&.......o......0..C........{-...%-.&.o.....................-.q.............-.&.......o......0..C........{-...%-.&.o.....................-.q...........

C:\ProgramData\miaB83E.tmp\data\OFFLINE\BE04B6CA\F3574DDF\System.Net.Http.Extensions.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22232
Entropy (8bit):	6.834492317681642
Encrypted:	false
SSDEEP:	384:qFTI1WE5mrOhEZ0GftpBjy+ILKHRN7Fg2eSlVE32x:TtcbKiUmFg2ewEmx
MD5:	7F86A47ACD4D810AD673AF81369F2F26
SHA1:	CEA8DA1478F2DEE41ED2ECD2059B73D1C161734E
SHA-256:	9C8B87E9A950DEB7F28752F875EA82F1B55A70996AC8C12073FCEA33664B2048
SHA-512:	372A61489665BD37C552C383FAFF971FDB2D581D45664A37E5D58DBD894B26B5CC8403800A559F489BB4FA47F088E6E06553ECA65EFB16AB9867E5A80A0A7AA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..T...........!................^,... ...@....... ..............................R.....`..................................,..W....@..0................>...`...................................................... ............... ..H............text...d.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B................@,......H........ ......................P .........................................d..h..(.zr...\|,.._A....M.....uX^.h........O.y.r..6..l.q..z.x;....#...u...f...R\(...C....%{.B..._v.M.......D..%..&.t@............(....*.BSJB............v4.0.30319......l.......#~..T.......#Strings....8.......#US.@.......#GUID...P.......#Blob...........G.........%3..................................................................E...a.G...z.o.....o.....o.....o.....o.....o...!.o...>.o...].o.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\C86575FB\F3574DDF\Renci.SshNet.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	804352
Entropy (8bit):	6.347648878213304
Encrypted:	false
SSDEEP:	12288:f5lqga6rBEEKAeWgVmfedIASjLrj3xVvPTrPTrQ2irclmKJMElmMSSMs:TaPEKRGzGc5Dk1f
MD5:	100F3487B7D64026DF5B68138535B734
SHA1:	A7974031C9C6E46897DDF017824949320E251D82
SHA-256:	F6A4BE2A762FFD5A1F8D47C0DEB34C3015D479BD409D01CC96F1D2D0BE55CAA2
SHA-512:	93665D418D08F16F744F37741D50168225CD2B8D3B0DC00CD6C87438A7AA784A04C417084C3D17D833F4A2450718AEB964C4B2D4F5597DAA084F725D8683D207
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..<...........I... ...`....... ..............................[.....@.................................VI..O....`..D...........................xH..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc...D....`.......>..............@..@.reloc...............D..............@..B.................I......H.......,....h...................G........................................{#.....{$...V.(%.....}#.....}$......0..A........u;.......4.,/(&....{#....{#...o'...,.((....{$....{$...o)...... G].$ )UU.Z(&....{#...o...X )UU.Z((....{$...o+...X...0..b........r...p......%..{#......%q>....>...-.&.+...>...o,....%..{$......%q?....?...-.&.+...?...o,....(-.....{......{/...V.(%.....}......}/....0..A........u@.......4.,/(&....{.....{....o'...,.((....{/....{/...o).....*. .p. )UU.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\C8694C4A\F3574DDF\Telerik.Windows.Zip.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	144896
Entropy (8bit):	5.94496716734926
Encrypted:	false
SSDEEP:	3072:KepFJwciefcZ4vNgdZb99nFzRePuy7C0CZfx3dWX5f28u4ESC:KoJwciekuNgdtng4WX5f283
MD5:	81E0DDAFD478911087129E7C60039B63
SHA1:	06ED10D73E27152BEDD26F757C07C2862A73BE0F
SHA-256:	9FBFB4A9084BC3F483DE06E8C792BB6A60F36B229E1687F04A36DF255020F786
SHA-512:	1C6E8B0D77F242234BECA1E1B1392D86E6A6724E9FDE978D76FC39372EE0D6699420EB0FFD80B10DE253B765E2691C1BC9DB7572C15D06B1019A0252552EC1DC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._.([...........!.....,...........K... ...`....... ..............................bI....@..................................J..S....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H.......t......................P .......................................K!_..{....a....z...i..Y.Ncj.X].Bw."....(A..DD.@...Q..MyX.z.k.}..J...+$F........n.....>....L.g...u./.....Ui...!.a8....{3.K..{......{...."..}....:..o.....(......6.(.....o..........(<....(....,...,...o....],.r...pr...ps....zb.......(..........(<...J.s....}.....(....*.0...............-.....,v.....(<.... ...._....d ...._.+J.. ....2. ....+.......Y....+....%.X... ...._X...X...X...2.. ....^.. ....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\C9CFA174\F3574DDF\System.Net.Http.Primitives.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21712
Entropy (8bit):	6.86182676889553
Encrypted:	false
SSDEEP:	384:4AkPMgIWkeo530GftpBjex0+ILKHRN70SlVE3y:4PMgeeriu0m0wEC
MD5:	018841345CFBF45EDA4CD1ADB74FD68B
SHA1:	F9928EF8B78F7CF2D3EB3EC68D28F36C89FFF3DA
SHA-256:	ACF0E0555AFED095CF12F719A3CD0E745435CED2575840A46A40EC61ED632265
SHA-512:	7DD159DC1D64E49A9106C2F04A46643C9AAFB83FC017D4F98F63B63D6317FC4AB370FAFB63BB512BFB6B4EC7EF2B2E6B362BB7F035A23DD1046D6DC2499EA5FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..T...........!.................... ...@....... ...................................`....................................W....@..0................>...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H........ ..t...................P .......................................K...S..........._.!."...F....Bs.`....e..-..P.N=..h.9U.icni..g{..E....v..7.Js$...y..;w..pFv..A...9.._.4..;..=~zo......XZ..7..(....*BSJB............v4.0.30319......l...L...#~......8...#Strings............#US.........#GUID.......l...#Blob...........G.........%3........................................................e.^...........C.....C.....C.....C...).C...B.C...Y.C...v.C.....C.....C.....C.............

C:\ProgramData\miaB83E.tmp\data\OFFLINE\CB29EF87\F3574DDF\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	5.683688089372797
Encrypted:	false
SSDEEP:	3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
MD5:	C8164876B6F66616D68387443621510C
SHA1:	7A9DF9C25D49690B6A3C451607D311A866B131F4
SHA-256:	40B3D590F95191F3E33E5D00E534FA40F823D9B1BB2A9AFE05F139C4E0A3AF8D
SHA-512:	44A6ACCC70C312A16D0E533D3287E380997C5E5D610DBEAA14B2DBB5567F2C41253B895C9817ECD96C85D286795BBE6AB35FD2352FDDD9D191669A2FB0774BC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.K...........!......... ......^.... ........@.. .......................@............@.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\CC802F8F\F3574DDF\DotNetZip.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	456704
Entropy (8bit):	6.8144585735393015
Encrypted:	false
SSDEEP:	6144:gsYYIOQaKp/NFN0if3Rd99UW0zW+Lc3P9QPQyHjGtSV41OJDsTDD50Yhe6dwxLVX:geYa2Xz3mPKS4msB0ie6CfP
MD5:	2AC40DA17C4AC9DF4A8701FAF3913A52
SHA1:	F5518FD34D920546BAFA8D648AA8FEECA3179B93
SHA-256:	46BF5F182875F53994B6BEE810570F85B2B39643C27EBBEE77CE554B1E3B6ED4
SHA-512:	80025E7F79839138B7365071265BCC6D791A3FAC48CECD7D170BE79A46016C3FCEF928676E666F6798A18C534310E5E27BF7F2896214DC615F0913F5F2798F3F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....kW.........." ..0.................. ... ....... .......................`......v.....@.................................x...O.... .......................@......@................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........H.............../............................................{...."..}.......(......0..F.......s....%r...po.....{.........(<...o....r...po.....\|....( ...o....&o!......0...........s"......o#...(.....0.............{......E............,.......8...D...+Q..{..........+M..{.......+A..{..........+2..{.......+&..{.......+...{..........+.r...ps$...z.6..od...(......(....*....0..a.......s....%.\|..........o!...o....r...po.....{.........(<...o....r...po.....\|....r#..p

C:\ProgramData\miaB83E.tmp\data\OFFLINE\D0DC5192\F3574DDF\Microsoft.Windows.Shell.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	167808
Entropy (8bit):	6.195069659774702
Encrypted:	false
SSDEEP:	3072:J/c9acTJ2IYK8/UVry6m6ihGAoeA+Ir8qsmkmsm:vcTSKVtcGuAMqoms
MD5:	8C57270AEA8639E85B31749B0CC0A732
SHA1:	4BAE9E7C1B663DE18769C8750FA3693E6FF607C9
SHA-256:	B6E0B3380CD45473F36D3FD822B85591BC2F7D0A1475355DC35E978F412522C4
SHA-512:	F256E33A489D55B72E6DB862F5169D905804416664570CE26849FCABDF7D01DE46E3C0974C20A2DBEC9DE06C87C96BECF8B550AC66E77077EA426C3658CA7C17
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L...........!.....j..........>.... ........... ...............................F....@....................................O.......x............t..............T................................................ ............... ..H............text...Dh... ...j.................. ..`.rsrc...x............l..............@..@.reloc...............r..............@..B................ .......H...........h...................P .............................................?.e..O8+r...}H...u+..(7..[>s...:..X2..Qmx...@.a..qcX.tm.L.........w....y%... ................1.'..Sh..]..XRz..E....(.........0...........{.....+.."..}....2...(...........0...........(.......-..-..-..-..,..,..o.....o......+..+....-..r...ps....z......-(...s....(....(.......s ...(!...(......+$..s"...(....(......s#...(!...(........0...........{.....+.."..}.....0...........{.....+..*"..}.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\D3571AAB\F3574DDF\Telerik.Windows.Themes.Windows7.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2603520
Entropy (8bit):	6.342737082826462
Encrypted:	false
SSDEEP:	24576:n+VH2V2FexRsBybdxp1CtvPudaDJe0GT67MeBQzp:+x2IFeAybd1yPFvGT67b
MD5:	C2041C73D7E4C18FCC3FD298EC8C919C
SHA1:	11592AC1943164ED4F2297A945201C18127FE47F
SHA-256:	C0DBAC1B65E376E15F05B89248BD5685018429FF44672E652E15D9BDCD350FFA
SHA-512:	A990A496C6C67F947949193ED9B4C4FEE648EC1EB682D7B8125C482831977B1C1FBB92B7A792BB779126072FFE7741455FCF281D1DA5BB9CBA4D460C8320BAB0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)[...........!......'...........'.. ....'...... ....................... (......(...@.................................@.'.K.....'.......................(...................................................... ............... ..H............text.....'.. ....'................. ..`.rsrc.........'.......'.............@..@.reloc........(.......'.............@..B................p.'.....H.........'.H............ .. .'.P ......................................<.v)..8.....j./.k.....a. ..w.pJ.I......P{j.\|-&P...b......)0.....W.wW#.lV$u......);....p...%c.m.Y~.6e+o.'[.4...U....."...R..(....*..'............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..t...b...]..z.....46{..N_.e...........#.,.....~^.p...0.n...v./H....w.E.g.C.c..pl.....?nr.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\D5A26372\F3574DDF\Telerik.Windows.Controls.GridView.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1121792
Entropy (8bit):	5.927642961005835
Encrypted:	false
SSDEEP:	24576:b2RDiBmd/Tsym3eklQ6teWPH8g1opoDEug:bAiBqm26tMpo
MD5:	EF51770B099A3689B49D7730CA67937D
SHA1:	699ECE14C2D68D1BEA3349A2956A811FD5E06DED
SHA-256:	A58B15EDEB0B9843CDA9AFF2DA43FC495F88890ADB863F4F65122DB1AC59EC45
SHA-512:	83C391A79EFAF8C9F12832841DB2A33606123B855BD86B125B33877BFE5813087FDCAFC4DD7F0AC3C54010F664A7274FB159FA884BA8B42A347B059E34E9D62A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)[...........!................~2... ...@....... ..............................-$....@.................................$2..W....@.......................`.......0............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`2......H...................... .......P .......................................!.5....CI..?.-.....7]......&A..4......a....Y...K]...p..H..3.O."bW...,..._R.<-....B...l.,...._...S.v...Y..\|..H7^\|... .9^&..oz.....o{...uu...(\|...,...(}....o~....3..~.....s....(....6.~.....(....6.~.....(......{........0..5........{......+.{.......}.......{....o.....r...ps....o....F.{....%-.&.{......0............}.....u......,...(....f.(....,..,..(......o......(......0..)........{.........(

C:\ProgramData\miaB83E.tmp\data\OFFLINE\DA156853\F3574DDF\OFXSharp.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.4109376893062
Encrypted:	false
SSDEEP:	384:xk1dhPuj5yK+sgK+F6JsKFFOosBMR3vBvZshiN0QVyS0KL/o1ZzRSkp0dUP3y:xkBiyK+sgHxoOjMV5xshiN0QVyS0KLik
MD5:	394C8583F38AE35BCBB5C7BA3E851297
SHA1:	4A9F3E7626F8B746844A5A08CFE4389B24599614
SHA-256:	2C85D0CC9D421BD08D04BBB07D45E4CE0F364333C854D7BC888A65C0C5B36725
SHA-512:	6EB815EE65B78FBE517695CDFB2F14001893804DE48731BD5D3D7DDA62298DA750E384FF1B491F2B0694A3A03F0A2B737CD1296A3F25EBF45D1D0607AEA9D0F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..S...........!.....T...........s... ........... ....................................@.................................\|s..O...................................Dr............................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........2..<@..............=.............................................(...."..(....&...(....&...(....Z.....(.....(..........0..Y........o...../.............A...o....(........o....(........o....(........s.......&r...ps?...z............KK.......0..4.......s.......o....s ...o!.....o".....-.r+..p.o#...o$....0.."........s%......o&...(........,..o'......................."..(....j..(....-...(........(....*.0..(.......s$.........(....o.......s.......s ...o!......o.....(

C:\ProgramData\miaB83E.tmp\data\OFFLINE\E832CDA\A31F71D2\Interop.QBXMLRP2Lib.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	5.060583948751635
Encrypted:	false
SSDEEP:	192:+oH17/37VBd/iFtstktk9tktstkBtkVjPcF1hSQCG4x6Itkd8bW/Ou8hkaX0i1+:+ori0Ap2GR38W/Ou8hZu
MD5:	0E02345D512D2F12CC4E952C97738241
SHA1:	7F7A76CFFCB561EE7593F8C9B292FC934C5283A6
SHA-256:	49AC72D20755C8F68B8F98D10C3B4EE2C4DD909A60B1BA3B92E560C21BC7738C
SHA-512:	7B55F7F0EEECDB622D80F254E287BDB35B8A3F5836EF368A98935C76F24156DC294202B3C1695FB73D4BAF03820AC9AA78DCD866798E919D29FEAED42FBF5B75
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R..[...........!.....:..........~X... ...`....@.. ....................................@.................................(X..S....`............................................................................... ............... ..H............text....8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............@..............@..B................`X......H.......P ...7..........................................................BSJB............v4.0.30319......l....!..#~..<"..\|...#Strings.....3......#US..3......#GUID....3......#Blob...........W?........%3....................................................M...M...n.............k.........t.{.................{.......................{.....{.....$...4.$...D.....a.......................!...........-.!.....C.....?.!.....C.....R.!.....U.....e.!.....f.....x.!.....v.......!.%...........!.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\EB13BCBE\F3574DDF\System.IO.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.9270593020053415
Encrypted:	false
SSDEEP:	384:FJm/WFMrOhEZ0GftpBjMT6fMk+ILKHRN7uX6lFgJj:yaYbKi2zkmuXMw
MD5:	D552DE7D39179B914DB7CC2DBDD005C2
SHA1:	044329C6C335224BA05A4E398A5FCB204F13AC36
SHA-256:	24BD076D31DC9D363EB2ADB8B27A7D45D9F975AEEC565132D27901537E31F239
SHA-512:	B82CBD6C4B3D378FBA1793858C556EA1FDAA405905686CE219F192D16041E79AA063145C6D469AA7C15AA945D3EF344618FA0996D6611282A8718DD0DE77D64D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.T...........!.................... ...@....... ..............................%)....`..................................)..W....@...................>...`.......(............................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ......................P ............................................A...0...........k..,V....X....&i.:.l..'...P..h."....J..W_..e..MZ..}j.e....-..%....p.o..o.8.M.....R9.%.sHrQG.j\........(....BSJB............v4.0.30319......l... ...#~..........#Strings....l.......#US.t.......#GUID.......@...#Blob...........G.........%3........................................................T.M.....n.....2.....2.....2.....2.....2...1.2...H.2...e.2.....2.....2.....2.........6.#.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\EDD15B9F\F3574DDF\Telerik.Windows.Controls.ConversationalUI.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	5.889884490451558
Encrypted:	false
SSDEEP:	3072:14rltvOzyhXpyHj2f/Y/YBLZ5M9XYvmvrx/cXzPm:14rnOzy5pyH6wwD5Mnx0Xz
MD5:	FD28473421A09A5F130AEF3ECA75D96A
SHA1:	2695E2266A67E04D5750EEE2CE85B96F880E4562
SHA-256:	D4D301DDE9A3AFBE623F44CFA07D08842852634978C5212400F3CC03735057E5
SHA-512:	D18F67903BCDAA4EE7812FBA4336396FF963E449D683EE99541054EDDD6F62DB91737119FB31766F5B588F2B3C53055A9A119B358ED75716771B53AD8C15EF4F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o.)[...........!................~.... ........... ....................................@.................................,...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................`.......H.......X.......................P .........................................v.I.....C...]V...H."..+.....3&...(......]u..\|......."..k< R.N..n.m./;....8.AJX..G=....<N].....9.k../.S...,."..eQ.+.\|..~.S8"..(....2.(....u-......B.-...(....o....B.-...(....o......(....,..(....oY...(....-..(....oY....o.......0..........(.....@.....(....9....s......r...p.(....oU...-.~ ...+..(....oU...o!...("...o#...&.r...p.(....oW....2...o!...("...o#...&.r...p.(....oQ...-.~ ...+..(....oQ...o!..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\EEE19DB2\F3574DDF\LiteDB.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	355328
Entropy (8bit):	5.97632681013557
Encrypted:	false
SSDEEP:	6144:mtY8gj5LlWwTjrG6VFNEjqpmzYyfQQG5HdE:t9LlTTjTu2pHyoW
MD5:	25B242D00C6C32E1F437EB2064EA2E29
SHA1:	3712BD78C80A237DD804EC77C64498DEFDE12E94
SHA-256:	E72ACDDF47586BC0999D598E3BD125A254BB6F4AE151C076993304F6E31FBBED
SHA-512:	F1CA54008290F67825F4AA0C8F78476D0E4EBB3B7F50C338F51C87A96B0D25457496FE6062AA57E401C444F5AA80DF8E6B97C2E681E699905F3DC39200D235D7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....2..........." ..0..d............... ........... ..............................Q.....@.....................................O...................................,...8............................................ ............... ..H............text....c... ...d.................. ..`.rsrc................f..............@..@.reloc...............j..............@..B.......................H........z...............................................................0..a.........4j(,..........s?...}......{....sF...}......{....sC...}......{....s;...}......{....s9...}.....^.{.....o...+o/...o3...Z..s....%.}....%.}....Z..s....%.}....%.}....R.{....,..{....o@.....(4.....{...."..}......{...."..}......{...."..}......{...."..}......(4.....(......(......(......(.......YE....................+..s.....s6....s#....s(...s1...*....0..)........s......o.....o.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F60707B8\32E16591\importantfields.properties

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2340
Entropy (8bit):	4.7748908634690315
Encrypted:	false
SSDEEP:	24:xkQypVEwVUVEmVNq8wKb4P4qlTyIgZLiu9/suQtQFt83ex32dwSZy5TfuERYY8+Z:QAjb4V9zgFx90FQFt8OxmdbZ8RYErt
MD5:	8C1FC93C9C1893EFFD51D5B89F19578C
SHA1:	47C865380A35D7CDCFF0D8A242703D585490E5F2
SHA-256:	67835258D2F8EAE248BD99AB10DC58E5D6B6614ED69FBAC8BC7AD7811609BDDD
SHA-512:	FE420AC796BBF5E4AB0DF6F06BF5BD833FF0DCD358AA650982E46E0D57D513F3CB8F7FA3053E6F8779C98B86F0D53D150DC3C1251A8D468C39044200AF7CBAA7
Malicious:	false
Preview:	.Invoice=,Customer,Item,InvoiceDate,CustomerMsg,Number,BillingAddressLine1,SalesTaxCode,Amount,ItemSalesTax,..Estimate=,Customer,Item,TxnDate,CustomerMsg,Number,BillAddressLine1,SalesTaxCode,Amount,ItemSalesTax,..CreditMemo=,Customer,Item,TxnDate,CustomerMsg,Number,BillAddressLine1,SalesTaxCode,Amount,ItemSalesTax,..SalesReceipt=,Customer,Item,TxnDate,CustomerMsg,Number,BillAddressLine1,SalesTaxCode,Amount,ItemSalesTax,..Customer=,Name,Parent,CompanyName,FirstName,MiddleName,LastName,BillAddressLine1,ShipAddressLine1,Phone,Email,OpenBalance,Notes,Currency,..Vendor=,Name,CompanyName,FirstName,MiddleName,LastName,VendorAddressLine1,ShipAddressLine1,Phone,Email,BillingRate,VendorTaxIdent,AccountNumber,OpenBalance,Notes,Currency,..Item=,Name,ItemType,Price,SalesDescription,IncomeAccount,ExpenseAccount,AssetAccount,..Charge=,Customer,Item,Amount,ARAccount,..Account=,Name,AccountType,AccountNumber,Description,..ItemFixedAsset=,Name,AssetAccount,PurchaseDesc,PurchaseDate,PurchaseCost,AssetD

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F60707B8\32E16591\mandatoryfields.properties

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	4.754766181385497
Encrypted:	false
SSDEEP:	24:xOG/hqM9GZLXGm/P1QtFaw/N/vwSZyJI1sIS:Bd9GFXGtFaw/NHbZmI1zS
MD5:	B9E415F072A324B08483AC1AD5BC7F28
SHA1:	96CF8AE26ED41A8AFE14EF959F2D8F6B2F4BBCB8
SHA-256:	859221197FD34B69E30EBA0B8BACB30BA346A1BDCDC182943D4DE4B12B6059BC
SHA-512:	D630DC4B7796C0406A29540047B95D61A026B32AD9A1823CDAC4410DD8BD925F0C70D67E91D5B3EB23903C31BBDDD44689FF271D6189F90D5CF92A28B66C78DE
Malicious:	false
Preview:	.Invoice=,Customer,Item,..Estimate=,Customer,Item,..Credit Memo=,Customer,Item,..Sales Receipt=,Customer,Item,..Statement Charge=,Customer,Item,..Payment=,Customer,Amount,..Customer=,Name,..Vendor=,Name,..Employee=,Name,..Item=,Name,..Account=,Name,..Fixed Assets=,Name,..Price Level=,Name,..Class=,Name,..Other Name=,Name,..Group Items=,Name,..Item Payment=,Name,..Item Discount=,Name,..Bank Statement=,TxnDate,Payee,BankAccount,Account,..Credit Card Statement=,TxnDate,Payee,CardAccount,Account,..Inventory Adjustment=,Account,Item,..Bill=,Vendor,..Bill Payment=,Payee,Amount,BillNumber,..Check=,BankAccount,..Credit Card Charge=,CreditCardAccount,..Credit Card Credit=,CreditCardAccount,..Inventory Transfer=,FromInventorySite,ToInventorySite,Item,QuantityTransferred,..Journal Entry=,Account,..Transfer=,TransferFromAccount,TransferToAccount,Amount,..Vendor Credit=,Vendor,APAccount,..Sales Order=,Customer,Item,..Trial Balance=,AccountName,Debit,Credit,..Build Assembly=,ItemInventoryAssembly,

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F60707B8\32E16591\wiki.properties

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	67106
Entropy (8bit):	4.97126068658023
Encrypted:	false
SSDEEP:	1536:K4peyzqO3uf3AYLCrs2wAq5+fgbtHb1K7SSbKPAC1ddFd6I35LhtrOTr0t+O/wkN:BpeyzqO3uf3AYLCrs2wAq5+fgbtHb1Kk
MD5:	68765B68B2077BD6CC2EB8B87B9EA3D5
SHA1:	85699D0DF1EBF9861933404A6D639F070928DCD8
SHA-256:	D4A914CE356DB7518F595ACA8A154C4E3FA388E07869AB582C0A8593C03AFAFB
SHA-512:	AD72138A0969BCD85C40E0239D118654A3F37A18EB1441076688621C06A4E0539C71EBB034A9607E17A7BB1823096FE825087EF6F5C98DE33233B24829E59D70
Malicious:	false
Preview:	.Select_Enum=Select..Invoice_Enum=Invoice..Sales Receipt_Enum=SalesReceipt..Estimate_Enum=Estimate..Sales Order_Enum=SalesOrder..Statement Charge_Enum=Charge..Payment_Enum=ReceivePayment..Credit Memo_Enum=CreditMemo..Bill_Enum=Bill..Deposit_Enum=Deposit..Journal Entry_Enum=JournalEntry..Check_Enum=Check..Credit Card Charge_Enum=CreditCardCharge..Credit Card Credit_Enum=CreditCardCredit..Purchase Order_Enum=PurchaseOrder..Vendor Credit_Enum=VendorCredit..Time Tracking_Enum=TimeTracking..Inventory Adjustment_Enum=InventoryAdjustment..Inventory Transfer_Enum=TransferInventory..Item Receipt_Enum=ItemReceipt..Transfer_Enum=Transfer..Vehicle Mileage_Enum=VehicleMileage..Customer_Enum=Customer..Item_Enum=Item..Class_Enum=Class..Employee_Enum=Employee..Vendor_Enum=Vendor..Item Payment_Enum=ItemPayment..Sales Rep_Enum=SalesRep..Inventory Site_Enum=InventorySite..Vehicle_Enum=Vehicle..Item Sites_Enum=ItemSites..Assembly Items_Enum=ItemInventoryAssembly..Fixed Assets_Enum=ItemFixedAsset..Group

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F60707B8\EE643BC5\Credit Memo.properties

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:3MRMG3LMeMRA:3QMqJQA
MD5:	0772ADC7DF3E26FDA7D6052D5E24B66C
SHA1:	4C006ADB76247D5A6AC1C4BAD93ADFD16E3BD975
SHA-256:	0ED4A743021E2B89B988F5744B30BFE077FF40CA28562906D05C9A86C18CF08C
SHA-512:	E8690A00EA50DD16E7EE59DA9D1B391959AE271102219C13868B13164A945833DA09949C37793C8C1C42173DBF6C957E56E218413ADA966031807968A1210949
Malicious:	false
Preview:	.InventorySiteLocation=InventorySite

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F60707B8\EE643BC5\Estimate.properties

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:3MRMG3LMeMRA:3QMqJQA
MD5:	0772ADC7DF3E26FDA7D6052D5E24B66C
SHA1:	4C006ADB76247D5A6AC1C4BAD93ADFD16E3BD975
SHA-256:	0ED4A743021E2B89B988F5744B30BFE077FF40CA28562906D05C9A86C18CF08C
SHA-512:	E8690A00EA50DD16E7EE59DA9D1B391959AE271102219C13868B13164A945833DA09949C37793C8C1C42173DBF6C957E56E218413ADA966031807968A1210949
Malicious:	false
Preview:	.InventorySiteLocation=InventorySite

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F60707B8\EE643BC5\Invoice.properties

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.146168704467279
Encrypted:	false
SSDEEP:	3:6C/ocR9swLyMRMG3LMeMRA:qcvZLyQMqJQA
MD5:	9CDF75F130E226586143B565CC1C5AF0
SHA1:	BD1E05B7DEDE2B6B81A70289C3A5D29B15999F50
SHA-256:	C0D4B45AAF93A5FEEC89EFE3984C4563AD3B3BF54FB7D20DA0DB9F6B08CB55B8
SHA-512:	C59E1EA3C615E135E3EA731975083FA8892C8333FEE1D2D6D0CE2187A8D2F6F599E1F7009C4AA1BD7926150D774B7A205A00DF88F018B0D833379F09121CBA6B
Malicious:	false
Preview:	.Quantity=Item..Rate=Item..InventorySiteLocation=InventorySite

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F60707B8\EE643BC5\Sales Order.properties

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:3MRMG3LMeMRA:3QMqJQA
MD5:	0772ADC7DF3E26FDA7D6052D5E24B66C
SHA1:	4C006ADB76247D5A6AC1C4BAD93ADFD16E3BD975
SHA-256:	0ED4A743021E2B89B988F5744B30BFE077FF40CA28562906D05C9A86C18CF08C
SHA-512:	E8690A00EA50DD16E7EE59DA9D1B391959AE271102219C13868B13164A945833DA09949C37793C8C1C42173DBF6C957E56E218413ADA966031807968A1210949
Malicious:	false
Preview:	.InventorySiteLocation=InventorySite

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F60707B8\EE643BC5\Sales Receipt.properties

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:3MRMG3LMeMRA:3QMqJQA
MD5:	0772ADC7DF3E26FDA7D6052D5E24B66C
SHA1:	4C006ADB76247D5A6AC1C4BAD93ADFD16E3BD975
SHA-256:	0ED4A743021E2B89B988F5744B30BFE077FF40CA28562906D05C9A86C18CF08C
SHA-512:	E8690A00EA50DD16E7EE59DA9D1B391959AE271102219C13868B13164A945833DA09949C37793C8C1C42173DBF6C957E56E218413ADA966031807968A1210949
Malicious:	false
Preview:	.InventorySiteLocation=InventorySite

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F6E1FDBA\F3574DDF\Microsoft.Practices.ServiceLocation.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18112
Entropy (8bit):	6.224403881687228
Encrypted:	false
SSDEEP:	384:D0xk42ZtyvslnQyrgbPyIH/rFzs4zwQW+p2W/1S0GftpBjcw4l:gVenwRBzwcTimwe
MD5:	92A533BE83B7FA43A1B18F009A7D450B
SHA1:	E9AC62EBB0643BFFB243D889C535A8ABCD1BA52A
SHA-256:	34005D6A80434542780C6D192E6ABD07BEA49B2EEB7E43FBFDFE90C2889986E5
SHA-512:	B7AE35D9AB96C51B50998B46B8E73BA61BFC01812853C870872A18A3AA986DB8A66D3B8E173E1D7DD58097C07B07AFB64E5297B4B894B8FA1BF565773856A491
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.gS...........!....."...........A... ...`....... ....................................@..................................A..O....`...............,..............T@............................................... ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................A......H........&..d............$..O...P .......................................J.#.....6z&2.c.d..4...L......\|.<..bK... ....\|e.u(.Q...v..D..#P.fu...........a[\%~..^..<..Y....,.{K....vE}+P.<..a.S+C...y.\..(...."..(....&...(....v(....-.(#...s....z~....o...........2~..........&...o....&...o.......0.............o............o.....s....z....................0............o...........o.....s....z.................^......(.....o.........^......(.....o.........*.0..<.......(...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\App Logo.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 200 x 75, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15245
Entropy (8bit):	7.9727562410449435
Encrypted:	false
SSDEEP:	384:uTgI02clnvAIrTA8SMqaOJ5GlIner1T1MsatCqlBe5+FrO//d7:uTc7RvPYaOJ+IsfHeS//x
MD5:	EE0E75D4810DAFBA921E23D2B17ED95B
SHA1:	BCE7CDD5E667612EB4316D58BA9DF7E382EC2954
SHA-256:	97EA6703D93CD25FCE0BC26FA222B2494C9F7064A829DF536DB9574AFCF3735A
SHA-512:	D0D08ADAE2B39E9B8E79ACA7C04E979ADC382323F99F5F0693867FA75C1E683C15924B6874DB02ED068F20AE9D7A75339C108BFF9A3F1191E003A029D5AB0672
Malicious:	false
Preview:	.PNG........IHDR.......K.....5\|......sRGB.........pHYs...#...#.x.?v...YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y..9.IDATx..}...U..{U.=}M. \".r..pI.......TV. ...~...L.s=wW@W.W!.._.....".9....r..K.%H...}...U.T..\d..w^.SU.......WZ.....w..n{@..3u..].;.q..i..J.....{.(..Q.a.8wm<3....]f...WZ......02..G..8.z...[.C./e..f..pW.(S.J^..N.(.S./2..Z+.`.../%..E...o.....k....}V8~U.`...d.....P... .i...`.Q>..P.q...CD).p...J.}.IF.$..Kd...H4~U~.;&}..=...j.~.)....S.....q.wE..9....qP. ^...6.....#.{CF@.`.......;........j@.`...i.o[...LO..w. ..p..#...L.jf.......]..^U{-_..GD..4....m+..I..:..F..N.BC)..K..`..6B.....W..U....L.BQ.b....>F......m..W..>2.A^.....l.a...\|...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Banner.jpg

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, PhotometricIntepretation=RGB, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 492x63, components 3
Category:	dropped
Size (bytes):	19981
Entropy (8bit):	7.529123248543396
Encrypted:	false
SSDEEP:	384:JWXgil04jcQbK46uSgcP96YGAjdeytzYCTyOwzypLeiWtz/:Ju7QQuruSg+cnytdTyOwzypKFtL
MD5:	7EF965631C0E277ABBBD63CCCED7C304
SHA1:	5E85B366520472681104084D085B05F8730E9162
SHA-256:	82B4F18E62BBC3CFBE1026BACEAE92B06ACAEE80CFE5E2259DF5841BAB0FC03F
SHA-512:	CC75FF4688B479ABD961FAF88CC67E93FF69B857CDC18A8A8C178B4EB90E291E947CB0FFB723E8A23B9D0443819BF8A5312D6A475E9700E538A8AFD99A3C4507
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM.*.........................................V...........^.(...........i.........f.......H.......H........................................?.......!http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Chat.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	7.852862736239081
Encrypted:	false
SSDEEP:	48:C/6B9gI/QC+BtnaBAuGLB/jZctT/c9Iu0wjnxkzozkHaC:CSBlrKQBoBZctT/cWuFxBaaC
MD5:	F685A3B8099A6FFABDFEB991E15513C2
SHA1:	4D815C6BD14390A4AFE99F642CFE2FDCC394F83C
SHA-256:	CD13B2A6F9FD4A405956CDFA7599D2762BE4DAA4B605FA48B30196177FC2C070
SHA-512:	FE46E41C3BFF38ACABCDED8BE0401B62F3AC407C68F12F96C16FA178E4A8087DC140FF30FA24EDFAA80F77DEBA9F1D310B361888F5E9E31A82843DD9247A832D
Malicious:	false
Preview:	.PNG........IHDR...`...`......w8....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<...!IDATx..]]L.U.>,..].......-..I...jS_0...&>.....o.....K....I#..\|.jb......h."T~#.......=..f!....;s../...=...9..;3...X....F...$... ..$..@ .H...@..H...@.......o~=.g......}..=W_.....~.#.(.hP...y.+. .L.^. .Q....\|.....-2y.....=``....^a..../....../P..C.H..1...PG}.;.J6..aG...`3.\|.`{$$.T.zT.w.....?.&eG;..]..iF>.js........V.as.:.}............m6X....?...D..bADw...6...f..k....c....e.<...o.pp.......5^.zZD..]....3.j".G.<)...f.#......3\ca...]..X...!......eP...b.../....b.rp...CF...[...`$.8.2...3.D.W&....J..!....~]q......G`..V........~..'+!.ij~....?...y....o...l........i.k.m..\|....E@.....S.,..h.....g8.....m.F..h.Z..f9.,@[..v...N.n.._6....r..4.q..1..m.1!7. ......d....2..).._.V....Y*..T.0/.......iMI...F=.RS......k..........hMKEr..FWC.y@n.....\.9......x....\|........3G...gNm...o....]R..=Z.o5....$.:eX..{..Zs...'.G.L..q..x..........i.TK.."....wyy.+f..!...`vq%...xx..V.x..

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Company Logo.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 200 x 75, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15245
Entropy (8bit):	7.9727562410449435
Encrypted:	false
SSDEEP:	384:uTgI02clnvAIrTA8SMqaOJ5GlIner1T1MsatCqlBe5+FrO//d7:uTc7RvPYaOJ+IsfHeS//x
MD5:	EE0E75D4810DAFBA921E23D2B17ED95B
SHA1:	BCE7CDD5E667612EB4316D58BA9DF7E382EC2954
SHA-256:	97EA6703D93CD25FCE0BC26FA222B2494C9F7064A829DF536DB9574AFCF3735A
SHA-512:	D0D08ADAE2B39E9B8E79ACA7C04E979ADC382323F99F5F0693867FA75C1E683C15924B6874DB02ED068F20AE9D7A75339C108BFF9A3F1191E003A029D5AB0672
Malicious:	false
Preview:	.PNG........IHDR.......K.....5\|......sRGB.........pHYs...#...#.x.?v...YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y..9.IDATx..}...U..{U.=}M. \".r..pI.......TV. ...~...L.s=wW@W.W!.._.....".9....r..K.%H...}...U.T..\d..w^.SU.......WZ.....w..n{@..3u..].;.q..i..J.....{.(..Q.a.8wm<3....]f...WZ......02..G..8.z...[.C./e..f..pW.(S.J^..N.(.S./2..Z+.`.../%..E...o.....k....}V8~U.`...d.....P... .i...`.Q>..P.q...CD).p...J.}.IF.$..Kd...H4~U~.;&}..=...j.~.)....S.....q.wE..9....qP. ^...6.....#.{CF@.`.......;........j@.`...i.o[...LO..w. ..p..#...L.jf.......]..^U{-_..GD..4....m+..I..:..F..N.BC)..K..`..6B.....W..U....L.BQ.b....>F......m..W..>2.A^.....l.a...\|...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Delete.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10597
Entropy (8bit):	7.912220615047378
Encrypted:	false
SSDEEP:	192:XbZToCRBzu9cfYvHKasUzFBOaujHRNr2x7cbGfz8ZX3LWAOmGVDiwpYCBp3PErxD:r2C6iasUJBzujmx7cSLWHLWAqtiYBl8B
MD5:	CAB3AFAA84A26E1A668A40B388505B81
SHA1:	1EB0B1BB63551CF8DC5DBF4EDEE629C1C30C8042
SHA-256:	64A3A4E33438ABD9AFD5B83276E76553784E99693E2F8E3D332184FF55252D26
SHA-512:	BCEA2498EAC10079F997AAC38C177C769EB8D833D65B4DB9B6913F0B682E7275B3AFBEED487C71A1CF2EFCE6405C5418EBF497B38B739A50900A1B39AF095A80
Malicious:	false
Preview:	.PNG........IHDR.............\r.f.. .IDATx..{t.U...y....$....../.s.9.D.....(.H..".R..=..gf.5.3.\.s..Td.Q.E ......qP@@..@^..........]U.......+U{..U....{.j. ....o...nDHd....n.0...n...\|...;w..hw].Dj<.544x.<..F3+C....,...=.d...c.pCCC~CCC%..H..5.f...n........T..iYm."..@.0..\|.....L .p..444..G./..<...!..E.E...`0..Mc...;...V...AJJ.<.CC....HOO.j4..,DW....\|....T.........!....u.,.'..Mu..T...0.DQ.(...p.. D./E.....{Gq.P$`.<.p#sC..EQDOOO.?. x......A.(.jF@&`2<q{....%............Ctuu......'j,)%%%...^Rw.Dx. ../._...."^..`d.@.On..Af2..0<r'.k@...'.@>........d.&`..$.k....a.].V......7g....u...............E2.....n.o..^...W.....O..\|.@...u.<..o.y^../...;...f.j.....H..;...}.}...@.~.....ZF.J........k...%........g....=#.x<....'^...@.@8...D.....]w...............@k.@.&..o...^.......@K..F....w..w{.>7'C.@8...?^#.x<....g^................{..k.9:.2.........Vd..x\|..,..}.N...p....K......v... . ..4..3..`..w...{.>_.@.@8....5...A..,Z..k.9;.2...h.=^#.J.......x.>o.!. ......"..2

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Delete1.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	7.774540431612985
Encrypted:	false
SSDEEP:	24:/7/6Dy6IDArHWVGvtYRnNjFFxLpyKNLbi36K7df126VM0cN:/7/6ulDOk5LjnxMvBf12+LcN
MD5:	CB5FF13082B66DBC4580D487FB901501
SHA1:	44D3D54449271120801EAAEE70D676B30AA63E32
SHA-256:	907E011D925252DE71DED669BEAA90B5D34419C7B8360E6816A180C4BDEE8836
SHA-512:	17024B79EAC3B47220061321085D54F5DDD93DEA7C6FB9F110F0BE97C5E2BAAD85C67AE74552BD4F510EB60E8B26392E1A63DAE521EEBE86048BB1CD9AF7B462
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sBIT....\|.d.....pHYs.................IDATx...k]E..?ym......^]=.b+d....M.M-........Z.W..E........H..B.J.+..Q!.XBM.G.......sq^h.=..;sg.x.0.ys.....s....T....D..0.<.4..`W.........w..%...5.(p...:.e........`.8....i......%...C...'.:.,+..`..>....@..'./.........W.W..i...$..lG&.a.i...[...%.g.a......Z..1...}.>..0...a...@.^..K......g...x..6.dp.....q..Ot..{....;.!.SxW...r..!..O.{#.7.[)....c..!.?..^.E..}..)~."Yfp.H!.,..c1....l.~\.M6f..Z.4.N."..Nr.F}."..>.D...A0...X]..5.+.O....=.-r..?F.Ex..0.......y.h...[.0...?.k...U..'9...?._.5.Q.X...,.Z.k...1vY1.Fvn.K........c.6.....R./..o]..U.t..#/z%......v...H...\|....Y..e.#..\|w]..a........nn*u.....^.:.D?2....ot_.ZcK.-..rPQ...J.......z.#(S.e..I....\|....a#oCK...N..>(C.G......@k<....-BC.S.....U.&...5.%...-.6....P.B..$.j.FN9:..!E8..h#.%'L+.&].8 ..7...q.bh..G.EE.....}......("...s.}..!73......O...;...d....^..'b..p..C..GE..#Ya.."z...yEh"yJ...r.Y.....(.]......?... r''..r@..V.G_.x.A....E..W.^....A...U..."\|..\|

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Export.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6968
Entropy (8bit):	7.772180551455239
Encrypted:	false
SSDEEP:	96:C13g1mnTT4xCeTx9Isgh0wHY2goia54ALv9YXe3pEcyDyflsWBRvLLZ6U5mb4jaI:CFB8pT3YqQ72A7lpZtsWbmMm8rf7Fdh
MD5:	63B02A4F13B2B48091C18D82889513AE
SHA1:	61158066B337737AD8B87D80102F681CC3BC2B99
SHA-256:	D311BC1359AAE8A767B508B224AA5D58287EAC2FC480346D20D54810564B2DAE
SHA-512:	6B3F7E199E61F59B4407F365CD21F26D5BE3FA93886C5D2D0B22AB857E92E963FC9D73376874DB0DC42FFE355FDC0B35A2AE981C7043BD4D91DDC7E99EC4E1EA
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..{pU.....I @..I(.B.(...3....k....j..p9"(R..........Zg:-.Z...L...VcA8=:.p....$.;.r.{..[..,.....{=..o.-...<...[;D......$...~x..Br..."---..\.F..S.........\|...s.Vl.......`.[... B....$@0...._c.U.?p.7.g..R.....`...y.L.c....u..r....L.... .....~I......\|~.x...>z.D...1s..5.J)...n...322h.....@.@.'......bI..[)uJ.2.Y...$....'..I.&.gb}......A..B.....<X{..A./........A.7t&.r ....[.&..!~...............{^..Kn.\|?Q{C....@...-..........@o.Z....`..f.j....\|..@d.F....L ..@...0B+r.4.<..H%.@..v.@$z.C.e.U.3.&.f..?.v&.')@5.I...y....[..]~.m.`a...<..0.7..j.`7....,...r9.......@..V.vS.r.l.s........[..M@o.V....p..7o.L...R5..M..e....?.>L...R..`.....r.X.`.L...R.......e.\.,\..&...n.._..(....IY '.E....`. Uz.f)@T.X....,^..&....`.v.....A6.'.\|.&...n-."1.;e..'...O..`....@.........$P^^.....7.."1.3.....,Y.....7..".;5......X.t)L....d.F..4..$....y.R....0....R..!.XU(......0.....0K.fb....U...TVV....pY.`d.f.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Import.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6800
Entropy (8bit):	7.7716733712347885
Encrypted:	false
SSDEEP:	192:J+Be/Q+/vVOL50+stWcd9hj8lw5bFG3OT67CtMJjp:J+A/Q+FaW+sbNRbFGerMJjp
MD5:	5509C7D4D493B3E1993B8DF54C1B295A
SHA1:	69064A29FA8F3DD771314EE1F949DC449F514350
SHA-256:	3856EF4B2C82EB7D8F86B4691387E3CA372AB735D0044467D19B23E5FDACCE3E
SHA-512:	F9D2E3082CF6398B900CBDA183163588EDAAD7B0D11D62973D79F34C7844C71424B97C54B9F10E861B79F928046577933D8397B8F1B4DFA08AEE8A3816A27184
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<..."IDATx...p....C..,.../.e..jMb..........B.SYH..lj.$[.,..,..MX...,w .0.8....`..%[6.,..K.i.......z}.h...\.F3.f.o..}............3{...... ..A.;'.......460. J..%K..a.....b:.'..=.X..\|.x..`.....H/..........@..RLC.........cz.$.0.D...0....s..$..`..R ..fe. ..v..._..8.P(D..{/.[.l.\.~}=f)G.h..0..^/...(.@....08...`...j1K...X`....7)......AR..RL.O...cyQ.)...$I...\{..A=.......k.xP........`f..x<....?..P8....a...../e.......P....X^~1e..[.\|......~hD.....5.."........_/.H ......0B..f.@.{.@...e?.#.^.....V7g..H .. g...$.x..U.. ..;...V.........."..n....F.`...V.f.o.,.x<.r`.y.......... z."....C..$.........J....Y...... ......j.`Y...n..vH..........N.....; ......w...l,.....w...@. .._.~^.`&..e.R..u.]....r..`V......E.w.}7$...\...a$......s.=.....u.....,..=...C......@..........%K ...ds. ...I@..... ...d........A.]..........I.FA.hU`R!(.X.ti-..@..@..VU...l.*T...-.....p....0.v....U.H`......Y..0.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Import_Export1.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	465
Entropy (8bit):	7.25564314625225
Encrypted:	false
SSDEEP:	12:6v/7Y7/6TR8RdYoXlWXn4pw2Xos7GYFsALzvgpj2f:/7/618RblWXnLnYnfn
MD5:	F0EC31A34818D0E5FDC17D7E4F42B0B2
SHA1:	DF21A95FC0BADF6E1012E6EC3EA424525FB2250A
SHA-256:	76F67C90403E692E4CB83CA26894D992CEA57603F70A8D060CD844FA4EDEF2C3
SHA-512:	C9168ADFCE79C76C0F1CE9773B7798B80DF63C1FF97599DDFBF40DDFC2CE0838E9268B8F2502F2C2C74D78E5EAB0A273C834494BEFBD51AE991F51918B0B272D
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sBIT....\|.d.....pHYs................sIDATx..MJ.P.F........".{p...A.?E...g.nB..Waq!:.$.4Ms.5y....4........q..q..r`...b.\|.Lr.&...3.&.)...H../?x.s...3.e4....'.......5...^...K.ix.....#.O..........p..7.q<Q....."l...q...j\.:....4}...../.-../........#.....\.:...........q...j...o)...it.....f.....-......u.5....]w..W.?...k...;z.jm....f.q..hCBo....+.M..kB........06.&.=u$d.p].w.mr..9...d$\>..py.q..ql.............IEND.B`.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Logo-Transactions.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 1131 x 572, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	81424
Entropy (8bit):	7.939508818618094
Encrypted:	false
SSDEEP:	1536:I2ZLqkAeokB+Qy5C9I0+ZOTqwWhlnbj/HXlNDGdl1ab18sNLoxxO9chm4/sU4g97:35Azy/IxZQWPbrXl/asJFytR7
MD5:	45001E25C02B845F9304953655210492
SHA1:	D24963C74C764630283E136122C84E223A3E5FF5
SHA-256:	3CEA526EAD7DEC1C5BE8B0FF6655AB09072160FE7AD02A9DBFB843ED5B6320BA
SHA-512:	B377379C04EF006890EB3C41F32163CB37C16B9D2749AB2F98057E5146E304EA988E6FAE58865A75BC08FF3356D897B7F08D1A873D3D7541A23AAE924B4C701B
Malicious:	false
Preview:	.PNG........IHDR...k...<.....Fr&.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:Compression>1</tiff:Compression>. <tiff:Orientation>1</tiff:Orientation>. <tiff:PhotometricInterpretation>2</tiff:PhotometricInterpretation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..E*...@.IDATx......e....y.........!.$.!.!..t...0..}........}.]w.............+!...r$.p.@.!.\}T=..W....d....o.df......tW..9.bC....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@....@

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Logo.ico

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	121104
Entropy (8bit):	4.123155981048824
Encrypted:	false
SSDEEP:	768:mxarF3HDyeMMY4t8zAnyhODi5VVZDxVbcOiNMH0jJi+UWo7ORCteUla0jyG1if:mxAFZnt8CyhOKVVZcx7tiaCQUlakVE
MD5:	195A448C748728F9A61A7F455018E5BC
SHA1:	3D5CB16EC91CEC66A30348685465394ED1584C4F
SHA-256:	868229E3CAA7DBC05D3CFF67781C3D2E8385620593A8DBA8674FD0357A5B1AE4
SHA-512:	9128A161DC437792E53BD526D5E605BDA4980157A07ABF668ADC0D635B06F83DBFAE31F190701165662E677684E836F67AE49A4FEE838420ACCB7F233642E105
Malicious:	false
Preview:	............ ..S..f......... .(....T..@@.... .(B..0\..00.... ..%..X... .... ............... .h........PNG........IHDR.............\r.f..SiIDATx..y\|.Wy..}...m..8.Y..$.xK."S.-;2e).....B[Z..R(oK..%J......Z.RZ.H...."%.C....o!.JC6g..;w........zKl..W...D...=3s..<.9."..,%Tex.gr....^^...eD....g....JT..n}r.^..G....\|.....wU...'.<..U.3q;.uq99=..b.."...n..8x../..B.KL..m5.....#...D\.[.Z..`...{..7fJiD....TR.A..r.?cc.##3.t.....^...T.b....m..8....S6.@.E....l=8.r...p..gvm9..."..et~.A..r./.jX.d...7./.....y.....s.v.........gF.....{R,#....P..#.....u..`L.Ff..n.+....:.._y...t.+*...+O@..j..Q....)...b.D\.b.[o.....g../..j...5.+....0......g...+n...6....}g..{..X.1..H.....X.aG.?.5T.1....0W.9..d.o..K...2w....o3._LVT.@.`.z....bE@.#..[.n....l..8.8.O{K.+..E...;.eK....OQ....T7k.b..XD..........ol....Q)..M..C..... ....Pwr.D....^..^S... ..3../...q])..Am.P...C.]....S..oJN...f...R1.d... "1.{..?iT.E0./.t}.1....._...r.......M._..O.{...?S(.:(.n...b..E...].....y...9)..w.r....n.....3..i

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Logo.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26140
Entropy (8bit):	7.968446606897966
Encrypted:	false
SSDEEP:	768:HuHBhSqowaS1LH79Uf+sgXuT1Q5LlKM0g8:OHyqEeH7N9uekM0g8
MD5:	201AE20E32F9EE1E760B4D19DF29047A
SHA1:	DC1E80A621565CF6AA3E8FFC2E26488222985620
SHA-256:	0662B36E0C40DA1938D1328DA0A59612CE7C35D81C75C241E04D17DD9932E8FE
SHA-512:	4D59FCBE1118689444FA138F11E489B1324076B003B3E9DBE89DC39C0622290482B561ADF9AFB97BCC1C5C75AE04108F0C49A6F912351AAE362E821757F38BDD
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....sRGB........ cHRM..z&..............u0...`..:....p..Q<....pHYs.................iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:Compression>1</tiff:Compression>. <tiff:Orientation>1</tiff:Orientation>. <tiff:PhotometricInterpretation>2</tiff:PhotometricInterpretation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..E...@.IDATx.....U.?^..{..I......$(...L.DE.P...?.cU@E]..u.]..^..{...u.]V$^.......fD..Lb...+@...>.....VUOO2G.3.3...z...{..............Z..n...2.C)...._..k..6_...x6..Z.9~.$..RZ.jK.m..HT.......6.H..C...W..Zu..m...!P..h.Z..zC...h,.....%..W..RCYs.V...".]@..T^\.V.&."Q.I.2x.....C...3..'J....V.......!..%4.....o...@.o.?w.9....k..X./0.q.d.......t.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Logo_su_4a.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 1489 x 556, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	27896
Entropy (8bit):	7.866837910731793
Encrypted:	false
SSDEEP:	384:DfG4TysniBbGLTPXuxBLO0rkIBap1waxyYsFAYtbWydmoKZMNiOG0vdNS3c+F8mu:D0snGKTv9FlxyNrtbXQFMT5mABb
MD5:	E0048821CA3F154EB5B180E2D2740A11
SHA1:	7103074CC6E23FAF253789663C36753B2F588B61
SHA-256:	2257C7E1E8D2A0E6FA84BDBCB68B7333E602C7E1EFD6B8D71D55EC61DD1D7311
SHA-512:	7F21EF89FFDB01ED882DFC1631E81FEADF1DD53E4F5A5AA55556D1E75ED35D582F95772F0EDD288636D61A9EB2068E493E8F99B7652B93140207AF03D0884E7E
Malicious:	false
Preview:	.PNG........IHDR.......,........C....pHYs...#...#.x.?v.. .IDATx....n...6.;F..q .}...r$e.n.9...4...1...r.f..........D.7......8....k.h..=`)Q..?U.....d.M>U......./.......d...y.~....>I^<._......:.u...m..........3...l...\$9.<X?Mr:.u..%..!:.....U.y..Yg`~_.....$.i.s.(........X..d.<.^.......B...C.sG.........B\.....,..%.%9....M.....<Z..\..i...Y.P.!:....`..........'J.P.!:...po..l.d..j..".Qt..4.......U.d.a.....<.e.K..Y;.........7]...c.Ex.d(L.h.!:....7.....4.......S...Q...k..X3.......@..Y?..y.Z..w..).@=.........v../Uc...N{..R.......Z.;..&...-u.[..x...!:....Lw2..\|.....$.]... D.........D#.J...!:....@w2{..$...h..${.^.T).......@...^....h+........Nt...(Xw2.&y..E...Z.w.X!!:......-.:.<H.....X........v..F.^..$.j...V@.......Nf.$....L.I~.N:.j.........l.......Mw2.)..r.......UW.[.h..A:.r.X.......Q.T.......'..X,......`.tW..>W........@C.... .`.......@.tn H.X0!:...4...;.$.+..b......A...a...m.z....}....U......Nf.$oU..x7.u....x:.........^..<.A...........j.;..f....j.H?

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Mail.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	7.788837850676476
Encrypted:	false
SSDEEP:	48:C/6BXKi6wZWMmuYWvZq+VEF8zZ5M+BvvvPPe+hOwqqgdA7WCcK3:CSBXKi6CmAvZrEo5Pe+YwLgd413
MD5:	A165D58FC112BA2F92AB98B1E2F356F3
SHA1:	04B732824F897D99012D7614D7375B960FC5044D
SHA-256:	DDC79360670A083AF8D098CA666D2E06E00730BF03A2900A83DC193621C84BB9
SHA-512:	544D25B8C3D795D2DF44A567156CE3513D78033D222F7523112D0A4B8A70EE46B9BDABAF42DDC9BC221B41E3AE16CD9A70248237DDFA1877F058E47CCCA44937
Malicious:	false
Preview:	.PNG........IHDR...`...`......w8....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..]IS.G.~ZG..%..$..'.J...rINv.9...L~@..#.\\eN9.b........[9.qp..0...b...!.H....C.#.[.3~.jJ..f.....i.....f.9..$..@C...4$..@C...4$..@C...4$..0.U:../...&G...X....V..C.............O3...&..".....>...UJ.9....R...}...$2&e..S.0.x.0...\|...E.%.bDTlO.......,...c.....1.4..H.>.>.>./....._...&..q.D....v.....X.....D..%.)......m..%f!I...3`/.ZD...6....4:O.....I...0O..:.l=B..)...n.RF@..?.T!.tC[UME..rA.....(p..3.>.\|{>.C.!..R-.O.^CuW.;..H.{....w.G...Z$......_......&*Q.>4..h.[..@..^Z.....e".......9.`q.1l.._'}.f....z.G+...oW........[4..Ba......u...l.G.%.....E!.P....."I..O..'._.._.>v...NF..)9.N'......]M.z)9....#.b.".0....p:..gO.B....>..'... .]...&.W)F-..B.R.G.w.H.='=.......y......H...T8.^.....B...Ur.......h...m.L.2.G...!...o....\$.>!4.....`.0.ru4M...aR.fa......v{......B......s!....P...9....o..$.Tr...v.Y......h....p{......c.C.....Rg..%[Qf.5....h.K/..@;p../.I..,.\|.N...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\Phone.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.780650713229545
Encrypted:	false
SSDEEP:	48:C/6Be673Rn0xZ/PeUdruV0DnnV3/TfhPVXkbusO22oe0gUNg:CSBT3RmiODp/TfRVXGus12o0
MD5:	1F6405B0C620582B1B94036DD2B36E31
SHA1:	74F5044501961A0A19998D0C2451C1630A730F92
SHA-256:	E3D3B98135C4580591471F1AD939030A3C4996497F6392E47DC2B1BF167CADC9
SHA-512:	994CF76F4514AFEBA8DEDF39B08A994EFDBD029E75F1E77B3A743D418328AB371795833E4469E0B7DE1C2B0B15364D25F85F3C3C51C003BB766476D08F1B48CD
Malicious:	false
Preview:	.PNG........IHDR...`...`......w8....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..MLTW......t>p.. t.d.Hj.Q...B..6...UY.t...Y4...l....nhJ..:..R...B.D,....0........ax_....'7....;.{....E[[[@.'........ .$.@.H....... ...@"....f...=#..%.Zd...Y..z.>n.........4..oT.17d ..H..(.._.........k.D..!...MEOW..m"x.W.../..........d$.A,X.....!X<.`..ho..l\|.......k..z..n.{........Z,..&3>.\|...`B....F......./.....t...ay.....GzLQ5. 'YqA..j....CP.....'....Z.=...(/s....,.Zz(r......i.....H...K.;?.g.....!......c.p..........(q...i2.......4......?.NMN..#.6..aI /.'...=..A...".t.x.(...{....%...=?S.YpF..D-".hV....s.`..d......3..qbeO.A/.D>..{@..7:.K!....f..(.FvW1...==.wD........K.v.../.7.L....E......S....b..v}..._..b._$..m...B.{....3...../. esAYyP.8...@.d..5O.}j~..>X.w.R.@...4.............Pd..nza.........r.'G......z...3..X.\|(.&.Z..B..u.D.T7 .i..Z{.lb=g@....,.A....LL.p.M..d%......6.}....\O...q......uy..c...$Dc...O....z\|:k......#U....9..?.>.......

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\QBLogo.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 292 x 288, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	12141
Entropy (8bit):	7.956002709913871
Encrypted:	false
SSDEEP:	192:tjp/wEY+cxOTyJ/3oJPc62WvHWdavqb+Q586IqcBXu7PugoAj:tjp/jY+TyJ/EqFyQz1IXu7PZok
MD5:	8C9CC418E4C8B0A179944DFA95D6EA89
SHA1:	4BD827C69F770D9D5B3C7FB22D1A6A67400A0B88
SHA-256:	1FA721ED8DA497449DB8CFF1150B8F15288232570DF1D548016E10F6B737C689
SHA-512:	01472411FFCE2954BEF39B3BDFA48F0BD4FF5A23926990A821A2A1E12523C3EFA7E623DB60539B9783EB570F496419A9C98B97C3AC737AB86F75F07E7207E36C
Malicious:	false
Preview:	.PNG........IHDR...$... .............sRGB........ cHRM..z&..............u0...`..:....p..Q<....iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:Compression>1</tiff:Compression>. <tiff:Orientation>1</tiff:Orientation>. <tiff:PhotometricInterpretation>2</tiff:PhotometricInterpretation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..E...,.IDATx..}.\|M...I$...$"!A....K.;....(.V...U..X...Z-.E..]...A"...X"$....o~....r.9s.9.>>...{..\|.\|..y.B.^.z.........V_.i ..... ..s@.h...M#.I.!@d.g.....".F@..B..F..!...D6..&5..-A.....?J.~....O..?I...n..{.O..5.i...^.z..Y..~..!..m![."........-l.T..........;.........K;.f..._k...-j....L\zL\Z.....7..'g]..(UUc..J.8..v..T..._y........... ...P......b......j..O.t.b>.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\QuickBooks Logo_Horz.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 1100 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42028
Entropy (8bit):	6.381458504537123
Encrypted:	false
SSDEEP:	768:NtsnOhoVMeP0GdhW9bkM2DtdGbhmxEz6RuFMCPr/:NSn0ORMoU0LGt96RuFpT
MD5:	7DD06B14CF008DC8CC3C275777455440
SHA1:	8B8585FF7C43D50C9B98099A3C8435076AFBBC53
SHA-256:	0CF253F6035570D054921661F1306FE92C2635939052C5849DAAA07EDB0EE983
SHA-512:	8ACFA81E1286C6D4B264862EEF030071F971687F8B79DE6616A76B574B2FB4B2DB6196CDF4BC3153105A0602C1D0A7017888F592283B19D56005CEDE69233960
Malicious:	false
Preview:	.PNG........IHDR...L...,.......&G....pHYs.........g..R..;.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Macintosh)</xmp:CreatorTool>. <xmp:CreateDate>2016-02-19T11:28:13-08:00</xmp:CreateDate>. <xmp:ModifyDate>2016-07-20T09:47:56-07:00</xmp:ModifyDate>. <xmp

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\SplashScreenBackgroud.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 3001 x 3384, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	611849
Entropy (8bit):	7.933848107965016
Encrypted:	false
SSDEEP:	12288:YXh6SfMP/FdrL0a4Y/wcpg3I7YrPqZTrHExhfVwFOT9:YASQvYL2wLSYMTTEEOT9
MD5:	447AFE92EF2367498D5338F53278F51E
SHA1:	D820090B868B958736966991A31A048F471AB44C
SHA-256:	E643CFD3D6EAFC2A011273A1AED9C41425A4FD82AF435962B83E19CB79803C6C
SHA-512:	4B6E27EAF9C3AE79A2335B44D056C12CF51AB903D5A0B87FE674FAC48C1CFBEBD11526945D67E13DB9E8DFD150BF2B80C723A1222B696A78947B3CB546CEE700
Malicious:	false
Preview:	.PNG........IHDR.......8...........pHYs............... .IDATx...Ol.g././.E.A]n......N....3....3.]...t..f;......]pW....WJh..,\R`q%N..."..Y.q..{.v..r.ec.'..\....\|$........U......~.!.....Ok.1.d.G~..~.E~...b...,%.}.._...........(..%w.....}.)...]4...Z.~.n.{.r._..M.4.S..8......T..;....T@3..M..t.}l......kt.\.,....Ofz.......[E........S'..e...tq....Z..M.>........^.].............'<UZ...M...:.....I.....+......@.Pr......4......Sk..\|..X..v.*k.i...+......@!......(...7..>i........Q..Y...d..l......T..;....=...zY}l........S.g...~B.S......`.)......u.N`_/.+..U.SEx'........Rr......6....?...C@!.%Yx...........Sr.....m:..ye....H..%x'.......&J.......f.Sy..>.'..l..$KIf..}&..d.gm.......D......$I3.....8...J.O..M..?.v.~.......P.%w....>.v".X.,.O......v.}..?.'...............Lc..>.'..Nd.2n..fi...........[......'^....ewm...NZ?.~&.'./Lfz.......PUJ.....=...p......Si........J.?V,_Z.&.W...{w...........{y...y.G.....{.k{r.~._W...v.~!..w........uJ.........^h_..S.I.\|}k.......2.....Z)n/vT...3

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\favicon.ico

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	MS Windows icon resource - 1 icon, 76x75, 32 bits/pixel
Category:	dropped
Size (bytes):	23762
Entropy (8bit):	2.5647461231279522
Encrypted:	false
SSDEEP:	48:7cYW2bFQyKH6/hMDOURaSdV49wmzXgCfRJUXbOqGZaHkkwqiL4m69lUX8HK3qIIM:c2ZQyKHdOqaqQfILO5xkw3WK3mCz
MD5:	7F3952744F3463220D36416F713175C3
SHA1:	8FDB88694AA0E0E76FA66C46F29A04E979093683
SHA-256:	BBCC568BBC7720FCD0743AA617282F149E9F901639F8C534808BC39DB6B129FA
SHA-512:	695FA97B6063EFF04399B276A8CF83FBDACB1D0D8ED6A2E156B8E63D1B3035E727B13BBE1C6CBE1F7AA0DBA7E7052CC6E1C1703956A45978503F090573538DC2
Malicious:	false
Preview:	......LK.... ..\......(...L......... ......Y.......................................................................................................................................................................&/..'T..(...(...(...(...'...(Y..(3..$...........................................................................................................................................................................................................................................................3...(M..(...)...)...)...)...)...(...(...)...)...(...(...)...V.."......................................................................................................................................................................................................................................+...(l..)...)......)...(...(...(...(...(...(...(...(...(...)...*...)...)...(x.(...........................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\favicon.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 76 x 75, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4412
Entropy (8bit):	7.953462093425719
Encrypted:	false
SSDEEP:	96:8g9+gflb3X7CKATktHkAlMp0lZ8+0AwDmRYlLDKd2MNClGfwEyY/9+:8gZtHOKATkNeB15m+l/TMCGa
MD5:	04882E62A343D362BE82B98145EAE556
SHA1:	0B5D6B2091E50091A4BD0FC1F3C3CC9D34571459
SHA-256:	159C1CB448EA2D8549C6E396C4A7C1877FF9807E8BC604754F33317C86BA5148
SHA-512:	2D5045A02A28FBAFB0688D32687CDFB3C2D718255650CF2050D928E0D2506973192C3DCB67D48E5CCEB4B10C07104BACEE8F6C4A4A941B4A479D22B4A1F4EBC6
Malicious:	false
Preview:	.PNG........IHDR...L...K......a.....sRGB.........IDATx..\....y.....$.1 #..N..F..;.+!Q.cHY..D....y.@..8..Db.U.M."..F..J9........%N...l.;.@.N...t.}..Lw...vwvv..q.GN]u.~.............9m..]..v..OI..s..J...\.d.....\|...x%.gJ.K~v2.<.y...v..2....m1e%.%...U.5...z..#.L9.;..k..n..~..\|..L%..D..B..}..`..O.1.......7N..W...4........P.s.u{.8.F.I+1....../z.d....Z_..S..\|G.6c..U$.........W6.)D...m...\.~...U.V...4...w.:.D..L......a....".H....2).o....j..fF#_.....p..[..(.......$g4`....d..Z...H1........`....L.-H.W..M.Y:.,_3...n:3..P+./.'g...:........p..1..........J,p......0.zj.'.g...p..K.W^....:..D...]`........=N].>......c.ry.=....Vr.L...k.M.....LSo...h..b....~...5.$.u...w....-9.rn....:.k...e2aK&..[..,.7v.%.k..\.m9Wq.A...j...#]-o{.N.sR7..1v'...T...X.Y.#.d,.#.M=.VE7....Z......wp.w....SJ".....0...L.m......g......1u..y`..f.k.{.w..........y .I:)....v.3\."....$K._.[.\._...)........G.V..D....V.2...W7./D"....G.4..9..s..+.'...$CT.%..?L.Z{F7s=. .....e'..g.&.c.\|.....

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\index.htm

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.430378597201219
Encrypted:	false
SSDEEP:	6:qkxAGKQXMiIOYWJe5KVJJcUOzIYKZ3yueXMGb:5kyYjUVXlOzIYN8Gb
MD5:	BA9FF954F1E41B392A6B9918ABAB7BC0
SHA1:	8735A6F2CBC5EE528C2FA51AECBE701CA397BA88
SHA-256:	4FDA4B56D4DD2BF137C965D33A31D24EC16941919B06C32489E962CF3BE1ED76
SHA-512:	7A7998F463C7FAF48E0E894B447069FF276BAFC0B572503276437D5F016A408B10BA6C34F0CE237D30C904CB491D282F2A5A5D718514CEDCAA897665E4582220
Malicious:	false
Preview:	<html>.. <head></head>.. <body>.. .. <h1>.. .Excel Transactions for QuickBooks Desktop.. </h1>.. <br/>.. <p>Fast,Reliable & most trusted app for QuickBooks</p>.. </body>.. ..</html>

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\installaware.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2510
Entropy (8bit):	7.7918243528472955
Encrypted:	false
SSDEEP:	48:6S/6x4vOrKQ5N0SI2i6Qg32KvfcmiB225ORA7bjhxZc2xCYrXm1LSxv6hU9:nSDuOKb2i6F2Ec3pOa/jxBxCYr2Bsvd
MD5:	5A920C50F9C88A600A69A98B51CC1487
SHA1:	DA284E3F77C84532F96265C3AAC556F7C600FF59
SHA-256:	AC0E370D8EED1D7EB7F1CF8AB3C9F284E92EC24410ADBBE8163E89BCC037AE90
SHA-512:	56B698D81D388E579A179977E78B9182C5D69A68FF88C748B323178EB6E533F93202621A4F4667D501AE59ECE9962C248F90CED18460D3DF65EEE81EF4DBA6C0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y....IDATX..W[l.W.>.....NR.CD%......[.A....Q.&m.............}.......@..)u..D-..b .%$%....+M......{wgf.....7.m.._..s.....Y..I. 2,r.X....i5h......B.....o...#.F.6S....r..U)...M).F%Bfs.$J....?9.EE.#.f.0h...o./.../).4....$e...*..Pe!......3V/......0...i.=.>...B.C.a.82.....$@.<.>....b@..pX..3.nH.#...w.\|...#%..H....p..'.wg..g/....6#..!_......q.x...H(.6.9.. ....K.f.t.E2..xoD@..R7xM. U..q..!<....1./l..{...q..>.#...d.1..<G....=.\|.........Q..4.f....r...y1.$......8....j9......K.#..L....3B-../.f'.g..q.4.I...y....<.t3:..:<

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\logo.jpg

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 1489x556, components 3
Category:	dropped
Size (bytes):	77300
Entropy (8bit):	7.696977797483546
Encrypted:	false
SSDEEP:	1536:6nK/KT4lB8QQCLxID2xgxihfHNIBw0iRWytlwH7ME9wH9xV2:iKblKhC9ID6gxihfH2BtiYAUVGHZ2
MD5:	ED7B767134151892EEDBC7E56BBAFD89
SHA1:	02919D3DEBD2084E90064DD04CD737D55A3ABF8D
SHA-256:	F3B68B60AEBFC858239958288D3B1AAE054C03C7AC77C94FE90C108998CDC5A7
SHA-512:	4FA9A5AAF4C0B46C8E19F5CFE145D94EFF738D9D8979C5134D34A786549FEA1FDED1A4778B292F0FCACEB5AB8D78435AD8B53F95D7C3F4F42C6A231A7345AF54
Malicious:	false
Preview:	......JFIF.....`.`.....:Exif..MM.......Q...........Q..........#Q..........#.......C....................................................................C.......................................................................,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.../...\|3.;....."..V..~{..;F....A.H..><...F.U..I.\|1..;ew.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\shortcut.ico

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	99678
Entropy (8bit):	5.037372625199376
Encrypted:	false
SSDEEP:	1536:HjUKLWwDBy+4myMzq8SkfpIpCK4nbRJO+/V5rXkgE2VYTJWlZkUh1UtgBx1BtiQx:HA7wD/f+34nb+Ulwc
MD5:	47E5065A805B7C4B8F680BD6D1D226C7
SHA1:	D283B0C2B07478F2932E75440F9817414439603E
SHA-256:	989EBE671B60804D221C299746CC253C5E0A150FA6A0A6CB6DB15FAB8FC917BE
SHA-512:	C5192D01EBE9886C372A205A9A9001AF7C29FC05141056F8C92E2EDDDCA6A67A5FF684A459E1F2ED56DE81C9C71DD574CD773AA2788641A84F0ACB6AB77219CA
Malicious:	false
Preview:	............ .h...V... .... .........00.... ..%..f...@@.... .(B...;........ .(...6}..(....... ..... ...................................W...\...NL..F...F...H...G...D...F...PN..^...X...........[...P...R...I...U.`..................R.v...M...K...X...S...k...O...O...J.J.v.................................3.d...L...Y...W...O...H.T.~...............f...O...T................4.h...O...b...DI-.e...............^..............................W...UO..F.................m......B.........r.............V.....P...V..................m......E.........u..................R.1.e...................A..................................X.7.h..........{...d......u...W...G..........................Y.+.`......<.......h...................\|.......................T...P......Y.../......................d...d............l....O...HGV.{............................./...#...5.........$.d...TLP.q. .Q.............................&...&...,....V....Q.@.w.'.U.*.V.+.X..........................g...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F89064B2\5867B062\success.png

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PNG image data, 395 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11001
Entropy (8bit):	7.809790157356541
Encrypted:	false
SSDEEP:	192:kSnTOm6+FxUVvuQCZ6JXDeP6ZIgUxCQiQggQ0RuhmbWtRRq:jnimFXQvuQCkJzBbUCyggnRuhmboHq
MD5:	7819D36917A33ACA79CE4D6D10CCF4D2
SHA1:	9AB0809601B7EB1A24DE0CE077176AE3E1989B19
SHA-256:	5BF36319603782F4048D47618DB90CBA3A4350F9922CB9B549326173AE433EBB
SHA-512:	F69CBAC70F45DE262AB64699F5CF76C96EF7EED5E97219FD35C88D804A72E8964A75C99FBF42C64EFED31EEEC642081FC7D194D7F34F9281E4E04D3D629A1077
Malicious:	false
Preview:	.PNG........IHDR.............s.@.....sBIT....\|.d.....pHYs............... .IDATx...y..U....9U...%A.8..Q...#.J.Hw.(&.N.....q...3..Q.^..w.Etd&IwT.I%!...F^2b.t.%......;]..?...,.tW..<O}..........M......................................................................................................................................................................................................................_.x....)a...M-G?..?.9M-.).^....H..c.PIax..i!.....C..C;V.....Z.X .....v..'.X...s.p..g.i..fE.Y...A~....Wy...4.._{.=...Na...-.=rq........kv............!.....S.......'.....9..#...y.J.Y..ny..K...B..3f....@.h...s....~.\...:....+..........;}.NI;..;....\.\|.O...c............tnt.\..s..c.w...7r..I7K...w..[...z....@KU..Or...s.t.\|x../Y.J^.\...nVt7.:.o..E...z....@SU..Ls.N.(......7.F..w..\u..x..}......s]..\p=u...0.{?.zS..i..q0:m...7.b...P,...Q..g...;i..N....._^.w!...W.i...G,0a......V...{.l..........s.oX..{.s.O......4..K.s.t...d..w....x....... ?....ree.;nz...r9U.....b

C:\ProgramData\miaB83E.tmp\data\OFFLINE\F8ED8800\F3574DDF\Quartz.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	893440
Entropy (8bit):	5.841264701919036
Encrypted:	false
SSDEEP:	12288:DUqZVbUHUqU/Al1HcQBjPvdV3q0C4ckklTZApe26A+6r7A8JbP/qJdzh+:TQ5VdqnEzr7A8Jqh
MD5:	745235D63EBACD6171AB9E3B4FA2C5C7
SHA1:	CCD090E096EBED62F1261F5E6E44D5F25198A3D6
SHA-256:	917D35FBDEC8F1CCECDB0DFCAD7DBE59067988813D712521B4AEE56107C684BC
SHA-512:	4DECB85E51E04D243BD2F917DF43E316664E20C2AA5EF54C5AE8223D47ADC3E9B2DFDA00A840C3DB445F04EEA0901A386EE87F70D3224C31877B6BA82CF72546
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o..[........... ..................... ........@.. ....................................@.................................H...L.................................................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................H.......d[...Y..............d.............................................(...."..(.......&...(......~.(.....:....r...ps....z..}.....s....z..s....z.6.{.....o......:.{......o.....2.{....o...........s....z.2.{....o.......2.{....o.........(...."..(.......:.(......(...+..0...........o.....=...............(...........0...........(....s.......(.......o...+........"..(.........(....b.(......(....(....}.........{..............................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\FCC6B9D7\F3574DDF\System.Threading.Tasks.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35016
Entropy (8bit):	6.54246973766738
Encrypted:	false
SSDEEP:	384:WL0xHprBefGMOrRQY+hoZhOZkcvr3Eql38WqATrOhEZ0GftpBj1x+ILKHRN7c6lE:NRBefGBkoWjvr0VabKirxmcM+
MD5:	85F6F590B5C4B8C7253E9C403C9BE607
SHA1:	D5A9DB942A50C8821BACD7F6030202C57EC4708B
SHA-256:	D20552FD5C8C8C9759608A84DB1E216DA738F5E9F46DE9E8A3F39A0D6265CB8B
SHA-512:	9C78CB444E28618D44E9DEB23571FC7BBCE268882C2803E0CCC0E84B3E6EAB89C6AF2AAC0D81EF0D2C9FD1E9611CB35334EF3304FB16C5BA0481F6A7273C3660
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.T...........!.....@..........._... ...`....... ....................................`.................................\_..O....`...............J...>..........$^............................................... ............... ..H............text....?... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............H..............@..B................._......H.......h..../..................P .......................................#..ON.... "J.0..r....6RbR[..44....F.....E.X....1.XIE...:....5.M...Txn.\rycn.....o\|.V}...l}.1En...`.T. \(e .u..=.nA...@p:.(......}....R..r...p.(.....(...+N..r...p.(....(...+R..r...p.(.....(...+Z...r...p.(......(...+Z...r...p.(......(...+..0..$...........(...+..-...........o...........0..............(...+..-.s....z.o.......0..............(...+..-.s....z.o.......0..............(...+..-..*.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mDown.dll\mDownExec.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1587200
Entropy (8bit):	6.625369192208514
Encrypted:	false
SSDEEP:	24576:tfZhR78sRL2Zxq0Yxfzz/JBySGuDqy8txiZ4enyZ1jTq8kzGkzRaI:VCQ0lYB/J0SGEVOo6psGA
MD5:	E289FE03E461BAF39878972213F20EC7
SHA1:	6FAA11CB6E104AD5FFB26A9612FC37CD39CBCC81
SHA-256:	31A80D529A3EBBED72E1EA678F571D700DBE36396E6C725437FF2B12C5E99511
SHA-512:	9179B458DBEC04BE7326AE0D229C6A0D0EF4B2EC2A6F7967D200C2F6C67858C6EDA78F430F655E4C9DD7042B91A35C9FAE2FB7BD21CFDE5506DCE0D87FE4960E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...g}R[.................J..........de.......p.....Q....................................................................P....0...8...p..............................................................................L:.......p..^....................text....1.......2.................. ..`.itext..4....P.......6.............. ..`.data....V...p...X...N..............@....bss.....W...............................idata...8...0...:..................@....didata.^....p......................@....edata..P...........................@..@.rdata..............................@..@.reloc..............................@..B.rsrc........p......................@..@.....................8..............@..@........................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1460736
Entropy (8bit):	6.672375942890088
Encrypted:	false
SSDEEP:	24576:10VVsOA8OlyuOOQbsjMBG3hCaWuaBfhBiSlGJsRMVw3IB9b7epYfF6:1aVHtBYOfhESlFP3CZSKfF
MD5:	D4ED54099D1186758E4C5BCCB35545F9
SHA1:	1A0D16FE21A56776A2954723E9C699074B690174
SHA-256:	6C1F2C15B6F9E068B5213544FECA0E189A56B86BFA877C2BD8E231765CA9C4FB
SHA-512:	0825DBA841197F96E0DE7E249B109CB51FC5DA838FF9EFD13DA8F700F097BE3A61A0BEE663C7FD6D13F911C799465CAE9DE6EB05659D40D77C0F0382DC700267
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...m}R[............................D..............Q....................................................................O........?.......\......................P....................................................................................text...4........................... ..`.itext.............................. ..`.data....R.......T..................@....bss....`T... ...........................idata...?.......@..................@....didata..............2..............@....edata..O............<..............@..@.rdata...............>..............@..@.reloc..P............@..............@..B.rsrc....\.......\..................@..@.....................J..............@..@........................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\cabinet.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	56080
Entropy (8bit):	6.471892347922079
Encrypted:	false
SSDEEP:	1536:Je/7+7mzLZ9Q6uooPz0OQJ6hbaenpmju6xv50VK/kroRj:JeC7mzl9Q6w09J6hbaop0OK/kroRj
MD5:	267AB17A3526C6C46B2A1CF9A0A51280
SHA1:	A18DDA64D88228D0783D5FF24769FF0375DB1349
SHA-256:	CB535E27870708F94F46ECB75BF6A5DFF17422C28B9F21C2C80AB7B1FCF1F715
SHA-512:	DD462E0DD24940C39EBF843D21DECEDC2CA96FEC3848CDE25218EC9EA45B19A8D559251309240688E981C6915BEC664B6969280E157B00115F13003E60BE430A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{J...$...$...$...%...$..97...$..."...$...$...$.Rich..$.................PE..L...R.C8...........#.........2.....................u.........................0......N...........................................<............................ ......`.......................................`...D.......\............................text...M........................... ..`.data....(..........................@....rsrc...............................@..@.reloc....... ......................@..B4.D8 ...0[.8-...5.D87...........KERNEL32.dll.NTDLL.DLL.ole32.dll........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\imagehlp.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106013
Entropy (8bit):	6.212455176025638
Encrypted:	false
SSDEEP:	1536:M82ThwpbJDIQp4J0O0oRPcHPsw7e2EoFtV6tF3x6WyglF3CT:yTh0bJDIQp4J0O08cHp75kH6pgX3CT
MD5:	0B783914A5BF8CE566C6F7BE36E50759
SHA1:	B72151196A33D73606D20B0265B2D039EF9D1CF2
SHA-256:	A01EA2839B8B9676631CC7D5A9E8D6D64C2CAE5CFBA8D7E74D6E9F4B0E122331
SHA-512:	E863B49D8B1681279D4083EC6AAFC8EE3BB91F81DF4428089219BE616FD66560CC8F97B674B208ABD0566763E27ED5546F9DF9EC7B85B82E17F0376D6B6A07ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B/3...........!.....P...P.......S.......`.....v................................................................p.......k..(....................................`...............................................`...............................text....N.......P.......... ....... ..`.rdata.......`.......`..............@..@.data...4............x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\instmsi.msi

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Windows Installer database, Author: Microsoft Corporation, Keywords: Installer,MSI,Database, Comments: Instala Windows Installer, Create Time/Date: Wed Apr 14 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 2, Template: Alpha,Intel;1033, Last Saved By: Alpha,Intel;3082, Revision Number: {CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000;{CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000, Number of Pages: 30, Number of Characters: 8
Category:	dropped
Size (bytes):	951808
Entropy (8bit):	6.02604379952541
Encrypted:	false
SSDEEP:	24576:T8aSNCmuikMvQVcboqTR/oNsBOozxEAnxEq6UEWtoDbC0snsTSOfWLkLIHt2xNq0:T8aSNCmuiXQVcV/oNsBOozxEAnQWto/l
MD5:	DACAD73CE0EF57276296E89A4F28710E
SHA1:	5E99C052B9D24C8C245632D0691B949F59E19D95
SHA-256:	61AD5E27FC7D0D39E7CBA51C3792F18E6FDC744921E6C416798D8179AACFC32A
SHA-512:	1268D7A180F95847DD0725633E87884D478EBACBF93D11CB7557BF58CDABCF487D8E2D4E36717335983AB81816CB713F04E91E722A4D74CDA7EE34554E4DFED9
Malicious:	false
Preview:	......................>.......................................................p.......j.......n.......v.......t.......k.......g.......................................................................................................................................................................................................................................................................................................................................................................................................................C.......................................................A.......D................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...i.......E...f...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......g...h...l...j...k.......m...n...o...........r...s...t...u...v...w...x...y...z...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msi.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1927680
Entropy (8bit):	6.128521877107153
Encrypted:	false
SSDEEP:	49152:XCRTdYNHpRTrNHpRTfNHpRTRZzg5UYvn81oq24TVvnN6MatzkEs+qa3URcNoX:Tg5UYvaoq24TVv4MatzkEs+3xo
MD5:	1F4327678ED079D6FE37CBB2679F9B7E
SHA1:	1F5ECF24191E7E40C54354EFEFAC95A21AE91EA4
SHA-256:	56B289A74A0420E0D8BEFF631F1FC34C9F650E1876C2FE2BD7CC715CBAD04C49
SHA-512:	628359DD72B3684C08751E5890A79D11DBF9820A2F9DA706D92DEFDCE7942A09FDD7FC1634F85D99D312A068E05B3C166DD8D4A5F99A7DA6039A94B4A9653C7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8..8..8....c.8..I.U.8..z.f.8..8~..9..z.?.8..z.@.8..Z.b.8..Z.c..8....:.8..z.B.8..Rich.8..........PE..L......;...........!.........z.......i.......0....@.............................................................................x.......0)...........................................................................................................text............................... ..`.orpc........ ...................... ..`.data....\|...0...d..................@....rsrc...0).......*...n..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msiexec.exe

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	6.31626628635355
Encrypted:	false
SSDEEP:	1536:2eIGSoxLTd4LcE3AeweFR/L0thKAMkIOyMYozY0Cri+tg43wKcQvL6:jIGSoxLTd4LxAen0/Kbk5YozIeOwKcQu
MD5:	E6B975475B001A15B14AE6BDCDE58E45
SHA1:	78E98C30801D2E9FF3005F829B0574CD2B3C2F48
SHA-256:	175435FD486045310E8C393B9B151638756AD14C7C93232BBD9D6920F1268E46
SHA-512:	67957EB32D414E883EDF9D957D9A8783FFD5305E968A046245B79FB7677D5ABEB2651280C9D2117C097BBF53B2A4A10A6B40D5522C4A04F9A0F37D94548C620A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P2...S...S...S...p...S...S...S...p..S...p..XS...p..S...p...S...p...S..Rich.S..........................PE..L......;.....................P............... ..................................................................................x....`..X...............................................................................\|............................text............................... ..`.data...T3... ... ..................@....rsrc...X....`.......*..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msihnd.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	297472
Entropy (8bit):	6.293291033170778
Encrypted:	false
SSDEEP:	3072:QA/lZmzljpUKaEU6q+R91vlI2+a1Lnby+0K9RrqfXPQUwyf8gSXlTHM9u3cQKtTP:QA/XIUzEUonvlIrGT0MWfYdbzlbMIkz
MD5:	AB3A6F9B84D4B74F7811A99FB0314A9B
SHA1:	C26185396B46ED706C401A8605CE1BF946AE5CF1
SHA-256:	F7382C1B01B52ABFEF7BD5E7921C2D05E114584255FB1BC17119DBC035C8A008
SHA-512:	1C08854A4240C84913FD925968D838BE25978A58A2D0C59EF46636ED90105FF60CEE047CC58B5B7F555744461095A4CD854F4EB4670BE7870778D743E1D4281E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E-.Q$C,Q$C,Q$C,..Z,^$C,Q$B,.$C,...,G$C,..\|,P$C,...,P$C,..^,^$C,.._,/$C,..~,P$C,RichQ$C,........................PE..L.....;...........!..............................@..............................................................................................................+......................................................\............................text...c........................... ..`.data....4..........................@....rsrc...............................@..@.reloc...5.......6...T..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msiinst.exe

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	6.126214350182879
Encrypted:	false
SSDEEP:	768:SSjhX67ianPrIQBpZE/vwsRcL1S2cETJXUl:SS1X67RnUQBXYIsOZS2c4JE
MD5:	47EB6C6EAAAE1544A50339A51A8AE481
SHA1:	7DF0BEB8F719174419D9421497F203D63290F8D6
SHA-256:	3C97927B8BF0BB1A54271D6F117E0E12B673122284B2E382D55237A3487960B2
SHA-512:	A675F471A8404830B114CEC2F0605EF18DCA203B74E2D5A26F3F3A9B0055FF3DAAD45E04AC11FC794E6DF90B9CE700CF39F85E2F2193AF1D13BDE776D3157FCC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.jir..:r..:r..:...:y..:r..:...:..D:\|..:...:I..:..A:s..:...:u..:..9:s..:Richr..:................PE..L.....;.................\|...........I......................................................................................$...x....................................................................................................................text...$z.......\|.................. ..`.data...x...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msimain.sdb

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Windows application compatibility Shim DataBase
Category:	dropped
Size (bytes):	134164
Entropy (8bit):	5.119567377291569
Encrypted:	false
SSDEEP:	3072:2vbOQXQtrj+jcAxeL9+9sw4vQoZv++lbuSOS+J:2vbOQmOgL9+YOj
MD5:	9A7CA59803DD20AC5C6B900E8665169B
SHA1:	247C0DC1C82F70E6E7F9CAFA9F7C8C69EC4C2648
SHA-256:	AEEC814144D4253D3167360EC6399F542D9123E4D5878808BAC279D6436B3C8D
SHA-512:	DADD8F6023F063F59C0F7703D706218F59F8D54EDFF3CB2CF8C71C67DF22CF6EE32C379DD65C2C69D3FFCF0D84C500737EA294C9CB1126656FB1D6E629F3058C
Malicious:	false
Preview:	....A..sdbf.xh....x.....8.p.8.`.@......x...VILEBODAf...02MOCUED~...OCHCNERF....OCOTOHPI....RT1002IP....IERUTCIP....VEZILAER....DACOBRUT......YAWNIW&...IUSSKROW>....x.....8.p.8.........F1R..'.r....c..........n...@............N...p{...4!....k.\o8a.&.........>.+......)...w/........=@i?........=@i?.........ED....q-...I.....qM...I.....q]...I:....q}...I.....g.tWc.L.......s3.`O4......~.'.Xl...Y0.50..YV.......3.i\.....7..AZd.f...K@}...F.....0i........?.3i....2...,.3.....j................\...6.l.....\...6.......Q. .d......8 ?..H...,....@N.........i%.B...P...>.......X6...........^^..^!......^^..^!.T....^^..^!.D....^^..^!.6.......L........x.....8.p.8...@...........p..-1..V...U.h.........u.......D.....8.........."a..N..D....H.`T.z........../'2...t=.'.o.+........M..0........9.W1j.......\|.GE....qO.2-:.H:...,....I.R....T.kI..SYF...;.Ek..Y......;..nw[d....8..O.f......'.fK.h4...c...I..q....J....z.y....n..g...\|......!Y\|p.......&Eo....r.......L........eS.....B...&.w........vI!$!E-.H.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msimsg.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	5.7770113379561385
Encrypted:	false
SSDEEP:	24576:7FrZsyKWdbhmUXE9KIrufRO4t1YF6OWez17:VVhmUXE34t1YFp7
MD5:	1528B3892C7D02CD5BC58DB0736C069D
SHA1:	7B25B7DEC2448CD31D2D029FBB9177D68B0FA107
SHA-256:	AA5A8E2DFA32FD93E56B93F4EE57131EFCAB0C66E822D59DB187410D923EDB6B
SHA-512:	FF9CF44CEE136B5D9854C67F0F05740BBA915B58240F0A9A816DED4EEAE151B4A6C60D0BE650B9E28276DA582FBE1AC22149621CC2599270790E419609EE5CF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=.C.S.C.S.C.S.....B.S...n.B.S.RichC.S.................PE..L...U..;...........!....................................................................................................................x............................................................................................................rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msisip.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	6.0759855839723365
Encrypted:	false
SSDEEP:	768:DvNOtQ6P36XywYpWMbhK5CuInamzP0gEWm4C0HO:rNOK6/6zYpWM0C7namzPFEd0H
MD5:	B5BECF4BDAF9D68ABFFEA2E7F4747265
SHA1:	CCA2DF95690835604BC00E46F39DEA08810DF8EF
SHA-256:	325D9AEECB2E2607ECC43BFCE7E49C2561195158E8A38F366A33CCA5300876C4
SHA-512:	B0828B92849BB6A8E7CF5966C2930502F733C5F6D42787F8873FC1ADB1048A922DE786395BAEABBFE90E30365F29E1698ABEB156B34C3544B692921821DBECF3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k.c.8.c.8.c.88@.8.c.8.@.8.c.88@.8.c.8.c.8.c.88@.8.c.8U@.8.c.8.@.8.c.88@.8.c.8Rich.c.8........................PE..L......;...........!.....\|...&......Y<............@..................................=.............................. ...8......(...................................0................................................................................text...X{.......\|.................. ..`.data...\|...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\msls31.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	5.9814955021734715
Encrypted:	false
SSDEEP:	3072:sIvjlvPmGwB5RezjIN+vqjo/pFNrk3br+uubhokMD81s2pAFfqCF1hW4HgB/i:sSjpjwOjIN+v30vsVW2pK7F1hW4Hg
MD5:	2CAB9989FB957EFD98DBBBCB9B1946AB
SHA1:	0D01E4AC66D852730D8031A2BCAE215210EA7385
SHA-256:	841FDE9B24476A7ED364A3E4A1470AC9B7358BC92F29FCA4A06AAB557D140850
SHA-512:	92FA2DACE9589789FE2A84E4F561D1DDA32858AEEB4CD13EF73D94D6619A27F68988D653367D0CEB91FBFF8C427D6FF28E8ED0FE00FBA91B006F9FA13F3F9943
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..cp..cp..cph.ip..cp8.ep..cph.gp..cpRich..cp........................PE..L......6...........#.....0...@............... .....H.................................=...............................A..Y............`.......................p.......J...............................................................................text....#.......0... .............. ..`.rdata.......@.......P..............@..@.data...@....P.......`..............@....rsrc........`.......p..............@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\mspatcha.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28746
Entropy (8bit):	6.545540060601869
Encrypted:	false
SSDEEP:	768:hLCnlsA4wVor2lcvDd2nafVz7aGXdP6YMKdI6C6udCv:h2voo2p2naf9aediYMftdw
MD5:	60D88C0829FE1E16C32F76D71724807B
SHA1:	40FB4D13A643B6F8A7A7CABC2A3F9E48B9E0CC50
SHA-256:	6007DA6BB72FE138DD4AE622C78C5337E3EAF9E8020B748B4A6918563EC988F6
SHA-512:	A8D35023AA60C601B581847E8FA3A1B5E52D5A6515DE6C6EAF7AAFA64CDD6A3BFE6E17281C6870F39343D8D45E2460A8730E8BAA26C24296087BF37ACF55E414
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................Rich...........................PE..L....aJ9...........!.....d.........................X..............a..................`...............................p.......n..(...............................X...`...................................................T............................text....b.......d.................. ..`.rsrc................j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\riched20.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431133
Entropy (8bit):	6.6536949023972145
Encrypted:	false
SSDEEP:	12288:xWNTGm1c2qUkM9nv2VOXRc5uynesaycwrt/cIC:xW8m3qUv9EeROxXcoJC
MD5:	AE5ABEC31518E015A9FB4EB196854291
SHA1:	DEB63ECB2CBC60A688797478A204A2A57F49D1E6
SHA-256:	1C2508FB55DDC459D0327F2017471545C87420443391567094E768FB34032DA1
SHA-512:	DFE3E803AB7940FE4811627832CD048ED872111C3AE6B4DFE3493CB14E7932AFF9B5ACA7E5F387F5B38A44CAFBB350540A4B41955A3D28F36953B01FABCAA2F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.Gu...u...u...u...{...,......._...t...u...$...Richu...........PE..L...0.V8...........!...............................H................................................................`...=................w.......................(..<.......................................X...l...............`....................text............................... ..`.data...............................@....rsrc....w.......x..................@..@.reloc...(.......*...j..............@..B4.D80...0[.8=...4.D8G...4.D8T.....+8_...........KERNEL32.DLL.NTDLL.DLL.ADVAPI32.DLL.USER32.DLL.GDI32.DLL........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\sdbapi.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.659673413793373
Encrypted:	false
SSDEEP:	1536:PETcumoD4VtSnCl2nMdzMdcITmPKhi1fKIaj1/VYcR83:PETcRVtSnUdzMZiFA/VYcR83
MD5:	F8FD9158C6C71F3494A1D469EF78EEA3
SHA1:	747C7D9AA94317B894A77EA903DF959F60282EC4
SHA-256:	68AEFE972833C881857B27BC28D3191234B3C0D73B0F538032DCB82BE3DC4A0E
SHA-512:	D0940A38711DEB93139469863A5B507BE246AFDEDE6195FDD0264490FA4A00A06BB223347316E877B38557FAD5275FFA4384FF58836F54394819800FB140B843
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..O.h...h...h...K...h...h..Nh...K...h...K...h...K...h...K...h...K...h..Rich.h..........PE..L....};...........!...............................G......................... ......................................P...c.......P...........................................................................p...X....................................text............................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..B..};(.....};3.....};@.....};M...........msvcrt.dll.ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL..................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\shfolder.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21021
Entropy (8bit):	4.8801661651868615
Encrypted:	false
SSDEEP:	384:L5yAJ3gXLVMYNcJhGCMcrXWpiWwH/sHHgH2nKwsHTWHi5AGsHW0HcHpLHP0oqQGI:0AJ3IMYNcJXMcyu/z
MD5:	B7993C10B9A8C3B9735D7696C7B9E8B6
SHA1:	AC2E765311380BFA502B3B7AED2E8D80C351E08B
SHA-256:	6F0443A62FD444C4254F902F668543B867A0577504915D22CD75328F73CD4472
SHA-512:	D17AE76467F5FAC056494A0FDEF445A5BBB1F633507DDEF9B2AFC12DD47EAA68096784D47E968383B207382850100EF1915378E74564E29CBE1C8E0D422DD679
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{J...$...$...$...%.'.$.L97...$..."...$...$...$.Rich..$.................PE..L...q.^7...........!.........0...............0.....u.................................................................'..k....(..X....@...+...................p..P....,......................................`...4....................................text............................... ..`.data........0......."..............@....rsrc....+...@...,...$..............@..@.reloc..P....p.......P..............@..BM.^7....N.^7%...........KERNEL32.DLL.ADVAPI32.DLL.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\ansi\usp10.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314906
Entropy (8bit):	6.170788306003831
Encrypted:	false
SSDEEP:	3072:10EvBHYN6cpZbdPYxDhjnYnMq182s8Vvh0VCPL2zHoytG5dHJZE5d8wfI:1LHYwcLdy9Ir6v8tS8ytG5dHL+pI
MD5:	4437B4E1EFC79C331070B9F481E3E97A
SHA1:	793B1D0839912679CB43E50B63C186205B8B7D44
SHA-256:	4D8FF1F53C3BABF9BFD11B2EBCD44E2698CFE3BC80C6F0CBC64C0D191EA1FC1B
SHA-512:	C82CEA06778426943958E47A8A3372731A3834C412F919E1E6C35B7FE41DD55E3E6D881CD489464A69FD65180A4B1632527C0B06E62700F5C66BF4867089A7CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................Rich....................PE..L...0.C8...........!.........................@....ef.........................@....../^..............................@9.......1..d............................ ..p...`...........................................l.......`............................text...]-.......................... ..`.data........@...>...4..............@...Shared..P........0...r..............@..P.rsrc...............................@..P.reloc....... ......................@..B4.D80...0[.8=...4.D8G.....+8R...4.D8\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ADVAPI32.dll........................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1333248
Entropy (8bit):	6.6424211334203855
Encrypted:	false
SSDEEP:	24576:dhMU6yqYSJ7c0w2NdM2LPJuXABBcSVW1VVBNMo/GEo6:jex1nJQABmSVWLSo+5
MD5:	EF3FA77D0FC49335AFBE3FDFD55E0D0B
SHA1:	9817797A78174819EEB2A759F7BC6B15B464071B
SHA-256:	152452B88E64E159BB531ABA7AD55AE901F78EC86F26891EF0B9A5329B945B85
SHA-512:	B8DFF917AACB1C3B228E529F3E70193F13F23D9E11D4D91F86559350DBFD17121EAA8FF37C54EC600102EEA2325C8DF7EDE55702E7AC1755EE8DDD889AD02E22
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...c}R[.....................x......(..............Q....................................................................R......."6.......Z................... ..........................................................\.......^....................text...P........................... ..`.itext.............................. ..`.data....O.......P..................@....bss.....S...P.......0...................idata.."6.......8...0..............@....didata.^............h..............@....edata..R............r..............@..@.rdata...............t..............@..@.reloc....... .......v..............@..B.rsrc....Z.......Z..................@..@.....................X..............@..@........................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\cabinet.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	56080
Entropy (8bit):	6.471892347922079
Encrypted:	false
SSDEEP:	1536:Je/7+7mzLZ9Q6uooPz0OQJ6hbaenpmju6xv50VK/kroRj:JeC7mzl9Q6w09J6hbaop0OK/kroRj
MD5:	267AB17A3526C6C46B2A1CF9A0A51280
SHA1:	A18DDA64D88228D0783D5FF24769FF0375DB1349
SHA-256:	CB535E27870708F94F46ECB75BF6A5DFF17422C28B9F21C2C80AB7B1FCF1F715
SHA-512:	DD462E0DD24940C39EBF843D21DECEDC2CA96FEC3848CDE25218EC9EA45B19A8D559251309240688E981C6915BEC664B6969280E157B00115F13003E60BE430A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{J...$...$...$...%...$..97...$..."...$...$...$.Rich..$.................PE..L...R.C8...........#.........2.....................u.........................0......N...........................................<............................ ......`.......................................`...D.......\............................text...M........................... ..`.data....(..........................@....rsrc...............................@..@.reloc....... ......................@..B4.D8 ...0[.8-...5.D87...........KERNEL32.dll.NTDLL.DLL.ole32.dll........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\imagehlp.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106013
Entropy (8bit):	6.212455176025638
Encrypted:	false
SSDEEP:	1536:M82ThwpbJDIQp4J0O0oRPcHPsw7e2EoFtV6tF3x6WyglF3CT:yTh0bJDIQp4J0O08cHp75kH6pgX3CT
MD5:	0B783914A5BF8CE566C6F7BE36E50759
SHA1:	B72151196A33D73606D20B0265B2D039EF9D1CF2
SHA-256:	A01EA2839B8B9676631CC7D5A9E8D6D64C2CAE5CFBA8D7E74D6E9F4B0E122331
SHA-512:	E863B49D8B1681279D4083EC6AAFC8EE3BB91F81DF4428089219BE616FD66560CC8F97B674B208ABD0566763E27ED5546F9DF9EC7B85B82E17F0376D6B6A07ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B/3...........!.....P...P.......S.......`.....v................................................................p.......k..(....................................`...............................................`...............................text....N.......P.......... ....... ..`.rdata.......`.......`..............@..@.data...4............x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\instmsi.msi

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Windows Installer database, Author: Microsoft Corporation, Keywords: Installer,MSI,Database, Comments: Instala Windows Installer, Create Time/Date: Wed Apr 14 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 2, Template: Alpha,Intel;1033, Last Saved By: Alpha,Intel;3082, Revision Number: {CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000;{CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000, Number of Pages: 30, Number of Characters: 8
Category:	dropped
Size (bytes):	951808
Entropy (8bit):	6.029627921240929
Encrypted:	false
SSDEEP:	24576:A8OSNZmfikMhQccboqT+/+NsBGozxEEnjEq6UEWtoDbC4snsTMOf2LkLIHtuxPqC:A8OSNZmfiZQcc6/+NsBGozxEEn+Wto/X
MD5:	2B4B94ABE5C6B89A47F212C2D696D618
SHA1:	15DF612410AC2D576D069DF94B306066D15D60F3
SHA-256:	3900B678DE6D24DB7ED9D7190517C60793B9B435EC58BBE46AAD044A49CAF636
SHA-512:	0311EAC11B1FE3A3AE6420F46534A420E70C3C8D2BF05D5E754DFDB480722D28E97732AF0E25890AF22C3FAC1CE01ED008886E22445C37E9894ED76FEA76850A
Malicious:	false
Preview:	......................>.......................................................p.......j.......n.......v.......t.......k.......g.......................................................................................................................................................................................................................................................................................................................................................................................................................C.......................................................A.......D................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@.......B...i.......E...f...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......g...h...l...j...k.......m...n...o...........r...s...t...u...v...w...x...y...z...

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msi.cat

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	9178
Entropy (8bit):	6.934013526787076
Encrypted:	false
SSDEEP:	192:nC1zR7DDb5qikTvpTKaErlnkTN2+goPKJ54Kn4dFR+4Db:ArAChe1nDj+Yb
MD5:	C74C5092222CA8B7C32B3423B22DE3A0
SHA1:	3EF6BE0BBF482EB3D026247B31B1A0DADBC1C71F
SHA-256:	4B3A1258638737EE338885DFF62256AA747A08BFC738C4A9850477B4AC7462EB
SHA-512:	3059D6BE46BFCBBAC148C5A6E20D9EF5512F2F5B5EC0BE5970C1E34FE73EC81D01D5D54F9CB6DBAECBD0ECC8F7A89D031E9D173D5A6925EC0FF89FFA1601B0AD
Malicious:	false
Preview:	0.#....H........#.0.#....1.0....H.......0.....+.....7......0...0...+.....7.....(..GN..F..*....W..010818054031Z0...+.....7.....0..j0..&.R0.2.4.8.2.9.8.3.6.D.D.0.C.B.1.0.9.8.0.F.E.E.E.C.1.E.1.D.C.1.A.C.6.3.A.0.B.0.8.4...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........H).m...........c...0....R2.4.7.C.0.D.C.1.C.8.2.F.7.0.E.6.E.7.F.9.C.A.F.A.9.F.7.C.8.C.6.9.E.C.4.C.2.6.4.8...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........$\|.../p......\|.i.L&H0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..&.R3.7.0.F.D.A.0.E.C.9.4.3.3.B.2.6.E.4.A.B.3.C.8.5.C.0.4.3.0.4.0.7.A.5.3.4.A.2.E.8...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........7.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msi.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1991168
Entropy (8bit):	5.8958492897713075
Encrypted:	false
SSDEEP:	24576:GB7Nqm40TSJvanFIrEegExvhiwtqeBf4QASo0u7kHRwuVkdLURWs:GB7dSJvanedlxEwtq+sr7KVyLURF
MD5:	5A6627C42F40199CABBF11391E141928
SHA1:	43D97D4DA87D15C7FD96D95F9BFC90C3CEBF8A91
SHA-256:	860E1B58DE5FCB3DBC7DCD9A16C5FAA56C748DA24C69A05417C75CD40E4432D3
SHA-512:	F63401AB3650EF3CB5DE8F419807E3C3825F3CF68DA39A13C084A3DFA562BA77E7993F99B2E83AE2CED4D95D763AA49BB3D3228C07048BDB2654CD3767A6EE8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I....................................%.......%......%.......................H......%.......Rich............PE..L.....};...........!................\~.......0.....w........................................................................$...........H)..........................p............................................... ...............................orpc............................... ..`.text........ ...................... ..`.data........0...l..................@....rsrc...H)..........v..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msi.inf

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	5.322486389930819
Encrypted:	false
SSDEEP:	24:podajIZRTvvD6SxJre7OI+g/5xCYUf4QOSNWU4KugU5IvDGfjbIDSFSxJSbcexJJ:4aUTzSR5WvWNJgwIKbIDSY2bce2S
MD5:	FB6D53A80B79EEF39A6EE32DC35EF9EA
SHA1:	59A11A3EF985F9F776D5908F0A11910BB749CD5D
SHA-256:	95CC7C6E3797E544516B952442888D6A000FEF7B339997EC8ADDB7F180DF6D7E
SHA-512:	E29268033177E88693385847EEA2A2118943B3848A552E3A9B2629106F41644F82C78AE6CAD2CFEBE34D70D7F7212E3411687E32094E9D469EA74409C32346E1
Malicious:	false
Preview:	[Version]..signature = "$Windows NT$"..Class = %ExceptionClassDesc%..ClassGUID = {F5776D81-AE53-4935-8E84-B0B283D8BCEF}..Provider = %Microsoft%..CatalogFile = msi.cat..ComponentId = {2E742517-5D48-4DBD-BF93-48FDCF36E634} ; GUID assigned to the Windows Installer..DriverVer=03-13-2001, 2.0.2460.1....[SourceDisksNames]..1 = %msi_media%....[SourceDisksFiles]..msi.dll = 1..msihnd.dll = 1..msimsg.dll = 1..msiexec.exe = 1..msisip.dll = 1....[DestinationDirs]..Msi.SystemFiles = 11 ; %windir%\system32..Msi.DllCacheFiles = 11,dllcache ; %windir%\system32\dllcache....[DefaultInstall]..CopyFiles = Msi.SystemFiles,Msi.DllCacheFiles....;..; COPYFLG_REPLACE_BOOT_FILE flag (0x1000) not necessary for..; files in the dllcache..;....[Msi.DllCacheFiles]..msi.dll..msihnd.dll..msimsg.dll..msiexec.exe..msisip.dll....[Msi.SystemFiles]..msi.dll,,,0x1000..msihnd.dll,,,0x1000..msimsg.dll,,,0x1000..msiexec.exe,,,0x1000..msisip.dll,,,0x1000....[Strings]..Microsoft = "Microsoft Corporation"..msi_media

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msiexec.exe

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	5.818017231218899
Encrypted:	false
SSDEEP:	768:rI4YSbqG4TY4LkR2Jcwuoc7NokgteLVyNlKludccVor3whUOyZWCTRpmaBVVG:x4TY4LCj+c7NIGVybKluS3YnyQCyaB+
MD5:	E7A49533944654EDD82D26338DF0FD05
SHA1:	573E88D79B4359D4314A3DB71928730BD018FDB5
SHA-256:	9E251671385941E2ADA9AA40811F1BA1E876E40A70C81AFAE1F88D18D80D0FEB
SHA-512:	5C7933E4F1D4329380F22C9FED907041295DBD9D91CDDAC20961924614AA944ED6641915D0777DB0BB0C55B6C097EC51C10A21096C6C098E2EFE6B84219A5BD9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S[b..[b..[b...A.._b...A..Pb..[b...b...A..Tb...A..Zb...A..Yb...A..Zb..Rich[b..................PE..L.....};.....................H............................................... ......y9......................................<...........h...........................p.......................................P...........T............................text...^........................... ..`.data....*..........................@....rsrc...h...........................@..@..};H.....};S.....};`.....};m.....};w.....};m.....};......};............msvcrt.dll.ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.ole32.dll.msi.dll.....................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msihnd.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	6.29099735641058
Encrypted:	false
SSDEEP:	6144:NT/c7YrGE4VUDbJIFo4791yrsd4DtTnnhV7d:q7YrGEJqLzotTnh5
MD5:	E7F00952494BA4D9545242514614844A
SHA1:	8AC8A0228698E562C1B1592177662611ABEF144C
SHA-256:	DA4192B9B0A0C3A1BE1F1E52E2A4CC4BCF11B8436B04D0AE8118EF84FC4F6D34
SHA-512:	5FAA7518B5A4C33797C0D43D7C884D408351507B7223698DEF313AE23DAABE8B9B10DB58F86939D054CB5DADE6FCA525EBDC84E26D97FCFD42866D9EF9B179E2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..W...W...W...W..ZW..Wt...W..Wt..W..Wt...W..:t..W..wt...W..wt..,W..Wt...W..Rich.W..........PE..L.....};...........!................]..............`........................................................................(....................................+..........................................x...........t............................text...c........................... ..`.data....8..........................@....rsrc...............................@..@.reloc...5.......6...p..............@..B..};P.....};Z.....};P.....};g.....};t.....};....2.};......};......};............ntdll.dll.KERNEL32.dll.ADVAPI32.dll.USER32.dll.GDI32.dll.COMCTL32.dll.IMM32.dll.SHELL32.dll.....................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msiinst.exe

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50688
Entropy (8bit):	5.935720802852158
Encrypted:	false
SSDEEP:	1536:NB9UO9nZK+ISiSoPSLljX1FEiZ3ZmcmIHv:NB9U0nZKQlNR7Z3gcmIHv
MD5:	41C714021C92086E80B0B57DD1E634FB
SHA1:	60F86C8CE8FA4BEA23D7CA4C4F01E33D63B5990C
SHA-256:	A6F1B26EEB1DE06F319BBE0F5E4BED4AF9C708A9D4F3E574EEA924B29EBD5001
SHA-512:	81C4D3B826F2F715E03EDF2C65DBB9F00990B5A8FA40EEF5531FE1B656CF5DBCF5A45A86E8A903980C07624B84841F34597C716067FE5CC662AD69ED5CBD09A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................l.............l.....L.............L......l......Rich............PE..L...m.};....................."......Cj..............................................j:..............................................................................0................................................................................text...h........................... ..`.data...8...........................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msimain.sdb

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Windows application compatibility Shim DataBase
Category:	dropped
Size (bytes):	134164
Entropy (8bit):	5.119567377291569
Encrypted:	false
SSDEEP:	3072:2vbOQXQtrj+jcAxeL9+9sw4vQoZv++lbuSOS+J:2vbOQmOgL9+YOj
MD5:	9A7CA59803DD20AC5C6B900E8665169B
SHA1:	247C0DC1C82F70E6E7F9CAFA9F7C8C69EC4C2648
SHA-256:	AEEC814144D4253D3167360EC6399F542D9123E4D5878808BAC279D6436B3C8D
SHA-512:	DADD8F6023F063F59C0F7703D706218F59F8D54EDFF3CB2CF8C71C67DF22CF6EE32C379DD65C2C69D3FFCF0D84C500737EA294C9CB1126656FB1D6E629F3058C
Malicious:	false
Preview:	....A..sdbf.xh....x.....8.p.8.`.@......x...VILEBODAf...02MOCUED~...OCHCNERF....OCOTOHPI....RT1002IP....IERUTCIP....VEZILAER....DACOBRUT......YAWNIW&...IUSSKROW>....x.....8.p.8.........F1R..'.r....c..........n...@............N...p{...4!....k.\o8a.&.........>.+......)...w/........=@i?........=@i?.........ED....q-...I.....qM...I.....q]...I:....q}...I.....g.tWc.L.......s3.`O4......~.'.Xl...Y0.50..YV.......3.i\.....7..AZd.f...K@}...F.....0i........?.3i....2...,.3.....j................\...6.l.....\...6.......Q. .d......8 ?..H...,....@N.........i%.B...P...>.......X6...........^^..^!......^^..^!.T....^^..^!.D....^^..^!.6.......L........x.....8.p.8...@...........p..-1..V...U.h.........u.......D.....8.........."a..N..D....H.`T.z........../'2...t=.'.o.+........M..0........9.W1j.......\|.GE....qO.2-:.H:...,....I.R....T.kI..SYF...;.Ek..Y......;..nw[d....8..O.f......'.fK.h4...c...I..q....J....z.y....n..g...\|......!Y\|p.......&Eo....r.......L........eS.....B...&.w........vI!$!E-.H.

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msimsg.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	5.777004388495094
Encrypted:	false
SSDEEP:	24576:yFrNsyKWdbhmUXE9KIrufRO4t1YF6OWez17:KZhmUXE34t1YFp7
MD5:	0695F0F7008EB5F5B389ED0E57089BDF
SHA1:	16C1EFC321761DA9A082DA756ED9D1AADF9CA246
SHA-256:	FA4106578D9B3C425AB992B0877CBE1D60A05493CBF46FB21ECA89E5D468A0A8
SHA-512:	2F2AB3A4498ADED3E76A9DF0765E8390A9BB9F9D3E1500D1B8DD3679CA22E882C323492AC576DC185B9B6581FCBFFB1233A6E97CBB2BC33501A6C0C0E80725DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=.C.S.C.S.C.S.....B.S...n.B.S.RichC.S.................PE..L.....};...........!..............................q`...................................................................................x............................................................................................................rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msisip.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	6.201920535107619
Encrypted:	false
SSDEEP:	768:6Gxnz2TWfL8g3/2RVjoOPeHd4xKQ7m4d05hgl36:nxzdfLn3ug8eHd4R0fgl3
MD5:	91E27CBCEB6ADDCFDF0D1E7D1A3AD339
SHA1:	17D489C003355A34197C84BE37ED393BB9BFF2D3
SHA-256:	DEC5542F2A19FF58AF26B1E30A80D2628AC8FBA9D8569A867F1C8529EB209F8E
SHA-512:	58FC549A3953456F4149582288B35F98D72231FF06E34E633A3DFD77FCBBC5F9C2C8B864F02E32259B0D6AAEAE72F860CD3CD6739134424FB3447044F62E83F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............c.,.c.,.c.,8@.,.c.,.@.,.c.,8@.,.c.,.c.,.c.,8@.,.c.,U@.,.c.,.@.,.c.,8@.,.c.,Rich.c.,........................PE..L.....};...........!.....z...&......(;............_`.................................c..................................8.......(................................... ...........................................0....................................text....y.......z.................. ..`.data................~..............@....rsrc...............................@..@.reloc..d...........................@..B..};......};%...........KERNEL32.dll.NTDLL.DLL..................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\msls31.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	5.9814955021734715
Encrypted:	false
SSDEEP:	3072:sIvjlvPmGwB5RezjIN+vqjo/pFNrk3br+uubhokMD81s2pAFfqCF1hW4HgB/i:sSjpjwOjIN+v30vsVW2pK7F1hW4Hg
MD5:	2CAB9989FB957EFD98DBBBCB9B1946AB
SHA1:	0D01E4AC66D852730D8031A2BCAE215210EA7385
SHA-256:	841FDE9B24476A7ED364A3E4A1470AC9B7358BC92F29FCA4A06AAB557D140850
SHA-512:	92FA2DACE9589789FE2A84E4F561D1DDA32858AEEB4CD13EF73D94D6619A27F68988D653367D0CEB91FBFF8C427D6FF28E8ED0FE00FBA91B006F9FA13F3F9943
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..cp..cp..cph.ip..cp8.ep..cph.gp..cpRich..cp........................PE..L......6...........#.....0...@............... .....H.................................=...............................A..Y............`.......................p.......J...............................................................................text....#.......0... .............. ..`.rdata.......@.......P..............@..@.data...@....P.......`..............@....rsrc........`.......p..............@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\mspatcha.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28746
Entropy (8bit):	6.545540060601869
Encrypted:	false
SSDEEP:	768:hLCnlsA4wVor2lcvDd2nafVz7aGXdP6YMKdI6C6udCv:h2voo2p2naf9aediYMftdw
MD5:	60D88C0829FE1E16C32F76D71724807B
SHA1:	40FB4D13A643B6F8A7A7CABC2A3F9E48B9E0CC50
SHA-256:	6007DA6BB72FE138DD4AE622C78C5337E3EAF9E8020B748B4A6918563EC988F6
SHA-512:	A8D35023AA60C601B581847E8FA3A1B5E52D5A6515DE6C6EAF7AAFA64CDD6A3BFE6E17281C6870F39343D8D45E2460A8730E8BAA26C24296087BF37ACF55E414
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................Rich...........................PE..L....aJ9...........!.....d.........................X..............a..................`...............................p.......n..(...............................X...`...................................................T............................text....b.......d.................. ..`.rsrc................j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\riched20.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431133
Entropy (8bit):	6.6536949023972145
Encrypted:	false
SSDEEP:	12288:xWNTGm1c2qUkM9nv2VOXRc5uynesaycwrt/cIC:xW8m3qUv9EeROxXcoJC
MD5:	AE5ABEC31518E015A9FB4EB196854291
SHA1:	DEB63ECB2CBC60A688797478A204A2A57F49D1E6
SHA-256:	1C2508FB55DDC459D0327F2017471545C87420443391567094E768FB34032DA1
SHA-512:	DFE3E803AB7940FE4811627832CD048ED872111C3AE6B4DFE3493CB14E7932AFF9B5ACA7E5F387F5B38A44CAFBB350540A4B41955A3D28F36953B01FABCAA2F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.Gu...u...u...u...{...,......._...t...u...$...Richu...........PE..L...0.V8...........!...............................H................................................................`...=................w.......................(..<.......................................X...l...............`....................text............................... ..`.data...............................@....rsrc....w.......x..................@..@.reloc...(.......*...j..............@..B4.D80...0[.8=...4.D8G...4.D8T.....+8_...........KERNEL32.DLL.NTDLL.DLL.ADVAPI32.DLL.USER32.DLL.GDI32.DLL........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\sdbapiU.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72192
Entropy (8bit):	6.449616021144991
Encrypted:	false
SSDEEP:	1536:R+XuzhVtdQKdeHAonHjKN7TtKIn+UT+eSIdzw2ah6lLd0O:R+XuzhVtdQKd9GOd/+eSm6h67F
MD5:	552F387180800CDEA023DC65E2F62416
SHA1:	E0E76E9D224157FA9D1B83A1533B049103EEEBBE
SHA-256:	55AA0917FD64607FEDC6AD71DEE75E333C23DC283342205880F8F66DEDA269E6
SHA-512:	144E4EB61E932BC33EBBA9DCCB5D3A450EA7E1B63C54B459F47CD1CC0A5178C545DE16FD5D3E3F1A3861BCE56C9FD7D4DB457DD4A1A744A06FD255C3E0DEA1F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.5...[...[...[......[...Z.T.[..B...[..d...[.......[..G...[..f...[.Rich..[.........................PE..L....};...........!........."......^..............G.........................P......7...............................0...c.......P.... .......................0......P...........................................L.......P............................text............................... ..`.data...............................@....rsrc........ ......................@..@.reloc.......0......................@..B..};(.....};3.....};=.....};3...........msvcrt.dll.ntdll.dll.KERNEL32.dll...............................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\shfolder.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21021
Entropy (8bit):	4.8801661651868615
Encrypted:	false
SSDEEP:	384:L5yAJ3gXLVMYNcJhGCMcrXWpiWwH/sHHgH2nKwsHTWHi5AGsHW0HcHpLHP0oqQGI:0AJ3IMYNcJXMcyu/z
MD5:	B7993C10B9A8C3B9735D7696C7B9E8B6
SHA1:	AC2E765311380BFA502B3B7AED2E8D80C351E08B
SHA-256:	6F0443A62FD444C4254F902F668543B867A0577504915D22CD75328F73CD4472
SHA-512:	D17AE76467F5FAC056494A0FDEF445A5BBB1F633507DDEF9B2AFC12DD47EAA68096784D47E968383B207382850100EF1915378E74564E29CBE1C8E0D422DD679
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{J...$...$...$...%.'.$.L97...$..."...$...$...$.Rich..$.................PE..L...q.^7...........!.........0...............0.....u.................................................................'..k....(..X....@...+...................p..P....,......................................`...4....................................text............................... ..`.data........0......."..............@....rsrc....+...@...,...$..............@..@.reloc..P....p.......P..............@..BM.^7....N.^7%...........KERNEL32.DLL.ADVAPI32.DLL.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\OFFLINE\mWinRun.dll\unicode\usp10.dll

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314906
Entropy (8bit):	6.170788306003831
Encrypted:	false
SSDEEP:	3072:10EvBHYN6cpZbdPYxDhjnYnMq182s8Vvh0VCPL2zHoytG5dHJZE5d8wfI:1LHYwcLdy9Ir6v8tS8ytG5dHL+pI
MD5:	4437B4E1EFC79C331070B9F481E3E97A
SHA1:	793B1D0839912679CB43E50B63C186205B8B7D44
SHA-256:	4D8FF1F53C3BABF9BFD11B2EBCD44E2698CFE3BC80C6F0CBC64C0D191EA1FC1B
SHA-512:	C82CEA06778426943958E47A8A3372731A3834C412F919E1E6C35B7FE41DD55E3E6D881CD489464A69FD65180A4B1632527C0B06E62700F5C66BF4867089A7CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................Rich....................PE..L...0.C8...........!.........................@....ef.........................@....../^..............................@9.......1..d............................ ..p...`...........................................l.......`............................text...]-.......................... ..`.data........@...>...4..............@...Shared..P........0...r..............@..P.rsrc...............................@..P.reloc....... ......................@..B4.D80...0[.8=...4.D8G.....+8R...4.D8\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ADVAPI32.dll........................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\data\SaasAntTransactions-Setup.msi

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C8F3C76B-9135-4D81-AF4D-D3B6D839248C}, Number of Words: 0, Number of Pages: 200, Title: SaasAntTransactions, Subject: SaasAnt Transactions Installation, Keywords: Installer, MSI, Database, Author: SaasAnt, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	991232
Entropy (8bit):	6.324192997097148
Encrypted:	false
SSDEEP:	12288:YnLsSxuUmtFqpXBRYIjBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:6LsSxESXJW5BqPA2fc7wMz7
MD5:	90EF4CE95FBBF3C2174F8447EE770833
SHA1:	CC5D130855474D6D0D40647D02F04A23967EB919
SHA-256:	EF8584AE0B98FC724BA39CA758FD04BCAECA9EB80F0DF62738D1DBB36F7AC768
SHA-512:	2C3B5C7BDB1D0292314F50FFD118037817DFAE23F0E180A4D12986B8835705A040329D8172CB633C65645D045EB5672EDF61E50C192C6A315D1868E19644C14C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB83E.tmp\mia.lib

Download File

Process:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	606266
Entropy (8bit):	6.509399522017653
Encrypted:	false
SSDEEP:	6144:77mkzB4Do4JUqptRCwCzae0LYPpeBnVZ8w4toZAcLrJa/liSVHUPk:nmkzB+dtRRReCYRo38KLg/lIk
MD5:	6017C5F8EA6382684DEF62597535B277
SHA1:	1ED79B319B3B0E47BD3B08C194B4CFE1A06F12A8
SHA-256:	F4BB9CF2E03832F23B407D4BDEF1D44D4DFD6A510F2FDC1A6BE263241914B55B
SHA-512:	65A0E4505294C621C031F64051017C9BEE36EF4B5F793C39010A516E84443CD85DBF092A1B4D6526ABEFD499994739326E0B55B2480523DE7C8189B6DD3FF0F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.dat

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.208834227097956
Encrypted:	false
SSDEEP:	6:S5Y9SDwiwfNBr52EOXiaeUVb9Xiae1RfnsnpUOyE9Xiae78azAz7jM41wy:S5Y9SDwiwfNBt2E4mUrmTfniUFE1m7fU
MD5:	4C69F95F19B18CDE7952425DCA733EF2
SHA1:	C9CBED6BD59ADE5572844975BE1AA0895182B92A
SHA-256:	90F64E653E23CB64DD89C0173FA836738C55B6518BFBCA6618E6ACB047116184
SHA-512:	3D75E3251D6B95648ABD17827E9CA85DBB78C144BFBD0EBE1805D0C6B220D2B328D26DB5813EB586163A7B8FC2F262CA5E314631C71DE7AE5F3F3596DAAA7C3F
Malicious:	false
Preview:	MYAH-PREDEF-COMPONENT..Default..$..TRUE..TRUE..$..$..$..$..MYAH-PREDEF-COMPONENT..40196391..DEFAULT..0..$..C:\Program Files (x86)\SaasAnt Transactions..TRUE..SaasAnt Transactions..C:\PROGRA~3\{C8F3C~1\..MYAHLOGO..TRUE..STARTMENU..SaasAnt Transactions..MYAH64WOW..Win32..OVERRIDECACHE....NATIVE_ENGINE..FALSE..

C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.exe

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5605720
Entropy (8bit):	6.462629310060085
Encrypted:	false
SSDEEP:	98304:+F/bhwf+r5KT19iMvK1fucWXbBJ2Z3H2L7K13icjqsNTUOJ:+nwf+rMoMS1furLWHNFF
MD5:	41C67C2E7C85536894C9E348DA79EC9F
SHA1:	E9D198342373D581166DC97A28329448052FD637
SHA-256:	E4D21DA4A6E9A9BC18E51E949814E9ED19EF9057BAD161A6DF90B2608EE8452F
SHA-512:	20C0D57385D58D9ADA3AAB2F43FB4E9120DB1293FF90A61F3953F9E20C0FCFCDC0DB1E1A5EC50195DD3ABF8D2DAFCB8BC934A3DFD9EEFBB2CDB819F612CAA9FE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...%.R[.................\|9..&.......E9.......9...@...........................W.....o.U..........@........................... <..U....@.(...........`WU..1....<...............................<....................../<.......<......................text.....8.......8................. ..`.itext........8.......8............. ..`.data...0.....9.......9.............@....bss....$.....:......r:..................idata...U... <..V...r:.............@....didata.......<.......:.............@....tls....P.....<.......:..................rdata........<.......:.............@..@.reloc...1....<.......:.............@..B.rsrc...(.....@.......:.............@..@.............@V......VT.............@..@........................................................

C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.lnk

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.msi

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C8F3C76B-9135-4D81-AF4D-D3B6D839248C}, Number of Words: 0, Number of Pages: 200, Title: SaasAntTransactions, Subject: SaasAnt Transactions Installation, Keywords: Installer, MSI, Database, Author: SaasAnt, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	991232
Entropy (8bit):	6.324192997097148
Encrypted:	false
SSDEEP:	12288:YnLsSxuUmtFqpXBRYIjBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:6LsSxESXJW5BqPA2fc7wMz7
MD5:	90EF4CE95FBBF3C2174F8447EE770833
SHA1:	CC5D130855474D6D0D40647D02F04A23967EB919
SHA-256:	EF8584AE0B98FC724BA39CA758FD04BCAECA9EB80F0DF62738D1DBB36F7AC768
SHA-512:	2C3B5C7BDB1D0292314F50FFD118037817DFAE23F0E180A4D12986B8835705A040329D8172CB633C65645D045EB5672EDF61E50C192C6A315D1868E19644C14C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.par

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6086
Entropy (8bit):	5.214530823869961
Encrypted:	false
SSDEEP:	48:bvEHUj88RFXxGoT2PjvculVOCfLgT1fY5t7STVgBAFBf/OU9+rTcyC3TTCcFdydK:z/OAEgT10WIFcxWU+8
MD5:	951CCBB48C1A9B21D334A82D83E466DD
SHA1:	BA8BCB5DFC3364A57771E109E6A3782270E3A295
SHA-256:	30CF08829AA3C568E7FFCF9ECBCBEC9140B674BF0F4CB8C37E38E9718F611C3D
SHA-512:	B6D931C559482466F73F8D0481C86A0113DCC324239EF770AC5D83A337D6E6FB94C4F57753C6C2C7A7562750AA404CEEE3E1E7A29697EBA74B745C84009C8CE4
Malicious:	false
Preview:	.AF60707B8..FALSE..A61541D54..FALSE..A47DD5368..FALSE..A1DA3E462..FALSE..A52098B21..FALSE..ACC802F8F..FALSE..A59E0FAE8..FALSE..AB788C7C3..FALSE..A5A32B2FE..FALSE..A63ADD426..FALSE..A79EF4496..FALSE..ACB29EF87..FALSE..AEEE19DB2..FALSE..AA04D6C1D..FALSE..AF6E1FDBA..FALSE..AD0DC5192..FALSE..A901C7C89..FALSE..A6A99F5AE..FALSE..ADA156853..FALSE..AEB13BCBE..FALSE..A4625E0D0..FALSE..A1A97511A..FALSE..ABE04B6CA..FALSE..A35677B4A..FALSE..AC9CFA174..FALSE..AAA35C740..FALSE..A85CA11D2..FALSE..AFCC6B9D7..FALSE..A661E908A..FALSE..A4AD6D99..FALSE..A2639F99..FALSE..AEDD15B9F..FALSE..AAAB28644..FALSE..A32755537..FALSE..A1B03632E..FALSE..AD5A26372..FALSE..A6A02C8CD..FALSE..AB35D72DF..FALSE..A905D6215..FALSE..AAA301B57..FALSE..A92A72B5F..FALSE..A7703EBBF..FALSE..A7AA45FEF..FALSE..A41283706..FALSE..A3D4D0848..FALSE..AF8ED8800..FALSE..A905D63D6..FALSE..A6A38D2E8..FALSE..AD3571AAB..FALSE..AC8694C4A..FALSE..AF89064B2..FALSE..A8D59114E..FALSE..AB62AF75C..FALSE..A80CC9BA..FALSE..A79EC1EC4..FALSE..A67A3EB0F.

C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\SaasAntTransactions-Setup.res

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	8010621
Entropy (8bit):	6.095824757520697
Encrypted:	false
SSDEEP:	98304:AHDDYZC6Olj61KNnVzszjdZcXljpZJCjOVxBfn:AOyVxBfn
MD5:	90092A45DE9E2A26FE14E4705292832A
SHA1:	3650B13D0A14C4EC22BC17D70380001045184255
SHA-256:	2682AAAE215CA934D18AC1CF354DD22DA10B52532EB026D16FC2D6429488B339
SHA-512:	53390ACC45356A2E652EC6D147745D765D2377F0B8719AC6952FAEE0EB3E31CE0BEFB23FF856EC9A2CA3F17CD3A3C7329A2F17B93BF5D5957DCD28268496FD8A
Malicious:	false
Preview:	7z..'.....=.~+z................r...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb

C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\instance.dat

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.644719338231514
Encrypted:	false
SSDEEP:	3:lhyTZsp2Thgn6IRLUtnOjLEWSFxXiaMKiy:lAHi6suj9Xiaey
MD5:	95654CAAD8B886829EB458A7FCB652F4
SHA1:	A48616F19768607A6563AA71218CF689F53CD657
SHA-256:	49648E2ACA296AB2AC633436F7101375FDD3A88C84D74F1C2C6B8DA4F0D0ACFC
SHA-512:	1176C92E6434F2E90393E5778BD5EA4C17CD5C1DC160634F246BA1971F91BD5F8C8D01A3563C6AB9A858A4781E8B079798D91D0D8A98BF674C64FE8E2A91B268
Malicious:	false
Preview:	{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}..{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}..SaasAnt Transactions..

C:\ProgramData\{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}\mia.lib

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	606266
Entropy (8bit):	6.509399522017653
Encrypted:	false
SSDEEP:	6144:77mkzB4Do4JUqptRCwCzae0LYPpeBnVZ8w4toZAcLrJa/liSVHUPk:nmkzB+dtRRReCYRo38KLg/lIk
MD5:	6017C5F8EA6382684DEF62597535B277
SHA1:	1ED79B319B3B0E47BD3B08C194B4CFE1A06F12A8
SHA-256:	F4BB9CF2E03832F23B407D4BDEF1D44D4DFD6A510F2FDC1A6BE263241914B55B
SHA-512:	65A0E4505294C621C031F64051017C9BEE36EF4B5F793C39010A516E84443CD85DBF092A1B4D6526ABEFD499994739326E0B55B2480523DE7C8189B6DD3FF0F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\SaasAnt Transactions.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Sun Dec 10 10:43:59 2023, mtime=Thu Dec 28 17:54:56 2023, atime=Sun Dec 10 10:43:59 2023, length=3788792, window=hide
Category:	dropped
Size (bytes):	2129
Entropy (8bit):	3.837232435367538
Encrypted:	false
SSDEEP:	24:8c8BAE6dOE+quZ8AUaJLzxhdgXr+MfVS1Fv3BeSzUz4WfVS1Fv37UUI4JPJRyfm:8c8N6dOXnJLzXd05fVYBeSzXWfVYQ/
MD5:	DC97AA692C8AE57C3DCD11CC72C5B3BE
SHA1:	00265D29A60DA7B579D5E95CF69AB2FA9B4640F2
SHA-256:	64C320C8ACF8CDD83C8475D5CBE3C3D3EB0249F067CB06C53BE48D5C7E88FE66
SHA-512:	EA9970892A2A7BB0BDD90C11B24A7D04C82D064C44E6EA18E347C0F34C17D60BB3E78628533E26E56C6BEB0ADBD351F79F909773E4AC75AC468448BB361099AF
Malicious:	false
Preview:	L..................F.@.. ....H.^+.....Y.9...H.^+....9..........................P.O. .:i.....+00.../C:\.....................1......W...PROGRA~2.........O.I.W.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....r.1......W...SAASAN~1..Z......W..W...........................&...S.a.a.s.A.n.t. .T.r.a.n.s.a.c.t.i.o.n.s.....\|.2...9..W.] .SAASAN~1.EXE..`......W.].W.....1.....................Fw`.S.a.a.s.A.n.t.T.r.a.n.s.a.c.t.i.o.n.s...e.x.e.......r...............-.......q.............b......C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe..2.I.m.p.o.r.t.e.r.,.D.e.l.e.t.e.r. .&. .E.x.p.o.r.t.e.r. .f.o.r. .Q.u.i.c.k.B.o.o.k.s. .D.e.s.k.t.o.p.I.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.a.a.s.A.n.t. .T.r.a.n.s.a.c.t.i.o.n.s.\.S.a.a.s.A.n.t.T.r.a.n.s.a.c.t.i.o.n.s...e.x.e.[.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.A.D.F.3.3.6.D.A.-.8.3.A.5.-.4.B.5.9.-.B.A.8.C.-.0.7.D.B.C.9.4.3.4.5.A.1.}.\

C:\Users\user\AppData\Local\IIIQF\7z.dll

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	6.279217790646268
Encrypted:	false
SSDEEP:	3072:xyljBP/VZjAISqyTFjoZAO1h7BTF1rJa//diUTTBXJxO8hlIhb0:xeBnVZ8w4toZAcLrJa/liSVHU
MD5:	31CAD6A3EDD1C32981AD6B565CBEAC94
SHA1:	9338978C85A9423EE2A38CBA027F79192D684F1B
SHA-256:	B8521ABDA09EC17DDAD36528C1BC50395DC8C5F7C11C026A5B3FF23110C54182
SHA-512:	02E198B8EF192DE55DB35AE00A16A80B3309A9373A596C20D617B43DD7159A635BC303F371859E704375521A1242D02754807E2E9DFEF63FFD06993B24C17D3D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..P....................6...>..............._...........6...P...o.^.....o.j....................Rich............................PE..L....S.L...........!........................................................@.......................................@.......9..P...............................@.......................................................,............................text............................... ..`.rdata...@.......B..................@..@.data.......P...4...4..............@....sxdata..............h..............@....rsrc................j..............@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lang.loc

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161850
Entropy (8bit):	4.662047306059787
Encrypted:	false
SSDEEP:	3072:VmLCDQ9xl64bNmso7f4vqp/Mp+WD7UB4/YQfl:s
MD5:	6D2EA67B5892DC26D5ABD01608BC086A
SHA1:	14BC24724509E44918252D155FA3E7152FE232F3
SHA-256:	76AA59963903F0299CDA780A1DA7583227CB4C84F4EFF213A101841CE02C39C7
SHA-512:	1842D801325A1FD6F479A42A98A1C5A49EE7707B682E45BC95AE23C0E073288E9C4889710F6D925B6E852540355CB66565E2B745CFA7C76F34BF26FDDAAD9D7E
Malicious:	false
Preview:	Please install the common controls update from Microsoft before attempting to install this product...Setup resource not found..Setup resource decompression failure..Setup database not found..Runtime error in install: ..bytes..KB..MB..Attempting to get value of undefined variable ..Attempting to set value of undefined variable ..Copying: ..Unable to copy installation data to local folders..Downloading Web Media: ..Unable to download installation data from the web..Extracting Web Media: ..Unable to extract installation data downloaded from the web..Please locate your original setup sources to continue operation..Original setup sources required to complete operation, sources not found..General setup failure..Runtime error in setup script:..% complete..bytes received..InstallAware Wizard..InstallAware is preparing the InstallAware Wizard which will install this application. Please wait...Retry Download?..Downloading of installation data from the web has failed. Would you like to try again?

C:\Users\user\AppData\Local\Temp\mia.tmp

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (363), with CRLF line terminators
Category:	dropped
Size (bytes):	254808
Entropy (8bit):	5.830618485549341
Encrypted:	false
SSDEEP:	6144:msTS5gdOvlAe3RI0mQdGQSos2JE+PpJHVDiMeh:nTS5gdOvKM
MD5:	8D072963213B191784FD7C20CFCC90DC
SHA1:	B29469E9397B120F65F9AB36C22F5B71DF467DD9
SHA-256:	7F4D766324823B3D49353B4F80D29CEB5E1AF1BA00B96C7744E6F4E8EBAA9857
SHA-512:	DF2B72A9F8A318FF3E4DCD3F4EC9DF1817D06F9CA067597DE769FA617E3256991BE080CC89232767AAF6EF7BDB9AC2A39FB8BC13B6C53FC33D2945D9A2C4F26D
Malicious:	false
Preview:	.Set Variable..Comment..Code Folding Region..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment..Comment.

C:\Users\user\AppData\Local\Temp\mia1\SaasAntTransactions-Setup.msi

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C8F3C76B-9135-4D81-AF4D-D3B6D839248C}, Number of Pages: 200, Title: SaasAntTransactions, Subject: SaasAnt Transactions Installation, Keywords: Installer, MSI, Database, Author: SaasAnt, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
Category:	dropped
Size (bytes):	991232
Entropy (8bit):	6.3279146241176925
Encrypted:	false
SSDEEP:	12288:PmLlsxkUm8YWXBRIA+gBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:OLlsxrXw0W5BqPA2fc7wMz7
MD5:	3D34335F4D99FE1A9D8D8F7DA068385C
SHA1:	720745D325879D9D34A9066B37AADB9B416F493F
SHA-256:	66FD906AA278AE740504F1812B1368005ACBD27AE59D3859981BF4AD7FDD5F99
SHA-512:	0103BFFBDA90CF5BE89675A6E22C77D0E22DC10FDB5A09AE24A6F8EFE986035F6A076D9A67D0877E26908383FCEDD0B2CA53B201BA7B834971C8F702AA48C123
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	170267
Entropy (8bit):	4.139875113126559
Encrypted:	false
SSDEEP:	1536:k1Qa5EW7a5tGCwhwGYAh4HHGya5Y4c5sHC7WrC:oQaKW7ajRwhMdFanc5sHOWm
MD5:	55C9EA4FD3509F7BFBB6E070536A989F
SHA1:	F07DDC5147664AE877C790FDFBB88D3E62672B22
SHA-256:	9CBA29068D51907F65ACFDF4871C3A04329F778C926C93C5DF52A50BC6EA504D
SHA-512:	F831D031938C872BA4A6EEBDE98BB65771CB3C422E015EC1B94E46DA01C06A5D1C97AB6B474532A3BF0A840E44F68F152621D027C4B7039D0C1A2E4503A0819B
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq

C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mia1\destination.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	170061
Entropy (8bit):	4.134125568648367
Encrypted:	false
SSDEEP:	1536:9qQa5EW7a5tGCwhwGYAh4HHGya5855sHC7Wr2:8QaKW7ajRwhMdFak5sHOWC
MD5:	70525FD0719C4D6563824E18883CB3DD
SHA1:	9D557494102BCAD6B83A70748E17EBC24E5368FB
SHA-256:	ABC489E6994695B84C7C85F440A467B36CA8F0A011626DEC7FC3B832B29A0059
SHA-512:	28609F67F32F2978BEF9766BC2261156B8E3C46EE5D4930C1508EBFF5368E8766DAC1864015FA2DD335A505AB619FBB8CF5620568944C9B8544E797FF554C026
Malicious:	false
Preview:	...TFRMDESIGN.0.9...TPF0.TfrmDesign.frmDesign.Left.N..Top.\|.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq.

C:\Users\user\AppData\Local\Temp\mia1\destination.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.517230484954688
Encrypted:	false
SSDEEP:	3:XMaxAHGdRFRzuFRAdRLOEpe7J0vKaxAHGdRFMLYFRAdRLOEpe8vn:hx6KjRqMtrkeTx6KjMLYMtrk8v
MD5:	59026423C0D44EA89B888B433C25984B
SHA1:	E792D1B561AA81DE58715C5E7563F22316E940DD
SHA-256:	8811FC95D244192A55F4FA9E674ECB64E4C53E03F21985548C41191CACEB5C7A
SHA-512:	7DED0CB646211E3FE1849700FC88941EE7542573A5D88E8B165C96F088B690EDE3B7393ADF621755E41C5A96A1C49A7175E8E70F466936B3CBCD812B4E7DAF81
Malicious:	false
Preview:	.IF (FolderText.Text = ) THEN Next.Enabled := False;..IF (FolderText.Text <> ) THEN Next.Enabled := True;..

C:\Users\user\AppData\Local\Temp\mia1\etilogo.png

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PNG image data, 534 x 705, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	120159
Entropy (8bit):	7.964046812547644
Encrypted:	false
SSDEEP:	3072:2a3gxwFslLDRca21spNX0zy/ZFNbQoOi2B:2avFeLVctJzypQhrB
MD5:	BC23E3EA252228DF01DC50CEC4ED9178
SHA1:	3EA07E701AE17AF9DCB03DF3188AC6C8CF0B910D
SHA-256:	1AB783B2A514F0349BD001546E325BB2E9660A28E5E338ED93419E8ECD091F5B
SHA-512:	821AB95E5DB8087BA3E955B46AEC7D1E3332AC9054161F7A00B8D9B0079DD05EA2F31707409B597C7381CCD5992AEC94F04C5CF6297A403F82EE13D072FD4F18
Malicious:	false
Preview:	.PNG........IHDR.............3..v....PLTEGpL.\|.......1m..............l..h..c..b.......0u.....[.....\..QJ.z.agl.MGPq{ipr..........E;.WN.OH"4S..H..........U..........................p..}....................v........d....................j........[.....\........{........v........~........c........_..v.....X...........l..e........z.................U..p.................o............................................h.................u.................................................._.....`.....a.....[..............m...........R..........................j..P.....0_............Fv...............779....J..........3...............B..}..n..Z...`....R....R..m..4..)l.VVXDDFL..J..,,....egi.x..L.9t.h....#..9...9....{}~......v..t....F.......'.vg...{8..>.x...."tRNS.5+R..... ..o...\|..>.a..Q.zq..........(IDATx...".....f..qz.!L....P..;T.x....bAh..:."..../E.z.....tp/.......cn9.X...0.+...N.@.vv.Zeiw.U.~..}.>z....._.........GG....G...'._....1.+.......!...x...Z.{..b.X...x..l4zy......./..Q.. .#..

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	169465
Entropy (8bit):	4.121412448722742
Encrypted:	false
SSDEEP:	1536:2kQa5EW7a5tGCwhwGYAh4HHGya5QOE5sHC7WriQ:JQaKW7ajRwhMdFa7E5sHOW2Q
MD5:	9BEE60F92CF26E61B26BB046B9AB10EA
SHA1:	3A8C5C81B0DBF7A72AA17252D53E543CDC93048F
SHA-256:	E69471B808DC761BD503C2B4945E63F0988774E892BD4311D15FCB6916F38978
SHA-512:	EF6F63D910F8A909F48A9B6DA17D354EF2C2882B830275C21E0A9CAD54CF53DAFD969118DDABE3852B5553CF23FC0AF626E6F3305D211A0876A163955FFB84DD
Malicious:	false
Preview:	...TFRMDESIGN.0....TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq.

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	5.031607754540321
Encrypted:	false
SSDEEP:	24:vuikSi+nfi0ZiFuEai/pZSruicvSi+pipUivuNsIi/pEaiDatfi/pTvSgREii/pH:v5ExAGVPbu1ZRMfkf3faWYt
MD5:	B1F0A5E29827E1142A662C5559466064
SHA1:	379997B841337E254D7B4DB866E7553EC1A008B9
SHA-256:	0B686C6CA39DDC944696D1BA7D78D0B08A4AEC8F3EB1B22CE6E216B98B99F9AA
SHA-512:	3B5F07F835A5526893A6D8EE1DE130A260D34B1E192E54EDFD68C4583524A61285D71046E3ADED8C8A23EE870943146ADD659BB17D9F187B62785F9347452230
Malicious:	false
Preview:	.IF (checkSuccess.Caption = COMPLETE) THEN textComplete.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN textReboot.Visible := True;..IF (checkSuccess.Caption = CANCEL) THEN textCancelled.Visible := True;..IF (checkSuccess.Caption = ERROR) THEN textError.Visible := True;..IF (checkSuccess.Caption = COMPLETE) THEN RunNow.Visible := True;..IF (checkRemove.Caption = TRUE) THEN textRemove.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN RebootNow.Visible := True;..IF (checkSuccess.Caption <> COMPLETE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN textReboot.Visible := False;..IF (checkSuccess.Caption <> CANCEL) THEN textCancelled.Visible := False;..IF (checkSuccess.Caption <> ERROR) THEN textError.Visible := False;..IF (checkSuccess.Caption <> COMPLETE) THEN RunNow.Visible := False;..IF (checkRemove.Caption <> TRUE) THEN textRemove.Visible := False;..IF (checkRemove.Caption = TRUE) THEN textComplete.Visible :=

C:\Users\user\AppData\Local\Temp\mia1\gray.avi

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	RIFF (little-endian) data, AVI, 107 x 31, 10.00 fps, video:
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	2.6025793031989863
Encrypted:	false
SSDEEP:	96:D5qqqqqqqqqqwrrrKKrrrKgUUUKnUUUKmZ6UUUKoUUUKdUUUKxrrrKdrrrKqqqqO:HrtG6vxiF/xP
MD5:	718C1569EA402531E0C285D7F2F00B54
SHA1:	010B39EEB4CA2AA82D4FF3B5C0AE1F615FAA090D
SHA-256:	CB0ECC02BA073771704AD7406B8C385B0722AF56FEE7B1CC7EFA130119BB74E5
SHA-512:	F09B35695B8341A0A58DC8E56346D07781020F04508F5EA52997880A0C663796204159997898F7E26AB1D77E84C204412385D07F1DAA56281B124A88E112CD90
Malicious:	false
Preview:	RIFF8...AVI LIST....hdrlavih8.......h.......................<'..k.......................LISTt...strlstrh8...vidsmsvc................d...........<'...'..........k...strf(...(...k...................................JUNK................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mia1\icon.ico

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	121104
Entropy (8bit):	4.123155981048824
Encrypted:	false
SSDEEP:	768:mxarF3HDyeMMY4t8zAnyhODi5VVZDxVbcOiNMH0jJi+UWo7ORCteUla0jyG1if:mxAFZnt8CyhOKVVZcx7tiaCQUlakVE
MD5:	195A448C748728F9A61A7F455018E5BC
SHA1:	3D5CB16EC91CEC66A30348685465394ED1584C4F
SHA-256:	868229E3CAA7DBC05D3CFF67781C3D2E8385620593A8DBA8674FD0357A5B1AE4
SHA-512:	9128A161DC437792E53BD526D5E605BDA4980157A07ABF668ADC0D635B06F83DBFAE31F190701165662E677684E836F67AE49A4FEE838420ACCB7F233642E105
Malicious:	false
Preview:	............ ..S..f......... .(....T..@@.... .(B..0\..00.... ..%..X... .... ............... .h........PNG........IHDR.............\r.f..SiIDATx..y\|.Wy..}...m..8.Y..$.xK."S.-;2e).....B[Z..R(oK..%J......Z.RZ.H...."%.C....o!.JC6g..;w........zKl..W...D...=3s..<.9."..,%Tex.gr....^^...eD....g....JT..n}r.^..G....\|.....wU...'.<..U.3q;.uq99=..b.."...n..8x../..B.KL..m5.....#...D\.[.Z..`...{..7fJiD....TR.A..r.?cc.##3.t.....^...T.b....m..8....S6.@.E....l=8.r...p..gvm9..."..et~.A..r./.jX.d...7./.....y.....s.v.........gF.....{R,#....P..#.....u..`L.Ff..n.+....:.._y...t.+*...+O@..j..Q....)...b.D\.b.[o.....g../..j...5.+....0......g...+n...6....}g..{..X.1..H.....X.aG.?.5T.1....0W.9..d.o..K...2w....o3._LVT.@.`.z....bE@.#..[.n....l..8.8.O{K.+..E...;.eK....OQ....T7k.b..XD..........ol....Q)..M..C..... ....Pwr.D....^..^S... ..3../...q])..Am.P...C.]....S..oJN...f...R1.d... "1.{..?iT.E0./.t}.1....._...r.......M._..O.{...?S(.:(.n...b..E...].....y...9)..w.r....n.....3..i

C:\Users\user\AppData\Local\Temp\mia1\index.htm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	5.200932239396496
Encrypted:	false
SSDEEP:	24:hPCUdH/lUSnmepDQTZMJnhUn7wBITeyOB:tCEH/lDmepDyZMphUnkBgeyOB
MD5:	0793E8BB393E46AED0747031EA18BEFB
SHA1:	7C24AED88F0278AB82B445333F56AF093B81AAC0
SHA-256:	7DFADDAC1707DF54F6468D3719D2A83675D69280C84F2E24DB77AD0F991B66F0
SHA-512:	7B9BDC91324B57A0B6FD5A667BB321A85A0E05B5B6AAFCEF39FCDBDF4BAB775FADD1CC841E2EBDE7EC87F71C7EB8109C9CB3F7FFBAA207CD53DF431538D8BE41
Malicious:	false
Preview:	<!DOCTYPE html>..<html>..<head>...<title>SaasAnt Transactions for QuickBooks Desktop</title>..</head>..<body style="padding: 0px;background-color: #193048;color:#fff;font-family: sans-serif;">.. .. <div style="border: 1px solid #193048;padding: 10px;font-size: 22px;background-color: #193048;color:#fff;font-family: sans-serif;">SaasAnt Transactions for QuickBooks Desktop</div>.... <table width="300px" style="width: 400px;height: 200px" >.. .<tr>.. ..<td align="left">.. ...<img width="200" src="etilogo.png">.. ..</td>.. ..<td align="right" >.. ...<ul style="list-style: none;text-align: left;">.. ... <li style="padding: 10px;font-size: 14px; ">Bulk Import </li>.. ... <li style="padding: 10px;font-size: 14px; ">Bulk Export</li>.. ... <li style="padding: 10px;font-size: 14px; ">Bulk Delete</li>..... <li style="padding: 10px;font-size: 14px; ">Customizations</li>... <li style="padding: 10px;font-size: 14px; ">Free Customer Support</li>...... ...</ul>.. ..</td>.. .</tr>.. .<tr>..

C:\Users\user\AppData\Local\Temp\mia1\installaware.png

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2510
Entropy (8bit):	7.7918243528472955
Encrypted:	false
SSDEEP:	48:6S/6x4vOrKQ5N0SI2i6Qg32KvfcmiB225ORA7bjhxZc2xCYrXm1LSxv6hU9:nSDuOKb2i6F2Ec3pOa/jxBxCYr2Bsvd
MD5:	5A920C50F9C88A600A69A98B51CC1487
SHA1:	DA284E3F77C84532F96265C3AAC556F7C600FF59
SHA-256:	AC0E370D8EED1D7EB7F1CF8AB3C9F284E92EC24410ADBBE8163E89BCC037AE90
SHA-512:	56B698D81D388E579A179977E78B9182C5D69A68FF88C748B323178EB6E533F93202621A4F4667D501AE59ECE9962C248F90CED18460D3DF65EEE81EF4DBA6C0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y....IDATX..W[l.W.>.....NR.CD%......[.A....Q.&m.............}.......@..)u..D-..b .%$%....+M......{wgf.....7.m.._..s.....Y..I. 2,r.X....i5h......B.....o...#.F.6S....r..U)...M).F%Bfs.$J....?9.EE.#.f.0h...o./.../).4....$e...*..Pe!......3V/......0...i.=.>...B.C.a.82.....$@.<.>....b@..pX..3.nH.#...w.\|...#%..H....p..'.wg..g/....6#..!_......q.x...H(.6.9.. ....K.f.t.E2..xoD@..R7xM. U..q..!<....1./l..{...q..>.#...d.1..<G....=.\|.........Q..4.f....r...y1.$......8....j9......K.#..L....3B-../.f'.g..q.4.I...y....<.t3:..:<

C:\Users\user\AppData\Local\Temp\mia1\license.rtf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 16393
Category:	dropped
Size (bytes):	16559
Entropy (8bit):	4.842744748295051
Encrypted:	false
SSDEEP:	384:yVOT5qyEqXMgTwvqYhbrjpfjUmsENl1Z5yrhlScGlv5BVAxvz2:yMlq0APprsiTZ56hle5BVkq
MD5:	6893EDE3DEA1F758E25EEA5412B4B3DC
SHA1:	E2B0442E22FC46AAE118A527B22CCD4A119EF3B6
SHA-256:	7C890013A867E85EC4676CFBE54909DF9F20013247B29E6A4026C1CC230A54B3
SHA-512:	B7047088FB7019FB3A996B5C7602FCCB113B5D4B4F2E95D200923DB83602A7D68B2B1D03875276FDDAB55C0287D11C26B058B03A02D68AEE6ED1ACDF7878A8D1
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang16393\deflangfe16393{\fonttbl{\f0\fswiss\fprq2\fcharset0 userbri;}}..{\\generator Riched20 10.0.14393}{\\mmathPr\mnaryLim0\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\nowidctlpar\sa160\sl252\slmult1\f0\fs22 END USER LICENSE AGREEMENT\par..\par..THIS END USER LICENSE AGREEMENT (\ldblquote LICENSE AGREEMENT\rdblquote ) is a legal document that binds registered users ("User" or "Users") to certain obligations contained herein. You should read this Agreement carefully before accepting its terms. You understand and agree that the software application services described below are provided to Users exclusive under this Agreement by SaasAnt Infotech Pvt Ltd (referred to hereunder as "SaasAnt", "we," or "us"). By clicking the "Agree" check-box, you are acknowledging and agreeing that you are eighteen (18) years or older, that you have read and understand this Agreement, that you agree to be bound by the terms of this Agreement currently i

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	168291
Entropy (8bit):	4.0808000178095005
Encrypted:	false
SSDEEP:	1536:UNQa5EW7a5tGCwhwGYAh4HHGya5Yv5sHC7Wrz:AQaKW7ajRwhMdFau5sHOW/
MD5:	44C70E90869142ED725D58EB42235070
SHA1:	A507C66BA990475B0C5FF548BB8CF05FB8B7A6CB
SHA-256:	A7A145BDD5243783582D5CE412E4F38CDDFCDB1CE2CAAA806A42B428B7E2689E
SHA-512:	F5731393D65AA66ADF70B709C70F4A90997EF73E4330A717B16AA6E8ADEEED333C2BFA38E9345D870B89A77A4CBEE90C7614BB2C896472943CB16E02D0D972EB
Malicious:	false
Preview:	...TFRMDESIGN.0.O...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.73861100653936
Encrypted:	false
SSDEEP:	3:X/GrL97R2tuFRAdRLOEpe8vi7GrL97VuFRAdRLOEpe7Jv:v8KuMtrk84IuMtrkt
MD5:	CA654011A61F39DFFA059B66B5C17CF5
SHA1:	3132E6C30FBEEBF753B3C6D09230F1E6CC6F5C88
SHA-256:	8FE262CD661B485641F3ECF4BEC6079CB0EA515EE96E2A6C9C71B0CBE683DE73
SHA-512:	A324C6B20A91F73B2B19D96FD98B3FC8AF9C3A1852486D3BBB8D5156A6437D2FFF1FBC5B8747852F99A73DB7E6BF94B94DD8C53DE07A0E1752D590E2176300E5
Malicious:	false
Preview:	.IF (LicenseAccept.Checked = True) THEN Next.Enabled := True;..IF (LicenseAccept.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dll

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1587200
Entropy (8bit):	6.625369192208514
Encrypted:	false
SSDEEP:	24576:tfZhR78sRL2Zxq0Yxfzz/JBySGuDqy8txiZ4enyZ1jTq8kzGkzRaI:VCQ0lYB/J0SGEVOo6psGA
MD5:	E289FE03E461BAF39878972213F20EC7
SHA1:	6FAA11CB6E104AD5FFB26A9612FC37CD39CBCC81
SHA-256:	31A80D529A3EBBED72E1EA678F571D700DBE36396E6C725437FF2B12C5E99511
SHA-512:	9179B458DBEC04BE7326AE0D229C6A0D0EF4B2EC2A6F7967D200C2F6C67858C6EDA78F430F655E4C9DD7042B91A35C9FAE2FB7BD21CFDE5506DCE0D87FE4960E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...g}R[.................J..........de.......p.....Q....................................................................P....0...8...p..............................................................................L:.......p..^....................text....1.......2.................. ..`.itext..4....P.......6.............. ..`.data....V...p...X...N..............@....bss.....W...............................idata...8...0...:..................@....didata.^....p......................@....edata..P...........................@..@.rdata..............................@..@.reloc..............................@..B.rsrc........p......................@..@.....................8..............@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1460736
Entropy (8bit):	6.672375942890088
Encrypted:	false
SSDEEP:	24576:10VVsOA8OlyuOOQbsjMBG3hCaWuaBfhBiSlGJsRMVw3IB9b7epYfF6:1aVHtBYOfhESlFP3CZSKfF
MD5:	D4ED54099D1186758E4C5BCCB35545F9
SHA1:	1A0D16FE21A56776A2954723E9C699074B690174
SHA-256:	6C1F2C15B6F9E068B5213544FECA0E189A56B86BFA877C2BD8E231765CA9C4FB
SHA-512:	0825DBA841197F96E0DE7E249B109CB51FC5DA838FF9EFD13DA8F700F097BE3A61A0BEE663C7FD6D13F911C799465CAE9DE6EB05659D40D77C0F0382DC700267
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...m}R[............................D..............Q....................................................................O........?.......\......................P....................................................................................text...4........................... ..`.itext.............................. ..`.data....R.......T..................@....bss....`T... ...........................idata...?.......@..................@....didata..............2..............@....edata..O............<..............@..@.rdata...............>..............@..@.reloc..P............@..............@..B.rsrc....\.......\..................@..@.....................J..............@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\mWinRunExec.dll

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1333248
Entropy (8bit):	6.6424211334203855
Encrypted:	false
SSDEEP:	24576:dhMU6yqYSJ7c0w2NdM2LPJuXABBcSVW1VVBNMo/GEo6:jex1nJQABmSVWLSo+5
MD5:	EF3FA77D0FC49335AFBE3FDFD55E0D0B
SHA1:	9817797A78174819EEB2A759F7BC6B15B464071B
SHA-256:	152452B88E64E159BB531ABA7AD55AE901F78EC86F26891EF0B9A5329B945B85
SHA-512:	B8DFF917AACB1C3B228E529F3E70193F13F23D9E11D4D91F86559350DBFD17121EAA8FF37C54EC600102EEA2325C8DF7EDE55702E7AC1755EE8DDD889AD02E22
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...c}R[.....................x......(..............Q....................................................................R......."6.......Z................... ..........................................................\.......^....................text...P........................... ..`.itext.............................. ..`.data....O.......P..................@....bss.....S...P.......0...................idata.."6.......8...0..............@....didata.^............h..............@....edata..R............r..............@..@.rdata...............t..............@..@.reloc....... .......v..............@..B.rsrc....Z.......Z..................@..@.....................X..............@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	187210
Entropy (8bit):	4.1972134738099385
Encrypted:	false
SSDEEP:	1536:7/Qa5EWWa5tGCwhwGYAh4HHGta5YnT65sHC7WrI:jQaKWWajRwhMd4aST65sHOWc
MD5:	495C7B5E47E81A48D1F464A731A00AFD
SHA1:	B1FB41A411767533058A30335445DEEEAD4EE48B
SHA-256:	5A026A995494F352377C45DB4123FB368F39807F854F84AD014E640DDC4C06A0
SHA-512:	8F6B79DB5C48056042F90917E20D31279C0A99DB637DB1824921C49D0347FBA2F9F6550CB3366A8340AECEE6E237E0CE1FEE28E28319D6D234690537D0DE7FCD
Malicious:	false
Preview:	...TFRMDESIGN.0.6...TPF0.TfrmDesign.frmDesign.Left.*..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq

C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	168348
Entropy (8bit):	4.082654666205209
Encrypted:	false
SSDEEP:	1536:vMQa5EW7a5tGCwhwGYAh4HHGya5Y/Me5sHC7Wr9:EQaKW7ajRwhMdFaCMe5sHOWJ
MD5:	5E4E906C16844CCA7D62AC5D72232506
SHA1:	E671D820DABC199688C1141AC8121CADCC1D10FA
SHA-256:	152131E9433FE5C4B733CC5C2FCCB43911749568199321D9761319AFBBF75D96
SHA-512:	73449B1CE6D680AE6E2B0916336D85BB9C36CD2D424CEE8D9D39B525788F5A8F210A17AA736B293BCD099CE4ECA6F6549AC60A0668BCF41F8D8C06C3C4104076
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left.p..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq

C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mia1\progress.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	168612
Entropy (8bit):	4.093233388819004
Encrypted:	false
SSDEEP:	1536:ajda5EW7a5tGCwhwGYAh4HHGya5/q5sHC7Wr9:kdaKW7ajRwhMdFag5sHOW5
MD5:	526DC1B19FFBA44AAF9E532DD8348459
SHA1:	6DC90C67E31A53F1054FE9E656881CB424C0CCB2
SHA-256:	F4FF580A3B4D00291492D16CBAF3882CC1649BF7FC2E5CDB81DE52A2BA05C0E7
SHA-512:	EB4BE5E725DA7B48DD8850D2117A854854DD83C7EB4CD03B4AAF2FFCFC901596BAF2D7E2EAA6996F0CCE67B5D86C0829A54CD39CCD102ECC564D18205A7074F2
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color..clWhite.DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm....

C:\Users\user\AppData\Local\Temp\mia1\progress.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.790374511891148
Encrypted:	false
SSDEEP:	6:hjF2duukAiRcjjuukTDoRcjF2duukTDQTjjuukAh:RsIrqar1sIroarg
MD5:	26BA73F7D5201BBD03144A2AEEEB4A2A
SHA1:	E539F819F0A4B74FEF1B58DEAA21F86672509427
SHA-256:	66326E78AC1AEA60CAA6CE6194CF59FD5B557EBA57668E2DE7817FE677FA16B4
SHA-512:	923CB4B216F7D41F60F176B8554D6D6BBDE787A5BD6C624DA4553022EAF93D797A9D86BB4BB5511EB5F425A840E2DBC5563F715D1566564B1BCB6EE108AA19F7
Malicious:	false
Preview:	.IF (TestRemove.Caption <> TRUE) THEN CaptionInstall.Visible := True;..IF (TestRemove.Caption = TRUE) THEN CaptionUninstall.Visible := True;..IF (TestRemove.Caption <> TRUE) THEN CaptionUninstall.Visible := False;..IF (TestRemove.Caption = TRUE) THEN CaptionInstall.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\progressprereq.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	168320
Entropy (8bit):	4.079996400079164
Encrypted:	false
SSDEEP:	1536:z4a5EW7a5tGCwhwGYAh4HHGya5YW5sHC7WrG:saKW7ajRwhMdFaD5sHOWi
MD5:	2ACCBAA4EEC9CEC82321054503817385
SHA1:	CC0CA94F0B033C42B166D129921E02540373469B
SHA-256:	D98A1E7D12BAA595D642EFC84A43C6A0C7F1A266FC0EB99841B804EF15EB614D
SHA-512:	B182F5DC06C2DE7E840517D2D962B4A0190F2317601D2E62E4A081FE01757AA9CC2FA20EFE05A423DF3F59F1A290F6DF53697B777619E8B8FF445140956E6371
Malicious:	false
Preview:	...TFRMDESIGN.0.l...TPF0.TfrmDesign.frmDesign.Left.M..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight....ClientWidth....Color..clWhite.DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq..xo..

C:\Users\user\AppData\Local\Temp\mia1\progressprereq.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mia1\qblogo.png

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	PNG image data, 1100 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	41592
Entropy (8bit):	6.388229867127759
Encrypted:	false
SSDEEP:	768:ttxW2grdpF3k+kR3UJiRvgdWRIprimN7/X47fh:tLWDjcRRoTGi7Y
MD5:	94C59C186EE1DAEAC397EAF12EABDC43
SHA1:	2D88DE18BD29B5D4A4D1C8D967FEB91418DCDCB9
SHA-256:	6B0D616E48E675B9D9C5E82594D45F49D43E99F46480169BB1B7DF69C304C887
SHA-512:	C3EF838B83DD07D7B15E1AAD576740259F6F4A1520FB48AC285A24190CBC75EF3735C04F0046CA67BE8BFBC4A0707D431AA5B67E84367020A8FF73850CD4F715
Malicious:	false
Preview:	.PNG........IHDR...L...,.......&G....pHYs.........g..R..9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Macintosh)</xmp:CreatorTool>. <xmp:CreateDate>2016-02-19T11:28:13-08:00</xmp:CreateDate>. <xmp:ModifyDate>2016-07-20T09:46:15-07:00</xmp:ModifyDate>. <xmp

C:\Users\user\AppData\Local\Temp\mia1\readme.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	158447
Entropy (8bit):	3.655147362695761
Encrypted:	false
SSDEEP:	768:0c+aEilpj+W7aEiltTMtskowhwG1S79AQoM1HaeBiLyaEilM2W0i6qK6qnGx6qg:0c+a5EW7a5tGCwhwGYAh4HHGya5thl
MD5:	225AC934DAB4CA554F2BE763F62992AC
SHA1:	98A49DFD8D41147FD47543AD68482C1C04BEA5F0
SHA-256:	124C20E68DC7BD474C1DCE760ED8011EC59C267E8B98115B90FF124BE8DE7F58
SHA-512:	567AA18536DE9AF82956306BE4AF623A7CF447089F6963AFF03C311AEFD3A4188658D0DF7AE1F5A8A72F18DF2D6EEF205C18F5E5C8CF5792F595BC517393AF82
Malicious:	false
Preview:	...TFRMDESIGN.0..j..TPF0.TfrmDesign.frmDesign.Left.:..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq..xo......

C:\Users\user\AppData\Local\Temp\mia1\readme.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mia1\registration.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	168227
Entropy (8bit):	4.0788923450504875
Encrypted:	false
SSDEEP:	1536:UTQa5EW7a5tGCwhwGYAh4HHGya5YU5sHC7Wrq:KQaKW7ajRwhMdFar5sHOWW
MD5:	D0D9B70ACB9476D8E1A2EBA5FAB1B2C7
SHA1:	E41762DC47B0BF8085ECE4EDE6D84C482A054FCB
SHA-256:	3233923BBDCAB2B74D246A14F01E8647965536DBD86CCFD6AF90369D910EAE3B
SHA-512:	46B853D5A0075CBC8EFD01CB9842AB5D5F2C3790A8603624EC9B1D812853C5DDFDE5BC97650B048F7E3A3E7E3165B31C19363EBA51DAAB408666929BDABE4555
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq

C:\Users\user\AppData\Local\Temp\mia1\registration.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	221
Entropy (8bit):	4.697670484574571
Encrypted:	false
SSDEEP:	6:6BiLYMtrk8TVMLYMtrk8TbB7qMtrke8VRqMtrkt:cGYMtgIWYMtgIVmMtgpWMtgt
MD5:	F2C705AE963C9867C5292C2BA3D3BC0D
SHA1:	AA479DC07518B62235FC6178F4BFE9EE6988486C
SHA-256:	DC5DBA745566975DAC5FC7BF00E21173E9B5123BEE3548EEB875307CF9BF44D7
SHA-512:	2438E4187000B450E0836DEBD417FC1F594608E123BD5DB3105C46CF78AD03C51AE9E0BAD6DD78925AADD3C81EFF51E3FDA6B48F0D7F1F203525903C3415F7AD
Malicious:	false
Preview:	.IF (UserName.Text <> ) THEN Next.Enabled := True;..IF (UserCompany.Text <> ) THEN Next.Enabled := True;..IF (UserName.Text = ) THEN Next.Enabled := False;..IF (UserCompany.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159299
Entropy (8bit):	3.6863122637284245
Encrypted:	false
SSDEEP:	768:R/TaEilpj+W7aEiltTMtskowhwG1S79AQoM1HaeBiLyaEilM2W0i6qK6qO6qIGw:R/Ta5EW7a5tGCwhwGYAh4HHGya5tFX
MD5:	E365CA34F84487F72048CA7AB751A3EC
SHA1:	2435E0F8171EBF4FE8F972C9B574B376B6AEC82E
SHA-256:	8F4CB90C918BCD027D061389AC9A0FA0C4F60C5D99514BDED30D17204266D6FC
SHA-512:	883B32F3CDB4A57B63C82FD55E67D2E43F38DD6439F887D74D3008D979AF7451F141B2D4BC7DAD8AD1E9F4CEAED406AFCD3F85A451F027764E91A0A447868CF7
Malicious:	false
Preview:	...TFRMDESIGN.0./n..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight....ClientWidth....Color.Wai..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq..xo......~u..\|s.........................................................................................................KE>...}.qjb.wph.unf.yrj..\|t.umc

C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	708
Entropy (8bit):	4.634738153762559
Encrypted:	false
SSDEEP:	12:7VGYMtgIWYMtgpYMtgUYMtgHYMtgyYMtggGYMtgFMtghMtgiMtgTMtgZmMtgpVm+:7VfwPi9ALofNpKbBmxVmxWF
MD5:	696AAF75D0FDE1C9A32F6E0FA2748793
SHA1:	5437593B04AE8AB9A0C10AD98081498544C8B8B2
SHA-256:	3CFFFC761E1CB8ABBD1E2AE768498F81C98477BD32593A4B1E2689D664B9EE0A
SHA-512:	E393B331A5D6DFBD879F06C0D12F11D06C84CB55ACAE88FAEBA1E515D4ED6BB86C0D9EBC373414B64BC236FB224692F2E8CD224148B1BD500795A847C1067163
Malicious:	false
Preview:	IF (UserName.Text <> ) THEN Next.Enabled := True;..IF (UserCompany.Text <> ) THEN Next.Enabled := True;..IF (Key1.Text <> ) THEN Next.Enabled := True;..IF (Key2.Text <> ) THEN Next.Enabled := True;..IF (Key3.Text <> ) THEN Next.Enabled := True;..IF (Key4.Text <> ) THEN Next.Enabled := True;..IF (Key5.Text <> ) THEN Next.Enabled := True;..IF (Key1.Text = ) THEN Next.Enabled := False;..IF (Key2.Text = ) THEN Next.Enabled := False;..IF (Key3.Text = ) THEN Next.Enabled := False;..IF (Key4.Text = ) THEN Next.Enabled := False;..IF (Key5.Text = ) THEN Next.Enabled := False;..IF (UserName.Text = ) THEN Next.Enabled := False;..IF (UserCompany.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\setuptype.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	177685
Entropy (8bit):	3.787026651806808
Encrypted:	false
SSDEEP:	768:3gaEilpj+WWaEiltTMtskowhwG1S79AQoM1HaeBiLtaEilM2W0i6qK6qtsCTq0:3ga5EWWa5tGCwhwGYAh4HHGta5t0Q
MD5:	09A963A9E10CA95A72B8BC5238A840A9
SHA1:	ADBF60D74940820E61CF028A883BDBA04963DBC7
SHA-256:	51CE1F8C12D9354CF265C1DDE39AFD0C1773B4FEB3F8B0FBE4E1C44E690763D1
SHA-512:	6D2342EF38CCD8FB5DFB719F1671428E60A4233250BA06B236D3C9978ACAC78884C872222C85D9A0410D69E466A6ACB5987FCC6F98C28ACFA3C9A73167EB154B
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left.j..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq..xo......

C:\Users\user\AppData\Local\Temp\mia1\setuptype.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mia1\shared.translations.English

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4517
Entropy (8bit):	4.661666413680327
Encrypted:	false
SSDEEP:	96:5GxzNElYC8CqoOcKgj63DHcy8PrfbimsjypG/Db6zHGub6zHGW7fY7KMrXH+:5GElVKge3gh3bMoieGueGWrYO
MD5:	963D56EA2892BEEB40C0A8405F1751E2
SHA1:	D5A105B3DCDFE2CAFF1D1A0EC7616CB4CD904086
SHA-256:	D9744F1B16BCBF2ED50039BEB5A4C11967926E836E641F1CA7D89E3716495F6E
SHA-512:	0950B30FD90E14A244AE43810813980F4A01B1788578F24C28C94FBD22253FFA54DB3F8332C663DE5485C73AD33286BCA8BEC81EF34CBF9F2ED54565A47F6993
Malicious:	false
Preview:	.Please install the common controls update from Microsoft before attempting to install this product...Setup resource not found..Setup resource decompression failure..Setup database not found..Runtime error in install: ..bytes..KB..MB..Attempting to get value of undefined variable ..Attempting to set value of undefined variable ..Copying: ..Unable to copy installation data to local folders..Downloading Web Media: ..Unable to download installation data from the web..Extracting Web Media: ..Unable to extract installation data downloaded from the web..Please locate your original setup sources to continue operation..Original setup sources required to complete operation, sources not found..General setup failure..Runtime error in setup script:..% complete..bytes received..SaasAnt Installation Wizard..SaasAnt Installation Wizard is preparing Wizard which will install this application. Please wait...Retry Download?..Downloading of installation data from the web has failed. Would you like to

C:\Users\user\AppData\Local\Temp\mia1\shared.translations.Map

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	3.1405561400213298
Encrypted:	false
SSDEEP:	12:OwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPwFG:OwFPwFPwFPwFPwFPwFPwFPwFPwFPwFPt
MD5:	DECFEF04BC96CBD6E83AF6D4369F284C
SHA1:	0289E19DAF2E04811B50E0D632CED42D1F677724
SHA-256:	EF8AC249795A8BEA6C7E1AEC20935482BB31E98795A3282B829A19D5BC7DBC47
SHA-512:	2F380B592076DB85E70D5E9F73473078A6E3499E176F5F16C96F86FC1B2DFA288D0C9777F673DF8C8EF68EBBF20066D04BB39EFED2148DD95E9AC2E039D32ABD
Malicious:	false
Preview:	MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..DLGS..MSGS..DLGS..DLGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..DLGS..DLGS..DLGS..DLGS..DLGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..MSGS..DLGS..DLGS..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..STUB..MSGS..DLGS..DLGS..DLGS..NATV..NATV..NATV..NATV..NATV..NATV..NATV..NATV..NATV..NATV..NATV..

C:\Users\user\AppData\Local\Temp\mia1\shared.translations.Original

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4486
Entropy (8bit):	4.660441617892177
Encrypted:	false
SSDEEP:	96:gGxzNElYC8CqoO6Odj63DHcy8PrfbimsjyBW/Db6zHGub6zHGWjHtXKMrXH+:gGElIe3gh3bMteGueGWk
MD5:	C389915512EA9D1D936076CC715CF321
SHA1:	AD3A8F210C7EC7199775BC72111F9447B4FE39A9
SHA-256:	71BB5276716099DF8B1B530FB3F3C385DAC3853A6B709B5FE925A5C080D463F1
SHA-512:	C72524CEFB78E5C74DEE55C303273B3F39B006038F471D79C02897925932FD580776FBB6DA5B6E69658DFD47E5F86861614519F8366A8E6411E739C9749369F8
Malicious:	false
Preview:	Please install the common controls update from Microsoft before attempting to install this product...Setup resource not found..Setup resource decompression failure..Setup database not found..Runtime error in install: ..bytes..KB..MB..Attempting to get value of undefined variable ..Attempting to set value of undefined variable ..Copying: ..Unable to copy installation data to local folders..Downloading Web Media: ..Unable to download installation data from the web..Extracting Web Media: ..Unable to extract installation data downloaded from the web..Please locate your original setup sources to continue operation..Original setup sources required to complete operation, sources not found..General setup failure..Runtime error in setup script:..% complete..bytes received..InstallAware Wizard..InstallAware is preparing the InstallAware Wizard which will install this application. Please wait...Retry Download?..Downloading of installation data from the web has failed. Would you like to try again?

C:\Users\user\AppData\Local\Temp\mia1\startinstallation.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	158526
Entropy (8bit):	3.6616949363676894
Encrypted:	false
SSDEEP:	768:fjQaEilpj+W7aEiltTMtskowhwG1S79AQoM1HaeBiLyaEilM2W0i6qK6qHCTqc6:fjQa5EW7a5tGCwhwGYAh4HHGya5tB9
MD5:	909DD5AC30BCFF4D1333654151EB17E2
SHA1:	98F133843B77DABC7D0B6DF61D47459A64E92D19
SHA-256:	42DBD3BBF76FE4FA27965ADBFEAA4323C3D8E3EA4DD7A11D9387AB62517FA98B
SHA-512:	737E27947012475D6DC0D52B26512692616A4CD0BFBA8D02D2D3A48CCE56AD82A08ED86FC63A006873A2C34132906C7E0EDF6BF54154038D007539CC37D04C1C
Malicious:	false
Preview:	...TFRMDESIGN.0.*k..TPF0.TfrmDesign.frmDesign.Left....Top.[..HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq

C:\Users\user\AppData\Local\Temp\mia1\startinstallation.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	168678
Entropy (8bit):	4.094592098752634
Encrypted:	false
SSDEEP:	1536:4fQa5EW7a5tGCwhwGYAh4HHGya58M5sHC7Wrh:yQaKW7ajRwhMdFab5sHOW1
MD5:	7498CA7D19F98F645A80E2B50982AED5
SHA1:	ED8213442BD60C2592B9AEA027FC6D9254061BE5
SHA-256:	9A9BB60E830E7A3EDC35CA22BB1EA831054E18CE0DE6E71A19B19EC56826C79D
SHA-512:	4F953A091F220C7A5DDEAE3BD5694A3997545EFC80C88C4343EA3921A78BC0A7AED89C546B67299E411E2BFB5BAA1F348ADD745CDBA27C66AE72288CE872B7CA
Malicious:	false
Preview:	...TFRMDESIGN.0....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$ $VERSION$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq

C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.88142940077271
Encrypted:	false
SSDEEP:	6:hLYMtrk8LTqMtrkegurusdrHE8Pud2dusdrHEt:9YMtgQeMtg1dsdrHEUxIsdrHEt
MD5:	F50FE9C519147525ACFA922D1EC674F8
SHA1:	D2E5F714AF05CA9029107C4693C66C71414521A1
SHA-256:	A6C80DCFAA1B181F53E962460307AB55B1824A1F2A98BC4AAE7B7265B565D81A
SHA-512:	628B6437C9E356FF27833F3E2CB8FE7631C096F077D89B3E5309275682A3DDA5643232515A618D591A4AFA717AA36A1AE3365784FD45FFEA8B474F7F1CB824C4
Malicious:	false
Preview:	.IF (MenuGroup.Text <> ) THEN Next.Enabled := True;..IF (MenuGroup.Text = ) THEN Next.Enabled := False;..IF (ISNT.Caption = TRUE) THEN AllUsers.Enabled := True;..IF (ISNT.Caption <> TRUE) THEN AllUsers.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\update_download.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32653
Entropy (8bit):	3.2660830298663956
Encrypted:	false
SSDEEP:	768:ytHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf+:yVXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DV
MD5:	CB602028339D00C4DBB706C86DF9E389
SHA1:	F75C115A08686D6A83A660240F54E5234F815688
SHA-256:	19761B22486D4041528899F9CF8F689648BF17CF8D5418459C67E2F8A0C82CC3
SHA-512:	1DD03D35D4E9DC4AC7EC1A1403072FD2D092BA8265F045C59B557B191C73839A0DF12223E76B357B37DDBB6BF4D1E8935B86E709B961F1679BC80E18D0CFDD43
Malicious:	false
Preview:	...TFRMDESIGN.0.y...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

C:\Users\user\AppData\Local\Temp\mia1\update_download.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_install.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32712
Entropy (8bit):	3.276188088838966
Encrypted:	false
SSDEEP:	768:TtHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf3:TVXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D2
MD5:	B34F26CDAA44F4052F6E5492DA03A6AF
SHA1:	C72C7C891DBB2AD7387618B340974EF2E35F2CC0
SHA-256:	A9DCE5F9493CAD5A2059F3485D37F3B104C3D2F620E707FF5CA01AB441BF2462
SHA-512:	C23332865986AA058B7677BEF749C42C92F394E495382AF30D4FD761ABA824C634FE22F1F84D3DD2DB8F7BFCC738DB9F18EA20FCEA47F3DD571C79D93714CFF9
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

C:\Users\user\AppData\Local\Temp\mia1\update_install.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_notify_download.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33015
Entropy (8bit):	3.3312339385168404
Encrypted:	false
SSDEEP:	768:dPHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfW:dvXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dj
MD5:	11F85D2CF8875B6F3319A1A04E67D808
SHA1:	C148A7AC0723FE6246B4DD8FBADF36BE90B74D8E
SHA-256:	D4ECD2325508B27B31E2A9FD4A996FC449B06469C018E6FF107325D29700E119
SHA-512:	9D9D08B218CE5634F810FC32CF35146C5183DD7CB51C11A265B3FFFBCAE17737E756BEB34EBBCA8A00B6CD4377C0A0D4E5576AAC923D609E9FA426C8FFB7DE43
Malicious:	false
Preview:	...TFRMDESIGN.0....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

C:\Users\user\AppData\Local\Temp\mia1\update_notify_download.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	516
Entropy (8bit):	4.934215231943702
Encrypted:	false
SSDEEP:	6:a2P2J2du+P2pVw6P2/u+P2pVIRBN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgf:tI5V50INIkU3lkimkU3MIka
MD5:	E9C9A11806C14939C22C7EA9FF05EB45
SHA1:	8E82BDE4A7B9024195641649BF4ACF1DD5F92499
SHA-256:	F98E5CEB427FD0F0FED3FCF1125856F580547972AF05ECA6D6BE0358F626ECCA
SHA-512:	E8D605167D01C77964DC649676FD5C5ECEBEE11020951A3DA9D10C49368E46B0FFA761DF6DFF08508214A220B0CCFB539C154F2536ABA7ECD7B63DC2C1B50008
Malicious:	false
Preview:	IF (Scheduling.Caption <> TRUE) THEN SchedulingLink.Visible := False;..IF (Scheduling.Caption = TRUE) THEN SchedulingLink.Visible := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_notify_install.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33046
Entropy (8bit):	3.336672790672221
Encrypted:	false
SSDEEP:	768:rPHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfu:rvXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D9
MD5:	673178885A74C5200D7171E1B4E183E3
SHA1:	5818381EF74CC6B69ECDBCB97705869C059577C4
SHA-256:	1BBC1EE74DFD9A03B95C25C9B011965A9EB7F5DE01C696992FF88E2DE052806D
SHA-512:	983AB426C7F766D5656272A1044716D592DA49DEF880B17002AE46F39A9B6EB1C49190A15FAAB6A90934DE2572BB7E06AFC28E3D233E1BBDD6D62AF76C555A48
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

C:\Users\user\AppData\Local\Temp\mia1\update_notify_install.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	516
Entropy (8bit):	4.934215231943702
Encrypted:	false
SSDEEP:	6:a2P2J2du+P2pVw6P2/u+P2pVIRBN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgf:tI5V50INIkU3lkimkU3MIka
MD5:	E9C9A11806C14939C22C7EA9FF05EB45
SHA1:	8E82BDE4A7B9024195641649BF4ACF1DD5F92499
SHA-256:	F98E5CEB427FD0F0FED3FCF1125856F580547972AF05ECA6D6BE0358F626ECCA
SHA-512:	E8D605167D01C77964DC649676FD5C5ECEBEE11020951A3DA9D10C49368E46B0FFA761DF6DFF08508214A220B0CCFB539C154F2536ABA7ECD7B63DC2C1B50008
Malicious:	false
Preview:	IF (Scheduling.Caption <> TRUE) THEN SchedulingLink.Visible := False;..IF (Scheduling.Caption = TRUE) THEN SchedulingLink.Visible := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_reboot.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	877
Entropy (8bit):	5.549505671141563
Encrypted:	false
SSDEEP:	24:7a2XxbXGAwkMLcByKiIabA5SUws88Ya+PR4SoPRebZ9D9KHxWl:m2XxbXGAwkriIr4pkebZ9IHMl
MD5:	624DE50A4A6C0437D980DEA773109FF8
SHA1:	F249E26093386FFE926030F28FE2B0B4873625DA
SHA-256:	C4ACFDD3B07FEFA0DB03CD681ECAA839BFB04EB777E526434599B5A41FF59BCB
SHA-512:	63C82867571F41ADCDE0BF0E6DABABD86A7700D707E3BD302B7375BAFBE5495C8A58233521F5DFA1D39B1F428A07662738ED529EF8E5231869149453C011EB30
Malicious:	false
Preview:	...TFRMDESIGN.0.Y...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.k.ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label2.Left...Top...Width....Height.!.AutoSize..Caption.cUpdating $TITLE$ is almost complete. You must restart your computer for the updates to take effect..WordWrap....TLabel.Label5.Left...Top.0.Width....Height...AutoSize..Caption.)Do you want to restart your computer now?.WordWrap....TButton.Next.Tag...Left....Top.E.Width.T.Height...Caption..Restart &Now.Default..TabOrder.....TButton.Back.Tag...Left.I..Top.E.Width.P.Height...Caption..Restart &Later.TabOrder.....

C:\Users\user\AppData\Local\Temp\mia1\update_reboot.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_setup_account.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	36152
Entropy (8bit):	3.715506555383873
Encrypted:	false
SSDEEP:	768:V/HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfW:VfXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DZ
MD5:	6CF506036ACDBE8554FEC0CAD8B54B0F
SHA1:	5AAEF6089C2410141B02DEC3D33F69CF49FAA1B3
SHA-256:	33BE77CEB619494276458E4E460FEF863493B4481620B5A67B3A1316D72C1732
SHA-512:	0668694E92E75FD8224EC27C73855ACC5016ACE6636D441B517030AA14C37751933DF4427D2A2BF9BD9AFE51E55A1615797745D7D8308EA406B6F49DC1B37F03
Malicious:	false
Preview:	...TFRMDESIGN.0.$...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

C:\Users\user\AppData\Local\Temp\mia1\update_setup_account.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	4.899823733661456
Encrypted:	false
SSDEEP:	12:7VGYMtgnWMtgn6o1p6o2bMtgCyYo1yYo1vVmMtgxINIkU3lkimkU3MIka:7Vf+youoE4opoVVm5INI53ldm53MIt
MD5:	6C44799F82A9E3C3F0033400312E777D
SHA1:	484155839C215464D63745A5A144079E52614D57
SHA-256:	BD611C8203E1BD9AA67F8D1F99D8F9C103E8B7384FA7BE037ACA92B077DBA74A
SHA-512:	5C8D32592471A7A9C09479864C48FC80CBFF65F30F673CF01E03C502FD6B70F02C145FE1E6FB30D8EAF0FAA3A00C8AC11F21904921D5B66A822480567CF01D1E
Malicious:	false
Preview:	IF (UserName.Text <> ) THEN Next.Enabled := True;..IF (Password.Text = PasswordConfirm.Text) THEN Next.Enabled := True;..IF (Password.Text = ) THEN Exclamation.Visible := True;..IF (Password.Text = ) THEN ExclamationText.Visible := True;..IF (Password.Text <> PasswordConfirm.Text) THEN Next.Enabled := False;..IF (Password.Text <> ) THEN ExclamationText.Visible := false;..IF (Password.Text <> ) THEN Exclamation.Visible := false;..IF (UserName.Text = ) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_setup_finish.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160068
Entropy (8bit):	1.934119010860282
Encrypted:	false
SSDEEP:	192:XAMMfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cump6KDhT5mI:XeI/STn9
MD5:	F9ADFD6EC9732629EA7FCDB171B49987
SHA1:	3092A623D0E27BC5E03DB9EC67997D0E6354E808
SHA-256:	72ECEDF679889DFE4A64EDB63C9EEFE44E9DBA5DFC0251518B9C06CE0C97AFA0
SHA-512:	6085EE32FBA8D9E12B26EE0459A7E16EBA3539913AD4272B9B5EF590EC9389F92E0908E1E091A9C0D0E6856C0A79A822701DE9B37512DC4560A91F2E41F05C60
Malicious:	false
Preview:	...TFRMDESIGN.0.0q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................

C:\Users\user\AppData\Local\Temp\mia1\update_setup_finish.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_setup_schedule.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33902
Entropy (8bit):	3.4840746856844267
Encrypted:	false
SSDEEP:	768:kHHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfajKk:knXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D1
MD5:	FB8DB7BC2352BC8B2189821161CEF379
SHA1:	B6E94A9213291A2D289C62C4859492A1787D6699
SHA-256:	189B671D789580967E60E4C8B3ADD804CD4BF16EE1845250260B828D8761E658
SHA-512:	68DE9CE306C0938988F8CD51FF670A204573591FF8424CFF2C48585EAF7E5E1DE8A396623A2D45497083AF7FE4661AA377A2499A982292FDF21AA708A1CDB369
Malicious:	false
Preview:	...TFRMDESIGN.0.Z...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

C:\Users\user\AppData\Local\Temp\mia1\update_setup_schedule.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	974
Entropy (8bit):	4.892952093471582
Encrypted:	false
SSDEEP:	24:o7wKA7wY7wHvWvXvK/vqvqA77wz7wqAPINI53l53dm53MI53k:o7Q7P7e+vaiD77A7MPWq/icqU
MD5:	D77CCDD3A7937D2219195F35873311D1
SHA1:	7327FFEBD4F904CE4E1351662D4F26FEE272B973
SHA-256:	8089C47E824035E10F1CCF9478F72EA4D09FD946AA0AD71C9B8F7471922C3464
SHA-512:	9DAEDE3C919827762F066D0F3A28AB0174DF6077240B92D49846B9A5B694E0C3DF33B72F7B8FFAB0C1B18315E849052E33BE04BB40927C7D533A669D52D4D5B8
Malicious:	false
Preview:	IF (Keep.Checked <> False) THEN Notify.Enabled := True;..IF (Keep.Checked <> False) THEN Download.Enabled := True;..IF (Keep.Checked <> False) THEN Install.Enabled := True;..IF (Keep.Checked = False) THEN Install.Enabled := False;..IF (Keep.Checked = False) THEN Download.Enabled := False;..IF (Keep.Checked = False) THEN Notify.Enabled := False;..IF (Keep.Checked = False) THEN Time.Enabled := False;..IF (Keep.Checked = False) THEN Date.Enabled := False;..IF (Keep.Checked <> False) THEN Time.Enabled := True;..IF (Keep.Checked <> False) THEN Date.Enabled := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN InstallAwareX.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN InstallAwareX.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\update_setup_welcome.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160143
Entropy (8bit):	1.9385323471953442
Encrypted:	false
SSDEEP:	192:wbMMfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CBtLzg6T5mWC:wdI/gVK
MD5:	35F172C45DA2C84338CD11889AE3F058
SHA1:	57159FC6A38D63A1D776654A13F5EAE6B5A52808
SHA-256:	77888A511656391F3864564314ECB416797E6D78FBCB4FC8E81F61CE371DD373
SHA-512:	FF3A9A6952AEACBB94FFFD5759C4BAADBB6172052948874B78520FCB370A05B2F2840274CB9804F59D09172EEBF8EC6ABE0F3A69837FCF16207CD721A661F0F0
Malicious:	false
Preview:	...TFRMDESIGN.0.{q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................

C:\Users\user\AppData\Local\Temp\mia1\update_setup_welcome.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\welcome.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	158465
Entropy (8bit):	3.6559484073312514
Encrypted:	false
SSDEEP:	768:nEaEilpj+W7aEiltTMtskowhwG1S79AQoM1HaeBiLyaEilM2W0i6qK6qO6qIGh1:nEa5EW7a5tGCwhwGYAh4HHGya5tFY
MD5:	24949B79B4BC0A0019363202FAC4F53A
SHA1:	5A0A44CFBC8B6066859AD86BB53A8D8C8D4444F3
SHA-256:	EB802FDE7DA4B582E0165D2430517B89AFBC765A70AF80C2D82432463D547302
SHA-512:	BAC46DB0A333C1F9ABFA34E16F7B25A2E157585F6AC0F7D3E114B884E64DAF299F32C0B1600DB1FAC8FEDF5D6CE6DF9E945D6A6E23D5EC0DEDB9D395D2FB9D4C
Malicious:	false
Preview:	...TFRMDESIGN.0..j..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight....ClientWidth....Color.Wai..DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq..xo......

C:\Users\user\AppData\Local\Temp\mia1\welcome.dfm.miaf

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.727734523620873
Encrypted:	false
SSDEEP:	3:X/GrL97R2tuFRAdRLOEpe8vioqAcmNy7VuFRAdRLOEpe8vi7GrL97VuFRAdRLOEb:v8KuMtrk8suMtrk84IuMtrkeBKuMtrkt
MD5:	C754336979F1FCF2A5262EC706FD4E44
SHA1:	264DD254CFC4E620F270C95A91A6B38B0DD4A29D
SHA-256:	D4EB1FD50848053729420DC036FCE62FCFBE649E030AA309C64DBB252A554B13
SHA-512:	B0A291ED642D1ED0AAD5B09011A6C0635B0D26612C49768A45CC544897D88F4932F70E705413CB9A07FD9B3AF508BDFEA28C9D0BB800D0B9FAFBD398E762E0C9
Malicious:	false
Preview:	.IF (LicenseAccept.Checked = True) THEN Next.Enabled := True;..IF (LicenseReject.Checked = False) THEN Next.Enabled := True;..IF (LicenseAccept.Checked = False) THEN Next.Enabled := False;..IF (LicenseReject.Checked = True) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\wizard.dfm

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	158239
Entropy (8bit):	3.6101038553522367
Encrypted:	false
SSDEEP:	768:5SaEilpj+W7aEiltTMtskowhwG1S79AQoM1HaeBiLyaEilM2W0i6qK6qO6qb6qtH:5Sa5EW7a5tGCwhwGYAh4HHGya5tq
MD5:	90E552A589F911110B23E2654ED43C83
SHA1:	6B6B9F9CF0EA54F170983AF19A5B2CDAC746B368
SHA-256:	8241051774B237983EAFB579F20303F1A4854320173190A15552ECF02768B32B
SHA-512:	BE29DD996BA9CBFDC8B7F68BCB00EF51ADF166A944027F2AF3638E6192BAE252A63296CB0D1BBC9DEDC117A6341BCCD09B1E2D06B117C18BD1095EA48F4A4096
Malicious:	false
Preview:	...TFRMDESIGN.0..j..TPF0.TfrmDesign.frmDesign.Left....Top.w.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight....ClientWidth....Color.Wai..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.(.Picture.Data..n...TBitmap.n..BM.n......6...(.......'............j..................iaW.LF?...w.....o[O.OE>.pcX..si..tk.LFA.ocX.nbW.qeZ.pdY.sg\.th].NF?.ME>.{od.\|qg.{pf..xn..uk..yo.skd.....OF=.wla.jaX.lcZ..\|q.pg^.ne\.ri`..wm.vmd.tkb.xof..yp.}um.............uj^.vk_.ynb.lcY.jaW.ne[.pg].ri_.tka.jbY.iaX..{p.xoe.ld[.kcZ...t..~s..}r.\|si.zqg.og^.nf].me\.rja.ph_..yo.umd.tlc.skb..}s.xpg.wof.vne.\|tk.~vm......zq..xo......~u..\|s.........................................................................................................KE>...}.qjb.wph.unf.yrj..\|t.umc.

C:\Users\user\AppData\Local\Temp\{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}

Download File

Process:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10804
Entropy (8bit):	5.3810589782835345
Encrypted:	false
SSDEEP:	192:b8XMf+Zc7qNAM5gjntXh4nPFqyjXd91XS3E:4YqNAMqntR4PFq2O3E
MD5:	08197843F90BB99B0C8F6BABDD5D73FA
SHA1:	98CC95953BCA09E146F52AE7BEE1C9D85A704608
SHA-256:	A554D868DF216703B5D1B4A05CF6CA8D531246C038AD272DA87E5E769C99A87F
SHA-512:	60B8097C61432D579D1357744ED4AD3C7F31F4B290C935283388A9BBAD479869CB4BADD410393979FC881C035ADB4891483D4FEC8ADD2BAB9DE8C178B81092CB
Malicious:	false
Preview:	SourceDir..C:\PROGRA~3\{C8F3C~1\..$ex..MEDIAPACKAGEPATH..\PROGRA~3\..$ex..AF60707B8..FALSE..$ex..A61541D54..FALSE..$ex..A47DD5368..FALSE..$ex..A1DA3E462..FALSE..$ex..A52098B21..FALSE..$ex..ACC802F8F..FALSE..$ex..A59E0FAE8..FALSE..$ex..AB788C7C3..FALSE..$ex..A5A32B2FE..FALSE..$ex..A63ADD426..FALSE..$ex..A79EF4496..FALSE..$ex..ACB29EF87..FALSE..$ex..AEEE19DB2..FALSE..$ex..AA04D6C1D..FALSE..$ex..AF6E1FDBA..FALSE..$ex..AD0DC5192..FALSE..$ex..A901C7C89..FALSE..$ex..A6A99F5AE..FALSE..$ex..ADA156853..FALSE..$ex..AEB13BCBE..FALSE..$ex..A4625E0D0..FALSE..$ex..A1A97511A..FALSE..$ex..ABE04B6CA..FALSE..$ex..A35677B4A..FALSE..$ex..AC9CFA174..FALSE..$ex..AAA35C740..FALSE..$ex..A85CA11D2..FALSE..$ex..AFCC6B9D7..FALSE..$ex..A661E908A..FALSE..$ex..A4AD6D99..FALSE..$ex..A2639F99..FALSE..$ex..AEDD15B9F..FALSE..$ex..AAAB28644..FALSE..$ex..A32755537..FALSE..$ex..A1B03632E..FALSE..$ex..AD5A26372..FALSE..$ex..A6A02C8CD..FALSE..$ex..AB35D72DF..FALSE..$ex..A905D6215..FALSE..$ex..AAA301B57..FALSE..$ex..A92A72B5

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\156e6124817c16b48159bbfd14a96205_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe
File Type:	Matlab v4 mat-file (little endian) , sparse, rows 0, columns 20
Category:	dropped
Size (bytes):	1464
Entropy (8bit):	7.342286362069898
Encrypted:	false
SSDEEP:	24:ulYoCHnWU1kWetVDVRoNBEcN0Ufgpmhl/nSSK2XMy6G+nRqNhacy7:ulYPWU+Wet9Vq/h5gc6SK2hoEu
MD5:	6790A41B951ACFE096BCC9B921ADD04D
SHA1:	CADE7DA98C239A37969512581A6DB578281F4E04
SHA-256:	F83106FF2A62FCF3BDDEE249BFCB0F9CD2AD35FCC8B2D7B44814344C1FF23CA6
SHA-512:	3A35243E4B177FBD29827385BBC7E8B11FA921B61EC3FE486173224440327391D392AF0F3FA4EC53D55BDCBF8B6C8ABDE1830BBCF25C1F57722DFF5726C16807
Malicious:	false
Preview:	........................................SaasAntTransactions.....................RSA1.................p..+?....^ff~...qiEX=...{<.^!cV`!..vV.t..R.2...m...P...5,Y......;....Z.m...r.#.9....o...a.."...T.K...,....g........fd..P.....................z..O......r...C..A.&V.yM......,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ...R..Q.8...$.\|..c...........3.3[............ ...q..U....V...ug..w.L..u.....m......hy.....}...!7....c..8..s ..c.P..i...J.J.C,...y@2..S......S 6p=.h...g5......B..]"..N.......Pf....UMx.R....7.1.0[...p...Tv...Qa...oI;^....:.w....c.y.t.k(M. 2;.Gf7..D3....KZ..N..7t,a{u9....l....~."..).<^B..b+......;......L.7s......oJS"..,..af...u...W.BY*..^h.23K.I.g.{....+L.N.....>.Q$......J..$.(.IH.....S.zG.8V....."5..R`..Z0jWtI.w..6m.....`L..+...... ...-.T....0..........=..zI...v]..Q].....M@..;.V..1..7...XG..S......+.V.s=.42.n../q......n6....9Y."..P...Z.....j....~/..n.q.OGq8.x.h.>...$.q.G..Q......S..z....VU...cZQ.{.t&..T<.Z..0rl..f.^..

C:\Users\user\AppData\Roaming\SaasAntTransactions\hAdwe4317j\hAdwe4317j.db

Download File

Process:	C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe
File Type:	data
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	0.5696156960152249
Encrypted:	false
SSDEEP:	12:iCujJMLX+kld9bYT7/7/7/7/7/7/7/7/7/7/7/7/7DbClyBc3SWu:iCsAXrlwfCHi
MD5:	72F92172E2D533D8A5D9F21B1D0A89CF
SHA1:	87FCB990C50BD9CC2636CF97F3BAF0F31F4B5194
SHA-256:	14E74DF7D0DE692A180E35B8571736284BD0C40D33C3D571065CCBD1FD6EA603
SHA-512:	8D025539604CACE6721AAB57A624B5359043BB212822B81F73EB7B9291D2E53F030F84BBC9A3B42B1EF1E353CE0B740CC5E0D7545DF4738F3875583516A5AF58
Malicious:	false
Preview:	......................... This is a LiteDB file ......................................................history.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\SaasAntTransactions\saasant.log

Download File

Process:	C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3353
Entropy (8bit):	5.52473993322168
Encrypted:	false
SSDEEP:	48:ozrApgJoJYVWgBNNXzHSxBNN4zbFIi4SJvZoXFttXttO++U:S8MoSJJ++U
MD5:	D4BFE6743FC6988AA4FD1436972566D0
SHA1:	DB1D03AB2798356F3A0B9571DABE3B88C1FA0CF4
SHA-256:	A57519D8150C85E5FCB7735F5C7DA88CF8A25B71B492AE663A02C440FF7F1D42
SHA-512:	657EBE7C92D491DD4ED1E850AE1B50D6156EF6DCBCD28E7DB604DED6E1B58D48FA35E506E12124E5D5C920273829C0AF9EE46AD2244574DDA1C725400491DF28
Malicious:	false
Preview:	.2023-12-28 20:10:51,241 DEBUG [1] Saasant.Common.SystemLogger.Debug - ACTION=START,CONTEXT=HISTORY..2023-12-28 20:11:49,369 DEBUG [1] Saasant.Common.SystemLogger.Debug - ACTION=STARTED,CONTEXT=HISTORY..2023-12-28 20:13:07,033 ERROR [1] Saasant.Common.SystemLogger.Error - System.IO.FileNotFoundException: Could not find file 'C:\Program Files (x86)\SaasAnt Transactions\saasant.license'...File name: 'C:\Program Files (x86)\SaasAnt Transactions\saasant.license'.. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath).. at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost).. at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy, Boolean useL

C:\Users\user\AppData\Roaming\SaasAntTransactions\sekldaye3193lu.xml

Download File

Process:	C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.429068680530128
Encrypted:	false
SSDEEP:	6:JiMVBdHgSVJjVic4subinPic4s1ofG9nvX2/aZDyXmNFhxolF9nv+Su:MMHdZJj8iPiQvX2K2Ghx2xv+p
MD5:	41695A830FE3BCA38D907E51D24169C6
SHA1:	7F81A2F72CA3B009A0F824FA3769C966AD597DE1
SHA-256:	A83BFB6C5DAB69AE32699ECAFA81DDE5F1257029E7A4441DDA4D16E331C080A5
SHA-512:	3706A6F9A55A556177A8227B8A999D0AFDFD23A99DA8A9D40EF45F5F76F14657E27F6127A041467188EC9ED2056C00D8777D1905DE7999A00B6B4610E3150733
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<ArrayOfApplicationSetting xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">.. <ApplicationSetting>.. <Name>LAST_UPDATE_CHECK</Name>.. <Value>28-12-2023</Value>.. </ApplicationSetting>..</ArrayOfApplicationSetting>

C:\Windows\Installer\442129.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C8F3C76B-9135-4D81-AF4D-D3B6D839248C}, Number of Pages: 200, Title: SaasAntTransactions, Subject: SaasAnt Transactions Installation, Keywords: Installer, MSI, Database, Author: SaasAnt, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
Category:	dropped
Size (bytes):	991232
Entropy (8bit):	6.3279146241176925
Encrypted:	false
SSDEEP:	12288:PmLlsxkUm8YWXBRIA+gBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:OLlsxrXw0W5BqPA2fc7wMz7
MD5:	3D34335F4D99FE1A9D8D8F7DA068385C
SHA1:	720745D325879D9D34A9066B37AADB9B416F493F
SHA-256:	66FD906AA278AE740504F1812B1368005ACBD27AE59D3859981BF4AD7FDD5F99
SHA-512:	0103BFFBDA90CF5BE89675A6E22C77D0E22DC10FDB5A09AE24A6F8EFE986035F6A076D9A67D0877E26908383FCEDD0B2CA53B201BA7B834971C8F702AA48C123
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\44212d.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C8F3C76B-9135-4D81-AF4D-D3B6D839248C}, Number of Pages: 200, Title: SaasAntTransactions, Subject: SaasAnt Transactions Installation, Keywords: Installer, MSI, Database, Author: SaasAnt, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
Category:	dropped
Size (bytes):	991232
Entropy (8bit):	6.3279146241176925
Encrypted:	false
SSDEEP:	12288:PmLlsxkUm8YWXBRIA+gBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:OLlsxrXw0W5BqPA2fc7wMz7
MD5:	3D34335F4D99FE1A9D8D8F7DA068385C
SHA1:	720745D325879D9D34A9066B37AADB9B416F493F
SHA-256:	66FD906AA278AE740504F1812B1368005ACBD27AE59D3859981BF4AD7FDD5F99
SHA-512:	0103BFFBDA90CF5BE89675A6E22C77D0E22DC10FDB5A09AE24A6F8EFE986035F6A076D9A67D0877E26908383FCEDD0B2CA53B201BA7B834971C8F702AA48C123
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2233.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	6.443465180760872
Encrypted:	false
SSDEEP:	6144:zgj8g8Sy2AoNSlkJAiL9svGFXFPvA2wKcWQwMYW7rmk:zQ8guBoN2KA2wKc7wMz7
MD5:	89B5903624F9CDED346676E88F918693
SHA1:	162201E4E31FB327E0B16531C81041DC574A04A4
SHA-256:	851BB0A420E47AF2F49518FAE86E4B9755BD5DAA6E9EB3B2F1FC4585B6F05163
SHA-512:	FD2587EF52E43EC131E4D06A34306E038B85B98E9EE2866FFD117E906B019FBA6972B794BEC2A9E0FEF357E199A0D13E64A89D4356EA8BF6CAFD6A289B1B48A7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...>=xQ............................d........ ....@.....................................................................E............p...&.......................}...................................................................................text............................... ..`.itext..\|........................... ..`.data....,... ......................@....bss.....P...P.......8...................idata...............8..............@....didata..............J..............@....edata..E............L..............@..@.reloc...}.......~...N..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

C:\Windows\Installer\MSI22D0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI234E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI237E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI245A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	301283
Entropy (8bit):	5.973915022076978
Encrypted:	false
SSDEEP:	6144:oFQCrGoti5k/geqR+z2UhVTqUTtUTcATE29qV+bZT229YV+NfqmqwD/WS+HI91:oLNqRqmqBRHIH
MD5:	D38F60685A30CCD92DACC44FAF90FF88
SHA1:	49AB3387FEC9528073E6B95EC6DE6D01F27E493A
SHA-256:	F5482D71C6202E5282F109BD416BDAA446E75159B7A9A907FA550F2B1AFC61DF
SHA-512:	7D02ACD0FD03F9A0BA35E1E7DAD57AD55132FC95A9C5B45782C0BCF354A6642D4F7D2CF4DD64233AD09838BE2790B4B45DED8C58DCAC471D9ADBDD9612A5D108
Malicious:	false
Preview:	...@IXOS.@.....@..W.@.....@.....@.....@.....@.....@......&.{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}..SaasAnt Transactions..SaasAntTransactions-Setup.msi.@.....@.....@.....@........\PROGRA~3\&.{C8F3C76B-9135-4D81-AF4D-D3B6D839248C}.....@.....@.....@.....@.......@.....@.....@.......@......SaasAnt Transactions......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@c....@.....@.]....&.{1A1C48FA-A4B1-45F0-9919-0D545F0A41E3}Z.C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Credit Memo.properties.@.......@.....@.....@......&.{47B9CE9A-2F54-408C-9F06-CF19966B5A6F}W.C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Estimate.properties.@.......@.....@.....@......&.{E744BCB4-7928-41A6-9F0A-9186AF757EE3}V.C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Invoice.properties.@.......@.....@.....@......&.{5B6E1CA1-E811-42EE-89B4-951552C

C:\Windows\Installer\SourceHash{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.486038302014688
Encrypted:	false
SSDEEP:	768:T/T/O/O/PI2AhgjSLcApOycB07BfhQIsNT2WcOGpuz8sA0:bT/O/O/A2ALJQIsNT2WcOGdb
MD5:	1DE55421E072DE6A11574C4A8F37C99E
SHA1:	8EDC25E4C7005F851F1FF41563D60CEF24BB9A9C
SHA-256:	9D3F801A69DFB0AE1928F90E236EDC0E5F09A3AF3DABC5F9066A5D2A662388A5
SHA-512:	28A2A0CF228087C0A67201D3F882A9775E98C1EEDF6D2B27E7FCA125409173D4D22F67687A4735DC0A180D6E7114A4C7EDE8BB4865867E0BF0F966428B7D4A97
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5828558853993528
Encrypted:	false
SSDEEP:	48:98PhcuRc06WX44nT5qPLTQ3T3NVHGlS7TgyGH/kdDuO1cOnuQpwV:ghc1InTiLMD3NYlS7syeWuIcOuQpY
MD5:	7989387A3633537D19C95DB2A87A7726
SHA1:	E6CC0D0C897F579F6D576B9538B428EFD7CE0DD1
SHA-256:	550DA6488E40F659249B93A6A84F1152116F65EA7C363AEA34F52D2F384DE86C
SHA-512:	1088C6446F202DF1F20DD03D7052F4E6E2D897C53678BE59BDCEF9F84D0C34B7C769C5D6F8F4950A81A22CAD85F89D7B1B213B410AE154D51C9A7CE7517367BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{ADF336DA-83A5-4B59-BA8C-07DBC94345A1}\ctions2dMain5cshortcut.ico0.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	99678
Entropy (8bit):	5.037372625199376
Encrypted:	false
SSDEEP:	1536:HjUKLWwDBy+4myMzq8SkfpIpCK4nbRJO+/V5rXkgE2VYTJWlZkUh1UtgBx1BtiQx:HA7wD/f+34nb+Ulwc
MD5:	47E5065A805B7C4B8F680BD6D1D226C7
SHA1:	D283B0C2B07478F2932E75440F9817414439603E
SHA-256:	989EBE671B60804D221C299746CC253C5E0A150FA6A0A6CB6DB15FAB8FC917BE
SHA-512:	C5192D01EBE9886C372A205A9A9001AF7C29FC05141056F8C92E2EDDDCA6A67A5FF684A459E1F2ED56DE81C9C71DD574CD773AA2788641A84F0ACB6AB77219CA
Malicious:	false
Preview:	............ .h...V... .... .........00.... ..%..f...@@.... .(B...;........ .(...6}..(....... ..... ...................................W...\...NL..F...F...H...G...D...F...PN..^...X...........[...P...R...I...U.`..................R.v...M...K...X...S...k...O...O...J.J.v.................................3.d...L...Y...W...O...H.T.~...............f...O...T................4.h...O...b...DI-.e...............^..............................W...UO..F.................m......B.........r.............V.....P...V..................m......E.........u..................R.1.e...................A..................................X.7.h..........{...d......u...W...G..........................Y.+.`......<.......h...................\|.......................T...P......Y.../......................d...d............l....O...HGV.{............................./...#...5.........$.d...TLP.q. .Q.............................&...&...,....V....Q.@.w.'.U.*.V.+.X..........................g...

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	454234
Entropy (8bit):	5.35617488826112
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaun:zTtbmkExhMJCIpEG90D5JG81IIgMi
MD5:	6FF2E8F5B1FF0366ADECC03C8EE802FB
SHA1:	F59BD3BC73A292B212E60FF3FD2C4557F50094F3
SHA-256:	CFA35AFF0D7435256D0CBE693851DA6901D7705BDA992BF9E2CB7642F633A611
SHA-512:	528231B5D5E4975AA1E4F383599ABA95EF9053BE6D0B08418AF204DF3DE136F7435F6A2FAB2B5FBC42BA37A290F1C964E8037A46FB8B5EF908880FC398A7E11A
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF003724566A26C456.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5828558853993528
Encrypted:	false
SSDEEP:	48:98PhcuRc06WX44nT5qPLTQ3T3NVHGlS7TgyGH/kdDuO1cOnuQpwV:ghc1InTiLMD3NYlS7syeWuIcOuQpY
MD5:	7989387A3633537D19C95DB2A87A7726
SHA1:	E6CC0D0C897F579F6D576B9538B428EFD7CE0DD1
SHA-256:	550DA6488E40F659249B93A6A84F1152116F65EA7C363AEA34F52D2F384DE86C
SHA-512:	1088C6446F202DF1F20DD03D7052F4E6E2D897C53678BE59BDCEF9F84D0C34B7C769C5D6F8F4950A81A22CAD85F89D7B1B213B410AE154D51C9A7CE7517367BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF218E3FD38E2D2355.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF456BF850765386C0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF45C1D7BFB990EF60.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.2154721689703343
Encrypted:	false
SSDEEP:	192:hzX8boDu8iWuIcOuQpnCI3BglgNSh24IMHY73EWSL+d6Wk2wI3mA5her:hI053Bg+N624IMq5YjTq
MD5:	E9A5D577A0EF657BE51BA995200510DB
SHA1:	86D455423A6884E3DF7F0AAABA1842394D36D8C9
SHA-256:	2CE47D7FB468414C141687C9A94E61C8B7974A3271D939D27E388E403D5B4364
SHA-512:	009374686521EE50C45DC3E0BBECC10F78BE9E86B785E490FC5AB1C2AEDC42268C023A0F062C94255CC4DD7B23865306366E966D42C1D36CDB30767058971A61
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF51009B7F29062616.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.2154721689703343
Encrypted:	false
SSDEEP:	192:hzX8boDu8iWuIcOuQpnCI3BglgNSh24IMHY73EWSL+d6Wk2wI3mA5her:hI053Bg+N624IMq5YjTq
MD5:	E9A5D577A0EF657BE51BA995200510DB
SHA1:	86D455423A6884E3DF7F0AAABA1842394D36D8C9
SHA-256:	2CE47D7FB468414C141687C9A94E61C8B7974A3271D939D27E388E403D5B4364
SHA-512:	009374686521EE50C45DC3E0BBECC10F78BE9E86B785E490FC5AB1C2AEDC42268C023A0F062C94255CC4DD7B23865306366E966D42C1D36CDB30767058971A61
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF713EE58C3DB0628E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.8388737217772975
Encrypted:	false
SSDEEP:	768:X0b2AhgjSLcApOycB07BfhQIsNT2WcOGpuzrT/O/O/UsA:s2ALJQIsNT2WcOG2T/O/O/Ub
MD5:	17F6802349FDAE73320195FE234E2C25
SHA1:	B12D1A8A7557156CDF739BB6A56901BECE2C01B3
SHA-256:	0FB0CA1922B9755665F100B0C2FB0C220D91A3A24623BB654C37FA3528EC1983
SHA-512:	3C387C53E429E6D2F2E841A17D6E62030A93733A1753FD62EA3F59E4586C044EE764367540EF4376100DBE86FDBE6EF0FFAFD7CC8A76FFB4CCB6E08A8D25A6CA
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8275BF87E9A389DE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF92956288979952B7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.0182105042867893
Encrypted:	false
SSDEEP:	192:VDu8iWuIcOuQptk2wI3mA5herzCI3BglgNSh24IMHY73EWSL+d6:10Tqi3Bg+N624IMq5Y
MD5:	E670A97EA9FFF1F87C480CCA48814A83
SHA1:	392B9F8F44F8EFD65201DB360F83D019651879BE
SHA-256:	E6AA45C230D6314887B52CADE056220B512AD9D86EE0E675EED1F30B793EE20A
SHA-512:	83E971EFECD0E55EEF52033707B71715F33A98F4F0A2F42B011F132157D6949ACCCC1EC551D50432A05B5F7247262B3287A5961345755F82A7030F934F7D5428
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA3090986ACAFE04F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5828558853993528
Encrypted:	false
SSDEEP:	48:98PhcuRc06WX44nT5qPLTQ3T3NVHGlS7TgyGH/kdDuO1cOnuQpwV:ghc1InTiLMD3NYlS7syeWuIcOuQpY
MD5:	7989387A3633537D19C95DB2A87A7726
SHA1:	E6CC0D0C897F579F6D576B9538B428EFD7CE0DD1
SHA-256:	550DA6488E40F659249B93A6A84F1152116F65EA7C363AEA34F52D2F384DE86C
SHA-512:	1088C6446F202DF1F20DD03D7052F4E6E2D897C53678BE59BDCEF9F84D0C34B7C769C5D6F8F4950A81A22CAD85F89D7B1B213B410AE154D51C9A7CE7517367BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCBED8E212BC6943E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCE753296AB72AF9A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDC2158447991AFB2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.2154721689703343
Encrypted:	false
SSDEEP:	192:hzX8boDu8iWuIcOuQpnCI3BglgNSh24IMHY73EWSL+d6Wk2wI3mA5her:hI053Bg+N624IMq5YjTq
MD5:	E9A5D577A0EF657BE51BA995200510DB
SHA1:	86D455423A6884E3DF7F0AAABA1842394D36D8C9
SHA-256:	2CE47D7FB468414C141687C9A94E61C8B7974A3271D939D27E388E403D5B4364
SHA-512:	009374686521EE50C45DC3E0BBECC10F78BE9E86B785E490FC5AB1C2AEDC42268C023A0F062C94255CC4DD7B23865306366E966D42C1D36CDB30767058971A61
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.988389055247709
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SaasAntTransactions-Setup (1).exe
File size:	15'152'616 bytes
MD5:	b11f2737286c7d5def40591018967a9e
SHA1:	0ae122f676125dec27ca1b2e2ce353e825439686
SHA256:	c4f68fa1668adb315ab6e7d88a3644273d811dd2cc786c8206aef159753c9b7c
SHA512:	02d4abd5963ba01090bd7bec6fb8fdf60635f1e5c10c1552b46dd89a2b26d738dfa8944584be64b9410ab441e98b9d31d3a60f0d110b8c0f9c0c9bbf3d8ba7ab
SSDEEP:	393216:+KqVrEjO8zjh2ngYBLbMqbsbA4oAnKn5H3S6T5nS:yrWRaIE/rnhC+5n
TLSH:	1DE6335163F58327F1B326F1987462574A7B7C219FF4F2FBA299201ECB667809870362
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ew..............\|.......\|.......\|........t.......b..............\|.......V.......\|......Rich............................PE..L..

File Icon


Icon Hash:	34b53119074a261e

Static PE Info

General

Entrypoint:	0x422a48
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5ACD1957 [Tue Apr 10 20:06:47 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	b48671fed9d5ca4906417d42fcdb066b

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	06/10/2021 17:40:37 02/01/2025 13:18:14
Subject Chain	CN=SAASANT INFOTECH PRIVATE LIMITED, O=SAASANT INFOTECH PRIVATE LIMITED, STREET="1111/5, Noble Centre, Avinashi Road P.N. Palayam", L=Coimbatore, S=Tamil Nadu, C=IN, OID.1.3.6.1.4.1.311.60.2.1.2=Tamil Nadu, OID.1.3.6.1.4.1.311.60.2.1.3=IN, SERIALNUMBER=U72900TZ2015PTC034415, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	E48967BD99E17FF67FD86BEE34C3E0FE
Thumbprint SHA-1:	5C8FDB0874827DCA171FA3C5CA537375C8CC1A32
Thumbprint SHA-256:	1D2AABC902C8DABC74FEEAA1B060E550A0FD19BDABE4647F5A5683C2CDE3AF39
Serial:	16EAABC48ADF8C6A34A23D96

Entrypoint Preview

Instruction
call 00007F79C86E7B09h
jmp 00007F79C86E323Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0043E4B8h], eax
mov dword ptr [0043E4B4h], ecx
mov dword ptr [0043E4B0h], edx
mov dword ptr [0043E4ACh], ebx
mov dword ptr [0043E4A8h], esi
mov dword ptr [0043E4A4h], edi
mov word ptr [0043E4D0h], ss
mov word ptr [0043E4C4h], cs
mov word ptr [0043E4A0h], ds
mov word ptr [0043E49Ch], es
mov word ptr [0043E498h], fs
mov word ptr [0043E494h], gs
pushfd
pop dword ptr [0043E4C8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0043E4BCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0043E4C0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0043E4CCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0043E408h], 00010001h
mov eax, dword ptr [0043E4C0h]
mov dword ptr [0043E3BCh], eax
mov dword ptr [0043E3B0h], C0000409h
mov dword ptr [0043E3B4h], 00000001h
mov eax, dword ptr [0043C024h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0043C028h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000BCh]

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a538	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x45000	0x32dec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xe703f0	0x31f8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x351a0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x284	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3008d	0x30200	False	0.5151582792207792	data	6.495190538344969	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0x9348	0x9400	False	0.34438344594594594	data	4.653884166908034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x8400	0x2400	False	0.2585720486111111	data	4.213670913347177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x45000	0x32dec	0x32e00	False	0.1877351428132678	data	4.201251641961609	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x45d14	0x53a2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9979915927136852
RT_ICON	0x4b0b8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	English	United States	0.10349875783745416
RT_ICON	0x5b8e0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	English	United States	0.16568256967406708
RT_ICON	0x5fb08	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	English	United States	0.20446058091286307
RT_ICON	0x620b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	English	United States	0.25609756097560976
RT_ICON	0x63158	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	English	United States	0.3829787234042553
RT_DIALOG	0x635c0	0x1d8	data			0.5720338983050848
RT_DIALOG	0x63798	0x1be	data			0.5605381165919282
RT_DIALOG	0x63958	0x54	data			0.7619047619047619
RT_STRING	0x639ac	0x4a4	data	Arabic	Saudi Arabia	0.28703703703703703
RT_STRING	0x63e50	0x4a4	data	Catalan	Spain	0.28703703703703703
RT_STRING	0x642f4	0x4a4	data	Chinese	Taiwan	0.28703703703703703
RT_STRING	0x64798	0x4a4	data	Czech	Czech Republic	0.28703703703703703
RT_STRING	0x64c3c	0x4a4	data	Danish	Denmark	0.28703703703703703
RT_STRING	0x650e0	0x4a4	data	German	Germany	0.28703703703703703
RT_STRING	0x65584	0x4a4	data	Greek	Greece	0.28703703703703703
RT_STRING	0x65a28	0x4a4	data	English	United States	0.28703703703703703
RT_STRING	0x65ecc	0x4a4	data	Finnish	Finland	0.28703703703703703
RT_STRING	0x66370	0x4a4	data	French	France	0.28703703703703703
RT_STRING	0x66814	0x4a4	data	Hebrew	Israel	0.28703703703703703
RT_STRING	0x66cb8	0x4a4	data	Hungarian	Hungary	0.28703703703703703
RT_STRING	0x6715c	0x4a4	data	Italian	Italy	0.28703703703703703
RT_STRING	0x67600	0x4a4	data	Japanese	Japan	0.28703703703703703
RT_STRING	0x67aa4	0x4a4	data	Korean	North Korea	0.28703703703703703
RT_STRING	0x67aa4	0x4a4	data	Korean	South Korea	0.28703703703703703
RT_STRING	0x67f48	0x4a4	data	Dutch	Netherlands	0.28703703703703703
RT_STRING	0x683ec	0x4a4	data	Norwegian	Norway	0.28703703703703703
RT_STRING	0x68890	0x4a4	data	Polish	Poland	0.28703703703703703
RT_STRING	0x68d34	0x4a4	data	Portuguese	Brazil	0.28703703703703703
RT_STRING	0x691d8	0x4a4	data	Romanian	Romania	0.28703703703703703
RT_STRING	0x6967c	0x4a4	data	Russian	Russia	0.28703703703703703
RT_STRING	0x69b20	0x4a4	data	Croatian	Croatia	0.28703703703703703
RT_STRING	0x69fc4	0x4a4	data	Slovak	Slovakia	0.28703703703703703
RT_STRING	0x6a468	0x4a4	data	Swedish	Sweden	0.28703703703703703
RT_STRING	0x6a90c	0x4a4	data	Thai	Thailand	0.28703703703703703
RT_STRING	0x6adb0	0x4a4	data	Turkish	Turkey	0.28703703703703703
RT_STRING	0x6b254	0x4a4	data	Slovenian	Slovenia	0.28703703703703703
RT_STRING	0x6b6f8	0x4a4	data	Estonian	Estonia	0.28703703703703703
RT_STRING	0x6bb9c	0x4a4	data	Latvian	Lativa	0.28703703703703703
RT_STRING	0x6c040	0x4a4	data	Lithuanian	Lithuania	0.28703703703703703
RT_STRING	0x6c4e4	0x4a4	data	Vietnamese	Vietnam	0.28703703703703703
RT_STRING	0x6c988	0x4a4	data	Basque	France	0.28703703703703703
RT_STRING	0x6c988	0x4a4	data	Basque	Spain	0.28703703703703703
RT_STRING	0x6ce2c	0x4a4	data	Chinese	China	0.28703703703703703
RT_STRING	0x6d2d0	0x4a4	data	Portuguese	Portugal	0.28703703703703703
RT_STRING	0x6d774	0x4a4	data			0.28703703703703703
RT_STRING	0x6dc18	0x2f2	data	Arabic	Saudi Arabia	0.42572944297082227
RT_STRING	0x6df0c	0x2f2	data	Catalan	Spain	0.42572944297082227
RT_STRING	0x6e200	0x2f2	data	Chinese	Taiwan	0.42572944297082227
RT_STRING	0x6e4f4	0x2f2	data	Czech	Czech Republic	0.42572944297082227
RT_STRING	0x6e7e8	0x2f2	data	Danish	Denmark	0.42572944297082227
RT_STRING	0x6eadc	0x2f2	data	German	Germany	0.42572944297082227
RT_STRING	0x6edd0	0x2f2	data	Greek	Greece	0.42572944297082227
RT_STRING	0x6f0c4	0x2f2	data	English	United States	0.42572944297082227
RT_STRING	0x6f3b8	0x2f2	data	Finnish	Finland	0.42572944297082227
RT_STRING	0x6f6ac	0x2f2	data	French	France	0.42572944297082227
RT_STRING	0x6f9a0	0x2f2	data	Hebrew	Israel	0.42572944297082227
RT_STRING	0x6fc94	0x2f2	data	Hungarian	Hungary	0.42572944297082227
RT_STRING	0x6ff88	0x2f2	data	Italian	Italy	0.42572944297082227
RT_STRING	0x7027c	0x2f2	data	Japanese	Japan	0.42572944297082227
RT_STRING	0x70570	0x2f2	data	Korean	North Korea	0.42572944297082227
RT_STRING	0x70570	0x2f2	data	Korean	South Korea	0.42572944297082227
RT_STRING	0x70864	0x2f2	data	Dutch	Netherlands	0.42572944297082227
RT_STRING	0x70b58	0x2f2	data	Norwegian	Norway	0.42572944297082227
RT_STRING	0x70e4c	0x2f2	data	Polish	Poland	0.42572944297082227
RT_STRING	0x71140	0x2f2	data	Portuguese	Brazil	0.42572944297082227
RT_STRING	0x71434	0x2f2	data	Romanian	Romania	0.42572944297082227
RT_STRING	0x71728	0x2f2	data	Russian	Russia	0.42572944297082227
RT_STRING	0x71a1c	0x2f2	data	Croatian	Croatia	0.42572944297082227
RT_STRING	0x71d10	0x2f2	data	Slovak	Slovakia	0.42572944297082227
RT_STRING	0x72004	0x2f2	data	Swedish	Sweden	0.42572944297082227
RT_STRING	0x722f8	0x2f2	data	Thai	Thailand	0.42572944297082227
RT_STRING	0x725ec	0x2f2	data	Turkish	Turkey	0.42572944297082227
RT_STRING	0x728e0	0x2f2	data	Slovenian	Slovenia	0.42572944297082227
RT_STRING	0x72bd4	0x2f2	data	Estonian	Estonia	0.42572944297082227
RT_STRING	0x72ec8	0x2f2	data	Latvian	Lativa	0.42572944297082227
RT_STRING	0x731bc	0x2f2	data	Lithuanian	Lithuania	0.42572944297082227
RT_STRING	0x734b0	0x2f2	data	Vietnamese	Vietnam	0.42572944297082227
RT_STRING	0x737a4	0x2f2	data	Basque	France	0.42572944297082227
RT_STRING	0x737a4	0x2f2	data	Basque	Spain	0.42572944297082227
RT_STRING	0x73a98	0x2f2	data	Chinese	China	0.42572944297082227
RT_STRING	0x73d8c	0x2f2	data	Portuguese	Portugal	0.42572944297082227
RT_STRING	0x74080	0x2f2	data			0.42572944297082227
RT_STRING	0x74374	0x106	data	Arabic	Saudi Arabia	0.5076335877862596
RT_STRING	0x7447c	0x106	data	Catalan	Spain	0.5076335877862596
RT_STRING	0x74584	0x106	data	Chinese	Taiwan	0.5076335877862596
RT_STRING	0x7468c	0x106	data	Czech	Czech Republic	0.5076335877862596
RT_STRING	0x74794	0x106	data	Danish	Denmark	0.5076335877862596
RT_STRING	0x7489c	0x106	data	German	Germany	0.5076335877862596
RT_STRING	0x749a4	0x106	data	Greek	Greece	0.5076335877862596
RT_STRING	0x74aac	0x106	data	English	United States	0.5076335877862596
RT_STRING	0x74bb4	0x106	data	Finnish	Finland	0.5076335877862596
RT_STRING	0x74cbc	0x106	data	French	France	0.5076335877862596
RT_STRING	0x74dc4	0x106	data	Hebrew	Israel	0.5076335877862596
RT_STRING	0x74ecc	0x106	data	Hungarian	Hungary	0.5076335877862596
RT_STRING	0x74fd4	0x106	data	Italian	Italy	0.5076335877862596
RT_STRING	0x750dc	0x106	data	Japanese	Japan	0.5076335877862596
RT_STRING	0x751e4	0x106	data	Korean	North Korea	0.5076335877862596
RT_STRING	0x751e4	0x106	data	Korean	South Korea	0.5076335877862596
RT_STRING	0x752ec	0x106	data	Dutch	Netherlands	0.5076335877862596
RT_STRING	0x753f4	0x106	data	Norwegian	Norway	0.5076335877862596
RT_STRING	0x754fc	0x106	data	Polish	Poland	0.5076335877862596
RT_STRING	0x75604	0x106	data	Portuguese	Brazil	0.5076335877862596
RT_STRING	0x7570c	0x106	data	Romanian	Romania	0.5076335877862596
RT_STRING	0x75814	0x106	data	Russian	Russia	0.5076335877862596
RT_STRING	0x7591c	0x106	data	Croatian	Croatia	0.5076335877862596
RT_STRING	0x75a24	0x106	data	Slovak	Slovakia	0.5076335877862596
RT_STRING	0x75b2c	0x106	data	Swedish	Sweden	0.5076335877862596
RT_STRING	0x75c34	0x106	data	Thai	Thailand	0.5076335877862596
RT_STRING	0x75d3c	0x106	data	Turkish	Turkey	0.5076335877862596
RT_STRING	0x75e44	0x106	data	Slovenian	Slovenia	0.5076335877862596
RT_STRING	0x75f4c	0x106	data	Estonian	Estonia	0.5076335877862596
RT_STRING	0x76054	0x106	data	Latvian	Lativa	0.5076335877862596
RT_STRING	0x7615c	0x106	data	Lithuanian	Lithuania	0.5076335877862596
RT_STRING	0x76264	0x106	data	Vietnamese	Vietnam	0.5076335877862596
RT_STRING	0x7636c	0x106	data	Basque	France	0.5076335877862596
RT_STRING	0x7636c	0x106	data	Basque	Spain	0.5076335877862596
RT_STRING	0x76474	0x106	data	Chinese	China	0.5076335877862596
RT_STRING	0x7657c	0x106	data	Portuguese	Portugal	0.5076335877862596
RT_STRING	0x76684	0x106	data			0.5076335877862596
RT_GROUP_ICON	0x7678c	0x5a	data	English	United States	0.7666666666666667
RT_VERSION	0x767e8	0x1084	data	English	United States	0.09981078524124881
RT_MANIFEST	0x7786c	0x57d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4462633451957295

Imports

DLL	Import
KERNEL32.dll	GetLastError, ResetEvent, CreateEventW, CloseHandle, MultiByteToWideChar, WideCharToMultiByte, FreeLibrary, LoadLibraryW, GetModuleFileNameW, FormatMessageW, LocalFree, GetWindowsDirectoryW, CreateFileW, SetFileTime, SetFileAttributesW, RemoveDirectoryW, CreateDirectoryW, GetFileInformationByHandle, DeleteFileW, GetShortPathNameW, GetFullPathNameW, lstrlenW, GetCurrentDirectoryW, GetTempFileNameW, FindClose, FindFirstFileW, FindNextFileW, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, DeleteCriticalSection, GetStdHandle, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetCurrentProcessId, InitializeCriticalSection, QueryPerformanceCounter, GetTickCount, Sleep, LocalAlloc, GetProcAddress, SetCurrentDirectoryW, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, SetThreadUILanguage, SetThreadLocale, GetVersion, GetCommandLineW, CreateProcessW, GetExitCodeProcess, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, LCMapStringW, LCMapStringA, GetStringTypeW, GetStringTypeA, GetConsoleMode, GetConsoleCP, GetLocaleInfoA, IsValidCodePage, GetOEMCP, RaiseException, GetACP, GetCPInfo, LoadLibraryA, RtlUnwind, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, WaitForSingleObject, SetEvent, GetVersionExW, VirtualAlloc, GetCurrentThreadId, VirtualFree, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, HeapSize, InterlockedDecrement, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, HeapFree, HeapAlloc, ExitThread, CreateThread, HeapReAlloc, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, GetModuleHandleW, ExitProcess, GetModuleFileNameA, TlsGetValue
USER32.dll	SetForegroundWindow, CharUpperW, GetWindowRect, DestroyWindow, RegisterWindowMessageW, AdjustWindowRect, LoadImageW, LoadIconW, KillTimer, SetTimer, EndDialog, IsDlgButtonChecked, SetDlgItemTextW, GetDlgItem, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, LoadStringW, DialogBoxParamW, CreateDialogParamW, SystemParametersInfoW, PeekMessageW, GetDesktopWindow, MessageBoxW, SendMessageW, GetWindowLongW, SetWindowLongW, ShowWindow, MoveWindow, PostMessageW
GDI32.dll	GetObjectW
ADVAPI32.dll	RegSetValueExW, RegCreateKeyExW, RegCloseKey
SHELL32.dll	SHGetFolderPathW, ShellExecuteExW
ole32.dll	CoInitializeEx, CoInitialize, CoCreateInstance
OLEAUT32.dll	SysAllocStringLen, SysFreeString, VariantClear, SysAllocString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Arabic	Saudi Arabia
Catalan	Spain
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
Greek	Greece
Finnish	Finland
French	France
Hebrew	Israel
Hungarian	Hungary
Italian	Italy
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Norwegian	Norway
Polish	Poland
Portuguese	Brazil
Romanian	Romania
Russian	Russia
Croatian	Croatia
Slovak	Slovakia
Swedish	Sweden
Thai	Thailand
Turkish	Turkey
Slovenian	Slovenia
Estonian	Estonia
Latvian	Lativa
Lithuanian	Lithuania
Vietnamese	Vietnam
Chinese	China
Portuguese	Portugal

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2023 19:55:10.111198902 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:10.111233950 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:10.111309052 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:10.123948097 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:10.123964071 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:10.628417015 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:10.628509045 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:10.633738041 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:10.633752108 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:10.634414911 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:10.679889917 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:10.736951113 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:10.780750036 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:10.901155949 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:10.906445026 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:10.906483889 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:11.110486984 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:11.110558033 CET	443	49726	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:11.110626936 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:11.129242897 CET	49726	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:39.862035990 CET	49728	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:39.862078905 CET	443	49728	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:39.862155914 CET	49728	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:39.862999916 CET	49728	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:39.863010883 CET	443	49728	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:40.361516953 CET	443	49728	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:40.361762047 CET	49728	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:40.363512039 CET	49728	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:40.363521099 CET	443	49728	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:40.363768101 CET	443	49728	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:40.365326881 CET	49728	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:40.412736893 CET	443	49728	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:40.535749912 CET	443	49728	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:40.535809040 CET	443	49728	45.76.164.236	192.168.2.16
Dec 28, 2023 19:55:40.535850048 CET	49728	443	192.168.2.16	45.76.164.236
Dec 28, 2023 19:55:40.536811113 CET	49728	443	192.168.2.16	45.76.164.236

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2023 19:55:09.921627045 CET	64673	53	192.168.2.16	1.1.1.1
Dec 28, 2023 19:55:10.100653887 CET	53	64673	1.1.1.1	192.168.2.16
Dec 28, 2023 19:55:39.684801102 CET	60076	53	192.168.2.16	1.1.1.1
Dec 28, 2023 19:55:39.861040115 CET	53	60076	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2023 19:55:09.921627045 CET	192.168.2.16	1.1.1.1	0x5bae	Standard query (0)	saasant.com	A (IP address)	IN (0x0001)	false
Dec 28, 2023 19:55:39.684801102 CET	192.168.2.16	1.1.1.1	0xa508	Standard query (0)	desktop.saasant.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2023 19:55:10.100653887 CET	1.1.1.1	192.168.2.16	0x5bae	No error (0)	saasant.com		45.76.164.236	A (IP address)	IN (0x0001)	false
Dec 28, 2023 19:55:39.861040115 CET	1.1.1.1	192.168.2.16	0xa508	No error (0)	desktop.saasant.com		45.76.164.236	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

saasant.com

desktop.saasant.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49726	45.76.164.236	443	2452	C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-28 18:55:10 UTC	211	OUT	POST /dt-service/installation/installed HTTP/1.1 Accept: application/json Content-Type: application/json; charset=utf-8 Host: saasant.com Content-Length: 366 Expect: 100-continue Connection: Keep-Alive
2023-12-28 18:55:10 UTC	25	IN	HTTP/1.1 100 Continue
2023-12-28 18:55:10 UTC	366	OUT	Data Raw: 7b 22 63 6f 6d 70 75 74 65 72 49 64 22 3a 22 35 41 35 33 2d 39 45 46 37 2d 31 34 45 35 2d 45 39 30 30 2d 30 33 41 45 22 2c 22 68 61 72 64 77 61 72 65 49 64 22 3a 22 35 41 35 33 2d 39 45 46 37 2d 31 34 45 35 2d 45 39 30 30 2d 30 33 41 45 22 2c 22 65 78 70 69 72 65 64 41 74 22 3a 6e 75 6c 6c 2c 22 65 64 69 74 69 6f 6e 22 3a 22 33 2e 31 2e 33 2e 30 22 2c 22 61 70 70 22 3a 22 31 22 2c 22 6f 73 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 2d 31 30 2e 30 2e 31 39 30 34 35 22 2c 22 70 72 6f 63 65 73 73 6f 72 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c 22 6e 65 74 76 65 72 73 69 6f 6e 22 3a 22 34 2e 36 2e 32 20 6f 72 20 6c 61 74 65 72 22 2c 22 Data Ascii: {"computerId":"5A53-9EF7-14E5-E900-03AE","hardwareId":"5A53-9EF7-14E5-E900-03AE","expiredAt":null,"edition":"3.1.3.0","app":"1","os":"Microsoft Windows 10 Pro-10.0.19045","processor":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","netversion":"4.6.2 or later","
2023-12-28 18:55:11 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 28 Dec 2023 18:55:11 GMT Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Vary: X-HTTP-Method-Override, Accept-Encoding Access-Control-Allow-Origin: Access-Control-Allow-Credentials: Access-Control-Allow-Methods: Access-Control-Allow-Headers: Access-Control-Expose-Headers: ETag: W/"f-KOwe7l9ASePE8hNQacHSyA" set-cookie: saasant.did=s%3AoP-jlmxgBqm4HyZO-r-JSo1yZi2XN8QM.UQt2%2FNoEot0VfVEzY9tvOrhBpAzdsUed%2BujNxYGJ7ik; Domain=.saasant.com; Path=/; Expires=Fri, 29 Dec 2023 18:55:10 GMT; HttpOnly; Secure Server: 1.2.3 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, no-transform {"status":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49728	45.76.164.236	443	2452	C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-28 18:55:40 UTC	160	OUT	GET /dt-service/installation/updateInfo?app=1&version=3.1.3.0&out=JSON HTTP/1.1 Accept: application/json Host: desktop.saasant.com Connection: Keep-Alive
2023-12-28 18:55:40 UTC	635	IN	HTTP/1.1 200 OK Date: Thu, 28 Dec 2023 18:55:40 GMT Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: Access-Control-Allow-Credentials: Access-Control-Allow-Methods: Access-Control-Allow-Headers: Access-Control-Expose-Headers: set-cookie: saasant.did=s%3A1HxihlsngC_N_JNs1_FPIt5YM1bOeHm8.jlb%2FjGpsjWu3a%2F00zCCCoEzPZgrjqcSn13C8idGZDGA; Domain=.saasant.com; Path=/; Expires=Fri, 29 Dec 2023 18:55:40 GMT; HttpOnly; Secure Server: 1.2.3 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, no-transform
2023-12-28 18:55:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:54:21
Start date:	28/12/2023
Path:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SaasAntTransactions-Setup (1).exe
Imagebase:	0x400000
File size:	15'152'616 bytes
MD5 hash:	B11F2737286C7D5DEF40591018967A9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.1784923265.00000000076C3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:54:29
Start date:	28/12/2023
Path:	C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe
Wow64 process (32bit):	true
Commandline:	.\SaasAntTransactions-Setup.exe /m="C:\Users\user\Desktop\SAASAN~1.EXE" /k=""
Imagebase:	0x400000
File size:	5'605'720 bytes
MD5 hash:	41C67C2E7C85536894C9E348DA79EC9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000002.00000000.1798730636.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaB83E.tmp\SaasAntTransactions-Setup.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:54:48
Start date:	28/12/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7d91f0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	19:54:49
Start date:	28/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 65C17165B9D6E452AFEA89C327EA4A92
Imagebase:	0xb90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:55:04
Start date:	28/12/2023
Path:	C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\SaasAnt Transactions\SaasAntTransactions.exe"
Imagebase:	0x580000
File size:	3'788'792 bytes
MD5 hash:	0F6452633C2790B06B482D15C47B5D0A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 6D26AE70 Relevance: 25.9, APIs: 2, Strings: 12, Instructions: 1392COMMON

Download Yara Rule

APIs

Part of subcall function 6D2707D0: CharUpperW.USER32(?,00000000,?,6D26FCF3,?,6D26FE6C,?,00000000,?,00000010,12131721,?,00000000,00000000), ref: 6D2707F7
Part of subcall function 6D2707D0: CharUpperW.USER32(?,?,6D26FE6C,?,00000000,?,00000010,12131721,?,00000000,00000000), ref: 6D270804

_memset.LIBCMT ref: 6D26B3D4
VariantClear.OLEAUT32(?), ref: 6D26BEEE

Strings

udf, xrefs: 6D26BA33
a, xrefs: 6D26B895
!, xrefs: 6D26B89D
exe, xrefs: 6D26B192
hT)m, xrefs: 6D26B3B8
r, xrefs: 6D26B899
rar, xrefs: 6D26B8F8
R, xrefs: 6D26B891
001, xrefs: 6D26B76A
Unknown error, xrefs: 6D26BEB2, 6D26BEB7
hT)m, xrefs: 6D26B77E
iso, xrefs: 6D26B996

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CharUpper$ClearVariant_memset
String ID: !$001$R$Unknown error$a$exe$hT)m$hT)m$iso$r$rar$udf
API String ID: 2702283269-156973676
Opcode ID: feff80bc73416fce3c2e6cb2ef52d5546edd8d97e4b02cc227040b55df58f799
Instruction ID: 1d7b9bd237f9be4a931498efc1c9e4e00afa3ef8bc4b95d7d70444b75050a75e
Opcode Fuzzy Hash: feff80bc73416fce3c2e6cb2ef52d5546edd8d97e4b02cc227040b55df58f799
Instruction Fuzzy Hash: 93C25E719452698FCB24CF28CC80BEAB7B5BF49305F5040E9E549AB251DB31AEC5CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D268AB0 Relevance: 20.3, APIs: 7, Strings: 4, Instructions: 1018
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6D268BF9
_malloc.LIBCMT ref: 6D268CB0
__CxxThrowException@8.LIBCMT ref: 6D268CCA
__CxxThrowException@8.LIBCMT ref: 6D268CE1
__CxxThrowException@8.LIBCMT ref: 6D268CF8
FindClose.KERNEL32(FFFFFFFF,?), ref: 6D268EA0
__CxxThrowException@8.LIBCMT ref: 6D26997B

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

rar, xrefs: 6D2690BC
R)m, xrefs: 6D268F05
001, xrefs: 6D269003
@S)m, xrefs: 6D268B27

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$CloseFind$ExceptionRaise_malloc
String ID: 001$@S)m$rar$R)m
API String ID: 231924613-712040919
Opcode ID: 5e98fc3ee6a5499195c7755037cdc9068b31e3205564f437fc1102fb374e8d3c
Instruction ID: b9a255692dbd2690fcdf2fb4896a7526c3ffa15cec480b1bb75dae7e14a02729
Opcode Fuzzy Hash: 5e98fc3ee6a5499195c7755037cdc9068b31e3205564f437fc1102fb374e8d3c
Instruction Fuzzy Hash: 3F9236B15483859FC324CF29C580AABF7E5BF89304F548A2DF69987341D731E855CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D274C00 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D272470: FindClose.KERNEL32(?,12131721,6D290658,00000000), ref: 6D2724C4
Part of subcall function 6D272470: FindFirstFileW.KERNEL32(6D2950B8,?,12131721,6D290658,00000000), ref: 6D2724DE
Part of subcall function 6D272470: FindFirstFileW.KERNEL32(?,?), ref: 6D27253A

FindClose.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 6D274CE0

Strings

R)m, xrefs: 6D274D27
(_)m, xrefs: 6D2751F1

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: (_)m$R)m
API String ID: 2295610775-3278456483
Opcode ID: af91e5fc0b36eef6afdc515bec1f49771fca030cd728810ccbfdc515bec2e61d
Instruction ID: 54df74d554e37f2c1f946dcff7572edf4b691245485ffe888c8c125d57d87807
Opcode Fuzzy Hash: af91e5fc0b36eef6afdc515bec1f49771fca030cd728810ccbfdc515bec2e61d
Instruction Fuzzy Hash: 293249B15483858FD320CF68C880A6BF7E5BFC8314F544A2EE69997390D771E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D282A30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 122
libraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6D282B0E
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6D282B20
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 6D282B3C
FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 6D282B48
FindResourceW.KERNEL32(6D260000,00000068,RC_DATA), ref: 6D282B7E
LoadLibraryW.KERNEL32(?,?), ref: 6D282BA7

Strings

7z.dll, xrefs: 6D282AAC
RC_DATA, xrefs: 6D282B76

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Find$LibraryLoad$CloseFileFirstResource_memset
String ID: 7z.dll$RC_DATA
API String ID: 597928718-3209790242
Opcode ID: a6238bf3d78b0b6f62faef62c9e54f1ce318b69a9cd434184bb2ba5153cb31fa
Instruction ID: 2567808a9ada6da0381cca27506ac07f96e91e18a75621a9e68d0ca9d364db62
Opcode Fuzzy Hash: a6238bf3d78b0b6f62faef62c9e54f1ce318b69a9cd434184bb2ba5153cb31fa
Instruction Fuzzy Hash: 0E41C5B154D3499FC710DF24C948B6BB7E8BF89309F41092DF64997282DB34A409CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6D2735F0 Relevance: 13.0, APIs: 8, Instructions: 979COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6D2737C4
GetLastError.KERNEL32(?), ref: 6D2737D1

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CloseErrorFindLast
String ID:
API String ID: 754982922-0
Opcode ID: 0d2cba775f6f3fdceef1a3490dbf476e0c23f01e84f84ae1ed25efac9c1bbe9e
Instruction ID: 3db92fea818c24b0e564be2fdc03dade8d1f1d510a74dba390013c06417c2f94
Opcode Fuzzy Hash: 0d2cba775f6f3fdceef1a3490dbf476e0c23f01e84f84ae1ed25efac9c1bbe9e
Instruction Fuzzy Hash: 0E828D7164834A9FD734CF54C480BABB7E5BF89318F10492DEA9997381D731E849CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D282980 Relevance: 10.6, APIs: 7, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadResource.KERNEL32(6D260000,00000000,6D260000,?,?,6D282B94,?), ref: 6D282993
SizeofResource.KERNEL32(6D260000,00000000), ref: 6D2829A1
LockResource.KERNEL32(00000000), ref: 6D2829AE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 6D2829CF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 6D2829E5
FindCloseChangeNotification.KERNEL32(00000000), ref: 6D2829FA
DeleteFileW.KERNEL32(00000000), ref: 6D282A0A

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: FileResource$ChangeCloseCreateDeleteFindLoadLockNotificationSizeofWrite
String ID:
API String ID: 290882627-0
Opcode ID: ec81891adb553f12314e5086a809d82982362a4af57997722f93b09624e4d276
Instruction ID: 02dd8753f96d654323128981a8919932e2859c5bdb25234e0d7a5ed8e003a7b2
Opcode Fuzzy Hash: ec81891adb553f12314e5086a809d82982362a4af57997722f93b09624e4d276
Instruction Fuzzy Hash: FD112C757802167BD73086698C4CFABB7BCAF46621F104155FD45E72C1D7718809C260

Uniqueness

Uniqueness Score: -1.00%

Function 6D266460 Relevance: 6.2, Strings: 4, Instructions: 1207COMMON

Download Yara Rule

Strings

ERROR: Can not delete output file , xrefs: 6D266ECB
can not open output file , xrefs: 6D266FEA
ERROR: Can not create file with auto name, xrefs: 6D266C91, 6D266D5F
ERROR: Can not rename existing file , xrefs: 6D266DE0

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID: ERROR: Can not create file with auto name$ERROR: Can not delete output file $ERROR: Can not rename existing file $can not open output file
API String ID: 0-3343490755
Opcode ID: 91e52954f2f9d5729bdbad8096ad47fdaf658e4af8b834c634789413c1611a74
Instruction ID: b89c4b28ebc2335ffc42ec9884a62177c7ae2984f1f1309c01521158fdd3c21b
Opcode Fuzzy Hash: 91e52954f2f9d5729bdbad8096ad47fdaf658e4af8b834c634789413c1611a74
Instruction Fuzzy Hash: FDA2F672D4834D9FDB04CFA4D880BAEB7B4BF88305F108569EA0597341DB35A945CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6D272470 Relevance: 4.6, APIs: 3, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,12131721,6D290658,00000000), ref: 6D2724C4
FindFirstFileW.KERNEL32(6D2950B8,?,12131721,6D290658,00000000), ref: 6D2724DE
FindFirstFileW.KERNEL32(?,?), ref: 6D27253A

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: ebb9252a6543ef68c73c739ff30c2a0058ed3cfb24366f7f8b813b3a5dd3a4ef
Instruction ID: f96d508a6fd2a9593f6db2d46f07254119d1432cff46f5befc2e4c3feacfa7c9
Opcode Fuzzy Hash: ebb9252a6543ef68c73c739ff30c2a0058ed3cfb24366f7f8b813b3a5dd3a4ef
Instruction Fuzzy Hash: 5C3164B15483469FC730DF25C849B6BB7E4FF49329F104B29E5A9972C0E730A909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10019EFC Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(1001A015,?,?,?), ref: 10019F09

Part of subcall function 1001A3C4: HeapCreate.KERNEL32(00000000,00001000,00000000,10019F1B,00000001), ref: 1001A3D5
Part of subcall function 1001A3C4: HeapDestroy.KERNEL32 ref: 1001A414

Part of subcall function 1001BFAC: TlsAlloc.KERNEL32(?,10019F53), ref: 1001BFB2
Part of subcall function 1001BFAC: TlsSetValue.KERNEL32(00000000), ref: 1001BFDA
Part of subcall function 1001BFAC: GetCurrentThreadId.KERNEL32 ref: 1001BFEB

GetCommandLineA.KERNEL32 ref: 10019F60

Part of subcall function 1001A421: VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A459
Part of subcall function 1001A421: VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A464
Part of subcall function 1001A421: HeapFree.KERNEL32(00000000,?,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A471
Part of subcall function 1001A421: HeapFree.KERNEL32(00000000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A48D
Part of subcall function 1001A421: HeapDestroy.KERNELBASE(?,?,10019FC1,1001A015,?,?,?), ref: 1001A4C0

Part of subcall function 1001C098: TlsGetValue.KERNEL32(FFFFFFFF,?,10019FCE,00000000,1001A015,?,?,?), ref: 1001C0B0
Part of subcall function 1001C098: TlsSetValue.KERNEL32(00000000,?,10019FCE,00000000,1001A015,?,?,?), ref: 1001C130

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Heap$Free$Value$DestroyVirtual$AllocCommandCreateCurrentLineThreadVersion
String ID:
API String ID: 1348591257-0
Opcode ID: 34f96abe632768e47baa2bffe8d2b045542454c29b03e75bf19a9a8238ef7ead
Instruction ID: 8c1f116477d2608024c7700a61e60c165b33ed3b7c53a85e67fa66fca4a9002f
Opcode Fuzzy Hash: 34f96abe632768e47baa2bffe8d2b045542454c29b03e75bf19a9a8238ef7ead
Instruction Fuzzy Hash: 7A111878904769ABF709DBB08986A0937A6EB06341B21443EF405CE563DF74E4C3DB56

Uniqueness

Uniqueness Score: -1.00%

Function 6D26B447 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

udf, xrefs: 6D26BA33
iso, xrefs: 6D26B996

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID: iso$udf
API String ID: 0-3451695527
Opcode ID: 631bf98f0f93a0cb257eaec2d8bf077ce4d8ac67ffa37df8ed19c12539fb77fe
Instruction ID: 75a11890d6d90f412b2574beebc274d8e32b6a0b7383ed614748f320bc6bf0a9
Opcode Fuzzy Hash: 631bf98f0f93a0cb257eaec2d8bf077ce4d8ac67ffa37df8ed19c12539fb77fe
Instruction Fuzzy Hash: AEF18175A4426A8FCB24CF28C890AE9B7B1FF49305F1541E9E949A7351DB31AEC1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 10001B41 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 10001B4B

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
Instruction ID: d3e97598432a4a316c69c7b199a975740681d618dafaa63f0622d860b7c48d59
Opcode Fuzzy Hash: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
Instruction Fuzzy Hash: A9C09B7490431D97DB00E7E5D9C9D8EB7FCB608204F500451E555F3141E670F94587A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2782B0 Relevance: 53.3, APIs: 28, Strings: 2, Instructions: 779
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 6D2784B2
__CxxThrowException@8.LIBCMT ref: 6D278687
__CxxThrowException@8.LIBCMT ref: 6D2786ED
__CxxThrowException@8.LIBCMT ref: 6D278708
__CxxThrowException@8.LIBCMT ref: 6D278723
__CxxThrowException@8.LIBCMT ref: 6D27874D
__CxxThrowException@8.LIBCMT ref: 6D27882F
__CxxThrowException@8.LIBCMT ref: 6D278A68
__CxxThrowException@8.LIBCMT ref: 6D278A83
__CxxThrowException@8.LIBCMT ref: 6D278A9E
__CxxThrowException@8.LIBCMT ref: 6D278AF2
__CxxThrowException@8.LIBCMT ref: 6D278324

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

__CxxThrowException@8.LIBCMT ref: 6D278390
_malloc.LIBCMT ref: 6D2783B1
__CxxThrowException@8.LIBCMT ref: 6D2783CB
__CxxThrowException@8.LIBCMT ref: 6D278416
__CxxThrowException@8.LIBCMT ref: 6D278468
__CxxThrowException@8.LIBCMT ref: 6D278CE4
__CxxThrowException@8.LIBCMT ref: 6D278CF9
__CxxThrowException@8.LIBCMT ref: 6D278D14

Strings

7zCon.sfx, xrefs: 6D2784F2
(_)m, xrefs: 6D278525

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_malloc
String ID: (_)m$7zCon.sfx
API String ID: 1305767944-4289881278
Opcode ID: 8fbe4d2c54635ce1f764297b5a792c16f572013c8506d4249d71e468ec8834fd
Instruction ID: 5fab697f2b21fe4da6f5aa7dabeeafafc636bfa18a409be0552369bdf2a4d7fd
Opcode Fuzzy Hash: 8fbe4d2c54635ce1f764297b5a792c16f572013c8506d4249d71e468ec8834fd
Instruction Fuzzy Hash: 8862AC71D4425DDBCB21CBA4C980BEEF7B8AF48304F1881E9D649A7241DB745B89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10004859 Relevance: 30.7, APIs: 16, Strings: 1, Instructions: 904COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000485E

Part of subcall function 100081EF: __EH_prolog.LIBCMT ref: 100081F4

Part of subcall function 10017690: InitializeCriticalSection.KERNEL32 ref: 100176BE

DeleteCriticalSection.KERNEL32(?), ref: 10004A99
SysFreeString.OLEAUT32(?), ref: 10004D73
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004E67
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004ED2
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004F2E
DeleteCriticalSection.KERNEL32(?), ref: 10005080
DeleteCriticalSection.KERNEL32(?), ref: 100050D7
DeleteCriticalSection.KERNEL32(?), ref: 10005131
DeleteCriticalSection.KERNEL32(?), ref: 1000519C
SysFreeString.OLEAUT32(?), ref: 100051C5
DeleteCriticalSection.KERNEL32(?), ref: 10005201
SysFreeString.OLEAUT32(?), ref: 10005238
DeleteCriticalSection.KERNEL32(?), ref: 10005274
DeleteCriticalSection.KERNEL32(?), ref: 100052EC
DeleteCriticalSection.KERNEL32(?), ref: 1000537C

Strings

*, xrefs: 100053D3

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CriticalSection$Delete$FreeString$H_prolog$Initialize
String ID: *
API String ID: 3004459923-163128923
Opcode ID: a2fd4f51cf098088f1d673df1d5e7e4f5325e63a52518889363f111df623ee90
Instruction ID: ecb8a8915c69c7c96d6c908040f4422d87eeaffb21051c4ea884642e96cadca4
Opcode Fuzzy Hash: a2fd4f51cf098088f1d673df1d5e7e4f5325e63a52518889363f111df623ee90
Instruction Fuzzy Hash: C3926B74900289DFEF04CFA4C884ADDBBB5FF19344F21849CE446AB256CB71AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6D2642E0 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D262670: __CxxThrowException@8.LIBCMT ref: 6D262688

Part of subcall function 6D264D10: _malloc.LIBCMT ref: 6D264D3A
Part of subcall function 6D264D10: __CxxThrowException@8.LIBCMT ref: 6D264D54

__CxxThrowException@8.LIBCMT ref: 6D2646C2

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

__CxxThrowException@8.LIBCMT ref: 6D264855
__CxxThrowException@8.LIBCMT ref: 6D264876
CharUpperW.USER32(?), ref: 6D264943

Strings

lP)m, xrefs: 6D26484D
Incorrect command line, xrefs: 6D26431B, 6D26433E, 6D26454F, 6D264579, 6D2648F9
(_)m, xrefs: 6D2642F8
Cannot use absolute pathnames for this command, xrefs: 6D264521

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$CharExceptionRaiseUpper_malloc
String ID: (_)m$Cannot use absolute pathnames for this command$Incorrect command line$lP)m
API String ID: 2609558216-2284161092
Opcode ID: 52747f57d81c475e7f306d14b13ac95960f2f4e892c01747b1c5abadbfbcec9b
Instruction ID: 32508948b2678c22423dfd253723478ca4138536b998aaff6d8e5203657bdb1a
Opcode Fuzzy Hash: 52747f57d81c475e7f306d14b13ac95960f2f4e892c01747b1c5abadbfbcec9b
Instruction Fuzzy Hash: 8922A27154C3CA9BD711CF14C490BA6BBE1AF89308F08856DE5D54B392C771E986CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 6D283EF0 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-p, xrefs: 6D2842F4
7za L , xrefs: 6D283F2F
-x, xrefs: 6D2841BA, 6D284256
!, xrefs: 6D284375
-i, xrefs: 6D283FF8, 6D284110

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID: -i$ -p$ -x$!$7za L
API String ID: 0-2873427068
Opcode ID: 818272f16659f89b2be4bb5a35dd7991afb1a3ffcc10ff2100a2dcd9dff3dc9e
Instruction ID: 046071a73bb77b2072e8a7b31ad415f46e2801e40db9d1348a44ffbcdaa7762e
Opcode Fuzzy Hash: 818272f16659f89b2be4bb5a35dd7991afb1a3ffcc10ff2100a2dcd9dff3dc9e
Instruction Fuzzy Hash: DEF1C671D4428CEBCB04DBE4C940EEEBBB9AF58305F154169E6156B282D770AA09CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6D26C2D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 6D26C32F

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

_malloc.LIBCMT ref: 6D26C313

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

_malloc.LIBCMT ref: 6D26C353
__CxxThrowException@8.LIBCMT ref: 6D26C36F
GetLastError.KERNEL32(6D294C28,80000000,00000001,00000003), ref: 6D26C3BC

Strings

(L)m, xrefs: 6D26C388
(L)m, xrefs: 6D26C3D7, 6D26C3E0

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw_malloc$AllocateErrorExceptionHeapLastRaise
String ID: (L)m$(L)m
API String ID: 2571202727-274693059
Opcode ID: f2a0c25b88ad52e51f63618ff5fcf17c282d5fd0861c8a667953f722e8855a92
Instruction ID: 47e894f2109a49e68d70dc7d322b8ec5d2a1e889af763c10d45bee6cb46b3186
Opcode Fuzzy Hash: f2a0c25b88ad52e51f63618ff5fcf17c282d5fd0861c8a667953f722e8855a92
Instruction Fuzzy Hash: 1D41F471640349AFCB10DF99C880BABFBA8FF49710F148128EA559B381C770E906CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001A421 Relevance: 9.1, APIs: 6, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A459
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A464
HeapFree.KERNEL32(00000000,?,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A471
HeapFree.KERNEL32(00000000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A48D
VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,10019FC1,1001A015,?,?,?), ref: 1001A4AE
HeapDestroy.KERNELBASE(?,?,10019FC1,1001A015,?,?,?), ref: 1001A4C0

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
Instruction ID: 1c740d521b0f7e213dbb02f6402200852ca7cbed31c7f2444751ff5461a08e8a
Opcode Fuzzy Hash: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
Instruction Fuzzy Hash: 5A110035240365BBE661EB10DCCAF05B7A6E785750F314026FA456A571C7B2BCA2CB14

Uniqueness

Uniqueness Score: -1.00%

Function 6D2769E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,12131721,6D29FCC8,00000000), ref: 6D276A18
FreeLibrary.KERNEL32(00000000), ref: 6D276A38
FreeLibrary.KERNEL32(00000000,12131721,6D29FCC8,00000000), ref: 6D276A84
GetProcAddress.KERNEL32(?,CreateObject), ref: 6D276AA5

Strings

CreateObject, xrefs: 6D276A9D

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: CreateObject
API String ID: 1386263645-166191583
Opcode ID: eb14b675a85030c469dcb8d8e0e1bff8b2ab4b9e42e979f37512c0e158f55a3f
Instruction ID: e9758da0d4789434cacefe697e084da0c93c508c3cd7e68280617e1d55d7d54e
Opcode Fuzzy Hash: eb14b675a85030c469dcb8d8e0e1bff8b2ab4b9e42e979f37512c0e158f55a3f
Instruction Fuzzy Hash: CB416E75A4030AEFDB20CF66C484BAAB7F5FF49315F10856AE8699B380D734E900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6D263E70 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 6D264042

Part of subcall function 6D264D10: _malloc.LIBCMT ref: 6D264D3A
Part of subcall function 6D264D10: __CxxThrowException@8.LIBCMT ref: 6D264D54

__CxxThrowException@8.LIBCMT ref: 6D2641B5

Strings

P)m, xrefs: 6D263F2A
P)m, xrefs: 6D26409D, 6D2640A0

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID: P)m$P)m
API String ID: 175252994-2334468101
Opcode ID: 8a01b5c3d2b9756115e9b268b07ec5cd94aaf94f1fb67db12bcf949f6602a6d9
Instruction ID: cec6719088012a5f3ed456daf48a6fa3555d3825d2d5801a5f207b2d60d07e19
Opcode Fuzzy Hash: 8a01b5c3d2b9756115e9b268b07ec5cd94aaf94f1fb67db12bcf949f6602a6d9
Instruction Fuzzy Hash: EAB126B1D0425DDBDB10CF99C984AEEFBB4BF08304F6481AEE619A7240D7305A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D275F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,GetMethodProperty), ref: 6D275F83
GetProcAddress.KERNEL32(00000000,GetNumberOfMethods), ref: 6D275F9F

Strings

GetNumberOfMethods, xrefs: 6D275F99
GetMethodProperty, xrefs: 6D275F77

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AddressProc
String ID: GetMethodProperty$GetNumberOfMethods
API String ID: 190572456-2134343882
Opcode ID: 125d5eca26756e167cc8754e13ec8398acd0f523e70582eafb149d988e4a832a
Instruction ID: 5eb14b0065aaadf295e96e266a315706643d6ebe81403353c8933ec2d54f4c71
Opcode Fuzzy Hash: 125d5eca26756e167cc8754e13ec8398acd0f523e70582eafb149d988e4a832a
Instruction Fuzzy Hash: AC215E75E4131EABCB24CF95D9C0AAEF7B9FF49309F104025E914A7201E731E906CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D268670 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000), ref: 6D268916
__CxxThrowException@8.LIBCMT ref: 6D26892C

Strings

<H, xrefs: 6D26896F

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorException@8LastThrow
String ID: <H
API String ID: 1006195485-4022674625
Opcode ID: 2817c4be902da9ff312efe45dade11ff697869b2bd3095645a8d5f97cc3525ae
Instruction ID: d143807d5a80eaa4c505a908471bd38c3d03b163bf276b7e7721d7b1dcf3c74b
Opcode Fuzzy Hash: 2817c4be902da9ff312efe45dade11ff697869b2bd3095645a8d5f97cc3525ae
Instruction Fuzzy Hash: 2DE182B1D4428D9FCB00DFE8C990AEEFBB5BF49304F14816DE515AB284D731AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D26CAE0 Relevance: 4.8, APIs: 3, Instructions: 266COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D26CB18

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D26CB30

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Part of subcall function 6D26A910: __CxxThrowException@8.LIBCMT ref: 6D26A992

GetLastError.KERNEL32(?,00000000,00000000), ref: 6D26CBD3

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$AllocateErrorExceptionHeapLastRaise_malloc
String ID:
API String ID: 214124409-0
Opcode ID: d7a519344518b49d4a1b7b5c1f0733b6df3d884777fd5cfafd0d31acaf037205
Instruction ID: 786ea0cf19c7f866d5efd5b1d8bfee93533754225f65f96a3d31fca3ac3d594f
Opcode Fuzzy Hash: d7a519344518b49d4a1b7b5c1f0733b6df3d884777fd5cfafd0d31acaf037205
Instruction Fuzzy Hash: DDA194B1D0424DEFCB04DFA8D980ADEB7B4FF48318F118129EA15A7341D735AA59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D272A70 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,12131721,?,00000000,?,?,00000000,?,?,?,00000000,6D290C38,000000FF), ref: 6D272A9F
CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,12131721,?,00000000,?,?,00000000), ref: 6D272ACC
CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6D272B2B

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: af7bd7c3386c2a55749daae2fe82c3decee658ed69bc74c88c7aeb734f92b94c
Instruction ID: 726ac45ffcdcd035d3af3d1fe5508a910eda36725724d207aad2688a058ba8c5
Opcode Fuzzy Hash: af7bd7c3386c2a55749daae2fe82c3decee658ed69bc74c88c7aeb734f92b94c
Instruction Fuzzy Hash: C531B1B1A0420AAFDB20CF64CC45BABBBB8FF05724F104319F925972C0D730AA15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D271340 Relevance: 4.6, APIs: 3, Instructions: 86COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,12131721,?,?,?,?,?,00000000), ref: 6D27136E
GetLastError.KERNEL32 ref: 6D27138C
CreateDirectoryW.KERNEL32(?,00000000), ref: 6D2713D7

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: cf79a916487835df8e7a401bbb3c68f1b1cdffa4e50f537a782318046b5921b7
Instruction ID: e0e28fe821fbbf4db4767f19897285f297feadbd478aa6322caed80caa2a1265
Opcode Fuzzy Hash: cf79a916487835df8e7a401bbb3c68f1b1cdffa4e50f537a782318046b5921b7
Instruction Fuzzy Hash: C3210673E442099BDB20CF95D8057AFBBB8FF45625F00017AEE1893240DB366904C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6D261AB0 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,?), ref: 6D261AEC
GetLastError.KERNEL32 ref: 6D261B01

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e7adde8c501de34fdbbe3f44058feaf741b386b40ba82a1c5e061afd5c156ca5
Instruction ID: 7296a737bcc344e974dc787189a8ecb15a6dab8958dea726925ffd0bb75a2e5c
Opcode Fuzzy Hash: e7adde8c501de34fdbbe3f44058feaf741b386b40ba82a1c5e061afd5c156ca5
Instruction Fuzzy Hash: 8C11D37675524F4B8700CE6DE8419AB77E8EB85322F00822EFD18C7250E732E49597F1

Uniqueness

Uniqueness Score: -1.00%

Function 6D270880 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D2708A5

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

__CxxThrowException@8.LIBCMT ref: 6D2708CD
__CxxThrowException@8.LIBCMT ref: 6D2708F7

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID:
API String ID: 3476068407-0
Opcode ID: 13db1541be12b6e5cb8525d87d4a14855f77c85bcc9abeee066cb8cd6a6b0df5
Instruction ID: 044db72c6b837a5c0e5fc0aeceb967f13aa9ffd94afaff9f78f2043382f8c534
Opcode Fuzzy Hash: 13db1541be12b6e5cb8525d87d4a14855f77c85bcc9abeee066cb8cd6a6b0df5
Instruction Fuzzy Hash: 071108B064070D9BC724CB96CAD0C2BB3F9AB58204B18893CD50A93242D771A9084650

Uniqueness

Uniqueness Score: -1.00%

Function 10002805 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000280A
EnterCriticalSection.KERNEL32(00000000,?,?,?,10002894,?,?,?,?,?), ref: 1000281B
LeaveCriticalSection.KERNEL32(00000000,?,?,?,10002894,?,?,?,?,?), ref: 1000284F

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 31ba921f93e0922ecbc56fece5b0bbad6d7110b5eb9d49f18265bee903e4b92a
Instruction ID: a3f251eb98acb8aeedd518acfd2e06878d0524bbd79d22e0378b99734f5e22aa
Opcode Fuzzy Hash: 31ba921f93e0922ecbc56fece5b0bbad6d7110b5eb9d49f18265bee903e4b92a
Instruction Fuzzy Hash: D401467AA00214AFDB11CF94C848B9ABBB9FF48711F10841AFD01A7221C7B4A9119B60

Uniqueness

Uniqueness Score: -1.00%

Function 10008A65 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10008A6A

Part of subcall function 1000A4D5: __EH_prolog.LIBCMT ref: 1000A4DA

Strings

, xrefs: 10008B73

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: e5ab11678a7af806c47a763770102e730e2bdbd4d0fd60aadb5155847553715b
Instruction ID: 5679c1a6151dc724afce86c3166b852d76cd262a1264ab291975f652ea8321e5
Opcode Fuzzy Hash: e5ab11678a7af806c47a763770102e730e2bdbd4d0fd60aadb5155847553715b
Instruction Fuzzy Hash: E3717F74E00609DFEB04DFA4C981AADB7F1FF44390F104519E495AB39ADB34AB81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 100087AE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100087B3

Strings

, xrefs: 1000887A

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: d440410e0f6ecbe5b83ba7b8c1205205ce8a76e29a2380b00ce8a680fd4569c3
Instruction ID: dc996c4eb68a87c8f199726ed84f9ce0c47e74a02a5fa25993d790b30f922306
Opcode Fuzzy Hash: d440410e0f6ecbe5b83ba7b8c1205205ce8a76e29a2380b00ce8a680fd4569c3
Instruction Fuzzy Hash: B4515275E002069FEB14DFA8C881ABEB7F5FF88380F548529E545E7245DB70AE41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D261950 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 6D26196C

Strings

(L)m, xrefs: 6D26195C

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: (L)m
API String ID: 2591292051-1242017383
Opcode ID: d7027c2b484a3ae512f64d118907759966f58258b5501a09bbd67793d7667bef
Instruction ID: 01b615bb67547c9b2cb0a48b53d7638ae3a76133560758afed1e04b09126dadd
Opcode Fuzzy Hash: d7027c2b484a3ae512f64d118907759966f58258b5501a09bbd67793d7667bef
Instruction Fuzzy Hash: D5E0D87014574A1BC7115E699808B57BBD85F02372B10CB28E979DB6C0D770E482C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 6D2717B0 Relevance: 3.1, APIs: 2, Instructions: 87fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6D271060: SetFileAttributesW.KERNEL32(00000000,00000000,12131721,?,00000000,?,?,00000000,?,12131721,00000000), ref: 6D27108F

DeleteFileW.KERNEL32(?,?,12131721,00000000), ref: 6D2717EE
DeleteFileW.KERNEL32(?), ref: 6D271848

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: File$Delete$Attributes
String ID:
API String ID: 890995776-0
Opcode ID: eb0f7dec612ddf11f46d85617dc2b6a3a4b6b3d66d597ccb75260ac0d3203b11
Instruction ID: 6891b035d75a6928262bfb0a675895af2be59305ceb5ce7abfc98b839603e076
Opcode Fuzzy Hash: eb0f7dec612ddf11f46d85617dc2b6a3a4b6b3d66d597ccb75260ac0d3203b11
Instruction Fuzzy Hash: D321C473E482099BDB20CFA5E9057EFB7B8FF45269F00017ADD1993240EB36A904C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D271060 Relevance: 3.1, APIs: 2, Instructions: 85COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,12131721,?,00000000,?,?,00000000,?,12131721,00000000), ref: 6D27108F
SetFileAttributesW.KERNEL32(?,00000000), ref: 6D2710ED

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 323be6385a0d06654c46b1fda16f4ddbb93499269499e2eec83e780dafe89b75
Instruction ID: e0474b79dcc8640ed2197642d8143652e64dfe38200247d721c02034f26c6c56
Opcode Fuzzy Hash: 323be6385a0d06654c46b1fda16f4ddbb93499269499e2eec83e780dafe89b75
Instruction Fuzzy Hash: 1621B273E442099BDF10CF95D805BEFBBB8EB85625F00016AE91897240EB36AA04C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2777E0 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D2777E6

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D277803

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: e40840150352f22fccc58c71a3b361b249608170ae5fc8e09970bc20fed000b7
Instruction ID: 02cb74e4086258dc749a5b9fe3f778e27a194313846e9ca8a74a5a1f7b1787e1
Opcode Fuzzy Hash: e40840150352f22fccc58c71a3b361b249608170ae5fc8e09970bc20fed000b7
Instruction Fuzzy Hash: 5A01D47194420AEBDB24CF18C4909AAB3A9EF55315F0880BAED05DF342E771EE45D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 10019CB8 Relevance: 3.0, APIs: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576

CreateThread.KERNEL32(00000000,00000000,Function_00019D23,00000000,?,?), ref: 10019CF9
GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocCreateErrorHeapLastThread
String ID:
API String ID: 3580101977-0
Opcode ID: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
Instruction ID: 578384fe474d0b562f95e97df9c8fae57dcf2a9e42d60c7228f8a9f52e2ea293
Opcode Fuzzy Hash: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
Instruction Fuzzy Hash: 77F028372043156BDB21DF65EC05DAF3BA5DF446B0B104029FA18CA190CB31D8918B91

Uniqueness

Uniqueness Score: -1.00%

Function 6D261C20 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6D261C4C
GetLastError.KERNEL32 ref: 6D261C75

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: a32934a56eee9b78e3c0c5076a359274be3aa1b97314e95265a70e10e3c9b65d
Instruction ID: 84c342cb5e9b9024a90198cd154745aafd4befce689c740fe11d3516466625fd
Opcode Fuzzy Hash: a32934a56eee9b78e3c0c5076a359274be3aa1b97314e95265a70e10e3c9b65d
Instruction Fuzzy Hash: C601623224034F9BD750CE58D844BAB37F8BF44715F10882AF91ACB580D375E8909BB5

Uniqueness

Uniqueness Score: -1.00%

Function 6D2619C0 Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 6D2619EB
GetLastError.KERNEL32 ref: 6D261A0C

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: ff44aced2258fb57de1ef50158d22e593ad6f8e26cb15c3bf8579f0420d657f3
Instruction ID: 2cdb627272dc8dd8afaea3bde0e5844f19cb1dd24c48df0321c14f04f0d2054a
Opcode Fuzzy Hash: ff44aced2258fb57de1ef50158d22e593ad6f8e26cb15c3bf8579f0420d657f3
Instruction Fuzzy Hash: 51F08C7129038F9BDB04CE54D844B7733A9BB84316F10C42AF81ACB280D776E8A0CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1001A3C4 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,10019F1B,00000001), ref: 1001A3D5

Part of subcall function 1001A27C: GetVersionExA.KERNEL32 ref: 1001A29B

HeapDestroy.KERNEL32 ref: 1001A414

Part of subcall function 1001A4C9: HeapAlloc.KERNEL32(00000000,00000140,1001A3FD,000003F8), ref: 1001A4D6

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
Instruction ID: f49a4552e00520ddd5bd994c2c6f56530b3037705a70c7491d35245aff95e9ec
Opcode Fuzzy Hash: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
Instruction Fuzzy Hash: 80F09274611302ABFF14EB309D8AB5935D1DB86791F308436F905CD0A6EBF0D8D2A611

Uniqueness

Uniqueness Score: -1.00%

Function 6D261BE0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000002,6D27B356,?,?,?,?,?,?,6D295380,?), ref: 6D261BE9
GetLastError.KERNEL32(?,?,?,?,?,?,6D295380,?), ref: 6D261BFD

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 3423adb1ff58508843b6fb88e5354f31aaac27456cafa4d686ac088a2b870111
Instruction ID: a9edd6e161590e8c762ab27b7d847724a07b53e082d97573b2c402d136f343ba
Opcode Fuzzy Hash: 3423adb1ff58508843b6fb88e5354f31aaac27456cafa4d686ac088a2b870111
Instruction Fuzzy Hash: BAE012743907475BDB214A36CC4833B75E47F017377908B28E07AC54E0E72DE0C18A24

Uniqueness

Uniqueness Score: -1.00%

Function 6D2709E0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D2709E8

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D270A02

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: af33c19e366a6a3cb34b4647538e67dcc9e8c06c3abeacff7658adcde95360e2
Instruction ID: fb8c46ec517d420444a54527214472be9efa26c7625275bc18246517e53d4da1
Opcode Fuzzy Hash: af33c19e366a6a3cb34b4647538e67dcc9e8c06c3abeacff7658adcde95360e2
Instruction Fuzzy Hash: 0AD05EA0C9D24D728A04C6A5A9419BAB7AC891A204F4901A4BD0986542FA26961D42A6

Uniqueness

Uniqueness Score: -1.00%

Function 10005AA5 Relevance: 2.1, APIs: 1, Instructions: 563COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10005AAA

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 77d91d3dc47dd387f4a4c0ba6b5aa2c283876a1cf57c9fbbaea89970380046ef
Instruction ID: 24b6dd137383e7686c229cdd86bb12439a3ed7e02ed9f8727553bb3e51178dae
Opcode Fuzzy Hash: 77d91d3dc47dd387f4a4c0ba6b5aa2c283876a1cf57c9fbbaea89970380046ef
Instruction Fuzzy Hash: 37427F74904249DFEB00CFA4C984BDDBBF5EF09384F244099E849AB386DB75AE45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10009824 Relevance: 2.0, APIs: 1, Instructions: 502COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10009829

Part of subcall function 1000940A: __EH_prolog.LIBCMT ref: 1000940F

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 20f936d777ea9103e340114ca1ee5d19f73f9782134bda5456cca3b6a12e0127
Instruction ID: 7486e4567ea8ddc6047f59b84a49b8006f4fb568e8041e622ffbf8bfe16b7337
Opcode Fuzzy Hash: 20f936d777ea9103e340114ca1ee5d19f73f9782134bda5456cca3b6a12e0127
Instruction Fuzzy Hash: FE326A74904249DFEB14CFA4C880BDEBBB5FF45384F50806EE44AA7296DB70AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1000A0CE Relevance: 1.8, APIs: 1, Instructions: 315COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A0D3

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b70ee2b395d88cec1f4979dc7763d5ee60afbb6c3d3700f3cfe0a681a2f91748
Instruction ID: 16904ee073535d8266284e3ab4d1ee50d97a619b8a40ccf019ff2181d9a9fe66
Opcode Fuzzy Hash: b70ee2b395d88cec1f4979dc7763d5ee60afbb6c3d3700f3cfe0a681a2f91748
Instruction Fuzzy Hash: 4DC17F74A0024ADFEB14CFA8C884BDEBBF1FF49380F204629E445A7245DB75AE81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6D267350 Relevance: 1.7, APIs: 1, Instructions: 158timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32(?,00000000,00000000,00000000,12131721,?,?,?,?,?,6D290300,000000FF), ref: 6D267438

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 4dd28ebc794f5d11b350820749cde610c056e4dd13da3af31ce712a9e38074d1
Instruction ID: c827523f09d0da0492cf66bdbe6504b40e4135b4ae7ef91551e3b597a9815915
Opcode Fuzzy Hash: 4dd28ebc794f5d11b350820749cde610c056e4dd13da3af31ce712a9e38074d1
Instruction Fuzzy Hash: B7517D71A44BCBAFD309CF74D484BA5FBB0FB49314F108669D52987A01E731B8A4DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10008DDD Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10008DE2

Part of subcall function 1000A51C: __EH_prolog.LIBCMT ref: 1000A521

Part of subcall function 1000809D: __EH_prolog.LIBCMT ref: 100080A2

Part of subcall function 10008A65: __EH_prolog.LIBCMT ref: 10008A6A

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0f2ef54e4d54980d6866c9ca524e59761326e1e766cc54546d6848b3260f56d2
Instruction ID: 0609df34ebabf0a4a76e2918ca157b4269ad3ae51d55b8a1eb59a52bcf34417c
Opcode Fuzzy Hash: 0f2ef54e4d54980d6866c9ca524e59761326e1e766cc54546d6848b3260f56d2
Instruction Fuzzy Hash: DF51B274D00159DBEF14DFA4C885AEEBBB2FF44390F108159E8556B286CB71AF41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000790D Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10007912

Part of subcall function 1000A496: __EH_prolog.LIBCMT ref: 1000A49B

Part of subcall function 10007AD6: __EH_prolog.LIBCMT ref: 10007ADB

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6bb2def5445f3f3c03a7c343a9c0ad1c6318bdf414d74d1a9ec3108368a0102b
Instruction ID: b40d17a970ea470072cc094887da7a6dca03317504114bf01e9f4a1a4d97d151
Opcode Fuzzy Hash: 6bb2def5445f3f3c03a7c343a9c0ad1c6318bdf414d74d1a9ec3108368a0102b
Instruction Fuzzy Hash: 71516D34900249DFEB11CFA4C954AEDBBB4FF95344F244099E845A7246DB74AF01DB62

Uniqueness

Uniqueness Score: -1.00%

Function 1000670B Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006710

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef6ed3350f196110724b134d7ae58aa8eb2fad54a812ca61983dfb10647da9bd
Instruction ID: 1deedfb3ed3693e114189d5c8674f5dba158b51214873baba276ba9a2bcc193c
Opcode Fuzzy Hash: ef6ed3350f196110724b134d7ae58aa8eb2fad54a812ca61983dfb10647da9bd
Instruction Fuzzy Hash: 73419F74900246CFDB24CF58C88496ABBF2FF48358B2546ADD0999B351C731ED46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10001BB7 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5099f1d692100a5232163a5791f00c8b8683fd86d0e2744a0ba1ce0008d983f8
Instruction ID: 59f6696383dde50044605197c7a13ccbc641f9314ce92faebeca66c50bce22a2
Opcode Fuzzy Hash: 5099f1d692100a5232163a5791f00c8b8683fd86d0e2744a0ba1ce0008d983f8
Instruction Fuzzy Hash: 47219F7198468ADBFB24CF60D9808EEB7B6EB412D0B21852DE49267648D730FE41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 100188B8 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?), ref: 1001899F

Part of subcall function 1001A13A: InitializeCriticalSection.KERNEL32(00000000,?,?,?,10018A6D,00000009,?,?,?), ref: 1001A177
Part of subcall function 1001A13A: EnterCriticalSection.KERNEL32(?,?,?,10018A6D,00000009,?,?,?), ref: 1001A192

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
Instruction ID: bde266228d008e092059639ff97bb6b14f601e90ad82446575358dbeed7d10ff
Opcode Fuzzy Hash: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
Instruction Fuzzy Hash: C5219032A00255BAEB10DB68DC42BADB7A4FB01764F284215F924EF1C0C774EBC18B52

Uniqueness

Uniqueness Score: -1.00%

Function 10001BB2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1b3d449f9b1d9ca4bc486b6888b2a71bf231b77982e7f41f13db39985a04daa4
Instruction ID: c4781e215bb38ec63fc671d50aeec44c86b20336711f2647e792547350c1aef8
Opcode Fuzzy Hash: 1b3d449f9b1d9ca4bc486b6888b2a71bf231b77982e7f41f13db39985a04daa4
Instruction Fuzzy Hash: 3911E232A4124A9FFB14CF64C9808EEB3F2EB403D0B21813DE052A7648D730FE428B90

Uniqueness

Uniqueness Score: -1.00%

Function 6D271420 Relevance: 1.6, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6D26890F,12131721,?,?,00000000), ref: 6D271528

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 92af9d70f2e6d11d48145151b61c5ee084ede443155bf833a8a6680280f99efd
Instruction ID: 1af8c5cba12be0f7c7bb3ca36c498b0f4918eb3184b08d0d8edfd0952a7db527
Opcode Fuzzy Hash: 92af9d70f2e6d11d48145151b61c5ee084ede443155bf833a8a6680280f99efd
Instruction Fuzzy Hash: 4BB1F571E4420E8BCF26CFA8C991AFEB7B5FF84305F144179D906A7240E735A949CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100030FD Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10003102

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b051d9f97361328a0859d23c7aef542bc19b666e6010b629010daeab35dc1547
Instruction ID: 1a273919c2d2e3c34155be655625f51d11ef425e7a56d82b9c8decfb09a307f8
Opcode Fuzzy Hash: b051d9f97361328a0859d23c7aef542bc19b666e6010b629010daeab35dc1547
Instruction Fuzzy Hash: 4011CE71A44155ABE722CF29CC05B9F37A9EF0A7E4F008119F805DB265DB31DD01C790

Uniqueness

Uniqueness Score: -1.00%

Function 100039C8 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100039CD

Part of subcall function 10003600: __EH_prolog.LIBCMT ref: 10003605

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 257c9c1ad85ce65f22fa997ad81c770c6af4072d1a7d7a18d6b680d099e47f4b
Instruction ID: a8771e25a5af01616f041783a1a562797f3037f43c5b4569f99eca130688d05b
Opcode Fuzzy Hash: 257c9c1ad85ce65f22fa997ad81c770c6af4072d1a7d7a18d6b680d099e47f4b
Instruction Fuzzy Hash: 44118274E01795DAEB09DBA8C9153EEFBEADF95300F54414D9057A7282CBF42B04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 10006A20 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006A25

Part of subcall function 10001B41: GetSystemInfo.KERNEL32(?), ref: 10001B4B

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prologInfoSystem
String ID:
API String ID: 3096475795-0
Opcode ID: 52262b521e3cf9d1fda4bec855af299aea3512d706ab6bf0f58a7f0b292b1210
Instruction ID: 655e083bcbb9f064a1fc17e82f19a2947c3b56c2b4f5fa8eba001858af0e0911
Opcode Fuzzy Hash: 52262b521e3cf9d1fda4bec855af299aea3512d706ab6bf0f58a7f0b292b1210
Instruction Fuzzy Hash: 8701A2B0901B949FD320CF59D48469AFBE5FB09300F90886EE4AA9B612C7B8A6448F50

Uniqueness

Uniqueness Score: -1.00%

Function 6D2725A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 6D272470: FindClose.KERNEL32(?,12131721,6D290658,00000000), ref: 6D2724C4
Part of subcall function 6D272470: FindFirstFileW.KERNEL32(6D2950B8,?,12131721,6D290658,00000000), ref: 6D2724DE
Part of subcall function 6D272470: FindFirstFileW.KERNEL32(?,?), ref: 6D27253A

FindClose.KERNEL32(FFFFFFFF,?,12131721,?,00000000,6D2950B8,?,6D290438,000000FF,?,6D27265E), ref: 6D2725EA

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c489ae2199100a987e1b8a5e6b73dc809fa50902c5530a9bf7bc64f800564a02
Instruction ID: 44683eb2d0ab370be8cd628eb2bc1ef910a2d8c7ded12e6108a194baaaab96af
Opcode Fuzzy Hash: c489ae2199100a987e1b8a5e6b73dc809fa50902c5530a9bf7bc64f800564a02
Instruction Fuzzy Hash: 54F06DB6944649AFCB20CF99CC44BAAB7B8FB06624F50072AF831973C0D7346905CA64

Uniqueness

Uniqueness Score: -1.00%

Function 10001C8A Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001C8F

Part of subcall function 10001BB2: __EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 45d6ff788914fcc1d4c4362c08418d30e3fc6f4cbe7bfcd3fb78a9b9f7420235
Instruction ID: 5875ca03f24213d4aa71392faa60c1249694dc7a06dd944ad61b31c616a183da
Opcode Fuzzy Hash: 45d6ff788914fcc1d4c4362c08418d30e3fc6f4cbe7bfcd3fb78a9b9f7420235
Instruction Fuzzy Hash: 3AF03432A00219ABEB05CF98CC01BEEB7B9EB44365F108659B821E7290C775EE00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10001C8F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001C8F

Part of subcall function 10001BB2: __EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a6999b822fc1317c87866c67a3b2559ab8b1b0de13d547d74b0740a9a50685af
Instruction ID: a1ce7e251bf4dddfe6d8e665bceb41a424ebb3d89783d3dba666d18c8877da87
Opcode Fuzzy Hash: a6999b822fc1317c87866c67a3b2559ab8b1b0de13d547d74b0740a9a50685af
Instruction Fuzzy Hash: 43F0F876A00219EBEB15CF94CC05BEEB7B9FB44365F108659B825E7290C775AA10CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1000A4D5 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A4DA

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5e305e5dd078dffe59473feca98cbca4bc7fff0512b603f2e5de80fa23a82b3e
Instruction ID: 00a3cd71fa0aca0c29c4385373171d1cf368eeee970badd092b8d780c186b9fa
Opcode Fuzzy Hash: 5e305e5dd078dffe59473feca98cbca4bc7fff0512b603f2e5de80fa23a82b3e
Instruction Fuzzy Hash: ECE09275E00510ABDB08DFA88C066AE7AE5EB04360F10462EA016E72C1DFB06B408654

Uniqueness

Uniqueness Score: -1.00%

Function 1000A51C Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A521

Part of subcall function 1000A6CF: __EH_prolog.LIBCMT ref: 1000A6D4

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1012000332503e428c05b8117d4b32522b17b094d4f2e7d891d0d79f9d594998
Instruction ID: aa797ba4b590ef7c1940b9b2a0b5883bf8ddeea9a52a955fbfb363e5e3090a9b
Opcode Fuzzy Hash: 1012000332503e428c05b8117d4b32522b17b094d4f2e7d891d0d79f9d594998
Instruction Fuzzy Hash: 72E09275A00514AFEB08DBA88C066AE76E5EB48250F00862EA012E62D0DFB06A808754

Uniqueness

Uniqueness Score: -1.00%

Function 10006B51 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006B56

Part of subcall function 10006B9E: __EH_prolog.LIBCMT ref: 10006BA3

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c2b4014cf6554101de5823dbb260c55468e89f1724bea5b528826ce213b76a0a
Instruction ID: 8d9a37c6723f40ac26746b696ab844ca15524eaf609cb6dee056dacbd79d311a
Opcode Fuzzy Hash: c2b4014cf6554101de5823dbb260c55468e89f1724bea5b528826ce213b76a0a
Instruction Fuzzy Hash: 8BF08C71C01A60DBD724CF54C8057DEB7B4EF08310F10464EA8A6A7281CBB0BA40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000A496 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A49B

Part of subcall function 1000A0CE: __EH_prolog.LIBCMT ref: 1000A0D3

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 49073b19b42d1aece4de8f7d12bddb7de673f44c594ea106af3184a1002e2511
Instruction ID: 889d54ac72d292b4943fb779c3a4a2c7d1dd2e9b7142568b78a9c6437da24382
Opcode Fuzzy Hash: 49073b19b42d1aece4de8f7d12bddb7de673f44c594ea106af3184a1002e2511
Instruction Fuzzy Hash: 12E08C36900148FBDF02CF84C805FEF7B75EB452A0F00851AF40415051C3BAAA50DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10019DDE Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 10019E13

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
Instruction ID: 587474e3f6e270900c506b7264c4806e64e6eaefbf2122b89b9aa41b5ebd9e7a
Opcode Fuzzy Hash: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
Instruction Fuzzy Hash: D6E08C3694052AABEB12E7A0CC46A9E37A0EF08380F040010F8005E062DB70FED24692

Uniqueness

Uniqueness Score: -1.00%

Function 6D2893E1 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6D286375,00000001,?,?,?,6D2864EE,?,?,?,6D297F18,0000000C,6D2865A9), ref: 6D2893F6

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 91bc9d60c2516d5c8a54464babe748125c2224c66a55d4687e6406992dae6682
Instruction ID: 66e87cb6acf44b3268196b7cb976203100a126d3f50123582d6e21f6862ae3bf
Opcode Fuzzy Hash: 91bc9d60c2516d5c8a54464babe748125c2224c66a55d4687e6406992dae6682
Instruction Fuzzy Hash: 6FD05E325943495EDB405EB69C0CB233BECAB8639DF148435B80CCA180E770C550C600

Uniqueness

Uniqueness Score: -1.00%

Function 1000AB8D Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000AB92

Part of subcall function 10006A20: __EH_prolog.LIBCMT ref: 10006A25

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7465464f3484d0fe6a61d7cab71274671711f41a51988a712e270957caaa37a7
Instruction ID: f583651af7419ed68212601d7f78bfec3ebd47bcdcb2918c529af6d70d782719
Opcode Fuzzy Hash: 7465464f3484d0fe6a61d7cab71274671711f41a51988a712e270957caaa37a7
Instruction Fuzzy Hash: 1AD05E75F14141AFEB08DBB4981636D76E2EB48280F10856DA012E66C1DFB0BA80C625

Uniqueness

Uniqueness Score: -1.00%

Function 10019DE9 Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 10019E13

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
Instruction ID: 55bdce0fba70f3b5ff24939f3ea0e7f6c7887ef7bde984f872fb15fca6cc6046
Opcode Fuzzy Hash: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
Instruction Fuzzy Hash: 4FD05E31540626ABE213E770DC86A5E2394DF05790B110115F8408D062DF70FEC24192

Uniqueness

Uniqueness Score: -1.00%

Function 10017570 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 10019CB8: CreateThread.KERNEL32(00000000,00000000,Function_00019D23,00000000,?,?), ref: 10019CF9
Part of subcall function 10019CB8: GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03

GetLastError.KERNEL32 ref: 10017598

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorLast$CreateThread
String ID:
API String ID: 665435222-0
Opcode ID: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
Instruction ID: 5da84cd6a30c0b06f2c1d8553272c344b363e72c39abfbd7409f2c23709d4e44
Opcode Fuzzy Hash: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
Instruction Fuzzy Hash: 2EE0ECB2254252AEF304DB648C46FA776E9EB94B81F50442DBA49CA180E6B0D944C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 10012A20 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,10001E62,?,?,1000B459,?), ref: 10012A31

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
Instruction ID: 499c3da3a26d341c9e988975342de67c6826636d0b386d7712dafe969d9ecfde
Opcode Fuzzy Hash: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
Instruction Fuzzy Hash: 18B012F07B238176FE6E87204C5BF662451A740BC7F601098F301DC0C4E7E094409015

Uniqueness

Uniqueness Score: -1.00%

Function 10012A40 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,10001E7E,?,10001E58,?,?,1000B459,?), ref: 10012A4C

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
Instruction ID: 32e2f69f7c2909d2d391187de9ef312e1eea697864ad2fb4147c7fa98b3e1f25
Opcode Fuzzy Hash: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
Instruction Fuzzy Hash: 96B012B034230023FD78C3110D45B1611506B00741E60405C73016C4C08570E4018504

Uniqueness

Uniqueness Score: -1.00%

Function 0045D254 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2164596776.000000000045D000.00000020.00000001.01000000.00000005.sdmp, Offset: 0045D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_45d000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af57d910d49d8278b272d1c5b686ce12d02fd86820ac95061553183f1b4eef0e
Instruction ID: 6dfdc031c697fc1e6648c82353f9adc365046dc8c97b895b4623de4425c805d9
Opcode Fuzzy Hash: af57d910d49d8278b272d1c5b686ce12d02fd86820ac95061553183f1b4eef0e
Instruction Fuzzy Hash: 8D01A1B16442087BCB20EB98DC81EAB3399AB49315F008217FD04D7292DBBDD98587AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045D308 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2164596776.000000000045D000.00000020.00000001.01000000.00000005.sdmp, Offset: 0045D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_45d000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e694332cd869afef72d714b09643c92b02df4451c600dc0161b06d4e1d26d5f
Instruction ID: c958dbefeb605697edf91b6e8170604951f246ed2304612b0a3139f3e32851f6
Opcode Fuzzy Hash: 6e694332cd869afef72d714b09643c92b02df4451c600dc0161b06d4e1d26d5f
Instruction Fuzzy Hash: A1C0805160563025167031792CC58FF004C8C032BA314037BFD15C5243CBEC0DC5419D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D27B9C0 Relevance: 53.9, APIs: 15, Strings: 15, Instructions: 1428COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D27BC36

Part of subcall function 6D265290: _malloc.LIBCMT ref: 6D2652BA
Part of subcall function 6D265290: __CxxThrowException@8.LIBCMT ref: 6D2652D4

GetLastError.KERNEL32(?,00000000), ref: 6D27BAE7

Strings

rsfx, xrefs: 6D27BA4F
GetFullPathName error, xrefs: 6D27CC22
MAPISendDocuments, xrefs: 6D27C806
Updating for multivolume archives is not implemented, xrefs: 6D27BDE8
7-Zip cannot load Mapi32.dll, xrefs: 6D27C8D2
Scanning error, xrefs: 6D27C08F
R)m, xrefs: 6D27BC60, 6D27BC66
7-Zip cannot find MAPISendDocuments function, xrefs: 6D27C82E
Mapi32.dll, xrefs: 6D27C7EA
7-Zip cannot delete the file, xrefs: 6D27C659
The file already exists, xrefs: 6D27C449
7-Zip cannot find specified SFX module, xrefs: 6D27BAF2
P)m, xrefs: 6D27BC2C
SFX file is not specified, xrefs: 6D27BA83
7-Zip cannot move the file, xrefs: 6D27C71C

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$ErrorLast_malloc
String ID: P)m$7-Zip cannot delete the file$7-Zip cannot find MAPISendDocuments function$7-Zip cannot find specified SFX module$7-Zip cannot load Mapi32.dll$7-Zip cannot move the file$GetFullPathName error$MAPISendDocuments$Mapi32.dll$SFX file is not specified$Scanning error$The file already exists$Updating for multivolume archives is not implemented$rsfx$R)m
API String ID: 1413323173-633656524
Opcode ID: 4ba7961425a798578edb8f9873dd08047e0b61bdead7b9e66f50592ba70329f3
Instruction ID: 44b011587b460564d7b00bf10b43c17154f1cd8509ff357a314e7ab93d2cf8d9
Opcode Fuzzy Hash: 4ba7961425a798578edb8f9873dd08047e0b61bdead7b9e66f50592ba70329f3
Instruction Fuzzy Hash: 21C2B3B2D4825DDFDB20CFA4D840BEEB7B4BF49304F1441ADE619A7241D734AA49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001D844 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,1001CEDA,?,Microsoft Visual C++ Runtime Library,00012010,?,10021594,?,100215E4,?,?,?,Runtime Error!Program: ), ref: 1001D856
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1001D86E
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 1001D87F
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 1001D88C

Strings

user32.dll, xrefs: 1001D851
GetLastActivePopup, xrefs: 1001D881
GetActiveWindow, xrefs: 1001D879
MessageBoxA, xrefs: 1001D868

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
Instruction ID: 0f002242f215f962b8815e3b350398d74b100aa23eb915cf8c40db05b23b1dbb
Opcode Fuzzy Hash: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
Instruction Fuzzy Hash: A9014431604221AFE750FFF59CC4AAA7BE9EB59194721043BF604C6121DF35C8829B70

Uniqueness

Uniqueness Score: -1.00%

Function 6D27E950 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D27E9AF

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

xS)m, xrefs: 6D27EA15
(&m, xrefs: 6D27ECA6, 6D27EB8F
(&m, xrefs: 6D27EC97, 6D27E9A4, 6D27E9A7
Empty file path, xrefs: 6D27E9A8

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: (&m$ (&m$Empty file path$xS)m
API String ID: 3976011213-2707848631
Opcode ID: 62c141b9df12b35a9ad1bfe2d3a5e705dd4753acf41eaeb52d77932577f7a7bc
Instruction ID: ead7bbe2114f2a8c5473a00c8edc5f97ce58e3169a90baf94b3eb1dfa4523cfb
Opcode Fuzzy Hash: 62c141b9df12b35a9ad1bfe2d3a5e705dd4753acf41eaeb52d77932577f7a7bc
Instruction Fuzzy Hash: EEC19471D4425EDFDB24CFA8C980AEEBBB5BF49304F154069E905EB340D771AA05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2851C7 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6D286B91
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D286BA6
UnhandledExceptionFilter.KERNEL32(6D293328), ref: 6D286BB1
GetCurrentProcess.KERNEL32(C0000409), ref: 6D286BCD
TerminateProcess.KERNEL32(00000000), ref: 6D286BD4

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 9289c3bcf04ded9c81fae3249f232a8888fd18d4a1aa49d25657d88cc744aa01
Instruction ID: 83154cc36393d0f4d1bcbd8999fa07ae4e79b3023bca67300cc7b5c41b8cf4ec
Opcode Fuzzy Hash: 9289c3bcf04ded9c81fae3249f232a8888fd18d4a1aa49d25657d88cc744aa01
Instruction Fuzzy Hash: 6321CDB98102059FDB80CF1AD18CB473BB4FB9A31DF61402AF9099F291E7B05985CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6D26D1B0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 336COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D26D3E1

Strings

pT)m, xrefs: 6D26D466
@]&m, xrefs: 6D26D559, 6D26D55C

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw
String ID: @]&m$pT)m
API String ID: 2005118841-2905722022
Opcode ID: 520a2c3ce01969644b13be742992e82c3af7f8e48b20a542465403ad705c27ba
Instruction ID: d5d6a148947cf79c696a3b0ac4148a2387289f35a2877e9180806c20e17ddf84
Opcode Fuzzy Hash: 520a2c3ce01969644b13be742992e82c3af7f8e48b20a542465403ad705c27ba
Instruction Fuzzy Hash: 57D16CB1D4428D9FCB14CFA8C8806EEF7B5FF88304F258129D515EB294D771A986CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D26E670 Relevance: 4.8, APIs: 3, Instructions: 303COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D26E907
__CxxThrowException@8.LIBCMT ref: 6D26E925
GetLastError.KERNEL32(?,40000000,00000001,00000001), ref: 6D26E967

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorException@8LastThrow_malloc
String ID:
API String ID: 2956456951-0
Opcode ID: f48a49ab2af9ead537de6ea1fbecca45b67ac3b1fc3498ff426c8eb29037fc86
Instruction ID: 9391a93c7b1564535e93b6c48ce9174701ec780910300ec7ab2814ca18847d47
Opcode Fuzzy Hash: f48a49ab2af9ead537de6ea1fbecca45b67ac3b1fc3498ff426c8eb29037fc86
Instruction Fuzzy Hash: B4B1E5B1E543489BCB15CFA8CC80AAEB7B5FF88304F15852DE506DB394EB70A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1000C8E0 Relevance: 4.0, Strings: 3, Instructions: 282COMMON

Download Yara Rule

Strings

Z, xrefs: 1000C9A6
B, xrefs: 1000C99B
h, xrefs: 1000C9B1

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorEventLastReset
String ID: B$Z$h
API String ID: 1621066496-418080759
Opcode ID: e1f6dd76b88e89d43acadaa46f15ec36dfb5e081f259343b4ad707fa81163033
Instruction ID: d4bf31868797ce4aaab3f4efbcdf8c97de3f380066e3a3d4bf3ffd9c5ab09291
Opcode Fuzzy Hash: e1f6dd76b88e89d43acadaa46f15ec36dfb5e081f259343b4ad707fa81163033
Instruction Fuzzy Hash: 90A1C57560474A8BE724DF38C880EABB7E2FF84384F40492DE59E87245DA35F94D8791

Uniqueness

Uniqueness Score: -1.00%

Function 10009028 Relevance: 1.7, APIs: 1, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000902D

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 87b1cb203b31242bfee0ca3e1e1508b15ebe57291a8c3edffc8975049a0677b4
Instruction ID: 48fb987f334455dadb65256b5c9587e217c74211aec081cd1bc89f048034a23b
Opcode Fuzzy Hash: 87b1cb203b31242bfee0ca3e1e1508b15ebe57291a8c3edffc8975049a0677b4
Instruction Fuzzy Hash: 4AA14F74E0064ADFEB08CF95C8919AEB7F2FF94394F15C429E815AB259DB31AD41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1000CCA0 Relevance: 1.7, Strings: 1, Instructions: 496COMMON

Download Yara Rule

Strings

2, xrefs: 1000D037

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 82697d9cee79a60dba30a3ec0a2bc2c613e2b1ca3a0406945958fbe246bd38a8
Instruction ID: 1079d7736f2e4c7c8989939c6af625486dbdc2577425a1541b7c18a206872689
Opcode Fuzzy Hash: 82697d9cee79a60dba30a3ec0a2bc2c613e2b1ca3a0406945958fbe246bd38a8
Instruction Fuzzy Hash: 5902D2716043468BE714DF28C4906AEF7E2EFC9384F15493EE89AD7345DA30E946CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001B723 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001B6DD), ref: 1001B728

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0d25f4131f47676baac036409c8e3030cc7b453b37a8c5ccc114ce56050651fb
Instruction ID: 1051254bbefb4e344f2880b2f9b2c07541e039401552d222e32384afa57de220
Opcode Fuzzy Hash: 0d25f4131f47676baac036409c8e3030cc7b453b37a8c5ccc114ce56050651fb
Instruction Fuzzy Hash: 8EA011B08022208BE200ABA08C880003B22A220302B200000E008A2222CB38008A8A00

Uniqueness

Uniqueness Score: -1.00%

Function 1001B735 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 1001B73A

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5a1aaad73f95eea83048b84d73c5faa729b13ce467ef546cdb06ab920d03af2f
Instruction ID: be4856800ad67acc3a039856a6bcbc85aefd8906eb3105ec04f086e5cf881371
Opcode Fuzzy Hash: 5a1aaad73f95eea83048b84d73c5faa729b13ce467ef546cdb06ab920d03af2f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 10014A40 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: 3263fd24dd742fb59fb36d8349e04cf85f081d2316af3522b142c78f5d2b8c24
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: FE023B72A082518BCB19CE18C49436DBBE2FBC4355F174A3DE8969B7A4DB34D8C4CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1000EB10 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa60fe7b530fdf40270157a7b6132d553705ba9ca0899f20824aa194b349a049
Instruction ID: fdb71eb0ef9b3643b271625de557d6a2ebecbc0b2633d2f7e4f8bd180456dc3a
Opcode Fuzzy Hash: aa60fe7b530fdf40270157a7b6132d553705ba9ca0899f20824aa194b349a049
Instruction Fuzzy Hash: CD02C071704B828BE318CF28C490665FBE1FB88384F14462ED99A97746D731F856CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 100178D0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bd99d37eaa6867eec1d7a50a9384b8f81823022f15a02e339a3a4a3bfa796a
Instruction ID: 9c5390e3fadab9692d417b51c880d1e066aa3357a43fedb2d9b94bd26e97e4e2
Opcode Fuzzy Hash: 64bd99d37eaa6867eec1d7a50a9384b8f81823022f15a02e339a3a4a3bfa796a
Instruction Fuzzy Hash: C6D1C2769456778FE358DF59CC8023677A2EFC8310F6E0179CA51173A2C634BA12DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10017DC0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de67787633e223f5d116eb565b42cff61d1fd875a76b6ec4a88643942c8a547
Instruction ID: 1793d73b672dc367949f42c52ad67573012e5247c9a3a03e39662d6b18fd5c1f
Opcode Fuzzy Hash: 6de67787633e223f5d116eb565b42cff61d1fd875a76b6ec4a88643942c8a547
Instruction Fuzzy Hash: 82D1B372904A774FE354EF59CCC06367762EFC9310F6A4139CA52173A2CA34B592EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100153E0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2bb4c2883792f67d5ddad6746641f46985b858016333fa6129e3e3d2d4c4e1
Instruction ID: 96383ade98a58215ed32f4cdd969efcb3be9f339ad8da3a11947044bea7e3e3e
Opcode Fuzzy Hash: 5d2bb4c2883792f67d5ddad6746641f46985b858016333fa6129e3e3d2d4c4e1
Instruction Fuzzy Hash: CBC14970908741CFC364CF69D48021AB7E1FF8834AF59492EE5868B751E3B6E985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 1000E770 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56e9f775ee9cd96b41f118f553f7bf26bef5efb7cdbd4191ab952dacb7d0ea6
Instruction ID: 42fcec5d5ec972ad4015442881c7033992fbc64c0ea4dc345200aebaac4aaf91
Opcode Fuzzy Hash: b56e9f775ee9cd96b41f118f553f7bf26bef5efb7cdbd4191ab952dacb7d0ea6
Instruction Fuzzy Hash: 2EA139367043854BEF38CE28D8513EEB7D2EBC5344F54483EDA8A9B781DA396909C752

Uniqueness

Uniqueness Score: -1.00%

Function 6D27FEE0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296b58f34f79a88b6f591ce4efe9c99fcf63bc20cc3d2d929d4ac42a4ea09294
Instruction ID: d0e31e182542e55c3ca42e87ebda5759f2055cbd526ce8d5f4b3c5a4e3252178
Opcode Fuzzy Hash: 296b58f34f79a88b6f591ce4efe9c99fcf63bc20cc3d2d929d4ac42a4ea09294
Instruction Fuzzy Hash: F1A19CB154C3868FD320CF29C48176BFBE4BF89315F10892DE6EA87291D7719949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001AD1A Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: ab211030f3272b1fa13433932dfb787b10864fedb3a3c09548d991f5105d0713
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: D4B16975A0024A9FDB15CF04C5D0A98BBE1FB49368F25C1ADD85A5F382D731EE86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10016F80 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7290c1ce4328df220ee5b3f86eb676b21bb94360bc114edf73a16fb299262ce
Instruction ID: 8e383ef29179993eb79494c41e7a58609c11650d60d53051a38f6d484b45e824
Opcode Fuzzy Hash: f7290c1ce4328df220ee5b3f86eb676b21bb94360bc114edf73a16fb299262ce
Instruction Fuzzy Hash: 6D919DB29083658FC305DF49D88451AF7E1BFC4304F0B86AEE9985B322D271E945CF92

Uniqueness

Uniqueness Score: -1.00%

Function 10012F00 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6f4894e7bd593a2d8742387eb22ab4f9583147cb6f9537b925ec5e919472aa
Instruction ID: 093d65387232af22463852ecc555bfe2220f966dd3c6b935343c8ee3d064d7cc
Opcode Fuzzy Hash: 5f6f4894e7bd593a2d8742387eb22ab4f9583147cb6f9537b925ec5e919472aa
Instruction Fuzzy Hash: 44510AB6B087514BD308CE6DCC9072AB6D2EBC8204F48CA3DE496C7385E679DA59C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 10016D80 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e9adfeeebec5399e5050604e4fe299d32a0b989db558fca3ccdf9efe575e30
Instruction ID: 1641cb996cc23e8743f23b68164461e529cbbac4d726630e7f0921ac631b0ab3
Opcode Fuzzy Hash: e8e9adfeeebec5399e5050604e4fe299d32a0b989db558fca3ccdf9efe575e30
Instruction Fuzzy Hash: 4F6149725087158FC318DF49D88494AF3E1FFC8328F168A6DE9885B361D771E959CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10017330 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a36bb598b2f6ffa26dc0ad72d3b0d69c2e5a9c4510fe4b52411aaaf790342bc6
Instruction ID: 90663aaeee5d46ac95ea197676b1b998a7387d57c1bde345cb4c681c37e1526e
Opcode Fuzzy Hash: a36bb598b2f6ffa26dc0ad72d3b0d69c2e5a9c4510fe4b52411aaaf790342bc6
Instruction Fuzzy Hash: 56616255109BD59AC325CB3998900A5FFF0AE67001708879DE8E547F86C228F6A8DBF1

Uniqueness

Uniqueness Score: -1.00%

Function 100127E0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7beae25994adf21d44d2870a73852f328616c13210efb8cb38f089d4d450f9
Instruction ID: 43e036e625b05ba162c5e1f4b910a70c97b862bfc77a5f309f1e1a62e24e831f
Opcode Fuzzy Hash: 3c7beae25994adf21d44d2870a73852f328616c13210efb8cb38f089d4d450f9
Instruction Fuzzy Hash: 9B41C671B10A700BF31CCF6A8CC41563BC3D7C9396B55C639D562CA6D8DABDC58792A0

Uniqueness

Uniqueness Score: -1.00%

Function 10017710 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a870b104a41869d307648565ac6c907bdfc114ce6eacc325910ccab924f2cd
Instruction ID: a4dc133ff09336fb728bcc0f533d16d0b8f812171b0efad5f0bb8ef57f55d241
Opcode Fuzzy Hash: 36a870b104a41869d307648565ac6c907bdfc114ce6eacc325910ccab924f2cd
Instruction Fuzzy Hash: 9C316872E097A64AE320DE1E8C40122BBE3FFC1122F54C1BAD4958B64AD936D482D2E0

Uniqueness

Uniqueness Score: -1.00%

Function 1001E5C3 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
Instruction ID: 85bf8067adcc03e56e8eb012d445128729d2a9c90e1a1924c7083dbe21ea6bb7
Opcode Fuzzy Hash: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
Instruction Fuzzy Hash: 5B41C460C14FD652EB238F7CC842262B320BFAB244F01D75AFDD179963FB32A9846251

Uniqueness

Uniqueness Score: -1.00%

Function 1000D450 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78624e49b480ced391ff1e9dbb8ef5ef93f33f72b75982fb8d34a63e8646595d
Instruction ID: c793a61f70c6e445dc96b6803f56bc371dd2b77c186ac534e10025060f9506f1
Opcode Fuzzy Hash: 78624e49b480ced391ff1e9dbb8ef5ef93f33f72b75982fb8d34a63e8646595d
Instruction Fuzzy Hash: AF21B435704A468FE728EE1DDC9042AF3D2EFC9280B15852EE996C7345DA30FC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001000 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc70436239ad2ae4b08c90a15056f60f375c380647e5e81d2f2a2bf140216bcc
Instruction ID: e37dfb0215fb8378dbed7272f4c0c039f647e2c06321851043f53b69293ba5e4
Opcode Fuzzy Hash: fc70436239ad2ae4b08c90a15056f60f375c380647e5e81d2f2a2bf140216bcc
Instruction Fuzzy Hash: 71213D3E374D0607EB5C87699D736792182E385304B98A03CF58BCA6C1EE6DD5D5C609

Uniqueness

Uniqueness Score: -1.00%

Function 6D28E6B0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction ID: a6a8c051b4125cdccf669ecf0da28949fcf0a81061e373cff36ac02e1515680f
Opcode Fuzzy Hash: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction Fuzzy Hash: E421F832D1463A47C702DE6DE4C45A7B3A2FBC436AF134636ED94A31D2C525E818C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 1001E751 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction ID: 3e4cb352a0fa76a140d4531a50d40f04ea45ccb5b1c62413a0db441249336af6
Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction Fuzzy Hash: A121C532D0466547C742CE6EE48459AB3E2FBC436AF634B36ED8467190C638EC54C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 1001E82B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction ID: 5d779d631da0edc9e43e437f33c75592ea4799903e58388b208bd52ebebecd17
Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction Fuzzy Hash: 8921D77291446587C301DF2DE488A6BB3E1FFC4319F638A36E9858B181CA34DC85D690

Uniqueness

Uniqueness Score: -1.00%

Function 6D28E78B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2407533f79ef22d8e6d794d98aef535f9904e2ced6ea7e6753812806be966d
Instruction ID: 8399feb6921b1b149528846bc57d97f92a8314e95f76595a1a7a0ebb22ec7897
Opcode Fuzzy Hash: 6e2407533f79ef22d8e6d794d98aef535f9904e2ced6ea7e6753812806be966d
Instruction Fuzzy Hash: A421A77291452A87C302DF5DE888B7BB3E5FFC4319F578A36D991CB1D2C625D444CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6D262AD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 202fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(00000004,00000000,?,00000002), ref: 6D262BB4
GetLastError.KERNEL32 ref: 6D262BC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 6D262BDF
UnmapViewOfFile.KERNEL32(00000000), ref: 6D262C88
CloseHandle.KERNEL32(?), ref: 6D262C96
OpenEventW.KERNEL32(00000002,00000000,?), ref: 6D262CA8
GetLastError.KERNEL32 ref: 6D262CBD
SetEvent.KERNEL32(00000000), ref: 6D262CC4
GetLastError.KERNEL32 ref: 6D262CCE
CloseHandle.KERNEL32(00000000), ref: 6D262CD5
GetLastError.KERNEL32 ref: 6D262CDF

Part of subcall function 6D262670: __CxxThrowException@8.LIBCMT ref: 6D262688

Strings

MapViewOfFile error, xrefs: 6D262BEE
data error, xrefs: 6D262C6A
Incorrect mapping data, xrefs: 6D262C02
Incorrect command line, xrefs: 6D262B13, 6D262B63
Can not open mapping, xrefs: 6D262BCD

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorLast$File$CloseEventHandleOpenView$Exception@8MappingThrowUnmap
String ID: Can not open mapping$Incorrect command line$Incorrect mapping data$MapViewOfFile error$data error
API String ID: 682782048-464465891
Opcode ID: a4fc59c23df7ebfa5d6212bf867bb443fd1b4f402481c3e6cb4b185b57eddd68
Instruction ID: e199561423dda649116161a69195ac32b6e14b784b24dc4a798d5f2a3e405394
Opcode Fuzzy Hash: a4fc59c23df7ebfa5d6212bf867bb443fd1b4f402481c3e6cb4b185b57eddd68
Instruction Fuzzy Hash: 096129B5A8438E9BCB21CFA9C844BAFB7B4FF45759F114024EA14AB240D770E981C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6D28715B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6D297F58,0000000C,6D287296,00000000,00000000,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B), ref: 6D28716D
__crt_waiting_on_module_handle.LIBCMT ref: 6D287178

Part of subcall function 6D287790: Sleep.KERNEL32(000003E8,?,?,6D2870BE,KERNEL32.DLL,?,6D2894A4,?,6D285FE3,6D26FA7E,?,?,6D264D3F,0000000C,12131721,?), ref: 6D28779C
Part of subcall function 6D287790: GetModuleHandleW.KERNEL32(6D26FA7E,?,6D2870BE,KERNEL32.DLL,?,6D2894A4,?,6D285FE3,6D26FA7E,?,?,6D264D3F,0000000C,12131721,?,?), ref: 6D2877A5

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6D2871A1
GetProcAddress.KERNEL32(?,DecodePointer), ref: 6D2871B1
__lock.LIBCMT ref: 6D2871D3
InterlockedIncrement.KERNEL32(02C08302), ref: 6D2871E0
__lock.LIBCMT ref: 6D2871F4
___addlocaleref.LIBCMT ref: 6D287212

Strings

EncodePointer, xrefs: 6D287195
9)m, xrefs: 6D287184
DecodePointer, xrefs: 6D2871A9
KERNEL32.DLL, xrefs: 6D287167, 6D28716C, 6D287177

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$9)m
API String ID: 1028249917-3657584875
Opcode ID: f31f29c8f773204e5d07d14be5b6466e0bd227b475efa96a6bc42e6a476d04de
Instruction ID: 0fa096781d6f00db981fe5c7ca8f1554414de90231d47649c22bba3d2f562d3d
Opcode Fuzzy Hash: f31f29c8f773204e5d07d14be5b6466e0bd227b475efa96a6bc42e6a476d04de
Instruction Fuzzy Hash: 2211E17198870AAEE720CF7AC804B5AFBF0BF40318F10442DE5A9AB2D1CB30A504CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6D276530 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 323libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6D276AD8,GetHandlerProperty2), ref: 6D276584
GetProcAddress.KERNEL32(?,GetHandlerProperty), ref: 6D276595
GetProcAddress.KERNEL32(?,GetNumberOfFormats), ref: 6D2765B1

Strings

GetHandlerProperty, xrefs: 6D27658F
GetHandlerProperty2, xrefs: 6D276579
GetNumberOfFormats, xrefs: 6D2765AB
hT)m, xrefs: 6D27687A

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetNumberOfFormats$hT)m
API String ID: 190572456-1640931434
Opcode ID: f4c025047003bf44d7878c6dce51090c8269f0ca8ad0b82d6ecb5826ebe5db3b
Instruction ID: 8d0a99540a24366afb2c69ac106f03e7f3990dc40d55b037457f69b5cd9676ea
Opcode Fuzzy Hash: f4c025047003bf44d7878c6dce51090c8269f0ca8ad0b82d6ecb5826ebe5db3b
Instruction Fuzzy Hash: D0D158B1D4421D9FDB74DFA9C880BAEBBB4BF48305F1081ADE519A7241DB309A45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D280680 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

Part of subcall function 6D281230: _malloc.LIBCMT ref: 6D281258
Part of subcall function 6D281230: __CxxThrowException@8.LIBCMT ref: 6D281272

__CxxThrowException@8.LIBCMT ref: 6D280704

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Part of subcall function 6D2782B0: __CxxThrowException@8.LIBCMT ref: 6D278324
Part of subcall function 6D2782B0: __CxxThrowException@8.LIBCMT ref: 6D278390
Part of subcall function 6D2782B0: _malloc.LIBCMT ref: 6D2783B1
Part of subcall function 6D2782B0: __CxxThrowException@8.LIBCMT ref: 6D2783CB
Part of subcall function 6D2782B0: __CxxThrowException@8.LIBCMT ref: 6D278416

Part of subcall function 6D285FF4: __lock.LIBCMT ref: 6D286012
Part of subcall function 6D285FF4: ___sbh_find_block.LIBCMT ref: 6D28601D
Part of subcall function 6D285FF4: ___sbh_free_block.LIBCMT ref: 6D28602C
Part of subcall function 6D285FF4: HeapFree.KERNEL32(00000000,6D26FA7E,6D297EB0,0000000C,6D2881B5,00000000,6D298028,0000000C,6D2881EF,6D26FA7E,?,?,6D28C6AB,00000004,6D2982E8,0000000C), ref: 6D28605C
Part of subcall function 6D285FF4: GetLastError.KERNEL32(?,6D28C6AB,00000004,6D2982E8,0000000C,6D287669,6D26FA7E,?,00000000,00000000,00000000,?,6D28726D,00000001,00000214), ref: 6D28606D

__CxxThrowException@8.LIBCMT ref: 6D280A37

Strings

7za , xrefs: 6D2806D6
-mhe, xrefs: 6D2808F0
-sfx, xrefs: 6D280723
-ssw, xrefs: 6D280736
-w, xrefs: 6D28077E

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$_malloc$ErrorExceptionFreeHeapLastRaise___sbh_find_block___sbh_free_block__lock
String ID: -mhe$ -sfx$ -ssw$ -w$7za
API String ID: 1499254937-429077366
Opcode ID: 266833262c716a7e4ed89d677f7a89297a0947159565a98c11cf2972e8a254d6
Instruction ID: 52b90f84e4facd481a3645257b6b144e811f00db53e25ba144c0d016f9e8ca67
Opcode Fuzzy Hash: 266833262c716a7e4ed89d677f7a89297a0947159565a98c11cf2972e8a254d6
Instruction Fuzzy Hash: 1CC1A871C4824CDBDB01DBE4CD84BEFB7B8BF54308F154169DA05AB246E774AA48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001DD3D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,10021660,00000001,00000000,00000000,75A9E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DD7F
LCMapStringA.KERNEL32(00000000,00000100,1002165C,00000001,00000000,00000000,?,?,1001DA1F,?), ref: 1001DD9B
LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,75A9E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DDE4
MultiByteToWideChar.KERNEL32(?,1002CE51,00000000,00000001,00000000,00000000,75A9E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DE1C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 1001DE74
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 1001DE8A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 1001DEBD
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 1001DF25

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
Instruction ID: 295e34877b95ddc79519c14bcd414cd7068b9c5c0158a783dd3936514e77c558
Opcode Fuzzy Hash: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
Instruction Fuzzy Hash: FB517B31400259ABDF22EF94CD85ADE3FF9FB59751F20411AF910A9160C732DDA1EB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D26FD20 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 294COMMON

Download Yara Rule

Strings

x)m, xrefs: 6D26FDB2
hU)m, xrefs: 6D270040, 6D270043
|U)m, xrefs: 6D2700A5

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID: hU)m$x)m$|U)m
API String ID: 0-2497605397
Opcode ID: 4e679dbee68b932880c20d143bef1b2d5024a63b84a0f2a91fb5beb6393d4522
Instruction ID: 69c01f22f77177deba3878b5b18469e52e08095ad6250862638db19b08919a23
Opcode Fuzzy Hash: 4e679dbee68b932880c20d143bef1b2d5024a63b84a0f2a91fb5beb6393d4522
Instruction Fuzzy Hash: 0FC1B175D4424E9FCB10CF98C580AEEF7B5FF49324F248129E925AB350D731AA85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001CDB6 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 1001CE23
GetStdHandle.KERNEL32(000000F4,10021594,00000000,?,00000000,?), ref: 1001CEF9
WriteFile.KERNEL32(00000000), ref: 1001CF00

Strings

..., xrefs: 1001CE75
<program name unknown>, xrefs: 1001CE33
Runtime Error!Program: , xrefs: 1001CE89
Microsoft Visual C++ Runtime Library, xrefs: 1001CECF

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
Instruction ID: d8c9acc08caec27d87d178c777f48a963db8df66c36a8e0edad6fccd900c7ff8
Opcode Fuzzy Hash: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
Instruction Fuzzy Hash: 4131C476A0022CAFEB11EAA0CD85FDE77BDFB45344F6001A6F945DA041E770EAC5CA61

Uniqueness

Uniqueness Score: -1.00%

Function 1001CC4B Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CC66
GetEnvironmentStrings.KERNEL32(?,?,?,?,10019F70), ref: 1001CC7A
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CCA6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,10019F70), ref: 1001CCDE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,10019F70), ref: 1001CD00
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,10019F70), ref: 1001CD19
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CD2C
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 1001CD6A

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
Instruction ID: 10dabb665d0db05ed410ab17b42963db07fe2840a9ab64d8aea903b972c4df90
Opcode Fuzzy Hash: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
Instruction Fuzzy Hash: 7331A6B25043AE5FE311EBB8ACC5D2A7ADDEB4A1D4B220639F545CB111EA31DCC187A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2802B0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 271COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D28060F
__CxxThrowException@8.LIBCMT ref: 6D280329

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

__CxxThrowException@8.LIBCMT ref: 6D280624

Strings

7za , xrefs: 6D2802F6
-an, xrefs: 6D280569
(_)m, xrefs: 6D2805BE

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: -an$(_)m$7za
API String ID: 3476068407-56453897
Opcode ID: 1a6084bb4e2b487a31574a27daab73673014da660d99858b21a52f99b1d525cb
Instruction ID: f54c7fb474ffce010f8d79b0c8bb9400dcd998538e8306570fdef18898003554
Opcode Fuzzy Hash: 1a6084bb4e2b487a31574a27daab73673014da660d99858b21a52f99b1d525cb
Instruction Fuzzy Hash: 5CB1CA71D4828CEBDF11DFA4C980BDEBBB4AF54308F154069EA05BB242D775BA48C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D280AA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D280C28
__CxxThrowException@8.LIBCMT ref: 6D280C42
__CxxThrowException@8.LIBCMT ref: 6D280D3F

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

__CxxThrowException@8.LIBCMT ref: 6D280D54

Strings

-an, xrefs: 6D280BF4
7za l, xrefs: 6D280AE6

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_malloc
String ID: -an$7za l
API String ID: 1305767944-193614407
Opcode ID: 6e9d310b99eefa8101b95389843b21b16ccca1aeb1e4cb279bce75281c75fed8
Instruction ID: 97b5b66ee463306621b29e94f2af1621f66af4532c12bfcde428804efbb077ad
Opcode Fuzzy Hash: 6e9d310b99eefa8101b95389843b21b16ccca1aeb1e4cb279bce75281c75fed8
Instruction Fuzzy Hash: 0E91967194824CDFCF01DFA9C980BDEBBB4BF54308F154069E905AB282D775BA49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D28E5CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindMITargetTypeInstance.LIBCMT ref: 6D28E624

Part of subcall function 6D28E370: PMDtoOffset.LIBCMT ref: 6D28E400

FindVITargetTypeInstance.LIBCMT ref: 6D28E62B
PMDtoOffset.LIBCMT ref: 6D28E63B
std::bad_exception::bad_exception.LIBCMT ref: 6D28E661
__CxxThrowException@8.LIBCMT ref: 6D28E66F

Strings

Bad dynamic_cast!, xrefs: 6D28E659

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: FindInstanceOffsetTargetType$Exception@8Throwstd::bad_exception::bad_exception
String ID: Bad dynamic_cast!
API String ID: 3308565544-2956939130
Opcode ID: 75479d19dc53d31a0e184cee78302fbb8f77d8b262842b70f00aaf7e06407068
Instruction ID: 44960885c0a887942ba761d530e1ebfab776c314a7553bca0d75b55996ee3d60
Opcode Fuzzy Hash: 75479d19dc53d31a0e184cee78302fbb8f77d8b262842b70f00aaf7e06407068
Instruction Fuzzy Hash: DD112232ED421E9FCB00CFB8CD40AAE77B0AF45316F094068E512E72C2DB36D9099B90

Uniqueness

Uniqueness Score: -1.00%

Function 6D270450 Relevance: 9.2, APIs: 6, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 6D272A70: CloseHandle.KERNEL32(?,12131721,?,00000000,?,?,00000000,?,?,?,00000000,6D290C38,000000FF), ref: 6D272A9F
Part of subcall function 6D272A70: CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,12131721,?,00000000,?,?,00000000), ref: 6D272ACC
Part of subcall function 6D272A70: CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6D272B2B

GetFileSize.KERNEL32(FFFFFFFF,?,00000004,80000000,00000001,00000003,12131721,?,?,00000000,?,?,?,00000000,6D290C38,000000FF), ref: 6D2704A7
GetLastError.KERNEL32(?,?,?,00000000,6D290C38,000000FF), ref: 6D2704B4
CloseHandle.KERNEL32(FFFFFFFF,00000004,80000000,00000001,00000003,12131721,?,?,00000000,?,?,?,00000000,6D290C38,000000FF), ref: 6D27051D
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000,00000001,?,?,?,00000000,6D290C38,000000FF), ref: 6D27053D
CloseHandle.KERNEL32(FFFFFFFF,FFFFFFFF,00000000,?,00000000,00000000,00000001,?,?,?,00000000,6D290C38,000000FF), ref: 6D27056C

Part of subcall function 6D270A20: MultiByteToWideChar.KERNEL32(00000002,00000000,?,?,?,?,12131721,00000000), ref: 6D270AA7
Part of subcall function 6D270A20: __CxxThrowException@8.LIBCMT ref: 6D270AC1

CloseHandle.KERNEL32(FFFFFFFF,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 6D2706D8

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CloseHandle$File$Create$ByteCharErrorException@8LastMultiSizeThrowWide
String ID:
API String ID: 1518168698-0
Opcode ID: d8c2e1dceeea36bda5df068ec3fe74a8869b82a546ef246cae6c13c2037614e6
Instruction ID: f0cac3f9ccc3a766824158397ac7f993a57f9c766b4392872bdeb4d4686cae10
Opcode Fuzzy Hash: d8c2e1dceeea36bda5df068ec3fe74a8869b82a546ef246cae6c13c2037614e6
Instruction Fuzzy Hash: 9481D572D4420E9BCF20DFA5D940BEEB7B4FF45319F114229E925B7280DB36A949CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D282CE0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 472COMMON

Download Yara Rule

Strings

-p, xrefs: 6D282E33
7za A , xrefs: 6D282D17
-r, xrefs: 6D282DD2
-ir-!, xrefs: 6D282FAB

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID: -ir-!$ -p$ -r$7za A
API String ID: 3476970888-2239425251
Opcode ID: da95ca8dcf6990119138c1e54b7fa37ae330a34e1f7976a417f50064b31b01ee
Instruction ID: 8c5b594e4aecd55d73741d413ea82e4674bd2282c7ec7cc31f2d810a07b609c9
Opcode Fuzzy Hash: da95ca8dcf6990119138c1e54b7fa37ae330a34e1f7976a417f50064b31b01ee
Instruction Fuzzy Hash: C402C471D4424DDBDB10CBA4CC80BEEB7B4BF44308F1580A9E955BB282D771AA49CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1001DF8C Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,10021660,00000001,?,75A9E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001DFCB
GetStringTypeA.KERNEL32(00000000,00000001,1002165C,00000001,?,?,?,1001DA1F,?), ref: 1001DFE5
GetStringTypeA.KERNEL32(?,?,?,00000000,00000002,75A9E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E019
MultiByteToWideChar.KERNEL32(?,1002CE51,?,00000000,00000000,00000000,75A9E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E051
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 1001E0A7
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 1001E0B9

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
Instruction ID: 73f36e6d74bf66f6ce57e3c8a420cabe8a1af6d8c6052cc8844ff2d98f481940
Opcode Fuzzy Hash: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
Instruction Fuzzy Hash: 0041577250029AAFDB21DF94CC85EDE7BBAEB09790F20052AFA119A150C735DDD1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D28ACE3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 6D28AD0B

Part of subcall function 6D286968: __getptd.LIBCMT ref: 6D286976
Part of subcall function 6D286968: __getptd.LIBCMT ref: 6D286984

__getptd.LIBCMT ref: 6D28AD15

Part of subcall function 6D2872BB: __getptd_noexit.LIBCMT ref: 6D2872BE
Part of subcall function 6D2872BB: __amsg_exit.LIBCMT ref: 6D2872CB

__getptd.LIBCMT ref: 6D28AD23
__getptd.LIBCMT ref: 6D28AD31
__getptd.LIBCMT ref: 6D28AD3C
_CallCatchBlock2.LIBCMT ref: 6D28AD62

Part of subcall function 6D286A0D: __CallSettingFrame@12.LIBCMT ref: 6D286A59

Part of subcall function 6D28AE09: __getptd.LIBCMT ref: 6D28AE18
Part of subcall function 6D28AE09: __getptd.LIBCMT ref: 6D28AE26

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 492223a8f156333223bc877efbee521ee0aed80cfb7cdf105bd1cba45892fa36
Instruction ID: 5f3daea9558796b76428bb2d7e3eab9542cbd62ffbaa4ddc361fa53105767c0c
Opcode Fuzzy Hash: 492223a8f156333223bc877efbee521ee0aed80cfb7cdf105bd1cba45892fa36
Instruction Fuzzy Hash: A111C971D5460DDFDB00DFA4C584B9DBBB0FF04319F1180A9E914A7291DB389A159B60

Uniqueness

Uniqueness Score: -1.00%

Function 6D280DB0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 236COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D28109D

Part of subcall function 6D27F640: __CxxThrowException@8.LIBCMT ref: 6D27F66A

Part of subcall function 6D2782B0: __CxxThrowException@8.LIBCMT ref: 6D278324
Part of subcall function 6D2782B0: __CxxThrowException@8.LIBCMT ref: 6D278390
Part of subcall function 6D2782B0: _malloc.LIBCMT ref: 6D2783B1
Part of subcall function 6D2782B0: __CxxThrowException@8.LIBCMT ref: 6D2783CB
Part of subcall function 6D2782B0: __CxxThrowException@8.LIBCMT ref: 6D278416

Strings

7za d, xrefs: 6D280DF6
D_)m, xrefs: 6D28104C
-mhe, xrefs: 6D280F69
-w, xrefs: 6D280E18

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID: -mhe$ -w$7za d$D_)m
API String ID: 175252994-79320901
Opcode ID: fa957fc3a34571ca97b8f5a30d4b7b0601898aa71d77c22b773a651778d10a54
Instruction ID: c39074aa95fecee0fd11be080dd5c8316363aea1928ff43f9a88a1fa3510f444
Opcode Fuzzy Hash: fa957fc3a34571ca97b8f5a30d4b7b0601898aa71d77c22b773a651778d10a54
Instruction Fuzzy Hash: 4C91B7B1D4828CEBDB01DFE4C940BDEBBB4AF44308F154068EA05AB242D775BA49C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 1001A27C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 1001A29B
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 1001A2D0
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001A330

Strings

__MSVCRT_HEAP_SELECT, xrefs: 1001A2CB
__GLOBAL_HEAP_SELECTED, xrefs: 1001A30A

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
Instruction ID: ff41b7170f7c9f9639ed0085cf635e38180a7bd29c628196ad01e98acd5c5e28
Opcode Fuzzy Hash: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
Instruction Fuzzy Hash: DB310575C412986EEB61D6745C81BDD37E9DB17344F2400EAF195DE042E631DFC99B20

Uniqueness

Uniqueness Score: -1.00%

Function 6D27F5A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D27F621

Strings

-aos, xrefs: 6D27F5DB
-aoa, xrefs: 6D27F5C9
-aou, xrefs: 6D27F5ED
-aot, xrefs: 6D27F5FF

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw
String ID: -aoa$ -aos$ -aot$ -aou
API String ID: 2005118841-2698752949
Opcode ID: 6552c8351f333e20ab7c029bb8fd811bf5277871160f527d3d1fdc33af9da779
Instruction ID: 2fa7cab187160bbd6f14df186830bb68d936ac64f9b797da62578ffb76338477
Opcode Fuzzy Hash: 6552c8351f333e20ab7c029bb8fd811bf5277871160f527d3d1fdc33af9da779
Instruction Fuzzy Hash: D6F0626079D59C6349108A9DAC1057E739C870A95BF0046D6F90DCF301CB668E1263EA

Uniqueness

Uniqueness Score: -1.00%

Function 6D26EF70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D26EF8A

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D26EFA4

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

std::exception::exception.LIBCMT ref: 6D26EFC3
__CxxThrowException@8.LIBCMT ref: 6D26EFD8

Strings

d2)m, xrefs: 6D26EFD1

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID: d2)m
API String ID: 1974103008-3316255928
Opcode ID: 5103da417ac65ff06ef0a0a4aaa2290a5ff1267cbf7af5175e0e4708246abdbf
Instruction ID: 6ed27a87225b440718c2168b4392aeb7a22d4667351c4bcff100bf24e4b05228
Opcode Fuzzy Hash: 5103da417ac65ff06ef0a0a4aaa2290a5ff1267cbf7af5175e0e4708246abdbf
Instruction Fuzzy Hash: 58F028B0C8820D2BDB08CBB49D407FFB63A5B84305F088279D40291082EB34861C86B2

Uniqueness

Uniqueness Score: -1.00%

Function 6D2759C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D2759D3

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D2759ED

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

std::exception::exception.LIBCMT ref: 6D275A0C
__CxxThrowException@8.LIBCMT ref: 6D275A21

Strings

d2)m, xrefs: 6D275A1A

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID: d2)m
API String ID: 1974103008-3316255928
Opcode ID: d348e3db026caa3087ed42cabc9128df43a97bbdc429797be3a9175fea0b77f2
Instruction ID: 9605e81d466ed854d7b99616112b2700898a6f4a73af9c722f829ca5ab44e223
Opcode Fuzzy Hash: d348e3db026caa3087ed42cabc9128df43a97bbdc429797be3a9175fea0b77f2
Instruction Fuzzy Hash: 19F02BB1C9C20E65DB14DAF4C980AFFF73D5F51318F140269D412A20C2EB70971D82E2

Uniqueness

Uniqueness Score: -1.00%

Function 6D26F310 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D26F320

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D26F33A

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

std::exception::exception.LIBCMT ref: 6D26F359
__CxxThrowException@8.LIBCMT ref: 6D26F36E

Strings

d2)m, xrefs: 6D26F367

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID: d2)m
API String ID: 1974103008-3316255928
Opcode ID: f33115a230b6c08d53cc26b068b4ca585a2f47a787d6d1939f448904e6b11e20
Instruction ID: 16ac4ecbabc9792b4248687bfef90c52f0b8c3a8b340673eb181b7ba0ce6eaf7
Opcode Fuzzy Hash: f33115a230b6c08d53cc26b068b4ca585a2f47a787d6d1939f448904e6b11e20
Instruction Fuzzy Hash: 67F02BB089824C37CF08CF75D541AEFB7699F44314F048269EC1A85086FB70D35C86A6

Uniqueness

Uniqueness Score: -1.00%

Function 6D28AA32 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D28AA4C

Part of subcall function 6D2872BB: __getptd_noexit.LIBCMT ref: 6D2872BE
Part of subcall function 6D2872BB: __amsg_exit.LIBCMT ref: 6D2872CB

__getptd.LIBCMT ref: 6D28AA5D
__getptd.LIBCMT ref: 6D28AA6B

Strings

MOC, xrefs: 6D28AA3E
csm, xrefs: 6D28AA45

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
Instruction ID: a32cb9835bbb7d8b49d118e026345986daebd13554f8d4f88121cfdaca859362
Opcode Fuzzy Hash: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
Instruction Fuzzy Hash: 49E01A3169810D8FC700ABA4C144F6972A4BB49319F5600E1E588876E3CB24D4489A52

Uniqueness

Uniqueness Score: -1.00%

Function 1001C735 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 1001C793
GetFileType.KERNEL32(00000480), ref: 1001C83E
GetStdHandle.KERNEL32(-000000F6), ref: 1001C8A1
GetFileType.KERNEL32(00000000), ref: 1001C8AF
SetHandleCount.KERNEL32 ref: 1001C8E6

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
Instruction ID: 9e0b50c6418c78b4ce1b27a1f486aee3850f1a3a2b75f6582e04b96d90fbb996
Opcode Fuzzy Hash: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
Instruction Fuzzy Hash: 0C51243190436A8FE710DB68C8C4F697BE0EB05768F354669D5A29F2E2DB30DC86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 100010A6 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

CharUpperW.USER32 ref: 100010C1
GetLastError.KERNEL32 ref: 100010CD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000), ref: 100010E8
CharUpperA.USER32(?), ref: 10001101
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001), ref: 10001114

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 8383e40484a713360037c6af6127c53484664dbcfb1822a6f6cfd995dd4f40d0
Instruction ID: 5dd45f2d0006c2546d84b721a00360ca66f9a592c23ae8bd0920251664c2bfef
Opcode Fuzzy Hash: 8383e40484a713360037c6af6127c53484664dbcfb1822a6f6cfd995dd4f40d0
Instruction Fuzzy Hash: 210156B68002697BFB15EBE09CC9EDFB6ADEB082D4F110551FA42D3101E2B45D448770

Uniqueness

Uniqueness Score: -1.00%

Function 6D28C0C6 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D28C0D2

Part of subcall function 6D2872BB: __getptd_noexit.LIBCMT ref: 6D2872BE
Part of subcall function 6D2872BB: __amsg_exit.LIBCMT ref: 6D2872CB

__amsg_exit.LIBCMT ref: 6D28C0F2
__lock.LIBCMT ref: 6D28C102
InterlockedDecrement.KERNEL32(?), ref: 6D28C11F
InterlockedIncrement.KERNEL32(02891648), ref: 6D28C14A

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 12964534a65112aa4340af28c67de100ad6a37d276cc28a67b53f85bf806b558
Instruction ID: df273e86da2d27ef7dd33163894f657e0a1d3827fe878e020a5724f1b670e320
Opcode Fuzzy Hash: 12964534a65112aa4340af28c67de100ad6a37d276cc28a67b53f85bf806b558
Instruction Fuzzy Hash: E201C432DC9A1F9BDB019B66848876EB770BF81F2AF050215E410AB6C2CB345949EBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6D285FF4 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 6D286012

Part of subcall function 6D2881D4: __mtinitlocknum.LIBCMT ref: 6D2881EA
Part of subcall function 6D2881D4: __amsg_exit.LIBCMT ref: 6D2881F6
Part of subcall function 6D2881D4: EnterCriticalSection.KERNEL32(?,?,?,6D28C6AB,00000004,6D2982E8,0000000C,6D287669,6D26FA7E,?,00000000,00000000,00000000,?,6D28726D,00000001), ref: 6D2881FE

___sbh_find_block.LIBCMT ref: 6D28601D
___sbh_free_block.LIBCMT ref: 6D28602C
HeapFree.KERNEL32(00000000,6D26FA7E,6D297EB0,0000000C,6D2881B5,00000000,6D298028,0000000C,6D2881EF,6D26FA7E,?,?,6D28C6AB,00000004,6D2982E8,0000000C), ref: 6D28605C
GetLastError.KERNEL32(?,6D28C6AB,00000004,6D2982E8,0000000C,6D287669,6D26FA7E,?,00000000,00000000,00000000,?,6D28726D,00000001,00000214), ref: 6D28606D

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1fe9ef996683c41819e98c135dcf11e6678e6fcbe07e19dc7971299c2b75c3c4
Instruction ID: 6456de56a66df875161076a1a08d25e7466916773d31175899289374f44d45a1
Opcode Fuzzy Hash: 1fe9ef996683c41819e98c135dcf11e6678e6fcbe07e19dc7971299c2b75c3c4
Instruction Fuzzy Hash: 740184319DC24A9ADB205BB29848B5B7B74BF0236AF114028E6146B0C2CB358548CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 1001C031 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,1001C473,1001D0D7,00000000,?,?,00000000,00000001), ref: 1001C033
TlsGetValue.KERNEL32 ref: 1001C041
SetLastError.KERNEL32(00000000), ref: 1001C08D

Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576

TlsSetValue.KERNEL32(00000000), ref: 1001C065
GetCurrentThreadId.KERNEL32 ref: 1001C076

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
Instruction ID: c7b26c2ea065f329baa6dbda2ade13875997561f4633f5fb0c8b07fada39eb07
Opcode Fuzzy Hash: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
Instruction Fuzzy Hash: 0DF0BB35901331DBF2329B749C89F1A3AA6EF097B1F214318F6559E1A1CB30D8C29690

Uniqueness

Uniqueness Score: -1.00%

Function 1001A0CE Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A102

Part of subcall function 100189EE: HeapFree.KERNEL32(00000000,?,?,?,?), ref: 10018AC2

DeleteCriticalSection.KERNEL32(?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A11D
DeleteCriticalSection.KERNEL32 ref: 1001A125
DeleteCriticalSection.KERNEL32 ref: 1001A12D
DeleteCriticalSection.KERNEL32 ref: 1001A135

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
Instruction ID: 436f94670acdd869086ea8be0b95e1bb75b4415bd69928cd2107d9a27a45b4f1
Opcode Fuzzy Hash: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
Instruction Fuzzy Hash: 1AF0F4268002647AEA65F719AD8C8A97BD5DB822B27920476EC53B7030CD778CC29DA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D262830 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D262893

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

__CxxThrowException@8.LIBCMT ref: 6D2628BD

Strings

0M)m, xrefs: 6D2628B6
Cannot find listfile, xrefs: 6D2628B5

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: 0M)m$Cannot find listfile
API String ID: 3476068407-1527887347
Opcode ID: 2ea7d2f13622142e05b12d9f821c6b0242e68ba732f7965f662572c20ebe8178
Instruction ID: e4b32b5cc0222b5bb51dc88332360ce95bb205ef3eabfc550b1d44940fe3be31
Opcode Fuzzy Hash: 2ea7d2f13622142e05b12d9f821c6b0242e68ba732f7965f662572c20ebe8178
Instruction Fuzzy Hash: 2B3170B1D8429E9BCB20CF99C980AEFF7B8FF48214F444669E924A7241D7355A058BB1

Uniqueness

Uniqueness Score: -1.00%

Function 6D263BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 6D263C22
__fileno.LIBCMT ref: 6D263C3E
__fileno.LIBCMT ref: 6D263C5A

Strings

(_)m, xrefs: 6D263BF3

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: __fileno
String ID: (_)m
API String ID: 1873356214-1416082254
Opcode ID: c37a93a094eb9245b20b503299767473285ac43319b3ebbf6267a39afad8ce3d
Instruction ID: e19692566a7b25fbe8e10408e8f7768eb709475b9495402c34e823b4d27aa5c5
Opcode Fuzzy Hash: c37a93a094eb9245b20b503299767473285ac43319b3ebbf6267a39afad8ce3d
Instruction Fuzzy Hash: E831F6B258D7CAAFD311CB758540AAAFFA9AF11204F09CAADE45987743D731E848C770

Uniqueness

Uniqueness Score: -1.00%

Function 6D275BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\7-zip,00000000,00020019,6D28FD48,12131721,00000000,?,80000001,00000000,6D28FD48,000000FF,?,6D275DBD,?,6D29FCC8), ref: 6D275C1D

Part of subcall function 6D272FE0: RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6D275DBD,?,?,6D275C37,?,6D275DBD,?,6D29FCC8,00000000,00000000), ref: 6D27300E
Part of subcall function 6D272FE0: RegQueryValueExW.ADVAPI32(6D275DBD,Path,00000000,6D275DBD,?,6D275DBD,?,6D275DBD,?,6D29FCC8,00000000,00000000), ref: 6D27304E

RegCloseKey.ADVAPI32(?,?,6D275DBD,?,6D29FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D275C47
RegCloseKey.ADVAPI32(?,?,6D275DBD,?,6D29FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D275C65

Strings

Software\7-zip, xrefs: 6D275C11

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CloseQueryValue$Open
String ID: Software\7-zip
API String ID: 4082589901-3321436535
Opcode ID: b3bd8d5aade2aa14b12cc44456b24f17849ff038e2e81f09adaa7b4c89e34095
Instruction ID: 4762d8018d458d9c89359f840e248c0de712c93afb63241f3e7c1fc27ce994ee
Opcode Fuzzy Hash: b3bd8d5aade2aa14b12cc44456b24f17849ff038e2e81f09adaa7b4c89e34095
Instruction Fuzzy Hash: 86117072E45A29ABCB218F45DC44BBFBBB8FB05B25F00066EF919A7240D7355904CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 6D27C8BE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D27C8C2

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

GetLastError.KERNEL32(00000000,00000000), ref: 6D27C8C7

Strings

7-Zip cannot load Mapi32.dll, xrefs: 6D27C8D2
R)m, xrefs: 6D27C931, 6D27C937

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorExceptionException@8LastRaiseThrow
String ID: 7-Zip cannot load Mapi32.dll$R)m
API String ID: 2060628206-2600760947
Opcode ID: 229c84aedfccf3b7e66b2e4d2bf2a70355faff43fff2d1783b11b66be4271aa9
Instruction ID: c61ec39ec48f7e6b51fa2ba1fc86fd624891bdf904a44c6444aa067285483b75
Opcode Fuzzy Hash: 229c84aedfccf3b7e66b2e4d2bf2a70355faff43fff2d1783b11b66be4271aa9
Instruction Fuzzy Hash: BD11C87294824CDBEB10DBE4DD40F9EB7B4AF45315F6541ACE61D97280DB315A08CB72

Uniqueness

Uniqueness Score: -1.00%

Function 6D28B090 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6D28B0A3

Part of subcall function 6D28AFFE: ___BuildCatchObjectHelper.LIBCMT ref: 6D28B034

_UnwindNestedFrames.LIBCMT ref: 6D28B0BA
___FrameUnwindToState.LIBCMT ref: 6D28B0C8

Strings

csm, xrefs: 6D28B09F, 6D28B0B4, 6D28B0C7, 6D28B0E5, 6D28B0F5

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
Instruction ID: 0fdbcca035bb87e4d1a8751dbc596394cd9b64dccf44f9d613029309dae1f970
Opcode Fuzzy Hash: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
Instruction Fuzzy Hash: DF01467108554EBBDF125F51CC40EAB3F6AFF08355F018024FE29151A2DB3698B9DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D27F640 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D27F66A

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

-r0, xrefs: 6D27F66F
-r, xrefs: 6D27F693
-r-, xrefs: 6D27F681

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: -r$ -r-$ -r0
API String ID: 3976011213-1696425382
Opcode ID: c6743de6db849ddf81e370b650e49ef5f3c85976e02421ea2c62b46d8965fde6
Instruction ID: 6e03859c4917062441417d676831ba04869ca781859f8cf13666db1f37a48948
Opcode Fuzzy Hash: c6743de6db849ddf81e370b650e49ef5f3c85976e02421ea2c62b46d8965fde6
Instruction Fuzzy Hash: 18F029207EC18E33C6208AADAD24B3E738C970A50AF0006E4F828CB300C7268E0123E9

Uniqueness

Uniqueness Score: -1.00%

Function 100197CF Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
Instruction ID: c5e9eab5286596022c0fc86455b854ac72cbfdbbf2fd81343e62aa3bf37372db
Opcode Fuzzy Hash: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
Instruction Fuzzy Hash: 7791C371D01664AADB11EB68CC81ADE7AF9EF497A0F600226F854BE191D731DDC0CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001B010 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,10025958,10025958,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B031
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B055
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B06F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?), ref: 1001B130
HeapFree.KERNEL32(00000000,00000000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?,?), ref: 1001B147

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
Instruction ID: 9791cdc1e8676e8be9240cb2db72b85fdf48b460ca22e9baef45e6ba91bfb517
Opcode Fuzzy Hash: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
Instruction Fuzzy Hash: F4312670500B56EBE332CF24CCC5B2677E0EB447A5FA14529F5669B290E771E8C5CB48

Uniqueness

Uniqueness Score: -1.00%

Function 6D28CEA8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6D28CEDC
__isleadbyte_l.LIBCMT ref: 6D28CF10
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 6D28CF41
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 6D28CFAF

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 784d8456538b3556d78d2af8f90b18c4b16d33907fb99de46a90acc0b6cff3f8
Instruction ID: c5c4f2bdb383d7e00ae972067a515e17f020d07b30d9e1e85c24df1460f3f25c
Opcode Fuzzy Hash: 784d8456538b3556d78d2af8f90b18c4b16d33907fb99de46a90acc0b6cff3f8
Instruction Fuzzy Hash: 3F31A23199424BEFEB01CF68C8809BA7BB5BF01712F0186A9E1649B1D2D330D998EB50

Uniqueness

Uniqueness Score: -1.00%

Function 6D270F70 Relevance: 6.1, APIs: 4, Instructions: 86filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,12131721,00000000,?,?,00000000,00000000,00000000), ref: 6D270FAE
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 6D27100C
SetFileTime.KERNEL32(00000000,?,?,?,?,?,?), ref: 6D271033
CloseHandle.KERNEL32(00000000,?,?,?), ref: 6D27103F

Part of subcall function 6D2728A0: GetCurrentDirectoryW.KERNEL32(00000105,?,12131721,FFFFFFFF,?,00000004), ref: 6D272994

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: File$Create$CloseCurrentDirectoryHandleTime
String ID:
API String ID: 2622452211-0
Opcode ID: 1ca51badbc72c129a19666ab6348fa512bc3acdc5742e2b6b45c89036222f97c
Instruction ID: 987bd106d47c78e70744cd0b88f5949594bf8f25aeb30e377f1ea2ad8511e250
Opcode Fuzzy Hash: 1ca51badbc72c129a19666ab6348fa512bc3acdc5742e2b6b45c89036222f97c
Instruction Fuzzy Hash: B321A171A40209ABEB208F55DC85FAFB7B8FB45769F104229FE15AB2C0D7346E0486A0

Uniqueness

Uniqueness Score: -1.00%

Function 1000112C Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000112C
CharUpperW.USER32 ref: 10001144
GetLastError.KERNEL32 ref: 10001150
CharUpperA.USER32(?), ref: 10001183

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CharUpper$ErrorH_prologLast
String ID:
API String ID: 826227211-0
Opcode ID: ff1246a03657b54eff9156cf09a95992e04e2b4fa534e0be7897412a772be6bf
Instruction ID: 99cf40d06858b6207db1331b5053b1e25ae539a9e8e767eb293be6f8fe8ea0fc
Opcode Fuzzy Hash: ff1246a03657b54eff9156cf09a95992e04e2b4fa534e0be7897412a772be6bf
Instruction Fuzzy Hash: 8A11043590025BDFEB05EFA0D8919EEB7F4FF09384F200424F542A2269EB705E41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6D27D4C0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D29FC98,12131721,?,?,?,6D28FB68,000000FF), ref: 6D27D4F2
LeaveCriticalSection.KERNEL32(6D29FC98,?,?,?,6D28FB68,000000FF), ref: 6D27D50A
LeaveCriticalSection.KERNEL32(6D29FC98,?,?,?,?,6D28FB68,000000FF), ref: 6D27D547

Strings

[Content], xrefs: 6D27D52D

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: [Content]
API String ID: 2978645861-3799411330
Opcode ID: 32c0134cae0f7bbbad032e363d34cb2673d1b444e7806c066d4172e7cb85b7b0
Instruction ID: 7c9aa438e59c9d15bcbc7e5fc8810bba7d32a51c25727fa54cfee85a088abc2c
Opcode Fuzzy Hash: 32c0134cae0f7bbbad032e363d34cb2673d1b444e7806c066d4172e7cb85b7b0
Instruction Fuzzy Hash: 3F01C47294414CAFD720DF59C805BABB7F8FB09714F40866AFC05EB680D7756944DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D261A30 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,00100000,?,00000000), ref: 6D261A4E
ReadFile.KERNEL32(00000000), ref: 6D261A55
GetLastError.KERNEL32 ref: 6D261A72
GetLastError.KERNEL32 ref: 6D261A80

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: bf31baa9ff08383a0dfc7dc3d79b11e430a22dd680f15e8ac88efd48215bed37
Instruction ID: 2ebc047a5e496486aca9a1ed24ab556d626ca7407b60eab1b8751e1f830f64eb
Opcode Fuzzy Hash: bf31baa9ff08383a0dfc7dc3d79b11e430a22dd680f15e8ac88efd48215bed37
Instruction Fuzzy Hash: 72016D7239434F9BDB05DA949904BB737ACAB45762F10892AF916CA284D735EC90C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6D28BE2A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D28BE36

Part of subcall function 6D2872BB: __getptd_noexit.LIBCMT ref: 6D2872BE
Part of subcall function 6D2872BB: __amsg_exit.LIBCMT ref: 6D2872CB

__getptd.LIBCMT ref: 6D28BE4D
__amsg_exit.LIBCMT ref: 6D28BE5B
__lock.LIBCMT ref: 6D28BE6B

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 70b31f2e880aa015e04ed06cfaecf4b6da38a12b21b25485d8e142f1f724f977
Instruction ID: 0c10e06dee42a35752569088c74ad8c6713bf158f5bb1155cac813c88d0a2b74
Opcode Fuzzy Hash: 70b31f2e880aa015e04ed06cfaecf4b6da38a12b21b25485d8e142f1f724f977
Instruction Fuzzy Hash: E4F09032EC8B0ECEEB50ABB5840075EB2A0AF45719F46416DD6609B2D3CB306909CB53

Uniqueness

Uniqueness Score: -1.00%

Function 6D281C20 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D281C93

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

|2)m, xrefs: 6D281C8C
map/set<T> too long, xrefs: 6D281C5A

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: map/set<T> too long$|2)m
API String ID: 3976011213-3535866429
Opcode ID: d232b9ee0cff258e6e7381f8c5e72e0cd27a4d8f4c612756b732c71337125083
Instruction ID: 2301962cd75673e5968416a9b4cbbc9b56d43158ef9e1ce75b511a82b7435329
Opcode Fuzzy Hash: d232b9ee0cff258e6e7381f8c5e72e0cd27a4d8f4c612756b732c71337125083
Instruction Fuzzy Hash: 8EA197B1984646DFC706CF19C180916FBB2BF8A714729C19ED8695B792C332F886CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 100081EF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100081F4

Strings

, xrefs: 100083AB
, xrefs: 100083D3

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: 312c2aec7e709d08ccb2c85a8bc715850654904397243e69b9c15c2e37b53766
Instruction ID: 9585d42676a0d41e953fe7fe136552d86f024f2135ab78c93d006785aed77b76
Opcode Fuzzy Hash: 312c2aec7e709d08ccb2c85a8bc715850654904397243e69b9c15c2e37b53766
Instruction Fuzzy Hash: D471583090060ACFEB20CF94C881AAEB7B1FF88394F50456DD596A7255DB30BB86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D27FC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D27FD8E
__CxxThrowException@8.LIBCMT ref: 6D27FDA3

Strings

-u, xrefs: 6D27FC64

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throw
String ID: -u
API String ID: 2005118841-3343466670
Opcode ID: 1d708289286636dafff2ea184320f6b04f618c772539164d829908548ef164c6
Instruction ID: e2d82b1ab6bc77da9b13c15de825458f48dfc8f298b5bb05ac9b6b9c87b66936
Opcode Fuzzy Hash: 1d708289286636dafff2ea184320f6b04f618c772539164d829908548ef164c6
Instruction Fuzzy Hash: 3F41D67199C24CEBCB21CFA9C940EEFB7B4FF05305F50852AE814EB241E7319A459BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001D6A3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 1001D6B7

Strings

, xrefs: 1001D700
, xrefs: 1001D6DC

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
Instruction ID: 27a1dab1f5f815cb8d427bf576b62c8b4ec6ff9cec70f847aa7466e11b016868
Opcode Fuzzy Hash: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
Instruction Fuzzy Hash: 2B41483140436C1AEB11FA64CD85FEA7F9ADB01744F1006F7D585CF092D271C989DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D263CF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

CharUpperW.USER32(00000000,12131721,00000002,00000000,00000000,6D2643B8,0000001B,000000FF,(_)m,00000002), ref: 6D263D92

Strings

\)m, xrefs: 6D263D9E
Incorrect command line, xrefs: 6D263E02

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CharUpper
String ID: Incorrect command line$\)m
API String ID: 9403516-2116498605
Opcode ID: fc127fe91f8473b41fd4d799316c14ae8d5f802fe825263009a707ec89f34dbf
Instruction ID: fcaf8f9851a6329ed0277c463466fb8614074d8a83beebe5022a4e67390df942
Opcode Fuzzy Hash: fc127fe91f8473b41fd4d799316c14ae8d5f802fe825263009a707ec89f34dbf
Instruction Fuzzy Hash: 094128B6E4424A9FCB10DF58C8806BAF7B4FF48321F15416AEE1597340D736A941C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6D268400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D2684F6

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D268510

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

,S)m, xrefs: 6D268449

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: ,S)m
API String ID: 2732643326-3525303677
Opcode ID: 1be8fd13cc1469b5ee956bb97bf029e4ab035b861253d41436cb13d67a97929b
Instruction ID: 446319c2f6b152c2841bb43b935fcac85eb209bf09cae65e0ec21d733a85bcf3
Opcode Fuzzy Hash: 1be8fd13cc1469b5ee956bb97bf029e4ab035b861253d41436cb13d67a97929b
Instruction Fuzzy Hash: D95135B0A05B8AEFC350CF6AC48078AFBE4BF09304F548A6EC1AD87A41D371B554CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D27FDE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 6D27FE54
__CxxThrowException@8.LIBCMT ref: 6D27FED8

Strings

-v, xrefs: 6D27FE5D

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: Exception@8Throwwsprintf
String ID: -v
API String ID: 2898814609-1581256980
Opcode ID: 82625fa4d5585542a78d57987ae237f03dc3fb39ab4ea0a5b2f3230575b8cc6e
Instruction ID: 93de710cfb50ebf13560b6d9db4b354096cebfd6dfaba62aa7cad2040817660e
Opcode Fuzzy Hash: 82625fa4d5585542a78d57987ae237f03dc3fb39ab4ea0a5b2f3230575b8cc6e
Instruction Fuzzy Hash: A4314171D4424CAFCB10CFE9C944AAEFBF8FF48304F15852AE519AB245E7755A08CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D270AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,0000005F,00000000,12131721,00000000), ref: 6D270B62
__CxxThrowException@8.LIBCMT ref: 6D270B88

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

_, xrefs: 6D270B25

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ByteCharExceptionException@8MultiRaiseThrowWide
String ID: _
API String ID: 3144726602-701932520
Opcode ID: 92073d25cc1edbb0b7611021c3d4a9e175ff53c3ec89b08601754576e239c094
Instruction ID: 3a67e7372ac6fc62284b2305cfda298a971c96b873d0c8d232d78b6cd153b1bb
Opcode Fuzzy Hash: 92073d25cc1edbb0b7611021c3d4a9e175ff53c3ec89b08601754576e239c094
Instruction Fuzzy Hash: 9A219F71904249EFCB10CF99C980FABFBF8FF49718F14856AE9149B241D775AA04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D272FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6D275DBD,?,?,6D275C37,?,6D275DBD,?,6D29FCC8,00000000,00000000), ref: 6D27300E
RegQueryValueExW.ADVAPI32(6D275DBD,Path,00000000,6D275DBD,?,6D275DBD,?,6D275DBD,?,6D29FCC8,00000000,00000000), ref: 6D27304E

Strings

Path, xrefs: 6D273002, 6D273045

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: QueryValue
String ID: Path
API String ID: 3660427363-2875597873
Opcode ID: d9354e5200d70cc89e4cda9de0eaf6efd34526ce23d77754c4c368a8bad0d429
Instruction ID: 7a0da15ee185ec3c305f0d79857a4a6a041dd7e69fa77ae811ca1c762ca73e91
Opcode Fuzzy Hash: d9354e5200d70cc89e4cda9de0eaf6efd34526ce23d77754c4c368a8bad0d429
Instruction Fuzzy Hash: D9113071A05209AFDB24DFA5C8C087FF7B9FF48701B10846EE556D7241E7709940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D2622F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D26231A

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D262336

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

dL)m, xrefs: 6D26233B

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: dL)m
API String ID: 2732643326-2613397986
Opcode ID: a882ad358863f47bebd8c3068633a7f4303eea1131ca0ac7b6b31f4cfa2318c5
Instruction ID: 00891496b9a4f6754c3805fe9caa143fc5ad78125bb96c34e734ef8bd74865ed
Opcode Fuzzy Hash: a882ad358863f47bebd8c3068633a7f4303eea1131ca0ac7b6b31f4cfa2318c5
Instruction Fuzzy Hash: E7218EB1940608AFC720CF5DC980A9AF7F8FF49624F10C62EE56997780D735A9068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D265480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D2654AD

Part of subcall function 6D285F2A: __FF_MSGBANNER.LIBCMT ref: 6D285F4D
Part of subcall function 6D285F2A: __NMSG_WRITE.LIBCMT ref: 6D285F54
Part of subcall function 6D285F2A: RtlAllocateHeap.NTDLL(00000000,6D26FA6F,?,00000000,?,?,6D264D3F,0000000C,12131721,?,?,00000000,?,?,6D28EF9B,000000FF), ref: 6D285FA1

__CxxThrowException@8.LIBCMT ref: 6D2654C7

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

7&m, xrefs: 6D26549D

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: 7&m
API String ID: 2732643326-4205210786
Opcode ID: 3fdd8d51733cf0f0b053f8c080e51d88dffe16a94577caa25b5ab7bae477e2d9
Instruction ID: a9ab0155943052dd9103603af0537d43b662cb5d3312abb5d66deb145a3a48a7
Opcode Fuzzy Hash: 3fdd8d51733cf0f0b053f8c080e51d88dffe16a94577caa25b5ab7bae477e2d9
Instruction Fuzzy Hash: 2111D2B1644349AFC724CF55C884B6AB7E9EB45314F00863EE966C7691E730E944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D26ED10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D26ED86

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Part of subcall function 6D26EDB0: std::exception::exception.LIBCMT ref: 6D26EDDE

Strings

vector<T> too long, xrefs: 6D26ED3B
|2)m, xrefs: 6D26ED7E

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::exception::exception
String ID: vector<T> too long$|2)m
API String ID: 4171481480-636929389
Opcode ID: f743d37cf0fa535913dc4b08f2689e51e7b66c981aa77ef0940364b2ae8626f3
Instruction ID: e3d3ed34d7561a09908988958a1e4ad8b278468e9e5ac6ac1a846bbb9b590049
Opcode Fuzzy Hash: f743d37cf0fa535913dc4b08f2689e51e7b66c981aa77ef0940364b2ae8626f3
Instruction Fuzzy Hash: 1401B97104C3489BC310CF55C944B9BB7D8AB48754F040A2CF554962C1D774D504CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D28AE09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D2869BB: __getptd.LIBCMT ref: 6D2869C1
Part of subcall function 6D2869BB: __getptd.LIBCMT ref: 6D2869D1

__getptd.LIBCMT ref: 6D28AE18

Part of subcall function 6D2872BB: __getptd_noexit.LIBCMT ref: 6D2872BE
Part of subcall function 6D2872BB: __amsg_exit.LIBCMT ref: 6D2872CB

__getptd.LIBCMT ref: 6D28AE26

Strings

csm, xrefs: 6D28AE34

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
Instruction ID: f5b5fdcd95d32f3960263f6f33441fae5114380312cd7bc42d5cf22e7fd09ce5
Opcode Fuzzy Hash: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
Instruction Fuzzy Hash: 0101463488870FCBCB248FA0D480AADB3B6AF00216F20483ED561966E6DF309599CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6D28E688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D28E66F

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

std::bad_exception::bad_exception.LIBCMT ref: 6D28E697

Part of subcall function 6D285DCA: std::bad_exception::bad_exception.LIBCMT ref: 6D285DD5

Strings

Access violation - no RTTI data!, xrefs: 6D28E68F

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: std::bad_exception::bad_exception$ExceptionException@8RaiseThrow
String ID: Access violation - no RTTI data!
API String ID: 1432139112-2158758863
Opcode ID: 72d06d24e411f25d7723aadbf35ecf542a3e32fdb1bcf599fa4fb31a2c06ff22
Instruction ID: b29fecc2af4d93ce019bfbef3b106dcf2345865ae0e167e21160e519af6b2de2
Opcode Fuzzy Hash: 72d06d24e411f25d7723aadbf35ecf542a3e32fdb1bcf599fa4fb31a2c06ff22
Instruction Fuzzy Hash: 8EE08C719A410C8FCB00CBA8C980AAD73B0AB09306F0A0014E503E7291C734A944AF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D28518F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D285196
__CxxThrowException@8.LIBCMT ref: 6D2851C1

Part of subcall function 6D28663B: RaiseException.KERNEL32(?,6D280629,12131721,?,?,6D280629,?,6D298388,12131721), ref: 6D28667D

Strings

invalid string position, xrefs: 6D28519B

Memory Dump Source

Source File: 00000002.00000002.2170727930.000000006D261000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D260000, based on PE: true

Associated: 00000002.00000002.2170694854.000000006D260000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171170601.000000006D293000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171276774.000000006D29D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2171326492.000000006D2C8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d260000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 2427fac6de7bd111b8789478b2f9f54fe260e9c73e6b92f0be8c0c5b5cd7d204
Instruction ID: 17078e45d135d6c656ef0f6194a7ec2f14995bd4a5174447e903f371d7acf6c0
Opcode Fuzzy Hash: 2427fac6de7bd111b8789478b2f9f54fe260e9c73e6b92f0be8c0c5b5cd7d204
Instruction Fuzzy Hash: FBD017718E411C9BDB00DAD0CC84FEDB378AF14325F494434E315FA0C2EB64AA0C8A60

Uniqueness

Uniqueness Score: -1.00%

Function 1001AB6E Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001AB96
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001ABCA
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 1001ABE4
HeapFree.KERNEL32(00000000,?), ref: 1001ABFB

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
Instruction ID: 484c1ce75c38baac158856a15f7ab205fd40ab6127819ea80900b3ceb95b3c03
Opcode Fuzzy Hash: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
Instruction Fuzzy Hash: E8112570240321AFE721EF19CCC6A167BF6FB86764B61491AF552C69B1D3729CA2CF40

Uniqueness

Uniqueness Score: -1.00%

Function 1001A0A5 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,1001BFB2,?,10019F53), ref: 1001A0B2
InitializeCriticalSection.KERNEL32 ref: 1001A0BA
InitializeCriticalSection.KERNEL32 ref: 1001A0C2
InitializeCriticalSection.KERNEL32 ref: 1001A0CA

Memory Dump Source

Source File: 00000002.00000002.2170224335.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.2170190975.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170473205.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170536816.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170572245.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2170642456.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_SaasAntTransactions-Setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
Instruction ID: bb73eb11f573fb0f18e311b5dd9e76b2e5dde51fe535fe889abf8312516ef5db
Opcode Fuzzy Hash: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
Instruction Fuzzy Hash: BEC00231801138AFFA556B55DC848493FA6EB042723210063E10561030CEB31C93DFE8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SaasAntTransactions.exePID: 2452, Parent PID: 4220COMMON

Non-executed Functions

Function 1ED2489D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3087570744.000000001ED22000.00000002.00000001.01000000.0000001F.sdmp, Offset: 1ED20000, based on PE: true

Associated: 0000000B.00000002.3087488621.000000001ED20000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000000B.00000002.3087703824.000000001ED2A000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1ed20000_SaasAntTransactions.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e1bd3a2be17f3564540c029308d31d7ac1e3882d18ef729f1d17d3c322eb12
Instruction ID: f2cc691a421437ddf042e3507e7e3841bf695a28307c438a3417dabf4ec878b8
Opcode Fuzzy Hash: b7e1bd3a2be17f3564540c029308d31d7ac1e3882d18ef729f1d17d3c322eb12
Instruction Fuzzy Hash: 2DF07E2184F3E09EE7538BB458619923FB09D8720871E44EBD4E5CF4B3C90A191EDBA7

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SaasAntTransactions-Setup (1).exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

44212c.rbf (copy)

C:\Config.Msi\44212b.rbs

C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.Core.dll

C:\Program Files (x86)\SaasAnt Transactions\Common.Logging.dll

C:\Program Files (x86)\SaasAnt Transactions\CsvHelper.dll

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Credit Memo.properties

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Estimate.properties

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Invoice.properties

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Sales Order.properties

C:\Program Files (x86)\SaasAnt Transactions\Data\DepententMandatory\Sales Receipt.properties

C:\Program Files (x86)\SaasAnt Transactions\Data\importantfields.properties

C:\Program Files (x86)\SaasAnt Transactions\Data\mandatoryfields.properties

Windows Analysis Report
SaasAntTransactions-Setup (1).exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre